[rmcdaniel]

Adds opt-in PHP Server trace context for compatible SDKs. Existing authentication, namespace, claim, routing, receipt and history fences precede extraction or delivery. Caller context attaches to an existing admitted business insert. Retained/conflicting operations preserve their first origin; exact structural exclusions keep carriers out of business/history equality while preserving same-named business arguments.

Candidate: Server 2.10.0 / Helm 0.2.2, source 2ed4c6c70344b45aa3f1d24567e014dabdcf047d. It integrates main b88c175bd1 and locks normal published Core 2.9.0 / 2bc1ba0b57df34b74de02427d2225bd8e4dc6322. Every other locked package record is unchanged. Current deployment identities are synchronized. The ordinary image has no forced OpenTelemetry dependency.

Capability advertisement requires explicit enablement, the supported optional API and the actual three nullable columns. Baggage uses a JSON list of allowed keys, empty by default. A final regression correction rejects JSON objects with numeric keys, which associative decoding previously misread as lists. Seven HTTP controls verify the baggage persisted for valid/mixed/empty lists, numeric/named objects, malformed JSON and scalar JSON. The original failing reproduction is retained.

The guide covers an application-owned optional-API image, exact discovery, privacy, migrations and runtime boundaries. No mandatory protocol floor, new business RPC, cached-authority extension or replacement parent is introduced.

Validation:

• The exact PHP runtime, dependencies, schema and PHP test files are byte-identical to locally qualified 157b24dfb. That profile passes the API-absent protocol suite: 52 tests / 550 assertions.
• The same official API 1.10.1 / SDK 1.15.0 profile passes: 2,773 tests / 63,758 assertions, with 33 recorded compatibility/environment skips and six existing PHPUnit deprecations. All seven new admission cases execute successfully. All 966 installed Core production files match the immutable release before and after.
• The preceding b1 candidate completes all normal hosted checks successfully. Strict current-base protection requires fresh checks after integrating Native: ignore a caller's trace context where PHP Server admits it #566/Native: let a MySQL node wait out another node's bootstrap #567; those are queued. All PHP source/tests and release scripts remain byte-identical.
• The integrated storage-diagnostic contract passes all 24 Node controls. Native/shared/frozen source is unchanged from current main; this is no new native execution or adoption claim.
• Pint passes on the correction. Source release synchronization and normal Core authority previously pass; current-head normal hosted and Sonar gates remain required.
• Fresh b1 Sonar analysis passes. Independent PR-scoped API readback confirms three S3776 findings FIXED, nine individually reviewed S1142 findings ACCEPTED and zero OPEN findings. Rules and thresholds remain enabled.
• The clean current-source HTTP preflight passes normal published Python 2.7.0 propagation, worker replacement, real retry identities and an independent signal trace linked without parent replacement. The guide now uses the supported composer require --update-no-dev option, verified through normal installation. Earlier unsupported-option and generated-cache setup failures remain failed originals.
• Previous independent-worker PHP, Python and Rust source journeys pass. All three SDK minors are now published and their normal registry consumers pass against immutable Server 2.9.11's independent-root fallback. The actual configured Server 2.10 published tuple remains subsequent acceptance work.
• Core's published Laravel matrix passes all 16 combinations. Its configured migrations, PHP 8.1 / Monolog 2 and no-API consumers pass. Original two-CPU fan-out failures and the original four-CPU classifier failure remain failed; test-only Workflow #883 records the narrowly corrected passing runner without altering the release artifact.
• Original local setup/runner failures remain separate. On prior head 852f5412, PostgreSQL stopped before its scenario because APT rejected a package integrity mismatch. The official package control later matches; that failed original is preserved. The unchanged isolated PostgreSQL retry now passes in run 39540503499, attempt 2.

The native owner accepted this PHP layout. Native/shared/frozen files match integrated main, and the PHP ownership fence remains intact on all four connectors. Native conversion, carrier adoption and Cloud deployment retain separate qualification. Core #878 and Server #564 renewal drafts are not adopted.

Merge through normal branch protection after the required current-base checks pass. Publication waits for every fresh source gate and verification of the actual merge tree. Then use the protected image/chart workflow and verify the configured optional-API image with all three normal registry SDKs, restart/retry controls and downstream consumers. No published Server tracing capability is claimed by this PR's source results.

Refs durable-workflow/workflow#773.

[rmcdaniel]

Reviewed the nine php:S1142 findings against exact source e78704c0 and accepted them individually in Sonar, with a reason on every finding. These are maintainability tradeoffs, not false positives or fixed defects.

• DispatchObservability::payload and forTask use explicit omission guards for disabled tracing, unsupported real jobs, bounded references, queue backend/row identity and invalid carriers. The longer method keeps each stored-reference refusal beside the lookup it protects, without unserializing a job.
• WorkflowObservability::capabilities omits support for disabled configuration, each missing required column or schema-access failure.
• The four poll decorators stop at disabled metadata or failed original workflow/activity/query identity, attempt, lease and deadline checks before reading origins, dispatch records or event links. Their terminal return and fail-open catch preserve the original business result.
• validEntry and normalizeLinks reject unknown shapes, wrong bindings, missing/additional fields and invalid contexts at their boundary, rather than partially trusting an optional envelope.

For these methods, replacing the guards with nesting or extracting helpers only to meet a three-return count would make the boundary harder to audit. S1142 remains enabled. No quality profile, threshold, authority rule or test expectation changes. All nine exact keys from the review request now read ACCEPTED; their source is not described as fixed or as having zero accepted issues. The three separate S3776 findings remain with the implementation owner for focused source correction. Fresh exact-head analysis and normal qualification remain required.

[rmcdaniel]

The three owned S3776 findings are now fixed on f092e8e0f94aab3c6c36b7009cd8628437f078ae. The helper extractions separate optional delivered-task filtering, link identity validation and per-kind child/continue origin application. The unchanged 67 focused controls pass 2,335 assertions, and real Python/Rust source HTTP journeys also pass on this head.

Fresh exact-head Sonar analysis completed SUCCESS. Independent issue API readback confirms all three keys (AaFbsXWPBNAmuu9YTm0s, AaFbsXULBNAmuu9YTm0q, AaFbsXUMBNAmuu9YTm0r) are FIXED. The nine S1142 findings remain ACCEPTED with General's individual source review. There are no open findings in this PR scope at readback; accepted issues are not described as fixed or absent.

Required normal hosted tests remain pending. This is source qualification only. Published Core/Server/SDK acceptance and coordinated PHP schema adoption remain separate.

[rmcdaniel]

Exact source 942840e70592380323cc7273af1c5541df9062f4 now passes a fresh profile using normal published Core 2.9.0, without a path repository or version alias.

• Default dependency installation has no optional API and passes 52 protocol tests / 550 assertions.
• Adding application-owned official API 1.10.1 and SDK 1.15.0 passes the full enabled suite: 2,766 tests / 63,748 assertions. The 33 compatibility/environment skips and six existing PHPUnit deprecations remain explicit. The required observability profile cannot silently skip for missing API or Core.
• All 966 installed Core production files match immutable release 2bc1ba0b57df34b74de02427d2225bd8e4dc6322 before and after. No API dependency was added to the ordinary Server manifest.
• The first local invocation named an outdated protocol test file and remains a failed runner attempt. Correcting that path changes no source or test assertions.
• Current-head Sonar passes; direct API readback confirms three complexity findings FIXED and nine guard findings ACCEPTED. No rule or threshold changed.

The normal hosted feature suite and other completed source gates pass. The ordinary performance source gate is still queued. I am making the PR ready while retaining that gate before merge; actual image/chart publication and the configured three-SDK tuple remain subsequent acceptance work. Native/shared/frozen files and lease-renewal drafts remain separate.

[rmcdaniel]

The combined-head PostgreSQL rolling-upgrade job at 852f5412e4fb82f335cb87b914ced2743ccd5e09 stopped during Docker image setup, before the migration scenario ran. APT rejected node-balanced-match_2.0.0-1_all.deb: it received 711,724 bytes where the signed index expected 4,872 bytes, and its integrity check refused the package. The original job remains failed: https://github.com/durable-workflow/server/actions/runs/39540503499/job/119026892081.

A fresh download from the official Debian HTTPS package URL is now exactly 4,872 bytes with the expected SHA-256 98a1c466bff6baf6780c4b765ec665e684424bf7907439939b5fb1160ede039c. This is only a dependency-integrity control, not a PostgreSQL pass or proof of the original transport cause. GitHub currently refuses the isolated rerun request; the same workflow still has its MySQL cell queued. I will retry only the failed job on unchanged source when GitHub allows it. No integrity check, scenario, deadline or release gate changes.

[rmcdaniel]

A final configuration review reproduced a draft-only baggage-policy defect: PHP's associative JSON decoding turns {"0":"approved"} into a list. The Server therefore treated that JSON object as an explicit baggage allowlist, contrary to the documented list-only contract. The original reproduction fails with actual:["approved"] where an empty allowlist is required.

The pending source correction decodes JSON arrays distinctly from objects and retains only string entries before configuration caching. The unchanged reproduction now returns an empty allowlist. Seven HTTP admission controls cover valid/mixed/empty lists, numeric/named objects, malformed JSON and scalar JSON. They verify the baggage actually persisted on an admitted run, rather than only the parser result.

Formatting passes. The full official optional-API profile and fresh exact-head normal gates remain required before publication. This changes no carrier names, bounds, authority ordering, native/shared/frozen files or published package. Server 2.10.0 remains unpublished.

[rmcdaniel]

The current PHP Server candidate is b1adc64cd420dd7082cac135f5ed4399d4c1a2e2, integrating main 8ad23a9f77 unchanged. Its PHP runtime, configuration, schema, dependencies and PHP test files match the locally qualified privacy correction. That profile passed 52 tests / 550 assertions without the API and 2,773 tests / 63,758 assertions with API 1.10.1. The integrated storage-diagnostic Node contract passes 24 controls.

A clean tracked-source HTTP preflight now passes four additional journeys using normal published Python 2.7.0 and Core 2.9.0 with application-owned API 1.10.1:

• Caller context survives two independent workers, with four correctly related spans, three correlated logs and distinct durable/request/trace identities.
• A replacement workflow worker resumes while an activity is pending. Three worker processes exit cleanly, and resumed spans preserve the original caller.
• A real failing first activity attempt retries successfully. Both attempts have distinct span/attempt identities and retain one logical activity identity.
• A signal from a different trace reaches a workflow task as an actual admitted-command link. The task parent stays the original run origin.

Every case verifies the 36 installed Python production modules before and after execution. The original 45-second result and bounded shutdown controls remain. Test runtimes and network are retired. These are published-package consumers of unpublished Server source, not published Server-tuple acceptance.

The preflight also caught an invalid Composer option in the draft application-image recipe. composer require uses --update-no-dev; the corrected command installs the optional minimum API normally. The unsupported-option setup and a separate generated-bootstrap-cache setup failure remain failed originals. The clean archived-source run passes. No PHP runtime change was needed for that recipe correction.

Fresh current-head normal checks and Sonar remain required before merge and image/chart publication. Server 2.10.0 is still unpublished. Native carrier/catalog adoption, Cloud deployment and the separate renewal drafts remain outside this result.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
9 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.9% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

#558 is merged through normal branch protection as 74f17aae43fc26fb1ef3a88a6cf0153be5e1312a. The complete tree 11404acccb54e3de1e288c2082e285f997d7e389 exactly matches qualified candidate 2ed4c6c7. PHP runtime/configuration/dependencies/schema/tests/release scripts remain byte-identical to the previously passing PHP source. Native/shared/frozen source is preserved. The merged remote branch is deleted and its absence verified.

The release commit is now fixed, so main merges and source work can proceed independently. No further merge sequencing is needed for the PHP release. Current feature qualification is SUCCESS; the final performance status aggregate is queued after its substantive checks passed. I will cut the immutable PHP 2.10.0 / Helm 0.2.2 tag after that source gate finishes, then run normal publication and actual published-image consumers. No published image or native carrier/catalog adoption is claimed yet.

[rmcdaniel]

The immutable annotated 2.10.0 tag is pushed. Tag object b3eeb9d5985ea43d9573aa4504d98c022361175d peels to merged source 74f17aae43fc26fb1ef3a88a6cf0153be5e1312a, tree 11404acccb54e3de1e288c2082e285f997d7e389. That tree exactly matches qualified 2ed4c6c7. Every fresh normal source check is complete: 17 successful or inapplicable checks, including the full feature suite, TLS, source/performance aggregates, MySQL/PostgreSQL rolling checks, chart install and Sonar. Independent final PR-scoped Sonar readback remains 3 FIXED / 9 ACCEPTED / 0 OPEN.

The normal image/chart publisher is queued. The source authority names Server 2.10.0 / Helm 0.2.2 and locks published Core 2.9.0 / 2bc1ba0b. No image, chart, GitHub release or aggregate published-tuple success is claimed yet. Once the immutable image is available, the application-owned API 1.10.1 consumer image and all three normal registry SDKs will qualify that actual artifact, including worker replacement, retry identities and independent triggering links. Sample and Website delivery follow the same exact tuple.

Main can continue independently. Native/shared/frozen source and ownership boundaries remain preserved. Native catalog/carrier adoption and Cloud deployment keep their separate qualification. The previous setup, performance-target and runner failures remain recorded with their original outcomes.

[rmcdaniel]

The actual PHP Server 2.10.0 image is published and its normal image job passes first-run readiness, source-free Compose, protocol convergence and published-database TLS gates. The GitHub release is public. Matching Helm 0.2.2 publication remains queued, so the overall publisher is not yet complete.

Exact published tuple:

• Source: 74f17aae43fc26fb1ef3a88a6cf0153be5e1312a, tree 11404acccb54e3de1e288c2082e285f997d7e389.
• Docker Hub and GHCR index: sha256:d69f9009d6bb3a4fb60c3516c7268a99c832937eacd24fe5a078564076b5f427.
• amd64: sha256:55162dfc1331bc8aff7764109b7248140f9ab30397f613c8c37326cc083e3497.
• arm64: sha256:3d4f0cb5d0f43deac938c53bdb96ef586f94c8390f86771287f1cfb98fd1ad8b.
• Locked Core 2.9.0: 2bc1ba0b57df34b74de02427d2225bd8e4dc6322.

Both registries expose the same index and platform images. Actual image labels bind the source/tag/Core above. All 346 Server and 966 Core production files match the qualified sources; the Core provider autoloads from the installed vendor package.

The bare image has no OpenTelemetry API. A normally built application image installs API 1.10.1 and its three optional dependencies; all 118 preexisting lock records and every production file remain unchanged. That local configured image is sha256:8ca53f3213a0dc2a1a261bdc7e691f0d6000afbef0fa8ddeae76bcc4fad77b3e. It is a consumer of the published base, not another official release digest.

All three actual-image controls pass: API absent with the flag enabled omits capability, installed API with the flag disabled omits it, and installed API with the flag enabled advertises the exact eight-field capability. PHP SDK 3.1.0's normal registry consumer passes through two independent workers with four correctly related spans, three correlated logs, preserved request identity, clean scope restoration and the original business result. Database inspection confirms the actual caller origin and business/history exclusions. The other published SDK and restart/retry/signal journeys are running. Fresh Sample #266 and Website #332 gates are also running.

No native carrier/catalog conversion or Cloud adoption follows. The native owner can now use the actual immutable PHP image above for its separately owned conversion qualification. Original failed observations remain unchanged.

[rmcdaniel]

Server 2.10.0 publication and the six actual published enabled consumers are complete.

• Normal publisher: SUCCESS, including both image registries, first-run/source-free Compose/protocol/TLS checks and Helm 0.2.2. Clean anonymous chart pull and install pass.
• Image index: sha256:d69f9009d6bb3a4fb60c3516c7268a99c832937eacd24fe5a078564076b5f427. Helm package: sha256:f47d30a7e1748a5a92570a7cdc788189bee3db868a437c297aecb410c65c36cd.
• Normal published PHP 3.1.0, Python 2.7.0 and Rust 4.1.0 each pass caller/task/attempt parent relationships through independent workers, original result/request identity, scoped logs and clean shutdown.
• Additional published Python profiles pass worker-process replacement, actual failed/successful activity attempts with distinct attempt identities, and a separate signal trace linked to the original run. The real database preserves caller origins, empty default baggage and exact business/history exclusions.
• All 346 Server and 966 Core production files match the immutable image before and after. The application-owned API 1.10.1 recipe preserves every original full Composer lock record. Bare-image/API-absent, configured-image/flag-disabled and configured-image/flag-enabled controls pass the exact capability contract.

These qualify the PHP Server/SDK tuple. Native conversion/wire adoption and Cloud deployment remain independent. Core878/Server564 renewal drafts are separate. The original failures and post-study performance distinction remain recorded. Sample #266 and the final Website deployment still require completion before Workflow #773 closes.