[rmcdaniel]

Problem

Fixes the PHP HTTP validation defect in #583. A normal SDK cancellation loses all seven selection-member identity fields before the existing package normalizer sees it. The valid command returns 422, the SDK can mark replay blocked, and the losing activity remains claimable.

Changes

• Retain and type-check the seven existing cancellation fields before semantic normalization. The runtime still validates the original group, authored member and operation identity.
• Move the unchanged completion rule set into WorkflowTaskCompletionValidation so a contract test can exercise the exact transport rules against every package-advertised command type. No duplicated validation rule list is added.
• Add real HTTP timer-winner/queued-activity cancellation, namespace/member/lease/missing-field refusals and selected-run repair coverage.
• Document recovery using the existing selected-run repair API after upgrading.

Workflow stays pinned to published 2.9.0. This PHP change does not edit native/shared/runner/frozen paths, schemas, protocol versions or package dependencies. Current main's native changes are inherited through ordinary merges. Server 2.10.1 / Helm 0.2.3 metadata is generated by the existing release synchronizer; Composer changes only its product-train and lock content hash, with no resolution or package/reference change.

Evidence

The tests-first commit f2504601b reaches the actual completion route on unchanged production source and fails with the reported 422 and exact selection-cancellation message. Earlier fixture setup mistakes are not product evidence.

The final focused suite passes 16 tests / 152 assertions, including actual cancellation, missing/foreign identity, namespace isolation, original lease expiry and real blocked-run repair. Its grammar contract covers every one of the 17 package command types and keeps unknown fields discarded and forged principal fields prohibited. The affected selection also runs the existing worker protocol suites: all 160 existing cases pass; the first two expanded runs retain one fixture-only failure in the new expiry test (the existing lease-recovery response does not carry recorded, and legitimately appends recovery history). The corrected final test asserts the actual lease_expired response and absence of member cancellation, without changing production behavior.

Pint, PHP lint and release-metadata synchronization pass. Local generator-test attempts were runner-blocked by missing Git/PHP in their respective Node images; no full generator-test pass is claimed. Required repository CI runs its normal supported tool environment.

Preceding candidate d055dc55dcd15c59a64dfc6bc728d154a3197368 passes its actual PHPUnit feature suite (39590225989, job 119195688929), Sonar gate, Helm install/render/lint and repository/boundary checks. One valid Sonar repeated-string finding is addressed by a shared validation-condition constant, without changing the rules. Its optional performance, memo-rolling and query-topology executions were cancelled because this PHP validation patch changes none of those runtimes or contracts. The dependent performance aggregate therefore fails from those cancellations, not a measured product failure.

Qualified predecessor 5527ddd03e98adb1e10de6fa391e78c6f2932a35 / whole 6bb3b9d4f9703f972e229065db16bf788a996029 includes that constant and main bab54427f. Its exact required PHP feature suite, aggregate, Sonar, Helm install/render and repository/boundary checks pass. Optional cancelled runs remain cancellations, not measured failures.

Candidate ba8a4f6dcf4460db11652413bc3244e92519f411 / whole e0569134169051890c45a0cd248d781f46c63554 integrates native/docs main 95676bb8. Its exact PHP 39607910667, Sonar 39607910738, Helm 39607910850 and normal boundary checks pass. Optional performance 39607910734, memo 39607910724 and query-topology 39607910679 are terminal cancelled; their child checks and aggregate retain their own failure/cancellation states. These are not completed performance measurements.

Candidate cb77530a integrates the newer native/docs-only main cc7564f0. Before its required PHP job starts, main advances once more through native-build-only #586. Current efa0b17858c33bb0b1df7b73b666dbef37d04d70 / whole cfb6f236908de1f854d2d59b49dcb66f3ce181f7 integrates main a5996ef3 normally. This final ancestry update adds only the existing native codec build script change. PHP application, dependency, release, chart and CI bytes are unchanged from ba8a4f6d. No competing native edits are made and no earlier whole-tree pass is transferred. Fresh required checks, publication and installed Python/PHP/Rust acceptance remain pending.

Issue #583 remains open until the published artifact and installed acceptance are verified.

Actual SDK source qualification

Normal installed Python 2.7.0 and PHP SDK 3.1.0 each pass default and named timer-wins/cancel-loser originals against this exact candidate PHP source. Published Rust 4.1.0 exposes a separate SDK request-completion stall after the Server has correctly cancelled the activity; that failed original remains failed. Companion Rust SDK #112 corrects the unit-returning request behavior and passes both new originals. This Rust result uses candidate SDK source, not a published fixed SDK.

Final cohort: six completed originals, exact int64/null/Unicode results, original 30-second execution/run/observation budgets, 24 tasks (18 completed first-attempt tasks and six cancelled activities with zero claims), and nine events per run including exactly one SelectionResolved, SelectionOperationCancelled and WorkflowCompleted. Real late activity workers run in both namespaces with zero callback invocations. After all API/queue writers are removed, a SELECT-only audit preserves the exact SQLite file fingerprint. API launcher exits 143 and leaves built-in PHP workers; explicit TERM retires those before the audit. Queue exits 0. No graceful API-shutdown claim is made.

Earlier fixture failures (Python import shadowing/missing namespace, wrong Composer package name and PHP unregistered manual tick) are retained as fixture failures. The first PHP business original subsequently times out; it is not reused or counted in the final cohort. The first Rust 30-second failure is also excluded. Candidate-source results do not qualify the release image; #583 remains open for that publication/installed follow-through.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud