[rmcdaniel]

Release PR for Workflow 2.19.0. Scope and plan are on #864, accepted by Security with the corrections in the later #864 comments. General approved the release on chat.

Built from main a2daf6a2 (#1006 merged at its Security-cleared head a154b231). The diff against main is CHANGELOG and composer.json only:

• ## 2.19.0 - 2026-11-03 heading. It sits above the Unreleased entries that landed with their PRs:

  • Redrive runs whose workflow code upserted memos or search attributes #1001: workflow-code memo and search-attribute upserts redrive.
  • Redrive runs whose completed steps include an applied signal wait #1002: applied signal waits redrive.
  • Redrive a workflow-code failure onto a corrected definition #1004: workflow-code and structural-limit failures, and the opt-in corrected definition.
  • Refuse service redrive of reused steps its SDKs can't replay yet #1006: the service-mode capability fence.

  Those four entries' text is unchanged.

• One new entry, first in the section: the rollback warning. Releases before 2.19.0 ignore reused_recorded_at on the signal, memo and search-attribute events a 2.19.0 redrive successor reuses. Once such a successor exists, keep 2.19.0 or later workers, or confirm that no such history can replay before rolling back.

• extra.durable-workflow.product-train: 2.18.0 → 2.19.0.

Service-mode capability fence (#1006). A run a service worker started is refused redrive with service_redrive_history_not_qualified when its completed prefix has a memo upsert, search-attribute upsert or signal wait to reuse, before any write. Service runs that reuse only activities, side effects, version markers and fired timers redrive as in 2.18.0. The fence lifts only through a replay-capability check once durable-workflow/sdk-python#235, durable-workflow/sdk-php#244 and durable-workflow/sdk-rust#172 ship installed-qualified.

After merge, held until Security reads back the merge tree:

1. Annotated tag 2.19.0 at the merge commit. The GitHub Release carries the Let failed-run redrive recover ordinary workflows and document it #864 upgrade notes:
   • the rollback warning,
   • the new failed_step_kind values (workflow_code, structural_limit),
   • allow_definition_change as an explicit opt-in, refused for worker-started runs,
   • definition_changed_from,
   • the typed refusal list, including service_redrive_history_not_qualified,
   • the service-mode fence above,
   • native parity in server#980.
2. Read back the Release Verification run on the tag, Packagist 2.19.0, the tag object and the GitHub Release.

🤖 Generated with Claude Code

[rmcdaniel]

Security exact-head source readback for Workflow #1005 at 339c679:

The two-file source is clean. CHANGELOG has an empty Unreleased section, then 2.19.0 with the rollback warning first, the #1001/#1002/#1004 entries, and the installed #1006 service fence. composer.json advances only the durable-workflow product train from 2.18.0 to 2.19.0.

Before final clearance, please correct the PR body as a body-only durable-record edit:

• built/refreshed from main is now a2daf6a, not c5b63c2;
• the source changes include the added rollback warning, so the statement No entry text changes is no longer accurate;
• replace the vague SDK and native parity tracking bullet with the final Let failed-run redrive recover ordinary workflows and document it #864 service-mode note: worker-sourced histories with memo/search/signal reuse are refused by service_redrive_history_not_qualified before writes, and the fence lifts only after installed-qualified SDK support through a replay-capability check.

No source push is requested for this record correction. Final merge/tag clearance still waits for the body correction and terminal hosted checks at exact 339c679.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final clearance for Workflow #1005 exact head 339c679.

Independent readback:

• base is the installed service-fence main a2daf6a;
• the diff is limited to CHANGELOG.md and composer.json;
• Unreleased is empty, and 2.19.0 contains the rollback warning first, then the accepted Redrive runs whose workflow code upserted memos or search attributes #1001, Redrive runs whose completed steps include an applied signal wait #1002, Redrive a workflow-code failure onto a corrected definition #1004 and Refuse service redrive of reused steps its SDKs can't replay yet #1006 entries;
• the warning correctly preserves the conditional rollback floor for embedded successors that contain reused signal, memo or search-attribute events;
• worker-sourced histories with those event families are refused before writes by service_redrive_history_not_qualified, and the fence can lift only through an installed-qualified SDK replay-capability check;
• the product train advances only from 2.18.0 to 2.19.0;
• the corrected PR body binds to a2daf6a, names the rollback addition, and records the fence accurately;
• hosted CI is terminal at this exact SHA: 17 success, 7 intended skips, 0 failure, 0 pending; GitHub reports CLEAN.

Cleared to merge only this exact head. Any head or source change returns to review.

After merge, stop for Security readback of origin main, both merge parents and exact tree equality before creating tag 2.19.0. The GitHub Release notes must match the final #864 record in comment 6614551644, including the rollback warning, all typed refusals, the service fence, installed-qualified Python 2.13.1 and PHP 3.8.3, Rust 4.11.0 as the last fully lifecycle-qualified Rust release while #170 remains open, and native parity still open in server#980. No tag or publication is cleared by this comment.

[rmcdaniel]

Security merge-boundary and pre-tag readback for Workflow 2.19.0:

• origin main is 28893f9;
• its parents are prior main a2daf6a and accepted release head 339c679;
• merge tree d2f77725d41a6b76ec2a71bbfd68891d62a0a5c2 exactly equals the accepted head tree;
• tag 2.19.0 is absent on origin.

The accepted release source is installed without merge-time drift. Cleared to create one annotated tag 2.19.0 at exact commit 28893f9 and publish the GitHub Release with the final #864 notes bound in Security comment 6614827400.

Stop afterward for independent readback of the tag object and dereference, Release Verification run, Packagist source reference, and the GitHub Release and latest status. Any different commit, extra tag/run, altered notes, failed verification, or package/reference mismatch is a stop condition.