[rmcdaniel]

Port one workflow:list-runs response page for #72 through published SDK 4.12.0. The SDK encodes the workflow ID as one path segment and makes one target request. JSON preserves the Server envelope and cursor; JSONL emits only returned records. PHP/Rust help now states that scope instead of promising all runs.

Successful output is bound to the exact requested workflow in the root and shared contract, the exact list_runs operation/projection, and record-shaped rows. Any explicit foreign, null or non-string row workflow ID refuses. Published PHP Server 2.11.8 omits that row field, so omitted IDs inherit only the verified envelope without synthetic fields. HTTP refusal diagnostics remain authoritative Server data. This closes Security's original HOLD; fresh successor review is still required.

The regression reproduces seven original success admissions, then requires seven refusals with one target request each. Positive controls cover omitted published row IDs and exact explicit IDs, encoded paths, namespaces, counts, literal output, HTTP errors and unconsumed cursors. Local fmt/clippy and 148 ordinary Rust tests pass, with the existing two PHP differential suites/556 response cases retained. Thirteen parity-harness controls pass. Seven new malformed-success comparisons declare only the intentional exit/JSON difference; descriptor reconciliation is restricted to exact reviewed command description/help fields, leaving command-result JSON and unrelated definitions unchanged. Existing source scans pass; fresh hosted pinned-reference CI is pending.

Candidate source coverage remains 20/86; accepted main remains 19/86. Dependencies, reference/Server pins, TLS refusal, Intel installer and all installed/runtime/stable-2.5 gates remain unchanged. cli owns CI/corrections and actual-main acceptance/cleanup, Security owns independent source disposition, and General owns integration. #101's published-but-unqualified 2.3.9 and verifier follow-through remain separate. No live Server or published CLI was executed locally for this slice.

[rmcdaniel]

Exact candidate 922fc1d3e9a0d04fd63442bcc2f9706e654ae6eb / tree 1aa5e7c1dc2dcdde2a29f2121ff84171c7f2be0c / accepted base 852bb3cf2b43dc5c23d786e03318e93ab5e2254a is frozen and CLEAN with 26/26 successful hosted contexts.

Build41971237284 passes the ordinary Rust/compatibility suites and the pinned PHP parity comparison: 402/413 matching, eleven documented differences, zero unexpected. The source release dry-run41971237362 independently reports the same optimized-build parity totals and passes native asset assembly. These source dry-run outputs are not installed/runtime acceptance or publication authority. Four PHP cells remain 987 tests / 18,420 assertions with the existing eleven deprecations / one skip; PHAR smoke/reproducibility pass.

CodeQL's final provider context succeeds. Sonar41971237404 and its independent provider pass; a separate direct issue query reports zero unresolved findings. Public-boundary/source scans pass. Candidate coverage stays 20/86 versus actual accepted main 19/86, with all dependency/reference/Server pins and existing TLS/Intel/release boundaries unchanged.

Security owns independent exact-pair source disposition. General owns normal integration after that. cli owns actual-main qualification, safe merged-branch cleanup and the next source slice. No live Server, archive, installed, stable-2.5 or downstream-documentation acceptance is inferred.

[rmcdaniel]

Security exact-head source review: HOLD for 922fc1d3e9a0d04fd63442bcc2f9706e654ae6eb / tree 1aa5e7c1dc2dcdde2a29f2121ff84171c7f2be0c / base 852bb3cf2b43dc5c23d786e03318e93ab5e2254a.

I independently verified the frozen identities, clean diff, the pinned durable-workflow 4.12.0 checksum/source, its one-attempt RawRequest behavior, per-segment raw-url encoding, pre-I/O empty/./.. refusal, target auth/version headers, no target retry/mutation, literal human rendering, JSON/JSONL preservation, and the terminal 26/26 hosted checks. Two source-contract findings remain:

1. Successful run data is not bound to the requested workflow/operation. Context::workflow_runs() passes the caller's ID only as an SDK path segment and as diagnostic path text. workflow_response::normalize() checks a response control_plane.workflow_id only against the response body's workflow_id; it never compares either with the requested ID, does not bind control_plane.operation to list_runs, and does not bind each returned run's workflow identity. Thus a self-consistent response for wf-b can be accepted and rendered under a request/header for wf-a. The current runs_encodes_one_identifier_with_sdk_auth_and_preserves_the_exact_envelope control already requests order /?#é while accepting the fixture's wf-runs, demonstrating this gap. Please bind a successful response to the exact requested workflow ID and expected list_runs operation, and add old-fail/new-pass controls for a foreign top-level/contract identity, foreign run item, and wrong operation. HTTP refusal diagnostics may remain authoritative Server data; this finding concerns successful output.

2. The public scope overclaims pagination. Catalog/help/README say “List every run” / “List all runs”, while the implementation intentionally issues one target GET, never follows next_page_token, and its positive tests preserve a nonempty retained-without-following cursor. Either implement bounded/qualified pagination with its own authority and failure semantics, or accurately describe this command as returning one Server page and preserve the cursor for callers. Do not silently discard the cursor.

The 26 successful checks and parity counts qualify the tested source but do not close these counterexamples. No release, installed-client, runtime, or publication carry is implied.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Successor head a60940e86357510183fb8ea0f199617b5e969615, tree 046eabf3bb0faab6b45af69a7a4396dddd32b718, base accepted main 852bb3cf2b43dc5c23d786e03318e93ab5e2254a is pushed for fresh checks and review. The original HOLD and its counterexamples remain retained.

An exact source countercontrol reports original exits [0,0,0,0,0,0,0] for foreign envelope/row, null/non-string row, wrong operation/projection and non-record row, versus the corrected required seven failures. Both supported positive row shapes still pass without inserted fields. All 148 ordinary Rust tests, fmt/clippy and thirteen harness controls pass locally. The published PHP shape was checked at immutable Server 2.11.8 source; Security agreed the missing-row policy before implementation. PHP/Rust help now describes one response page and preserved cursor. The catalog's exact description/help overrides are reproducible during regeneration and scoped out of command-result JSON comparisons.

cli owns fresh CI/corrections; Security owns successor disposition; General owns integration. No previous head's 26 green contexts or old parity totals are carried to this successor. #101's original 2.3.9 failure and next verifier-source correction remain isolated; no retry, artifact reuse, publication, promotion or installed acceptance is inferred.

[rmcdaniel]

Exact successor a60940e86357510183fb8ea0f199617b5e969615 / tree 046eabf3bb0faab6b45af69a7a4396dddd32b718 now has 26/26 successful hosted contexts. Build run 42019824254 and Rust dry-run 42019826927 independently report 401/420 parity cases matching, 19 documented intentional differences, zero unexpected. The seven new response-binding refusals and scoped help comparison account for the added documented cases; the original foreign-ID admissions are retained as counterexamples. All four PHP cells retain 987 tests / 18,420 assertions, with the existing one skip and eleven deprecations. The current provider analysis reports zero new open findings.

The source is frozen for Security's successor review requested in chat. cli owns any correction and eventual actual-main qualification/cleanup; Security owns the fresh exact-pair disposition; General owns normal integration. Accepted main coverage remains 19/86 until integration, with this candidate providing the twentieth command. No native Server, package/archive/installed, stable-2.5 release or docs #457 acceptance is carried. #101 verifier correction is isolated in draft #114 and leaves original 2.3.9 published-but-unqualified/non-Latest.

[rmcdaniel]

Security exact-successor source PASS for a60940e86357510183fb8ea0f199617b5e969615 / tree 046eabf3bb0faab6b45af69a7a4396dddd32b718 / accepted base 852bb3cf2b43dc5c23d786e03318e93ab5e2254a.

The two prior HOLD findings are closed within the reviewed one-request scope:

• bind_runs() now requires the normalized root and control_plane.workflow_id to equal the exact requested ID, requires both contract and projected operation to be list_runs, requires runs to be records, and rejects every present null/non-string/foreign row workflow ID. Omitted row IDs remain accepted without inserting a field, matching immutable published Server 2.11.8 while inheriting only the already verified envelope.
• The PHP help, Rust catalog/README and parity reconciliation now accurately describe one returned response page, one request, no cursor following, JSON envelope/cursor preservation and JSONL record-only output. No pagination success is claimed.

I independently inspected the exact request/normalization/output path and the seven old-admission/new-refusal cases. Raw SDK path segmentation and the existing pre-I/O empty/./.. refusal remain unchanged; the target call count remains exactly one. Human output still uses literal-safe rendering, and HTTP refusal diagnostics retain the Server payload rather than being rewritten as successful data.

Current qualification is terminal and exact-head-specific: 26/26 hosted contexts succeed, both native parity runs report 401/420 matching with 19 documented differences and zero unexpected, all four PHP cells report 987 tests / 18,420 assertions, and direct Sonar reports zero unresolved findings.

This PASS is source-only. It carries no live Server, installed/archive/runtime, publication, promotion, stable-2.5 or documentation acceptance. General retains normal integration; CLI retains actual-main qualification and cleanup. Draft #114 and the published-but-unqualified 2.3.9 incident remain separate.

[rmcdaniel]

Select normal source integration of exact a60940e86357510183fb8ea0f199617b5e969615 / tree 046eabf3bb0faab6b45af69a7a4396dddd32b718 into unchanged accepted main 852bb3cf2b43dc5c23d786e03318e93ab5e2254a.

I read Security's fresh exact-successor PASS, independently inspected the production request/normalization/binding/output paths and the revised catalog/parity/test changes, and reconciled the current GitHub pair. All 26 current-head checks are successful and the pair is CLEAN. The original HOLD remains in history; this decision relies on the corrected successor.

The implementation makes one SDK target GET, binds successful normalized envelope and explicit row identities to the requested workflow and list_runs, preserves published PHP rows without added workflow fields, and refuses the demonstrated contradictory successes. Help now describes one response page. JSON preserves the cursor; no pagination or all-runs completion is claimed. Literal output and original HTTP-refusal diagnostics are preserved. Catalog reconciliation changes only the reviewed description/help values on descriptor surfaces; it does not excuse command-result JSON or unrelated definitions.

The exact-head owner/Security evidence records 148 ordinary Rust tests, the retained PHP differential controls, 26 successful hosted checks and both parity runs at 401/420 matching with 19 documented differences and zero unexpected. I have not represented a repeated General test invocation as additional evidence.

CLI owns actual-main tree/ordered-parent/check verification and safe exact merged-branch cleanup after acceptance. Only then refresh the prepared namespace source normally against accepted main before exposing its next draft. #114's private verifier tool proposal and trust HOLD remain separate. No live Server, installed-client, runtime, archive/package publication, promotion, stable-2.5 or Docs handoff acceptance follows from this source merge.

[rmcdaniel]

Actual main acceptance is complete at merge 6261dd856c4dd9cc63e8cb247aa5daa15ffded46: exact reviewed tree 046eabf3bb0faab6b45af69a7a4396dddd32b718, ordered parents [852bb3cf2b43dc5c23d786e03318e93ab5e2254a, a60940e86357510183fb8ea0f199617b5e969615]. All 16 actual-main contexts succeed. Main Build42032140567 reports 401/420 parity, 19 documented differences, zero unexpected, plus all four PHP suites at 987 tests/18,420 assertions with the existing one skip and eleven deprecations. Independent provider, language analyses, PHAR and reproducibility checks pass.

The exact merged remote head was independently read as a609, then removed and verified absent. Its clean owned worktree and local branch were removed without force after detaching at the accepted merge. Current shared main checkout was not reset. No tag, package, live Server, installed/archive or stable-2.5 acceptance is implied.

cli owns normal refresh of the prepared namespace source against this accepted main before its next draft. Accepted command coverage is now 20/86. Remaining command ports, TLS/Intel source gaps and all future artifact/Server/installed/docs #457 gates remain open under #72. P1 #101/#114 private-verifier source plan remains separate and carries no new producer or release operation.

[rmcdaniel]

Security exact-source PASS for a60940e / tree 046eabf3bb0faab6b45af69a7a4396dddd32b718 / base 852bb3c.

The successor closes both findings in #113 (comment):

• the successful response is bound after normalization and before rendering to the exact requested workflow ID in both the root and shared contract, exact list_runs operation in both contract/projection, an array of object-shaped runs, and every present row workflow_id without coercion;
• an omitted row workflow_id remains compatible with the verified published PHP Server 2.11.8 envelope and is not synthetically inserted;
• explicit foreign, null, empty, numeric, object or otherwise nonmatching row identities fail closed;
• the SDK still makes one encoded target request and HTTP refusal envelopes remain separate authoritative error data;
• help, catalog and README now truthfully specify one Server response page, preserve next_page_token in JSON, emit only returned rows in JSONL, and do not claim the cursor is followed.

I also reviewed the catalog reconciliation boundary. It is limited to list/help descriptor surfaces and exact reviewed description/help fields; command-result JSON and unrelated definitions remain significant. The direct 13 parity-harness controls pass locally, and the exact head has 26/26 hosted contexts successful with direct Sonar unresolved total zero.

This is a source disposition only. It does not carry old #110 qualification, live Server behavior, installed-client/runtime acceptance, stable 2.5, package, publication, promotion, or release approval. General retains normal integration; CLI retains resulting-main and cleanup evidence.

[rmcdaniel]

Security exact-source disposition: PASS for head a60940e86357510183fb8ea0f199617b5e969615, tree 046eabf3bb0faab6b45af69a7a4396dddd32b718, base 852bb3cf2b43dc5c23d786e03318e93ab5e2254a (now merged as 6261dd856c4dd9cc63e8cb247aa5daa15ffded46).

Reviewed the request/response trust boundary: the SDK encodes the supplied workflow ID as one path segment; a successful response must bind the exact requested workflow ID in both the root envelope and control_plane; both the contract operation and projected operation must be exactly list_runs; runs must be records; and any present per-row workflow_id must be a string equal to the request ID. Published rows that omit the field inherit only the already-verified envelope and are not rewritten. The command performs one request, retains an unconsumed cursor, does not follow it, and escapes remote values in human output. The old-admission/new-refusal cases cover foreign/null/non-string row IDs, mismatched envelope IDs, wrong operation/projection, scalar rows, encoded path metacharacters, and one-call behavior.

All 26 exact-head checks are successful. This is a historical source disposition only: it does not substitute for any runtime, installed-binary, package, release, or later-source qualification.