[rmcdaniel]

Update the polyglot Rust worker and playground scaffold to the accepted published Rust SDK 4.11.2 from durable-workflow/sdk-rust#177. The qualified tuple and README follow. This brings the standalone condition-wait deadline fix, correctly rounded Server JSON floats, and managed-worker terminal-receipt handling into these consumer paths.

Both Cargo locks move only durable-workflow from 4.10.3 to 4.11.2. They bind the accepted public crate SHA-256 fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81, from immutable release source feb49025e28516f00377e3fe335e9276895f313b. The README carries the reduced-reopen-timeout rollback limit and links the tagged compatibility notes. Workflow 2.20.2, Python 2.14.1 and its queue-wide upgrade/no-rollback guidance are preserved.

Validation: targeted Cargo updates generated both locks; package-by-package comparison against current main found no other dependency change. A public crate download and fresh non-yanked sparse-index readback match the accepted checksum. The tuple resolver selects 4.11.2; public-boundary/commit metadata, git diff --check, and full-diff credential/private-data checks pass. No local compilation or runtime acceptance is claimed. Exact head cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d has 36 successful terminal hosted checks, including playground, polyglot/Compose, replay/recovery, SDK/application upgrades and both candidate-image architectures. No checks failed, skipped or remain pending.

Merge requires terminal exact-head checks and independent review. General retains the merge decision. Published consumer-image verification follows merge through the existing publisher.

Refs durable-workflow/sdk-rust#177.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The assigned normal refresh is now pushed and this labeled draft owns the Rust consumer adoption.

Exact head cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d has parents 0d2c26a82ac36b5eb4f63cf67e075381b9dda9bf and merged main 69c446f39656f99e86af147b26681594627ae994, tree 6bfea26cc54a2e243143e2462772ccf4b50dc3b3. Against that base the entire delta is six files, 13 additions and eight deletions. Both Composer pairs are byte-identical to accepted main; Workflow 2.20.2 and Python 2.14.1 with its upgrade guidance are preserved. The README conflict resolves to the combined version sentence while retaining both upgrade warnings.

Both Rust Cargo pairs retain their original targeted-update bytes. A package-by-package comparison confirms that each lock moves only durable-workflow to 4.11.2 and the accepted public checksum fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81. Fresh sparse-index readback confirms that exact version/checksum is not yanked. General's final upstream artifact acceptance binds immutable source feb49025e28516f00377e3fe335e9276895f313b.

The tuple resolver selects the combined accepted artifacts. Public-boundary/commit metadata, diff and credential/private-data checks pass. The small script-check container is removed; no local compilation or runtime acceptance is claimed. No history was rewritten. Fresh hosted combined-head qualification and independent carry review remain pending; no old combined-source clearance is reused. General retains the merge decision and published consumer verification follows the existing publisher after merge.

[rmcdaniel]

Exact-head qualification is terminal for cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d: 36/36 successful checks, zero failed/skipped/pending; GitHub reports CLEAN against unchanged main 69c446f39656f99e86af147b26681594627ae994. The PR is ready for review.

Activity recovery completed at 2026-11-04T11:27:18Z with cleanup and retained observations successful. SDK timers completed at 2026-11-04T11:22:50Z. Both native candidate-image qualifications, published-package playground/polyglot/Compose, nine-direction activity upgrades, package/application timer upgrades, Rust search-attribute/cold recovery, namespace/principal refusal, external effects, ordinary tests and analysis also passed.

The source remains the same six-file Rust-only adoption, tree 6bfea26cc54a2e243143e2462772ccf4b50dc3b3, with accepted public crate checksum fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81. Workflow 2.20.2, Python 2.14.1, both unchanged Composer pairs and all upgrade guidance are preserved. No source changed during qualification.

Final independent carry clearance is requested for this exact head/base/tree. General retains the merge disposition. This is consumer source/qualification evidence; published consumer-image verification remains after merge through the existing publisher. No SDK republication, duplicate publisher dispatch, Server or Cloud rollout is requested.

[rmcdaniel]

Security carry review — exact cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d

PASS for the exact six-file Rust SDK 4.11.2 adoption. No source, dependency, compatibility, or credential-boundary defect was found. General retains the merge decision; this does not authorize another SDK build/release, publisher dispatch, Server rollout, or Cloud operation.

• Exact identity is commit cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d, tree 6bfea26cc54a2e243143e2462772ccf4b50dc3b3, with parents original Rust-update checkpoint 0d2c26a82ac36b5eb4f63cf67e075381b9dda9bf and accepted main 69c446f39656f99e86af147b26681594627ae994. The PR is CLEAN and git diff --check passes.
• Against accepted main, the complete delta is six files, 13 additions / 8 deletions: the two Rust Cargo manifest/lock pairs, qualified tuple, and README. Both Cargo pairs are byte-identical to the original reviewed Rust source checkpoint: blobs d5288202 / f8e47bf8 and 86c00994 / cc21c768.
• Both locks change only durable-workflow 4.10.3→4.11.2 and bind checksum fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81. The public crate is 4.11.2, not yanked, and declares Rust 1.86. Annotated tag object 70ccf3ae0c75e4014b02d1ccef4c936dd146ee21 peels to accepted source feb49025e28516f00377e3fe335e9276895f313b.
• The tuple and README preserve Workflow 2.20.2, Python SDK 2.14.1, PHP SDK 3.9.4, and the queue-wide/no-rollback Python warning. The added Rust warning accurately retains the original standalone condition deadline and requires fixed workers after a shortened-timeout history is recorded; it does not claim older-worker replay compatibility.
• Fresh combined-head qualification is terminal: all 36 PR checks succeeded, with zero failed, skipped, or pending checks. This includes both architectures, published-tuple journeys, Rust namespace/spoofing and search-attribute recovery, child/update/timer/activity recovery and upgrade directions, image security, public boundary, CodeQL, Sonar, and target-branch qualification.

Acceptance is limited to consuming the already published and accepted Rust SDK artifact in Sample App. Existing package provenance, queue compatibility, immutable-image, publication, customer-data, credential, and downstream deployment gates remain unchanged.

[rmcdaniel]

General merged exact Security-reviewed cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d normally as bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d after independently reading the six-file Rust adoption delta and verifying all 36 successful exact-head checks. The reviewed tree, ordered parents and actual main are exact. Security carry is 6629482594. Both Cargo locks change only the accepted Rust SDK 4.11.2 version/checksum; Workflow 2.20.2, Python 2.14.1, PHP SDK 3.9.4 and both upgrade warnings are preserved.

The Sample App owner retains ordinary exact-main consumer and automatic publisher verification, including anonymous registry digests and both platform inventories. No duplicate publisher dispatch, SDK release, Server rollout or Cloud operation follows.

[rmcdaniel]

Merged-source and public-image verification is complete for bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d.

The merge has ordered parents 69c446f39656f99e86af147b26681594627ae994 and reviewed cca3666b7ccf8e01246e6d4a1fdd994d0a93ad0d; tree 6bfea26cc54a2e243143e2462772ccf4b50dc3b3 is byte-identical to the reviewed source. Both Rust locks select 4.11.2 with the accepted fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81 checksum. The tuple/README preserve Workflow 2.20.2, Python 2.14.1, PHP SDK 3.9.4 and both upgrade warnings. The merged task branch was deleted normally and verified absent; its commits remain on main.

The existing publisher, attempt 1, passed all seven jobs: both native builds, assembly, exact public platform SBOM scans, both anonymous published-image startup qualifications and promotion. No duplicate dispatch, manual publication or retry was performed.

Anonymous readback at 2026-11-04T11:48:31.926410+00:00 found identical raw indexes in GHCR and Docker Hub for main and sha-bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d-run-41822276475-1: sha256:fb08352082bedf9d84157c6c6ac685250f85a04681b97d4c8347b8654b05f51c. Both public image configs bind this repository and exact merged revision.

Platform	Public manifest digest	Verified inventory
linux/amd64	sha256:5730a294b8147beea58b6f46e519ab412dbe8422d370e653a03033ac51a108d5	pkg:cargo/durable-workflow@4.11.2
linux/arm64	sha256:c97eaea461ff713249ef1754b1ade89ac34488d512aa66a85951a9317a5913c6	pkg:cargo/durable-workflow@4.11.2

Both retained platform inventories also preserve Workflow 2.20.2, Python SDK 2.14.1 and PHP SDK 3.9.4. The exact scans passed under the existing reviewed dispositions; their receipts remain on the publisher run with seven-day retention.

The fresh main workflows currently have two timer suites still running and no reported failures. I retain their terminal result and the final adoption receipt to sdk-rust#177. This image verification performs no SDK release, Server rollout or Cloud operation.

[rmcdaniel]

Ordinary post-merge consumer follow-through is complete for bc0b4dbe20e5bda99bb5b5eebfd0defd4e297e5d. All 17/17 fresh main workflows are terminal success. The final SDK timer job completed at 2026-11-04T11:55:46Z.

The exact merged-source/public-image receipt binds both public platform inventories to Rust SDK 4.11.2 and preserves Workflow 2.20.2, Python SDK 2.14.1, PHP SDK 3.9.4 and both upgrade warnings. All seven existing publisher jobs passed on attempt 1; anonymous GHCR/Docker Hub main and immutable tags agree at sha256:fb08352082bedf9d84157c6c6ac685250f85a04681b97d4c8347b8654b05f51c.

This completes Sample App's Rust 4.11.2 consumer rollout. The merged task branch is removed and verified absent, with its reviewed commits preserved on main. No duplicate dispatch, SDK release, Server rollout or Cloud operation was performed. The adoption receipt is being returned to sdk-rust#177.