[rmcdaniel]

Adds optional execution tracing, standard logging correlation and the accepted bounded W3C carrier contract for Workflow #773. The telemetry extra installs only the API. Applications own providers, exporters, sampling, bounded I/O and shutdown. Real capability discovery gates propagation; original poll identities and existing history/query/activity fences precede extraction. No synthetic initial receipt RPC or lease extension is added. Run origins parent task spans and real dispatch/command/outcome contexts become links. Baggage defaults empty and links carry none.

The prospective minor is 2.7.0, at 010f5cda5cf2a669c1df8603da4c7973d1b56aea. It includes current main 1b03ed2, #177 entry safety and #180 request keys. Runtime/tests exactly match the qualified e4fac655 source. A built 2.7 wheel installs normally without OpenTelemetry and its enabled integration remains a safe no-op in that API-absent profile. The whole-task debug dump is removed while same-named business arguments retain their meaning.

The current runtime passes 3,032 non-integration tests on Python 3.10, with three compatibility/optional-package skips and 105 integration tests deselected, plus Ruff, strict mypy over 35 source files and corpus validation. The new cold-worker corpus case recovers the parent from delivery/history while emitting no attempt span for completed work. Focused controls also cover original history refusal before extraction, malformed/insufficient claims, async/thread isolation, cancellation, preserved failures/results/request keys and fresh supervised-process export.

The preceding real source HTTP consumer passes against PHP Server tracing source through two independent workers, with four spans, three correlated callback logs and both exit codes zero. Direct inspection verifies its persisted caller identities and history exclusions. See the source receipt. Source and constructed controls do not qualify a published tuple.

Fresh analysis on the current 010f5cda minor head reports 28 fixed findings, one individually accepted inherited workflow-body complexity, two finding-specific false positives and no open findings. General's review records the inherited-body rationale; its business AST matches the existing main body after moving history loading and removing the debug dump. The introduced complexities and composite assertions were corrected. No rule, threshold or profile is disabled. New minor-head hosted checks remain pending.

No tracing package is published. Current-main integration, exact-head gates, normal registry consumers, the configured published Server/SDK tuple and matching docs remain required. Workflow #773 stays open until full PHP/Python/Rust tracing delivery; no native/catalog or Cloud adoption is claimed. Original failed timing, environment and corpus results remain preserved.

[rmcdaniel]

The S3776 finding AaFbEaBnA7Bol8W9A3Al on _run_workflow_task_with_history reports the existing workflow execution body's complexity after that body was extracted behind the optional tracing scope. I compared its AST with _run_workflow_task_core on current main 1b03ed2. Removing only the old whole-task debug dump and moving the existing history load to the outer wrapper leaves the business body AST identical.

I recommend individual acceptance of this inherited complexity, with the rule and threshold enabled. A further broad rewrite would change the existing entry decoding/refusal, update application, replay, local activity and completion error paths while introducing tracing. Keeping that proven body intact makes the authority ordering reviewable. The outer wrapper loads history through the original fences before telemetry and does not add an initial receipt RPC. The new cold-worker corpus case checks parent recovery and absence of replayed activity spans.

This is a specific maintainability acceptance request, not a false-positive or fixed-defect claim. The three newly introduced complexity findings in telemetry setup, link validation and optional claim validation are being corrected with helper extractions. Composite assertions are being split for clearer failures. Normal exact-head analysis and tests remain required.

[rmcdaniel]

General independently reviewed the exact PHP source b4d0e3b and the Python execution-wrapper extraction 432d784b against published 1b03ed2. The source-specific reasons in PHP #199 and Python #182 are accepted.

All eight exact PHP findings (seven S1142 guard/omission paths and the private S107 request boundary) and the one inherited Python S3776 execution body now read ACCEPTED through an independent API readback. Each issue has its own rationale comment. These are maintainability tradeoffs, not false positives or fixed defects. No rule, threshold or profile was disabled. The new Python complexities and assertions remain the implementation owner's fixes and require fresh analysis; no zero-open Python or SDK publication claim follows.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
1 Accepted issue

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Published 2.7.0 is available through normal PyPI and its protected publisher is now SUCCESS: https://github.com/durable-workflow/sdk-python/actions/runs/39532462277. The immutable source is ab7ee6f8d1ecef11112875e1d8bcf4798f7cb687.

A fresh normal registry HTTP consumer passes against immutable Server 2.9.11 through two independent worker processes, with the original result/request ID, three independent task/attempt root spans, three correlated logs, clean worker exits and restored scope. All 36 installed production modules match the release before and after execution. A separate normal default installation passes without the optional API, preserving the original return object and exception identity and restoring scope.

The initial canonical installation selected the prior release while PyPI indexes converged, so that publisher attempt remains failed. Rerunning only the failed publication job after unchanged canonical exact/default installation passed succeeded, without moving the tag or changing the artifact. The first HTTP harness incorrectly demanded an activity-task parent on the capability-absent path; its failed result is preserved and a corrected strict fallback probe passes. No runtime source or gate changes follow.

This Server does not advertise carrier support. Actual durable caller propagation remains pending the separately qualified Server release under #773. Component release.