[rmcdaniel]

Legacy imports can leave a run or task naming one namespace while its canonical instance belongs elsewhere. Cached-summary reads and worker task operations must refuse those inconsistent rows and preserve the foreign owner's state. A batch of foreign activity tasks must also leave valid work visible.

Require exact canonical instance/run/task ownership for reads, mutation locks, polling and both worker-replacement release paths. Check replacement activity execution/attempt references against the task's run before expiring an attempt. Preserve custom activity bridges outside the packaged task table. Adopt published Core 2.15.12 so ownership filtering happens before the activity poll limit, and retain the HTTP regression with ten foreign tasks ahead of valid work.

The final diff contains four PHP runtime files, the Composer dependency pair and four PHP test files. Only Workflow changes in the dependency lock. The branch incorporates main at 6caf527a; subsequent main changes through 5c50f9fb affect Rust and documentation. Native/shared/frozen fixture and CI implementation bytes are preserved.

Validation at exact head 546cb5ee0b3a56e0f7d3993155413b39394cd6ac:

• Complete normal PHP selection plus all three release-contract files: 3,652 tests / 73,451 assertions, zero errors or failures, 182 backend skips and six PHPUnit deprecations. Completed November 1 at 09:15:18 UTC with the repository's database queue profile.
• Focused ownership, visibility and HTTP poll-window files: 63 tests / 374 assertions, zero errors, failures or skips. Style passes for all eight changed PHP files.
• Actual normal Composer Core 2.15.12 installation: all 2,259 package files and 12 runtime class origins match the published reference before and after both test runs. Publication and installed-consumer acceptance includes all 17 publication jobs and complete 86-test bridge cells on SQLite and MySQL.
• Security accepts the exact source boundary, including two independent retry counterfactuals. Hosted checks are green, including PHP, topology, bounded growth, CodeQL and Sonar. The exact-head Sonar analysis has no unresolved issues or hotspots.

The initial local full run incorrectly forced the synchronous queue and failed four database-readiness/queue assertions. All four pass unchanged with the repository's database queue setting (4 tests / 52 assertions), followed by the complete successful run above. The failed run is retained as runner diagnosis; no source, assertion, timeout or gate was relaxed.

Source/package qualification does not establish a fixed published Server image. Published-image delivery remains separate; no Server tag/image or Cloud deployment is included here.

Refs #765 and durable-workflow/workflow#928.

[rmcdaniel]

Security exact-head review of 546cb5ee0b3a56e0f7d3993155413b39394cd6ac found no ownership-boundary blocker.

• The conflict-free prospective merge against current base 39a326589a028cdefa865ffc99974bb8285f6218 is tree 748def5c166be53b804d9b8b6b1f8c049a1e4e78; it changes only the recorded four runtime files, Workflow dependency pair, and four test files. git diff --check passes.
• The canonical chain is enforced before authority-bearing use: exact namespace identity on the instance, run and task relations; summary-to-run instance equality; the run-before-task mutation lock; the default activity bridge's ID-only claim; workflow claims; worker-replacement lease release; and activity execution/attempt references. Custom bridge tasks outside the package table retain their existing path.
• I added two disposable, uncommitted counterfactual tests against that prospective merge tree: a repeated activity poll using the same poll_request_id after the instance owner changes, and a workflow-history continuation after the owner changes. Both correctly refused the task and preserved every workflow/activity row: 2 tests / 16 assertions pass under isolated PHP 8.5/SQLite with no network.
• Removing only taskQuery()'s canonical run/instance predicate in the disposable copy makes both tests fail in the dangerous direction: the repeated poll returns the foreign activity task, and the history continuation returns HTTP 200 rather than 404. This demonstrates the reviewed guard, not incidental setup, enforces both retry boundaries.
• Exact lock installation succeeded and composer audit --locked reports no security advisory. Existing exact-head protected checks are green, including the full feature source qualification and CodeQL/Sonar; this review does not substitute for the PR's stated combined qualification.

Disposition: Security accepts the source boundary at this exact head. Keep the PR draft until its owner completes the stated combined qualification and normal protected merge. This is not published-image or Cloud-deployment acceptance, and no live service, release, credential or repository setting changed. The two disposable retry cases are a non-blocking candidate for permanent regression coverage.

[rmcdaniel]

Maintainer review of exact head 546cb5e: the canonical namespace chain is enforced before cached reads, task claims and replacement mutations; execution/attempt references stay within the task run, and custom bridge behavior is preserved. The lock update changes only Workflow and the ten-file diff preserves native/shared/frozen/CI implementation bytes.

Combined qualification completed at 09:15:18 UTC: 3,652 tests / 73,451 assertions, zero errors or failures, 182 backend skips and six PHPUnit deprecations. Focused ownership/HTTP coverage is 63 / 374; all changed PHP style checks pass. Every installed Core file and the twelve runtime origins match published 2.15.12 before and after. The initial four failures came from my synchronous-queue runner profile; the exact four controls and the full selection pass with the repository database queue profile, without product/assertion/deadline changes. Security's exact-head review is linked in the PR body and all hosted checks are green. No remaining source blocker found. Proceed through the protected merge queue; published Server image acceptance remains separate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud