[rmcdaniel]

Current complete 2.10.0 candidate qualified: 4f853f396dba5a530ef0815509b16bfddaa9ebc3, merged 38b5a639262bebcf3fd0e67c6ec42ab16bc3a966 with the same tree. All 17 applicable normal checks and fresh exact built-artifact/installed controls pass; qualified receipt. Earlier 12b5f372 is retained separately and superseded as current only after the new proof. Untagged/unpublished pending existing #197.

Group the now-qualified #167 cancellation/poll diagnostics into the still-untagged 2.10.0 release notes. All implementation is already merged through e31bc4efbc76d78ad9decf0c8e2b40e6b95b9369; this moves its existing changelog entry from the general unreleased section into 2.10.0. No code, dependency, protocol or version-field change.

Refs #210 and #167. The earlier qualified 12b5f372 artifact evidence remains an earlier candidate and is not relabeled. Current prospective candidate 4f853f396dba5a530ef0815509b16bfddaa9ebc3 has fresh exact-source wheel/sdist and isolated installed qualification, including all seven source items and cancellation controls. Normal final-head CI/analyzer gates pass. Draft #212 will be updated to match this complete cohort.

No tag/upload while the existing #197 Trusted Publisher account setup is pending. The security-only 2.9.1 reservation at 2da02a7ac8a68a7cd4267e86ef10e0198a309592 stays separate. Registry installation and consumer acceptance remain subsequent gates. Source guidance still marks these capabilities unreleased; Server floor 2.8.0, worker protocol 1.20 and control plane 2 are unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh built-artifact phase passes for prospective complete 2.10.0 / 4f853f396dba5a530ef0815509b16bfddaa9ebc3, including the now-qualified #167 diagnostics. Earlier 12b5f372 remains its own earlier cohort; final normal PR gates still need to finish before this candidate supersedes it.

The maintained build-only run 39953168211 succeeds on this exact source: metadata, Twine and isolated wheel/sdist smoke checks pass; publish is skipped. Separate local distributions of the same source pass the same maintained metadata/Twine/smoke checks:

Local artifact	SHA-256
durable_workflow-2.10.0-py3-none-any.whl	1aa29dee6b04dded72f88fbe273aaffe3c20a80b7f8f45b9f47bff16a96692b4
durable_workflow-2.10.0.tar.gz	ce36f179ec30cffb0d5d2098c86ef4b35bdc228aa6123c8e4c928ae50ee33a18

Fresh non-editable wheel installation: 37 installed Python files match the exact commit and wheel RECORD, no source overlay. 272 controls pass, no skips, in 4.75 seconds, including real private-CA HTTPS/refusal controls, the actual Prometheus adapter, poll recovery, harness failures/retries/Nexus, schema-1/2 bundle integrity and all new cancellation/request-identity controls. Python 3.12.3, pip 26.2.2, certifi 2026.10.23, fastavro 1.13.1, httpx 0.28.1, pytest 9.1.1, pytest-asyncio 1.4.0, Prometheus client 0.26.0. The wheel preserves certifi>=2026.10.19.

Actual installed console commands accept all four genuine valid exports and reject both historical Core 2.7.2 invalid exports plus all four new Server 2.11.1/Core 2.10.2 CLI/HTTP invalid exports. Every raw hash stays unchanged. Directory simulation remains integrity-only: zero candidate-code replays, replay_skipped: true, review_before_promote only. These are built-artifact controls, not registry publication or live-runtime acceptance. Completed consumer/build scratch is retired after retaining this proof.

Normal CI 39953122394 integration and final target guard remain pending. Final Sonar is zero open/confirmed issues and zero unreviewed hotspots; CodeQL has no open alerts. No immutable tag exists or moves. No upload, token fallback or repeated human account request is made; the existing #197 setup and separate security-only 2.9.1 reservation remain.

[rmcdaniel]

Current untagged release candidate: fresh source and built-artifact qualification passes for complete 2.10.0 / 4f853f396dba5a530ef0815509b16bfddaa9ebc3, including the now-qualified #167 diagnostics. Merged normally at 38b5a639262bebcf3fd0e67c6ec42ab16bc3a966, with tree 26b7da4ee940bc1706889ca6165eac40b89e67ab exactly matching the qualified head. All 17 applicable normal checks pass, including CI 39953122394; this changelog-only PR does not trigger the separate portal workflow. The merged remote head is deleted and independently verified absent. Earlier 12b5f372 remains its own retained earlier cohort and is now superseded as the current candidate only after this fresh proof.

The maintained build-only run 39953168211 succeeds on this exact source: metadata, Twine and isolated wheel/sdist smoke checks pass; publish is skipped. Separate local distributions of the same source pass the same maintained metadata/Twine/smoke checks:

Local artifact	SHA-256
durable_workflow-2.10.0-py3-none-any.whl	1aa29dee6b04dded72f88fbe273aaffe3c20a80b7f8f45b9f47bff16a96692b4
durable_workflow-2.10.0.tar.gz	ce36f179ec30cffb0d5d2098c86ef4b35bdc228aa6123c8e4c928ae50ee33a18

Fresh non-editable wheel installation: 37 installed Python files match the exact commit and wheel RECORD, no source overlay. 272 controls pass, no skips, in 4.75 seconds, including real private-CA HTTPS/refusal controls, the actual Prometheus adapter, poll recovery, harness failures/retries/Nexus, schema-1/2 bundle integrity and all new cancellation/request-identity controls. Python 3.12.3, pip 26.2.2, certifi 2026.10.23, fastavro 1.13.1, httpx 0.28.1, pytest 9.1.1, pytest-asyncio 1.4.0, Prometheus client 0.26.0. The wheel preserves certifi>=2026.10.19.

Actual installed console commands accept all four genuine valid exports and reject both historical Core 2.7.2 invalid exports plus all four new Server 2.11.1/Core 2.10.2 CLI/HTTP invalid exports. Every raw hash stays unchanged. Directory simulation remains integrity-only: zero candidate-code replays, replay_skipped: true, review_before_promote only. These are built-artifact controls, not registry publication or live-runtime acceptance. Completed consumer/build scratch is retired after retaining this proof.

Normal CI integration and the final target guard pass. This current cohort includes #189, #198, #166, #205, #173, #179 and #167. Draft #212 is refreshed to 754b284d5214da8a7c2cb92d4836bcd3efd1af8d for their eventual versioned guidance, and remains gated on actual registry publication/install acceptance. Final Sonar is zero open/confirmed issues and zero unreviewed hotspots; CodeQL has no open alerts. No immutable tag exists or moves. No upload, token fallback or repeated human account request is made; the existing #197 setup and separate security-only 2.9.1 reservation remain.

Final independent main verification: all 15 applicable main checks succeed on merge 38b5a639262bebcf3fd0e67c6ec42ab16bc3a966, including CI 39954588189, integration and target qualification. CodeQL has no open main alerts; annotations are runner-image notices. Main Sonar has an existing 509-issue backlog (475 code smells and 34 findings categorized as vulnerabilities), zero OPEN/CONFIRMED findings created since this session began at 07:19 UTC, and zero unreviewed hotspots. The zero total-issue counts above describe the candidate PR, not that existing main backlog. Draft #212 at 754b284d5214da8a7c2cb92d4836bcd3efd1af8d separately passes all 18 normal checks and its own clean PR analyzer review; it remains draft until actual registry publication and installed acceptance. No tag or PyPI 2.9.1/2.10.0 publication exists at final readback.

Retention limitation recorded after qualification: the four newer Server 2.11.1/Core 2.10.2 CLI/HTTP raw export inputs are no longer available. Their original identities, SHA-256 manifest and four numeric-kind observation reports remain, but those four inputs cannot currently be rerun or described as retained. The earlier committed invalid fixtures remain separate valid negative controls. No recreated export replaces or rescues a lost original. The exact 2.10.0 distributions, 37-file installation proof and observations from the already completed 272-control run are unchanged. The 509-issue Sonar count above is the 12:50 main-backlog snapshot, not a continuing zero-findings claim.

[rmcdaniel]

Python 2.10.0 is published and normally installed. The immutable annotated tag f857cb343371e13bdbdf39cfa7569040114fc891 targets exact qualified source 4f853f396dba5a530ef0815509b16bfddaa9ebc3, whose whole tree matches main merge 38b5a639262bebcf3fd0e67c6ec42ab16bc3a966 (26b7da4ee940bc1706889ca6165eac40b89e67ab). Protected OIDC publication 39978389335 completed build/publish and both maintained registry metadata/install verifiers. PyPI 2.10.0 was uploaded October 23 at 15:32:07–08 UTC.

• Published wheel SHA-256: 62a78da1c5bdc2af607c11eede5c56a3d25c2159e5f2266c72176f5aa8dda115.
• Published sdist SHA-256: 9439aad2d1d77c2dde082aa6855eac5ebac2f2da9d6f1bccbb51a3476e0fde3b.
• An independent normal pip install --upgrade durable-workflow==2.10.0 upgraded the prepared registry-installed 2.9.1 consumer. All 37 installed Python files match exact Git source and their RECORD hashes; complete file-set equality excludes missing or extra modules. All 50 hashed RECORD entries, including entry points and distribution metadata, are independently verified. Import comes from isolated site-packages, with no source overlay.
• 334 installed controls pass, including the earlier 272-control selection and the expanded runtime-payload controls. The first expanded run had 333 passes and one missing copied test-helper error; copying the unchanged helper inputs from exact source fixes the harness, with no SDK or assertion changes. The initial Simple-index lookup briefly lacked 2.10.0 while its version JSON already existed; the unchanged normal requirement/index later succeeded. Both failed observations remain unsuccessful.
• Installed console commands accept four independently genuine schema-2 exports and reject the two retained committed historical producer-invalid fixtures, without modifying their hashes. Directory simulation retains review_before_promote, zero replay-checked histories and explicit replay-skipped evidence. The four lost Server 2.11.1 raw exports are not rerun or relabeled.
• With SSL/proxy overrides removed for the trust probe, the actual default SDK context has certificate and hostname verification enabled and exactly matches the fixed certifi==2026.10.23 bundle's 118 roots. pip is 26.2.2.

This delivers the package cohort for #189, #198, #166, #205, #173, #179 and #167. Docs activation #212 can now proceed through its current-head checks, merge and actual Pages verification; its October 23 release date matches the registry. Those documentation gates are still pending. No #175/#215 source, major version, protocol-floor change or automatic Server/Cloud adoption is included. Earlier local 12b and 4f artifact hashes remain their own build cohorts; the hashes above identify the actual registry artifacts.