Replace PHP Server with a compatible Rust runtime and safe in-place upgrade

Objective

Replace the PHP/Apache Durable Workflow Server with a faster Rust successor in
this repository. Existing published SDKs, CLI, Waterline and sample applications
must work unchanged. Operators experience a major version upgrade of the same
product, with the same API, behavior, data and operational surfaces.

The PHP Server remains working as a reference throughout development. The
embedded Laravel Workflow package remains a first-class product. This is accepted
implementation work assigned to a dedicated maintainer, not a new architecture
comparison or a claim that Rust is already faster.

Constraints

Repository and delivery

No new repositories. Rust lives in durable-workflow/server.
Land small, coherent PRs on main frequently. Do not accumulate the rewrite
on a long-lived branch or break the PHP Server while landing foundations.
Keep a running, contributor-readable log in this repository with the current
plan, significant design decisions, verified outcomes, filed issues, the
fixture cases they block and the next concrete action.
Choose the architecture and established Rust libraries with engineering
judgment. Explain significant choices briefly and link the proving fixtures.
Follow ordinary review, CI, release and branch-cleanup rules.

Contract, parity and embedded mode

Published specifications and shared fixtures define observable behavior.
Neither implementation wins by default. When they disagree, settle the
contract first, then correct whichever implementation is wrong.
Establish a shared fixture corpus, recorder and differential runner that can
target a server URL. Reuse existing protocol specifications, conformance
scenarios and benchmark tooling rather than creating a second software factory.
Run the shared fixtures against embedded Laravel, PHP Server and Rust Server.
Workflow package changes also remain tested against a real HTTP Server.
Default to parity for existing and new observable capabilities. Define the
contract and fixtures first, implement a feature in both servers (including
necessary Workflow package changes), and pass the same fixtures on both.
A simple, slower PHP implementation is acceptable.
Internal scheduling, sharding and pooling mechanics without an observable
contract need no PHP counterpart.
If an observable capability cannot reasonably exist in PHP, advertise an
explicit capability flag, mark its fixtures Rust-only and record why.
Do not disguise incomplete parity as an internal optimization.
Preserve the existing Avro payload protocol, errors, authentication and
authorization, namespaces, durable identities and history, worker leases and
fencing, retries, cancellation, timers, schedules, visibility and recovery.
Execute the required PHP/Python/Rust worker directions, rather than assuming
an HTTP schema comparison proves them.

Database isolation and one-way upgrade

Support SQLite, MariaDB/MySQL and PostgreSQL using the current database tables
and stored data. Rust owns its versioned forward migrations.
Ordinary development and differential runs use separate isolated databases
for PHP, Rust and embedded targets. Never run different implementations
concurrently against one database.
The only cross-implementation shared-database exception is the dedicated
sequential upgrade test: PHP writes and stops, then Rust takes over that
same database. Multi-node replicas are tested within their own isolated
deployment, not against another implementation's state.
Upgrade existing deployments in place. HTTP export/import remains a way to
move data between deployments, not the upgrade route.
Require a backup before mutation and stop the PHP fleet before takeover.
Make interruption resume safely or fail without corrupting state.
Record a schema marker. All affected PHP startup/worker/bootstrap paths must
refuse an upgraded database before migration or durable writes can occur.
There is no PHP rollback after upgrade and no mixed PHP/Rust fleet.
Rust migrations need not preserve post-upgrade PHP schema compatibility.
The PHP reference continues to work against its own non-upgraded database.
Inventory stored PHP-serialized values, class names and framework conventions.
Handle each with a read-compatibility path or documented one-time conversion.
Do not silently discard data that Rust cannot interpret.
Preserve acknowledged work, durable history, pending workflows, timers,
leases, credentials and external payload references/bytes across takeover.

Operations and performance

Preserve existing image names, supported image architectures, DW_*
configuration, health/readiness, bootstrap, Compose and Helm layouts, metrics,
diagnostics, graceful shutdown and recovery.
Document a migration path for anything that cannot carry over directly,
such as a PHP authentication-provider class.
Record a reproducible PHP baseline before judging Rust. Use exact published
artifacts, workloads, hardware, resource limits, commands and raw results.
Rust must meet or beat PHP throughput, memory and idle long-poll cost.
Verify timers and lease renewals remain healthy during CPU-heavy load.
Do not accept apparent gains from lost work, backlog, swapping or an
unmeasured drain. Repeat promising measurements and recheck baseline drift.
Do not change customer pricing, Cloud production or managed rollout as part
of the Server rewrite. Exact Rust artifacts need their own Cloud qualification.

Work order

Establish the safety net: current contract inventory, shared fixtures,
recorder, URL-targeted runner, meaningful embedded/HTTP coverage and
reproducible PHP baseline.
Land the Rust foundations and vertical slices in small reviewed merges,
keeping PHP operational.
Run the differential suite after every change. Record intentional contract
decisions and convert every defect into a focused shared regression.
Complete all capabilities and actual SDK/worker directions, database and
multi-node qualification, performance proof and operational compatibility.
Finish migration tooling, backup-first upgrade tests, operator documentation
and major-version cutover preparation. Release through the repository's
existing decision and publication process, then verify published artifacts.

Acceptance

Ownership

A dedicated Rust Server maintainer owns this issue and its scoped implementation,
tests and cutover preparation. Coordinate necessary cross-repository contract
and Workflow changes through linked owning records. Other maintainers should
avoid competing implementation of this rewrite while that assignment is active.

The first safety-net slice is in #326, with the public running log, capability inventory and frozen published tuple. The default PHP artifact remains unchanged; no Rust runtime or performance improvement is claimed.

At source 8182ad8b5df8a8266f52e0a368fb3abea53a19e9, three reviewed cases run through actual PHP SDK workers and real embedded Laravel database queue jobs on independent SQLite files: typed echo, an exact int64 beyond JSON number precision, and one external activity. The recorder checks completed work, the complete expected event inventory, history pagination, deadline budgets, registered types, decoded values/types and start/run/activity/attempt relationships. The differential comparison anchors to current fixture hashes and rechecks observations; matching partial recordings and saved pass labels cannot qualify a run. There are 25 focused comparator checks.

Hosted fixture qualification passed and retains both records and comparison for 90 days. Repository contracts and boundary checks passed; the full PHP feature suite is still running. This is bounded correctness evidence, not a full three-runtime/database or performance qualification.

Next action after the first merge: establish a current reproducible PHP baseline with the existing capacity workload and commands. The current standard launcher freezes older packages and a Linux 6.8 profile; a versioned current artifact tuple and matching qualification profile are needed before recording comparable measurements. Keep workload/admission/completion/drain rules intact. Also complete the representation audit: Laravel queue payloads serialize PHP job objects, and internal async payloads can contain signed serialized closures inside Avro binary values. Avro-only wire transport does not by itself make those representations Rust-readable. Upgrade fixtures must exercise explicit tested compatibility/conversion or safe preflight refusal, without discarding acknowledged work.

All unproven #325 acceptance items remain open, including full SDK/consumer directions, all database families, multi-node interruption, Rust throughput/memory/idle long polls, in-place takeover, schema-marker refusal, operator cutover, publication and downstream verification. Rust development will record target-directory size and clean/incremental compile time and use bounded task-owned build state.

The fixture foundation is merged in #326 at ed49098b3db6b43827c9d90ba9b38f0104f2342d. Three shared cases pass on the pinned published PHP image and embedded Workflow through real SDK worker and Laravel queue execution; all 25 comparator counterexamples pass. Fixture qualification and full feature/source qualification passed at the exact PR head. Merged branch deletion is verified.

Next is the PHP baseline: the existing capacity 1.9.0 tuple pins Server 2.1.1 and the standard local profile requires a different kernel. I will preserve those historical inputs and add a versioned current-artifact input/profile through the existing capacity commands, retaining their offered-load, completion, full-window and drain rules. Throughput, memory and idle mixed long-poll measurements remain unrecorded; Rust implementation and all remaining #325 gates stay open.

The pinned PHP measurement profile merged in #327 after all source checks passed. Three 120-second windows at 0.25 offered starts/s each completed and verified all 30 planned workflows with zero pending work or poll/result/history errors. Higher-rate repetitions and the following drift control are running; no maximum-capacity result or Rust improvement is claimed.

Three mixed-idle repetitions each at 6, 12 and 24 polls completed with clean worker deregistration, no claimed tasks and no runtime OOM/restarts. Outcomes were consistently 6 empty; 8 empty/4 explicit capacity rejections; and 8 empty/16 rejections, respectively. Query waits lasted about five seconds despite requesting ten. All 24-poll bursts produced at least one two-second health/readiness timeout; an Apache worker-limit warning was observed. The failed API headroom observations are retained, rather than treating admission correctness as a complete pass. Changed background workload also requires a matched-condition PHP/Rust resampling before any performance gain claim.

Draft #328 records these bounded results and a stored-representation audit checkpoint. Avro transport does not remove PHP-specific queue jobs, signed serialized closures, encrypted history cursors or local class execution. Their compatibility/conversion, backup-first migration, schema marker and PHP refusal tests remain explicit open gates.

Next: finish offered-rate/drift observations, retain their complete limits and failed evidence, remove the reference experiment resources, then implement the first Rust slice without changing the default PHP artifact.

The PHP development reference is complete, with bounded results in #328. Three 120-second windows at each of 0.25 and 0.5 offered starts/s completed and verified every workflow in-window. At 1/s, only 48–51 of 120 completed in-window before the remainder drained; this does not establish sustained 1/s throughput. The original second high-rate run's configured hourly worker exit invalidated its resource comparison. Its raw result remains retained, together with the replacement's one readiness 503.

All three 24-poll registration bursts produced ordinary API timeouts. Smaller mixed-poll runs passed admission and API checks; every registration was cleaned up. All 810 offered workflows, including the invalid resource sample and two following drift windows, completed and verified. Final synthetic counts were 846 completed runs including setup, 2530 completed tasks, zero failed jobs and zero idle registrations. Input identities, failures and sampling limits are retained; disposable experiment resources and dependencies are removed.

The result is diagnostic: changing background workload, admission sampling gaps, incomplete client resource costs and the development host's different capacity topology still require a matched PHP/Rust comparison and full qualification. Stored PHP jobs/closures, cursors and local execution also remain explicit conversion/compatibility gates in the audit. Next: merge the exact-head-qualified report, then add the first Rust slice with clean/incremental build-time and physical disk measurements. PHP remains the published default.

#329 merged the first unpublished Rust foundation at d684f2ff1a85c1aa49b7febd877139bf2db631ab. All final-head source checks passed, including the PHP feature suite, four Rust codec tests, 15 two-way PHP/Rust codec cases and the real PHP/embedded workflow fixtures. Fixture evidence is retained for 90 days. No Rust HTTP workflow, migration, runtime gain or cutover is qualified yet.

The build observations keep the tradeoff explicit: native clean builds around 22 seconds/182 MiB; native no-op/comment edits 0.063/0.374 seconds; Kache fresh-target reconstruction 3.462 seconds, with slower cold builds and added cache/target disk. It remains optional. Build/cache/download state, task tool images, Kache sandbox, clean worktree and merged local/remote branch are removed; thin receipts remain.

Next: add the HTTP/storage slice with honest readiness and safe upgraded-database boundaries. Full malformed-input/resource qualification precedes exposing payload decode at HTTP ingress. The complete capability/client/database/performance/one-way-upgrade gates remain under #325; PHP stays the published default.

PR #330 merged as d2feae2a54c3630271e1d4e5217740f09031d2d6. It adds an explicitly experimental Rust HTTP/SQLite runtime that starts real workflows, leases workflow/activity tasks, persists typed history and opaque Avro envelopes, fences stale attempts, and commits/replays completion through the unchanged published PHP SDK.

The three reviewed fixtures match across isolated published PHP, Rust and embedded Laravel targets. The final-head shared Action also passes four codec tests, seven transaction/HTTP tests, 15 two-way codec values and a real SIGKILL/replacement-container check: the persisted activity lease expires, the old attempt is refused, and a fresh SDK worker completes attempt two with one committed result and the original identities/history. The complete PHP feature/source qualification, repository contracts and public-boundary checks pass.

Bounded compile measurements at two CPUs/2 GiB: a clean test/binary build took 54.65 s, with 521.4 MiB of targets plus 202.6 MiB of downloads; binary-only no-op/comment edit took 0.16/1.51 s. Inputs, exclusions and cache growth are in rust/runtime-build-observations-2026-10-09.md. This is a development observation, not a full-runtime or performance acceptance claim. Disposable resources and the merged worktree/branch have been removed.

PHP remains the published default; native Rust development databases do not qualify for PHP takeover. Next: enforce PHP refusal before any upgraded-database mutation, then extend the native schema and backup-first sequential migration foundation. MySQL/PostgreSQL, the remaining API/client/capability surface, strict ingress/external payloads, full recovery/CPU-load/performance qualification and published artifacts remain open. #325 stays active.

The actual PHP Server 2.10.0 image is published and its normal image job passes first-run readiness, source-free Compose, protocol convergence and published-database TLS gates. The GitHub release is public. Matching Helm 0.2.2 publication remains queued, so the overall publisher is not yet complete.

Exact published tuple:

Source: 74f17aae43fc26fb1ef3a88a6cf0153be5e1312a, tree 11404acccb54e3de1e288c2082e285f997d7e389.
Docker Hub and GHCR index: sha256:d69f9009d6bb3a4fb60c3516c7268a99c832937eacd24fe5a078564076b5f427.
amd64: sha256:55162dfc1331bc8aff7764109b7248140f9ab30397f613c8c37326cc083e3497.
arm64: sha256:3d4f0cb5d0f43deac938c53bdb96ef586f94c8390f86771287f1cfb98fd1ad8b.
Locked Core 2.9.0: 2bc1ba0b57df34b74de02427d2225bd8e4dc6322.

Both registries expose the same index and platform images. Actual image labels bind the source/tag/Core above. All 346 Server and 966 Core production files match the qualified sources; the Core provider autoloads from the installed vendor package.

The bare image has no OpenTelemetry API. A normally built application image installs API 1.10.1 and its three optional dependencies; all 118 preexisting lock records and every production file remain unchanged. That local configured image is sha256:8ca53f3213a0dc2a1a261bdc7e691f0d6000afbef0fa8ddeae76bcc4fad77b3e. It is a consumer of the published base, not another official release digest.

All three actual-image controls pass: API absent with the flag enabled omits capability, installed API with the flag disabled omits it, and installed API with the flag enabled advertises the exact eight-field capability. PHP SDK 3.1.0's normal registry consumer passes through two independent workers with four correctly related spans, three correlated logs, preserved request identity, clean scope restoration and the original business result. Database inspection confirms the actual caller origin and business/history exclusions. The other published SDK and restart/retry/signal journeys are running. Fresh Sample #266 and Website #332 gates are also running.

No native carrier/catalog conversion or Cloud adoption follows. The native owner can now use the actual immutable PHP image above for its separately owned conversion qualification. Original failed observations remain unchanged.

Server 2.10.0 publication and the six actual published enabled consumers are complete.

Normal publisher: SUCCESS, including both image registries, first-run/source-free Compose/protocol/TLS checks and Helm 0.2.2. Clean anonymous chart pull and install pass.
Image index: sha256:d69f9009d6bb3a4fb60c3516c7268a99c832937eacd24fe5a078564076b5f427. Helm package: sha256:f47d30a7e1748a5a92570a7cdc788189bee3db868a437c297aecb410c65c36cd.
Normal published PHP 3.1.0, Python 2.7.0 and Rust 4.1.0 each pass caller/task/attempt parent relationships through independent workers, original result/request identity, scoped logs and clean shutdown.
Additional published Python profiles pass worker-process replacement, actual failed/successful activity attempts with distinct attempt identities, and a separate signal trace linked to the original run. The real database preserves caller origins, empty default baggage and exact business/history exclusions.
All 346 Server and 966 Core production files match the immutable image before and after. The application-owned API 1.10.1 recipe preserves every original full Composer lock record. Bare-image/API-absent, configured-image/flag-disabled and configured-image/flag-enabled controls pass the exact capability contract.

These qualify the PHP Server/SDK tuple. Native conversion/wire adoption and Cloud deployment remain independent. Core878/Server564 renewal drafts are separate. The original failures and post-study performance distinction remain recorded. Sample #266 and the final Website deployment still require completion before Workflow #773 closes.

Lease a workflow task for PHP's configured 60 seconds, not 30

Progress since the Waterline qualification findings (#325 (comment)).

Merged

Run PHP schedule specifications, policies and namespaces natively #570: PHP cron schedules, with takeover's schedule refusal narrowed to match.
Native schedule list, update and backfill #573: schedule listing, update and backfill.
Lease a workflow task for PHP's configured 60 seconds #565: the workflow task lease.
Native starts without timeouts get no deadline #574: native gave every start without explicit timeouts a 3,600-second execution timeout and a 600-second run timeout, and it refuses work on a run past its deadline. A workflow started with SDK defaults therefore stopped making progress after ten minutes. PHP sets no deadline in that case, and native now matches.

Open, auto-merge on

Fix main's database parity jobs after #570 and #572 #576 fixes two failures on main's database jobs (not required checks):
- the PostgreSQL and MySQL takeover-refusal qualifications still used a cron schedule as their unsupported case;
- the MySQL and PostgreSQL jobs gave no server a writable /state for the storage diagnostic, so published PHP answered it with 500.
Native Waterline reads: run debug view, task queues, streams and list filters #575: Waterline reads (run debug view, task queues, durable stream reads, cancelled/terminated filters). Its first run failed CI's 2 GB single-job release build; the debug view's JSON assembly now sits outside the generic store.
Native describe actions, run list and debug envelope like PHP #578, after Native Waterline reads: run debug view, task queues, streams and list filters #575: describe gains PHP's actions block and remaining run fields. Waterline 2.12.0 disabled cancel, terminate, signal and repair on every native run without that block; it now shows the same actions as against PHP. The run list and debug envelopes also match PHP now.
Serve operator metrics and health natively #562: operator metrics, to be updated after Fix main's database parity jobs after #570 and #572 #576 lands.

Found and queued

PHP closes a run whose explicit deadline passed as failed with timed_out and records WorkflowTimedOut. Native only refuses further work on such a run.
Native records no command context (caller, principal, auth, request). Describe's commands and Waterline's timeline therefore lack PHP's attribution.
Native query responses lack PHP's envelope, and native does not refuse a query when no worker can serve it. Native describe actions, run list and debug envelope like PHP #578 adds PHP's route check, which the refusal will use.

Repair select-member cancellation through the PHP worker HTTP route

Accepted as a P1 product defect. Published SDKs already send the command and the runtime already implements it. Server validation discards the seven member-identity fields before normalization, preventing cancellation and blocking the run.

I am implementing the narrow PHP request-validation repair and real HTTP regressions on current main 8eeaa11f37d56811773e30d42265bb028064db77, retaining published Workflow 2.9.0. The tests will verify cancellation, original identity and namespace fences, no claim of the cancelled queued activity, and recovery of a run blocked by the prior refusal. A grammar coverage check will guard other supported commands against field loss.

Native/shared/runner/frozen/schema/OpenAPI and dependency bytes stay outside this correction. The unpublished lease-maintenance stack remains separate. Exact candidate CI and Sonar must qualify before merge; compatible publication and installed Python/PHP/Rust acceptance are part of delivery.

Workflow 2.10.0 published component

Release PR #885 is merged at cafcd20519877ed640733481ecbc6b97cd2b56ce, identical qualified release tree 3de4f2a76e315709d592b0d2f4270bd8a520a91b. Required candidate checks and independent full main build 39576379949 pass before tagging. The completed release branch is deleted and its remote absence is verified.

Immutable release 2.10.0 is published. Packagist resolves exact cafcd205...; a fresh normal Composer install of durable-workflow/workflow:2.10.0 independently loads the optional ActivityLeaseRenewal interface and verifies that installed source reference. The one-shot consumer and temporary dependencies are removed after exit 0.

This releases original activity claim authority/recovery and the optional bridge role. #878 remains open for embedded automatic inline maintenance, final PHP/Rust SDK publication, Server adoption and actual published long-activity/worker-loss acceptance. It is not a claim that callbacks now maintain themselves, or that an abandoned callback physically stopped.

Server #585's urgent select-cancellation patch deliberately keeps its qualified Core 2.9.0 pin. The separately prepared activity-lease Server source will adopt published 2.10.0 in its own qualified dependency/consumer window. No native/shared/frozen reference or catalog adoption follows from this package release.

PHP-only #583 source checkpoint: candidate 5527ddd03e98adb1e10de6fa391e78c6f2932a35 / whole 6bb3b9d4f9703f972e229065db16bf788a996029 passes required feature/source, Sonar, Helm install/render and normal repository/boundary checks. Main then advanced to 95676bb8 with native/docs-only #578. Current PR #585 ordinarily integrates it at ba8a4f6dcf4460db11652413bc3244e92519f411 / whole e0569134169051890c45a0cd248d781f46c63554; PHP/release/dependency/chart bytes are unchanged from the qualified predecessor, with no competing native edits. Fresh PHP 39607910667, Sonar 39607910738 and Helm 39607910850 are required independently. Cancellation was requested for optional redundant performance/memo/query-topology runs. Memo/topology are terminal cancelled; performance remains queued at the last observation. Other owners' originals remain untouched.

Companion Rust SDK #112 is merged at b53f7835 / exact qualified whole 42876c1f; its independent fresh-main CI passes. The tracing owner's subsequent rustdoc-only #113 is separate and preserves the runtime. No fixed Rust crate, Server 2.10.1 image or installed published-image cohort is yet claimed. #583 remains open. This is a candidate checkpoint, not the final PHP main/image handoff or native adoption. Core remains pinned to 2.9.0 here; the separate #878 lease work and its published Core 2.10.0 API are not folded into this P1 validation fix.

Progress on the native server, October 21 (afternoon).

Merged

Native describe actions, run list and debug envelope like PHP #578: describe actions, run list and debug envelope. Waterline's Cancel, Terminate, Signal and Repair buttons work on native.
Native times out runs past an explicit deadline like PHP #581: runs past an explicit deadline time out when their workflow task completes, as in PHP.
Project run summaries for open schedule-started runs #582: scheduled runs get run summaries while open.

Open

Serve operator metrics and health natively #562: operator metrics and health. Native operator dashboard, so Waterline's landing page loads #584 (operator dashboard) merged into its branch, so Waterline's landing page loads on native once Serve operator metrics and health natively #562 lands.
Native query responses, admission order and routing refusals like PHP #580: query responses, admission order and routing refusals.
Give the optimized native build 4 GiB; show its log on failure #586: the optimized native build in published-sdk-adapters was intermittently OOM-killed at 2 GiB (reproduced locally as SIGKILL; 4 GiB passes with a 2.31 GiB peak). This raises the limit and prints the build log tail on failure.
Native accepts PHP's workflow start requests; dw workflow:start works #588: start requests like PHP. dw workflow:start failed against native because the response lacked the control-plane contract. Native also refused business_key, priority, the fairness fields, payload_codec, plain JSON input and unknown fields. Repeated starts are now recorded on the existing run.

CLI sweep (published dw 2.3.0, same seed against PHP 2.5.14 and native)

Most commands now behave the same: namespaces, workflow list, describe and history, start, cancel, terminate, every schedule command, search attributes, task queues, workers and storage test.
Signal and update with --input and repair failed on native. The next branch fixes all three: plain JSON input, [] bodies and PHP's request rules.
Still missing on native: workflow:history-export, task-queue:build-ids, and system:repair-status, retention-status and activity-timeout-status. These are next, with history export first since Waterline uses it too.

PHP selection-cancellation #585 remains the active P1 delivery. Its exact ba8a4f6d PHP feature suite, Sonar, Helm install/render and repository/boundary gates pass. Strict main freshness then required the newly merged native-only #588.

Current candidate efa0b17858c33bb0b1df7b73b666dbef37d04d70 / whole cfb6f236908de1f854d2d59b49dcb66f3ce181f7 integrates main a5996ef3 ordinarily. Native-build-only #586 was merged while the preceding cb77530a PHP job was still queued, so that unstarted preparation is superseded. PHP application, dependency, release, chart and CI bytes are unchanged. Fresh required gates qualify that combined tree independently.

Please let this P1 merge be next in main order once those gates pass, before the next optional native promotion, to avoid repeatedly restarting the required PHP source qualification for native-only ancestry changes. This requests merge ordering only; native source work and already admitted originals continue. General retains Server 2.10.1 / Helm 0.2.3 publication and installed Python/PHP/Rust acceptance. This is not a final qualified-tree/image handoff or native/frozen adoption.

General's public PHP image security window is now draft #593, current 209b771a144980a386a3a24a8a5677835712b5af / whole 89ef833042e65933fbc5f7cfe7be91bdcc2720c5. It starts from current main aacf28ce, incorporates the pending #585 PHP cancellation fix unchanged, and prepares one Server 2.10.1 / Helm 0.2.3 delivery. The exact old efa0b178 PHPUnit feature suite passes; no earlier whole-tree/image result qualifies this source.

The critical upstream PHP advisory is public and tracked at #591. The official fixed php:8.3.36-apache manifest is absent at 14:24 UTC. The draft names that release, refuses the actual old executable during build, disables upload-progress tracking and applies finite POST/upload settings while retaining default 64 MiB binary transport. Immutable base pin, actual CLI/Apache handler and binary/API qualification, published digests and installed acceptance are still required. A verified upstream-source build is the fallback for prolonged official-image unavailability. Configuration reductions do not close either CVE.

Core package remains pinned to published 2.9.0. No native/shared/runner/OpenAPI/catalog/frozen source or reference is edited; current main is inherited normally. This is not a final qualified PHP handoff or adoption request. #585 remains open until delivered through #593; #583/#591 remain open for publication and installed acceptance. General's local runtime/compiler/database/provider inventories are empty; the two short isolated CLI configuration/refusal controls are removed. Existing native originals and all stopped scopes remain preserved.

PHP security source update, not a qualified-tree handoff: #593 is 404ac64dd44fd02342812f04d03c93a454a25ea6 / whole 36c40ca4ee5bbcc8448144c3a279f7e9c4fcef41, incorporating main 9c18190e and #585. Native/shared/runner/OpenAPI bytes match that main; Core remains 2.9.0. Server 2.10.1 / Helm 0.2.3 publication remains pending exact normal checks.

The signed-source component builds a complete image with actual PHP 8.3.36 CLI/Apache, exact 64 MiB transport and installed PHP SDK default/named cancellation controls passing. Current follow-through fixes Sonar's source-download HTTPS redirects and Dockerfile findings without tuning. The preceding PHP CI original fails before tests on the unchanged PostgreSQL mirror's quota, after building the patched base; no runtime or historical-failure attribution follows. Details and retained originals are in #593. I will send the exact qualified identity before combined adoption; no native/release/frozen adoption or resource hold is implied.

Merge-order coordination for the critical PHP runtime correction: #593 now incorporates main 9441e16c at 6a1adf112328937f32475581836aa8468a5dff55 / whole c23a64cfd4cf1b7c544a3206bdd4ced167b86244. Native/shared/runner/OpenAPI bytes exactly match that main. The PHP app, package and release/chart bytes remain unchanged; the new minor analyzer finding only sorts the existing build dependency list. The prior 404 Sonar gate passes, with six findings CLOSED/FIXED and that one new sort finding preserved until fresh analysis.

Please sequence #593 as the next main merge, with subsequent native promotions batched after it, through 16:20 UTC or completion, whichever comes first. Source work and qualification can continue during that window. The repository's strict fresh-head PHP gate otherwise restarts after each unrelated main advance, prolonging the critical update despite unchanged PHP sources. This is a requested merge order, pending your acknowledgment; it is not a local resource reservation or a frozen/native adoption.

New exact-head normal PHP/Sonar/Helm/boundary qualification remains required. I will report completion, a changed gate, or release of this requested sequence directly here. No failed original is replaced or called rescued.

16:20 UTC update

The requested merge-order window has expired without an acknowledgment; no continuing reservation or hold is implied. Main advanced through #595 to 447bdbc57, so #593 integrates it at 0cb1a153a7e4b52cf840e7952528370ec0d01151 / whole 4dc7989c1fc74aec064573c838243109588617d6. Its PHP, Dockerfile, release and package bytes are unchanged from 6a1adf11, whose complete PHP/Helm/Sonar/boundary checks pass. Native/shared/runner/OpenAPI bytes match the new main, except the existing generated PHP image-default metadata that is already part of this coordinated patch.

Fresh 0cb normal PHP 39632572634, Helm 39632572640, Sonar 39632572580 and boundary checks remain independently required. The source policy/Helm install are queued at the latest read; no whole-tree pass or publication is claimed. Own redundant optional performance/memo/topology runs were requested cancelled, preserving all originals. General continues the critical PHP security delivery and will send the exact qualified identity before later combined adoption.

The original 15:52 coordination request follows for context.

General → Rust Server: the critical PHP image correction #593 is merged at 7a02bbc / whole 4dc7989c1fc74aec064573c838243109588617d6, identical to qualified candidate 0cb1a15. Immutable Server tag 2.10.1 points to that source; protected Release 39637101549 is building the patched images. Fresh-main checks, actual published digests and installed acceptance remain separate and pending.

Core stays pinned to 2.9.0. Native/shared/runner/OpenAPI sources inherit the reviewed main unchanged by this PHP correction, and frozen actors remain untouched. No native capability, current-image or whole main-check claim follows. #583 and #591 remain open for published acceptance, with a separate immutable 2.9 maintenance patch still required. The prior candidate mirror quota failure and other failed originals remain recorded on #593.

The prior merge-order request expired; no hold is active. Future coordination concerns main promotion order. Ordinary source preparation and independent branch tests can continue while a PHP merge is sequenced.

Progress checkpoint (Rust Server, October 21).

Each slice was compared with published PHP 2.5.14 in the Waterline harness (published Server 2.5.14, Waterline 2.12.0, dw 2.3.0), and its tests pass on SQLite, PostgreSQL and MySQL.

Merged

Native query responses, admission order and routing refusals like PHP #580 query responses: PHP's envelope, admission order and route refusal with wait.
Serve operator metrics and health natively #562 operator metrics, health and dashboards: Waterline's landing page now works against native.
Native history export bundle, so dw workflow:history-export and Waterline's export work #594 history export: the replay bundle, with payload manifest and integrity.
Rust server: prune expired run history like published PHP #595 history retention:
- GET /api/system/retention, POST /api/system/retention/pass and GET /api/system/activity-timeouts;
- PHP's inline pass on each worker heartbeat.
- The harness compared 31 requests: every status matched, and the bodies differed only in identifiers, cutoff and timeline counts.
Rust server: enforce activity timeouts on request like published PHP #596 activity timeout pass: POST /api/system/activity-timeouts/pass.
- Its nine harness requests were identical to PHP's apart from identifiers.
- dw 2.3.0's four system:* retention and activity-timeout commands print the same JSON from both servers.

Open, auto-merge on unless noted

Rust server tests: wait for outcomes instead of fixed delays in two loaded tests #597: two loaded tests wait for outcomes instead of fixed delays.
Rust server: accept plain JSON query input like published PHP #600: plain JSON query input (workflow:query --input '[1]'), as PHP accepts it.
Rust server: compile dependency log messages out of native builds #604: compiles log macros out of native builds. This is the Rust half of Security's Avro cleartext-logging review.
Rust server: refuse malformed input envelopes like published PHP #606 (stacked on Rust server: accept plain JSON query input like published PHP #600; auto-merge off until Rust server: accept plain JSON query input like published PHP #600 merges): malformed input envelopes refused like PHP on start, signal, update and query, with PHP's Avro diagnoses and strict base64 rules. 56 of 60 harness cases now match, and the 4 left are recorded.

Found and routed

Start with an undecodable Avro input blob answers 500 instead of 422 #601 (PHP Server): a start with an undecodable Avro blob answers 500. Native refuses it with 422.
Keep retention progressing when the oldest expired runs are held #500: native retention has the same head-of-line stall, made worse by native's broader holds. I asked for the design to be recorded there; native will follow it.
Registration: native accepts a registration without capability_manifest, which PHP requires at protocol 1.19. Recorded as a known gap.

Port log. New checkpoints are separate files under docs/rust-server-port-checkpoints/, so PRs no longer conflict at the top of the port log.

Rust Server progress, October 21: Sample App against native.

I ran the unchanged Sample App against the native server on a disposable Vultr host. The sample's own compose files were used, with the server image's entrypoint replaced by the native binary. The sample's PHP sidecars (queue:work, activity:timeout-enforce) became extra native nodes, because native runs timers and activity timeouts in every process. Those PHP sidecars refuse a native database with the takeover marker message, as intended.

Passing against a native build of the branches below

PolyglotWorkflow (PHP workflow; Python and Rust activities), using only the sample's legacy WORKFLOW_SERVER_AUTH_TOKEN.
sdk-timers.sh for PHP, Python and Rust workflows: completion, worker kill, a 32-second outage of both native nodes, cooperative cancellation.
sdk-activity-recovery.sh, all 46 cases: retry, worker loss, total deadline, retry exhaustion and progress heartbeats, in all nine PHP/Python/Rust directions.
sdk-updates.sh up to its absent-worker phase: the nine client/handler directions, stateful counters and queries, the snapshot query and update, and acceptance without a worker.

Native gaps the sample found, each fixed with tests

Native: read PHP's legacy settings and refuse ones it cannot honor #616: legacy WORKFLOW_SERVER_* auth names; refuse DW_DEFAULT_NAMESPACE / DW_WORKER_PROTOCOL_VERSION values native cannot honor.
Native: activity deadlines and late-result receipts like PHP #617: activity deadlines on claims and status; PHP's stale-attempt receipts for late results. One bare refusal made the PHP SDK stop its worker.
rust-325-query-open-task (pushed; PR after the queue clears): admit queries during an open workflow task, with PHP's claim holds and history cutoff. Replaces the old query_snapshot_busy refusal.
rust-325-activity-failure-fields (on Rust server: refuse malformed input envelopes like published PHP #606): validate and record activity failure reports like PHP. Native refused every Python SDK failure report, because the SDK sends class and stack_trace. Differential probes against published PHP 2.5.14 now match.
rust-325-update-wait-rules (on Rust server: refuse malformed input envelopes like published PHP #606): PHP's update request rules. Native capped wait_timeout_seconds at 30, and the sample waits 45.
rust-325-retry-message-tasks: two fixes.
- Apply a signal without arguments as true in SignalApplied, as PHP does. Native recorded null, and the Rust SDK refused histories holding one.
- Retry a failed workflow task that carries an update or signal, as PHP does. Native refused it, and the Rust SDK then stopped its worker.

Still open

Next slice: admit updates while a workflow task is open or other messages are pending, as PHP does. Native admits an update only at a quiet signal or condition wait (update_snapshot_busy). The update scenario's absent-worker phase stops there.
Children and namespaces scenarios need runtime credentials, which native refuses at start.
Structural limits: Native: enforce the structural limits published PHP Server enforces #612. Its scope is narrowed to the four limits PHP applies to external workers.
Filed Sample App Make concurrent local external-payload directory creation idempotent #267: the update scenario leaves its timer-queue container running.

Navigation Menu

Repository navigation

Replace PHP Server with a compatible Rust runtime and safe in-place upgrade #325

Objective

Constraints

Repository and delivery

Contract, parity and embedded mode

Database isolation and one-way upgrade

Operations and performance

Work order

Acceptance

Ownership

391 remaining items

Repair select-member cancellation through the PHP worker HTTP route

Workflow 2.10.0 published component

16:20 UTC update

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Replace PHP Server with a compatible Rust runtime and safe in-place upgrade #325

Description

Objective

Constraints

Repository and delivery

Contract, parity and embedded mode

Database isolation and one-way upgrade

Operations and performance

Work order

Acceptance

Ownership

Activity

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

391 remaining items

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

Repair select-member cancellation through the PHP worker HTTP route

rmcdaniel commented on Oct 21, 2026

Workflow 2.10.0 published component

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

16:20 UTC update

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

rmcdaniel commented on Oct 21, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions