Canonicalize regression evidence identity across supported representations

[rmcdaniel]

Status Summary

The shared regression-corpus validator fingerprints representation details instead of one canonical execution identity in two supported paths. A golden-history replay case can be rewrapped as replay-regression-v1 with the same workflow input, history, and expected commands yet receive a different semantic digest. Codec wires are fingerprinted from Base64 text, while the advertised canonical check accepts distinct padded spellings that decode to the same bytes. Either representation-only change can increase a guarded corpus count without adding a new reproducer.

How to fix

Normalize every supported replay format to the same consumer-executed workflow/input/history/command/expected shape before duplicate comparison. Normalize codec wires to decoded bytes (or reject any spelling that does not round-trip to canonical Base64), including malformed-frame golden evidence. Keep protocol/runtime metadata out of duplicate identity unless an official consumer proves that it changes execution behavior. Propagate the same normalization to every participating repository-local validator.

Acceptance Criteria

• Rewrapping an existing golden-history case as replay-regression-v1 is rejected as duplicate semantic evidence.
• Distinct Base64 strings that decode to the same bytes cannot count as distinct codec evidence.
• Every accepted wire field, including malformed-frame golden cases, is valid canonical Base64.
• Adversarial tests cover both bypasses while genuinely new replay behavior and wire bytes still grow their respective corpora.
• Existing official PHP, Python, Rust, server, and workflow corpora continue to validate and execute through their normal consumers.

Delete when

Delete when all participating target branches use the canonical identity rules, representation-only additions fail qualification, and focused cross-format/canonical-wire regression tests pass.

Required source targets

durable-workflow/.github@main
durable-workflow/sdk-php@main
durable-workflow/sdk-python@main
durable-workflow/sdk-rust@main
durable-workflow/server@main
durable-workflow/workflow@v2

[rmcdaniel]

Cross-repository landing evidence (generated from trusted implementation pull requests or authenticated protected-branch completion records):
Completion source: 8066311d407842761e6a95893db1d897f6105719

Target	Latest attempt	Bound provenance	Landing	Required qualification	State
durable-workflow/.github@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	8066311d4078	Passed: Control-plane source qualification (check run 30518460324); cited qualification: legacy generic qualification cited run 30518460324	complete
durable-workflow/sdk-php@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	981519e03e3c	Passed: Target branch qualification (check run 30521166675); cited qualification: legacy generic qualification cited run 30521166539	complete
durable-workflow/sdk-python@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	e03edda95bc8	Passed: Target branch qualification (check run 30518130730); cited qualification: legacy generic qualification cited run 30518130708	complete
durable-workflow/sdk-rust@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	dcd0554f32bb	Passed: Target branch qualification (check run 30520080878); cited qualification: legacy generic qualification cited run 30520080899	complete
durable-workflow/server@main	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	1026cc8bc31f	Passed: PHPUnit feature suite (check run 30518027663); cited qualification: legacy generic qualification cited run 30518027665	complete
durable-workflow/workflow@v2	Authenticated protected-branch completion record	Authenticated lifecycle-writer record; exact commit revalidated on protected branch	844d54412577	Passed: build (check run 30520396723); cited qualification: legacy generic qualification cited run 30520396703	complete

Every declared target landing and required repository qualification is complete.

[rmcdaniel]

Cross-repository review confirmed the concrete legacy wire migration is correct, but the shared migration helper accepts any canonical Base64 replacement for a previously invalid malformed-wire spelling. That permits an immutable malformed corpus case to be rewritten to unrelated bytes instead of proving a representation-only repair. Hold completion until migration requires the canonical Base64 encoding of the exact legacy raw bytes, or an equivalently exact mapping, and an adversarial arbitrary-replacement case is rejected.

[rmcdaniel]

Release-gate update: the PHP (653982801df4) and Rust (edccbafe96ae) source fixes have passed public CI and clean post-merge audits. Workflow 659a0a5be106 passed public CI but remains incomplete: durable-workflow/workflow#412 covers malformed/conflicting inline-envelope identity, and durable-workflow/workflow#413 covers alternate valid Avro wires that decode to the same value. Both are P0 and must land with focused official-consumer evidence before this parent is eligible to close.

[rmcdaniel]

Source implementation landed in 8066311d4078 on main.

Required public qualification passed: https://github.com/durable-workflow/.github/actions/runs/30518460324

This issue remains open until its required public completion evidence is verified.

[rmcdaniel]

Required operational evidence passed in Source Qualification run 30518460324.

Verified push execution on main at 8066311d4078 contains landed source 8066311d4078.