[rmcdaniel]

Advances durable-workflow/.github#228 and durable-workflow/server#1136.

Published SDK 3.17.0 rejects a valid 300×10 KB fan-out before HTTP when native external storage is unconfigured: its planner applies the ordinary 2 MiB request limit to a completion batch. This consumes the agreed additive limits.max_workflow_task_completion_bytes only for workflow completion, retaining ordinary/per-value limits and conservative behavior for older producers.

With an explicit aggregate limit and explicitly unconfigured/disabled/unsupported storage, individually valid payloads are submitted inline once. Native accepts the batch or returns its typed aggregate refusal. Configured-storage transients and failure-report limits keep their behavior. Malformed aggregate metadata refuses completion planning without changing ordinary endpoints.

Validation: 118 payload-upload tests / 477 assertions and focused PHPStan pass. Seven core controls fail against the prior planner. Tests cover HTTP byte counts, typed413 size, no upload/retry, configured offload, per-value bounds, worker-policy cache isolation, missing manifests, old producers and malformed discovery. Updated to merged main after #404; source checks rerun.

Delivery remains pending Server1136 publication plus installed real-Worker within/above-limit acceptance. This draft makes no delivery claim on current native3.8.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Current review head43f63c40f737c6c8f2dba63333eef432500459d1 is updated to merged main after #404. Runtime scope is unchanged; added controls for configured offload above the explicit aggregate cap and missing transport manifests. Local suite now passes118 tests/477 assertions plus focused PHPStan. Seven original core controls fail the old planner. Security has this head. Source merge/release is not full delivery: Server1136 must publish its confirmed field, then sdk-php runs actual installed Worker within/above-limit acceptance.

[rmcdaniel]

Security source/authority review: PASS for exact head 43f63c40f737c6c8f2dba63333eef432500459d1.

The aggregate limit is scoped correctly. Discovery caches the optional value but validates and applies it only on the exact workflow-task completion route; ordinary requests retain max_payload_bytes, and older producers keep the conservative fallback. An inline completion is allowed only when the Server explicitly advertises a positive integer aggregate limit, no failure-report request cap applies, storage is explicitly unconfigured/disabled/unsupported, and every encoded value fits the ordinary payload bound. Configured/unavailable/unknown storage continues through the existing offload/refusal planner. The client submits the inline completion once, so the Server may accept it or return the existing typed, non-retryable aggregate 413; there is no upload or retry side effect. Malformed limit metadata fails closed only for completion planning.

The controls cover cache isolation, configured offload, individual-value bounds, actual serialized HTTP size, failure-report preservation, old/missing producers, all three explicit no-storage states, typed 413 size, and no retry. All current-head checks are successful across PHP 8.1–8.4, the focused/runtime suites, regression corpus, CodeQL/Sonar and target-branch qualification.

This is source acceptance only. It is not a delivery claim for native 3.8 and must not be released as qualified behavior until Server #1136 publishes the exact producer and an installed real-Worker within-limit/over-limit acceptance proves the end-to-end path. Merge only this exact head; any base/source change needs countercheck.