[rmcdaniel]

Python SDK 2.17.1 fixes replay when the runtime settles open activities at run close, refuses malformed static credentials before role selection, and adds the missing retained-update example to the developer portal's Client reference page.

The patch includes the reviewed changes from #306 and #312, plus #313's exact build/twine pins and wheel-only tool installation. Version, product train and registry version become 2.17.1, and the changelog records the two product fixes. The Client guide distinguishes a typed pending update from a completed None, preserves the update id, and uses read-only outcome retrieval.

Validation: the combined constructor/client/replay controls passed 1,257 local tests, Ruff, mypy and the regression-corpus validator. Each source PR passed its full 21-check suite and exact-head Security review; the release head runs the same checks after branch refresh. The current shared action policy and every workflow YAML parse pass locally. The documented methods were verified in installed PyPI 2.17.0 and the code examples parse.

After merge, create an immutable annotated 2.17.1 tag on the merge commit and publish through the protected PyPI workflow. Verify the installed package with the canonical credential fixture and replay regressions, then verify the deployed Client page. Sample App owns the broader corrected-Server tuple. The separate Server over-limit response-delivery defect remains tracked in server#1136 and .github#228; this patch makes no claim that it is resolved. Experimental timeout-cleanup parsing remains in #311.

[rmcdaniel]

Owner: sdk-python. The release draft contains the accepted replay fix and the portal Client example requested by the docs owner. Python examples parse and use methods verified in the installed 2.17.0 package. Next: merge reviewed #312/#313, refresh this branch and final changelog, then qualify its exact head before tag/publication and installed replay checks. #311 is excluded; server#1136 remains an explicit external aggregate-limit defect.

[rmcdaniel]

The full patch candidate is assembled at 640c262: run-close replay, static credential validation, wheel-only pinned package tools, and the retained-update Client guide. #312 has Security PASS and is merging; #313 is next in review. The final release qualification will refresh accepted main history while preserving this reviewed candidate tree unless a review requires a source fix.

[rmcdaniel]

Security release-diff review at 8d2565a5b63c5b0b80201275dbbd38e977fc9d5b: the assembled source is coherent, with final exact-head confirmation still required after #313 merges and this branch is refreshed.

Relative to the reviewed product and workflow changes, the new release-only delta is limited to:

• all three package identity fields moving together from 2.17.0 to 2.17.1;
• the dated 2.17.1 changelog heading over the reviewed replay-close and static-token fixes; and
• a Client guide for the already-published retained update-outcome API.

The guide matches the shipped API: update_workflow() returns a receipt; update_outcome() defaults to a completion wait, returns a completed value including None, and raises typed UpdateStillPending for pending work; callers retain update_id and read again without resubmission. It accurately covers raw receipt reads, continue-as-new ownership, failed/rejected/not-found/unrecognized outcomes, capability discovery, async/handle/sync parity, and no fallback admission.

#311's experimental timeout parser is absent. The #313 wheel-only package-tool delta is the exact reviewed tree, and the privileged upload job is unchanged. No release-diff Security blocker is present. This is not yet final tag authorization: after #313 merges, provide the refreshed exact head/tree and green required checks for the history-only countercheck.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS for exact head 8d2565a5b63c5b0b80201275dbbd38e977fc9d5b.

I rechecked this final release head against refreshed, reviewed #313 head 7f4738f7fe701f86f9f77e5c7c5a459348a5b555. The complete-tree delta is limited to the already reviewed release surface:

• pyproject.toml: the three 2.17.1 version identities;
• CHANGELOG.md: the dated 2.17.1 heading;
• docs/reference/client.md: the retained-update read guide (typed pending versus completed None, with no resubmission guidance).

That comparison is 3 files, 50 insertions and 3 deletions; there is no additional runtime or credential behavior beyond the reviewed #312/#313 tree. All required checks on this exact head are now green, including integration, package, docs portal, regression corpus, CodeQL/Sonar, public-boundary checks and target-branch qualification.

Approved course: merge #314 directly at this exact head and close #313 as incorporated, retaining #313's source evidence. This avoids a tree-identical ancestry refresh and another redundant full CI cycle. Any source change or head change requires counter-review before merge/tag.

[rmcdaniel]

Merged at the Security-approved 8d2565a head as c4ba1de. The merge tree is byte-identical to the reviewed head. Immutable annotated tag 2.17.1 now selects that merge commit and the protected PyPI publication path. #313 was incorporated directly, as independently approved by Security, preserving all checks and avoiding a duplicate CI cycle.

[rmcdaniel]

Published and installed acceptance for Python SDK 2.17.1 is complete for this patch's SDK changes.

• Immutable tag selects merge commit c4ba1de59d8bf12c42dd7a4904e308552d26b7f5; protected publication passed build, publish, registry verification and GitHub Release.
• A clean environment imported PyPI durable-workflow==2.17.1, with no editable SDK or source overlay. Its wheel SHA-256 is 90040cb28906985b227988815b1b53aa3079378673e35c689392ac71edaf7b35.
• 1,089 installed-package checks passed, using the exact tagged test checkout and the repository's pinned tracing test dependency: canonical static-credential vectors, run-close replay and worker refusals, the replay corpus, retained update reads and typed completion-size controls. The initial environment lacked the optional tracing test dependency; supplying it resolved that collection/runtime prerequisite without changing the SDK.
• The publication log confirms wheel-only build==1.6.1 and twine==7.0.0. The same pinned commands passed the ordinary package job, completing Pin build and twine versions in the package and publish jobs #303. Constructor validation and preserved empty/None/role behavior passed the shared fixture, completing Refuse static credentials with stray whitespace or control characters in Client (server#554) #304.

Stable portal workflow 43404716049 has built successfully and is deploying the tagged Client guide; live confirmation follows. Sample App owns the broader corrected-Server tuple.

The real oversized HTTP-response delivery defect remains open in server#1136 and .github#228. These installed typed-size tests use controlled responses and do not turn that published-Server nonpass into a pass. Python's live update-read and 300 × 10 KB results on Server 3.8.0 remain recorded above.

[rmcdaniel]

Live documentation follow-through is complete: https://python.durable-workflow.com/reference/client/#read-an-update-outcome contains the tagged retained-update guide. The public deployment-audit.json reports stable SDK 2.17.1, source c4ba1de and the matching published wheel digest. Stable portal workflow https://github.com/durable-workflow/sdk-python/actions/runs/43404716049 passed build and deploy. Docs and Sample App owners have the publication/installed evidence. #303 and #304 are closed with user-installable results; broader runtime follow-through remains explicit on server#1136/#1201 and .github#228.