[rmcdaniel]

An activity signature change could replace recorded input with a DTO's defaults and record a successful but incorrect result. Published Workflow 2.11.3 refuses that binding before the activity body runs and preserves the authored retry policy.

Update the root and microservice Composer locks to normally published 2.11.3 at 71213ae1e0338cda5967e0840782a981530ed854, and match the existing embedded tuple field. Composer resolution changes only the Workflow package in each graph. The separate Server component identity and all other package versions and references retain their existing values.

Both Composer manifests validate, both artifact-graph checks pass, and diff validation passes. Core's published cold-process acceptance proves refusal before the body and same-original recovery under an authored retry policy. Sample's exact source checks, main qualification and published image verification remain required. The broader Core published Laravel/PHP profile is independently running.

Refs durable-workflow/workflow#910.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Delivered Core 2.11.3 consumer update at merge 40be451c020c6a0e8c9561585bcd96d38a352a75, exact reviewed whole tree 2f1253964ff8bb957494cb7d621bb023de95c298.

All 32 candidate checks and all sixteen independent main workflows pass, including real smoke on amd64/arm64, the portable SDK consumers, both Composer/application checks and immutable image publication/qualification.

Anonymous reads independently verify both ghcr.io/durable-workflow/sample-app-devcontainer and durableworkflow/sample-app-devcontainer. Their exact revision tag and main currently share this index:

sha256:dda92159af8323edb20d22017bfd1162f328213899fa7a8792e1ae61fd7e7eff

Platform	Immutable child manifest	Config
linux/amd64	sha256:5568b49fdfd2f88883f8c5b566d6e86a7ca493009f617da6dc5bac9d3624cc84	sha256:9a376b33ec9e044e6747812e50f62eddc65bd5738e9ed08041244d8ccfe64055
linux/arm64	sha256:051e6972e96592629ff86bf9c02f32fa976c1833ce773e07ab63ee81e253955c	sha256:0f50adde70658b2ef9b1d26eeac845721d64187d4d1c3b3ec98ba857fa85fd4c

Both actual config labels identify exact source 40be451c020c6a0e8c9561585bcd96d38a352a75, and response digests match the bytes read. This is published artifact verification, not a source-only or cached-tag claim.

Only the embedded Core pin/lock references and that tuple field change to 2.11.3. The separate Server component and every other selected package remain unchanged. The merged remote branch is independently absent. Workflow #910's published cold-process acceptance and Website #363's eight live localized guards remain their own evidence; no Server/native/Cloud adoption follows.