[rmcdaniel]

Emit the Server-provided workflow/activity ready age as durable_workflow_worker_task_schedule_to_start_seconds when the poll advertises claimed_task_ready_age. Validate integer milliseconds against the portable bound, retain real zero, and omit missing/invalid values. Export only task_kind and task_queue labels; preserve existing public task struct layouts and recorder overrides.

Update the shared metrics fixture to revision 2 and extend the published Server test to require the new histogram. Eleven focused metrics tests pass, including malformed values, missing capability, zero, worker overrides and Prometheus output. Published Server 3.8.0 qualification follows before merge.

Closes #238.

[rmcdaniel]

Published Server qualification PASS at 898cb55 against native 3.8.0, exact index sha256:7988a23525d9e50e997a9f6f02e801300ed4f626de3cf6977033657ae7e9f58e / revision 28f084513235f6647e740c4b3d9e3aace7a323b7. Actual workflow and activity ready-age samples emitted with exactly two labels; a workflow queued before worker startup had a positive real age. All seven shared metrics and official Prometheus exposition passed, including activity success/failure and HTTP-error observations. Runtime container removed. The same check is now required in the existing Rust 1.86 CI job; next action is its green run and review before the next minor release. Owner: sdk-rust.

[rmcdaniel]

All checks, including Sonar, now pass at 3cb0d30. The runner now validates exactly one literal IPv4 loopback binding and valid port, refusing wildcard/remote/multiple bindings; six negative controls passed. No scanner rules were suppressed. The published-native metrics cell remains required in the existing Rust 1.86 job. Next action: Security exact-head review, merge and the following minor release with published-crate acceptance. Owner: sdk-rust.

[rmcdaniel]

Security source/runtime PASS for exact head 3cb0d3054f2a3dbd29966431076b941609c30cd3.

The revision-2 ready-age metric is correctly bounded and fail-closed:

• it emits only when claimed_task_ready_age is exactly true and task.ready_age_ms is an integer in 0..=2^53-1; missing, negative, floating, string, boolean and over-bound values are omitted, while a real zero is preserved;
• recording happens only after a workflow/activity task has passed claim/hydration authority and actually exists;
• labels are exactly fixed task_kind plus the requested task_queue; task IDs, outcomes and other high-cardinality/customer values are not exported;
• worker recorder overrides receive dispatch metrics while client request metrics stay with the client's recorder; normal, sticky and cooperative workflow paths plus activity claims are covered;
• Prometheus registers one histogram with the same two labels and no counter/outcome series.

The published-Server qualifier is also appropriately confined: exact native 3.8 index/revision/tag, inspected labels, random synthetic fixture credentials in a 0600 temporary env, read-only/cap-dropped/no-new-privileges container with CPU/memory/PID/tmpfs limits, and one validated 127.0.0.1:<valid-port> binding. Wildcard, remote, multiple and invalid bindings refuse. No Sonar rule is suppressed; the loopback validation resolves the prior HTTP finding. Cleanup removes only the randomly named owned container.

All 19 checks on this head are green, including the actual published native 3.8 workflow/activity samples, shared contract, Prometheus exposition, CodeQL and Sonar. No source blocker remains.

The PR is behind the current 4.15 main line, so refresh from main, preserve the reviewed feature diff and send the resulting exact head/tree plus required checks for counter-review. This remains a next-minor change and must not alter the frozen/published 4.15 package identity.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS for exact head e389b492dfff85eef1269bead29d091601060746 / tree c619499a5e2461da20889e081b99955493ab27f8.

I reviewed the complete revision-2 ready-age metric boundary and counterchecked the final refresh:

• runtime, parser, Prometheus adapter, tests and the published-Server runner are byte-identical to the already inspected 3cb0d305 source; the refresh adds accepted main plus the corrected shared-contract/README provenance;
• the vendored sdk-metrics-contract.json is byte-identical to .github revision-2 contract at 7a91906ece5cd599175a2e08ebcc9c8bc667a6f6 (SHA-256 081d98ec6f5f6e3812f81ddbe8d2589d75e7c6e457c580dc6631d7857594516a);
• emission requires the exact advertised claimed_task_ready_age capability and a bounded integer ready_age_ms; real zero is preserved, while absent, negative, fractional, string, boolean and greater-than-2^53-1 values are omitted rather than synthesized;
• workflow, sticky, cooperative and activity claim paths emit only after a real decoded claim, with exactly task_kind and application-controlled task_queue; worker recorder overrides remain separate from client request metrics;
• the Prometheus adapter adds only the histogram, with no counter or outcome/high-cardinality identity label;
• the qualification runner uses one literal digest-pinned native 3.8.0 image/revision, synthetic fixture-only credentials, resource/capability limits and an explicitly validated single 127.0.0.1 binding; wildcard, remote, multiple and invalid bindings refuse, and no Sonar rule is suppressed;
• all current exact-head checks are green, including both Rust versions, the actual published-Server qualification, package/docs/protocol, CodeQL, Sonar and target-branch qualification.

This is a next-minor source PASS only; it does not modify or retroactively widen the frozen 4.15.0 release. Any source/head change requires counter-review.