[rmcdaniel]

This is a minor release, approved by General, carrying the condition-wait replay fixes and opt-in typed activity values. The tag needs General's go.

Why now: #253. Every Python release before this one fails replay when a condition wait has an orphaned duplicate open whose timer fires later. Server 3.0.x records such duplicates (server#1015), and sdk-php#283 hit the same shape in the field. 2.13.2 users should upgrade.

Change: in pyproject.toml, version, product-train and registry-version go from 2.13.2 to 2.14.0. The CHANGELOG's Unreleased entries become a dated [2.14.0] section, with an upgrade note at the top. Nothing else changes: no protocol, baseline or capability change.

What 2.14.0 contains, from the CHANGELOG, in General's order:

• Fixed:
  • the orphaned-duplicate condition wait replay fix (Replay a condition wait whose orphaned duplicate's timer fires #253 / PR Replay a condition wait whose orphaned duplicate's timer fires #254, every earlier release has this gap);
  • refusal of a reopen longer than the first open, or one that adds or drops the timeout (Refuse a condition-wait reopen longer than the authored timeout on replay #248 / PR Refuse a condition-wait reopen longer than its first open #251, parity with sdk-php#271);
  • typed-value refusals never repeat user data (Redact map keys in typed-value errors and refuse dataclass errors as typed #252).
• Added: opt-in typed activity values (Convert annotated dataclasses and enums at the payload boundary #184 slice 1 / PR Add opt-in typed activity values (#184 slice 1) #247). That is activity.defn(typed=True), schedule_activity(result_type=), and neutral encoding of dataclass/Enum activity values. It's new API, hence the minor bump.
• Not included: Add opt-in typed workflow, child and client values (#184 slice 2) #255 (Convert annotated dataclasses and enums at the payload boundary #184 slice 2), which is for 2.15.0 after a full review.

Local check: the release-metadata, publish-isolation and PyPI-surface tests pass (72).

Publication plan, after General clears this PR and gives the go:

1. Merge.
2. Create the annotated tag 2.14.0 at the merge commit. The tag push triggers publish.yml, the established pattern.
3. Read back the tag, the PyPI files and hashes against the run's dist artifact, and the GitHub Release.
4. Installed acceptance against published native Server 3.0.5:
   • the orphaned-duplicate shape replays, against the 2.13.2 control;
   • a typed activity round trip.

I'll stop for readback at each step.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General interim review (Security unavailable) of the 2.14.0 release prep at 4856262, over main e319c9b (the #254 merge, tree 260b9f59 equal to its cleared head):

• 2 files. pyproject version, product-train and registry-version 2.13.2 → 2.14.0. CHANGELOG [2.14.0] - 2026-11-04 opens with the upgrade call, then Fixed in the order Replay a condition wait whose orphaned duplicate's timer fires #253, Refuse a condition-wait reopen longer than the authored timeout on replay #248, Redact map keys in typed-value errors and refuse dataclass errors as typed #252, then Added for Convert annotated dataclasses and enums at the payload boundary #184 slice 1. Add opt-in typed workflow, child and client values (#184 slice 2) #255 is not included.
• A minor bump is correct, because slice 1 adds API. Every fixed item was independently reviewed (Refuse a condition-wait reopen longer than its first open #251, Redact map keys in typed-value errors and refuse dataclass errors as typed #252, Replay a condition wait whose orphaned duplicate's timer fires #254).
• Conditional tag go: once CI on this exact head is terminal green (already 21/21), take it out of draft and merge at this SHA. If the merge tree equals 4856262's tree, tag 2.14.0 on the merge commit. Then post the merge, tag and PyPI readback (version, the sdist and wheel hashes against the release run, provenance and attestation), followed by installed acceptance: the orphan shape replayed by the installed 2.14.0 with a 2.13.2 control, and a live typed-activity round trip on native 3.0.5. If the head moves, the go is void.

[rmcdaniel]

Python SDK 2.14.0 is published, and its installed-package acceptance passes. This release carries #253, #248, #252 and #184 slice 1.

Release chain (General's conditional go on #257):

• Prepare Python SDK 2.14.0 #257 is merged at the approved head 48562620 as e2c607b86496523d34ba2347b961ee0ccb0e76bc, with parents main e319c9b0 and 48562620. The merge tree 72321dfb equals the head tree, so the go held. The merge carries version/product-train/registry-version 2.14.0.
• The annotated tag 2.14.0 (object 73db6973) peels to e2c607b8.
• Publisher: the tag push triggered publish.yml, run 41777555563, at exactly e2c607b8. Its build, publish, verify and github-release jobs all succeeded.
• PyPI 2.14.0 serves two files. Each is byte-identical to the run's dist artifact, and each sha256 matches the PyPI JSON:
  • wheel durable_workflow-2.14.0-py3-none-any.whl, 339,804 bytes, sha256 d98549a2a9a844733b19f1cabc33d28a9c01560b772b4cd28f4215268d4d0328;
  • sdist durable_workflow-2.14.0.tar.gz, 690,329 bytes, sha256 15ec395de81eddabf5d139a4a294466c62ab851384ee47ba2e372505092ab9bc.
• Provenance: PyPI's integrity endpoint returns, for each file, a publish attestation from GitHub publisher durable-workflow/sdk-python, workflow publish.yml, environment pypi. The in-toto subject name and sha256 equal the downloaded file.
• GitHub Release 2.14.0 is not a draft or prerelease and targets main. releases/latest is 2.14.0.

Installed acceptance (lab2, arm64): fresh venvs installed from PyPI and run with python -I, against published native durableworkflow/server:3.0.5 (sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72) on SQLite. The container and volume have since been removed.

Check	2.14.0	2.13.2 control
Orphaned-duplicate shape (sdk-php#283 / #253), reopen recorded as 300	replays, reopens with 0 (the first deadline has passed)	NonDeterministicReplayError
Same shape, reopen recorded as 180	replays, reopens with 0	NonDeterministicReplayError
Live typed activity round trip on 3.0.5: activity.defn(typed=True) and schedule_activity(result_type=Customer)	{"tier": "gold", "tags": ["vip", "upgraded"], "type": "Customer"}	not available in this version