[rmcdaniel]

Adopts Workflow 2.27.0 (released and verified: https://github.com/durable-workflow/workflow/releases/tag/2.27.0) in English and all seven translations, with reviewed source hashes.

• stable-releases.json selects workflow 2.27.0.
• Compatibility: the current embedded line is 2.27, with unchanged floors and worker protocol 1.22. The upgrade-contract link points at 2.27.0, and there are 2.27 upgrade notes (no migration).
• Configuration → Which namespaces an app runs (new, workflow#889): DW_V2_NAMESPACES / DW_V2_ALL_NAMESPACES. When the list is set, it is the exact list, so include DW_V2_NAMESPACE itself. It's an execution-safety boundary, not tenant isolation.
• Monitoring → Metrics and health (workflow#1112): operator_metrics.namespace_scope_refusals and the advisory health check. Use a shared cache store. The English heading now carries the explicit {#stuck-run-metrics} anchor the translations already use.
• Child workflows → Cost of wide fan-out (workflow#892 item 3): from 2.27 a close costs a fixed number of queries. Guidance near the default pending_child_count of 1,000.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS at f32d41d (CI 14 green).

The docs, stable-releases and source-hashes changes are content only, with no scripts or workflows. Security-relevant wording:

• Namespace allowlist: the section states the boundary correctly. It stops one app running another app's work with the wrong code or credentials, and it explicitly isn't tenant isolation, since apps sharing a database can still read each other's rows. I spot-checked the same sentence in all 7 translations, and each keeps the "not tenant isolation" caveat. The safe defaults are documented: unset means only DW_V2_NAMESPACE, an empty list serves none, and * is refused.
• Version links: the upgrade-contract link and the stable-releases entry point at the 2.27.0 tag. I verified that tag earlier: 6a0aa6f2, tree identical to the reviewed #1119 head.
• namespace_scope_refusals: the shared-cache note is operational guidance, not a security claim.

If #525 merges first, a branch update whose only extra change is the sdk-php line doesn't need a re-review.