[rmcdaniel]

The service journeys selected Native 3.3.1. Pin the shared tuple to published 3.3.2 and verified index 4aeceb42…debf912, which includes bounded local-record batching and coherent workflow descriptions. Other published package versions stay unchanged.

Validation: all36source checks and30actual-main checks passed. The separately dispatched full runtime diagnostic passed all9surfaces and9PHP/Python/Rust workflow/activity combinations, signals/queries and all3task-codec refusal sets. Server publication/provenance, protected corpus, exact Compose, default resolution and published PHP replay/condition-wait checks passed on this digest. The separate developer-image publication42610919065 passed all7jobs. Both public registries serve index c6eceb45…308acfc; both embedded tuples match Git and both native startup qualifications passed. Consumer delivery is complete. No workload speedup is claimed.

Refs durable-workflow/server#325, durable-workflow/server#1068 and durable-workflow/server#1075.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Source qualification passed on exact head 2f4894854d211b2e01dd6c8a76692eee9655643b, tree 89d3a8dbcf00061ba1b28a3530eae58c5d812478, base 49e9636758604835eb56fb74d6b58576839380ed: 36 successful checks, 20 successful original-attempt workflows and zero statuses. All CodeQL analyses and its aggregate, both Sonar checks, candidate developer-image checks, published SDK recovery/timers and the required branch checks passed. The diff is one file, 859 bytes / SHA256 787d5c0c16e276b8ff8ea9e6b2c4896f6b91c2e9a460fa648e1e66507b70e720.

General selects one ordinary merge with this expected head after the fresh main/base/clean/draft/no-auto-merge/source guards. No admin override or check waiver. Verify signed ordered parents and the reviewed tree on actual main, then its terminal checks. Keep the topic until main is successful. Full runtime and developer-image publication remain separate effects; this does not promote Server aliases or create its GitHub Release.

[rmcdaniel]

#334 merged once at 11:19 UTC as 98e8b49d1e80375c03d2ee114532a5d1558d2fc2. The signature is valid, ordered parents are [49e96367, 2f489485], and tree 89d3a8db equals the qualified source. Current main is this merge; ordinary main checks are running and the topic is retained.

General selects one polyglot-validation.yml dispatch on this exact main tuple with full_runtime_matrix=true. It covers all nine runtime surfaces, every PHP/Python/Rust workflow/activity combination, signals/queries and the three task-codec refusal probe sets. The shared tuple selects published Server 3.3.2 at sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912 with the unchanged published SDK, Workflow, CLI and Waterline versions. Prior dispatch count on this merge is zero.

One original attempt, no retry or cancellation. Report by T0 + 50 minutes and keep any live run's status explicit. Source/main checks remain required before the separate developer-image publication. This dispatch selects no image publication, Server alias or GitHub Release change. Retain the bounded diagnostic through November 9 at 20:30 UTC.

[rmcdaniel]

Published-tuple full runtime diagnostic PASS: run42608211979, attempt1, exact merged main 98e8b49d.

All nine required surfaces passed with none skipped: CLI start/result, the featured workflow, four corners, the full workflow/activity language matrix, signals/queries, task-codec refusals, type matrix, typed errors and Waterline. All nine PHP/Python/Rust workflow/activity combinations completed. Each language's repeated queries preserved state and its signal round trip passed. All three task-codec probe sets rejected unsupported envelopes before handlers/completion. Rust actually executed, and Waterline assets matched the installed package.

The report binds this run/attempt and source, Server 3.3.2 at sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912, PHP SDK3.11.0, Python SDK2.14.1, Rust SDK4.12.0, Workflow2.22.0, Waterline2.13.2 and CLI2.3.3. Required and observed versions agree. The ordinary teardown step passed; this workflow emits no independent final resource-count receipt.

This completes the selected full diagnostic. It is not a benchmark or an unrun broad Server aggregate. Ordinary main checks and the rebuilt/published developer image are still owed before release follow-through. No alias or GitHub Release was changed.

[rmcdaniel]

Actual-main custody is accepted at11:39UTC: 98e8b49d1e80375c03d2ee114532a5d1558d2fc2, valid signature, ordered parents [49e96367,2f489485], tree 89d3a8db equal to the reviewed head. All30check runs and17original-attempt workflows succeeded, including16ordinary workflows plus the separately selected full runtime diagnostic. Zero statuses, failures or cancellations.

Full runtime acceptance binds all9surfaces and9language combinations, repeated signal/query state and48PHP/32Python/24Rust pre-handler codec refusals on the exact3.3.2 tuple. General selects one topic deletion leased on 2f4894854d211b2e01dd6c8a76692eee9655643b, after merged-PR, exact-main/remote-head and zero-open-PR guards. Local and inherited WIP refs remain. The separate developer-image publication is the next effect.

[rmcdaniel]

General selects one developer-image publication through devcontainer-image.yml on exact main 98e8b49d1e80375c03d2ee114532a5d1558d2fc2, tree 89d3a8db. Source #334, signed main custody and the full published runtime diagnostic are accepted; all30main checks and17original workflows passed. The source topic is deleted with its exact-head lease and absence readbacks; local/WIP refs remain.

The current main workflow bytes equal the reviewed source (blob f54e19c1a07ae1109a72f9af5f4769329770f4e3). Its existing protected publication environment builds immutable amd64/arm64 images, assembles one index, verifies anonymous provenance/SBOM identities and the existing security policy on both platforms, qualifies native startup/application tooling anonymously, then promotes only the developer-image main channel in GHCR and Docker Hub. No workflow, security policy, credential scope or branch protection change. Both embedded tuples must match Git's Server3.3.2 pin and unchanged packages.

Zero prior dispatches on this main and no active developer-image publisher. One invocation, no retry/cancel or duplicate dispatch; the existing concurrency behavior remains. Cross-registry writes are not atomic: a failed/partial/unknown outcome remains NONPASS. Retain the exact scan artifact, both qualification results, independent registry indexes and bounded copied-tuple readbacks before accepting delivery. Report byT0+90minutes, keeping any live state explicit. Public standard hosted runners and existing environments only. Raw diagnostic review/retention at20:30UTC.

This selects no new Server build/tag, Server alias promotion, GitHub Release or Cloud adoption. Those later release surfaces remain separate after affected-consumer acceptance.

[rmcdaniel]

Developer-image publication and independent readback PASS: 42610919065, attempt1, exact main 98e8b49d1e80375c03d2ee114532a5d1558d2fc2. All seven original jobs passed: both native architecture builds, index assembly, exact public SBOM/identity policy, both anonymous native startup qualifications and channel publication.

GHCR and Docker Hub main return byte-identical 1,613-byte indexes at sha256:c6eceb459ad78391ce9b82a45daa62ed665f0ae6ca19f0255802a79a7308acfc. Both platform manifests and their provenance/SBOM identities bind this source. Native startup qualification passed in103s (amd64) and96s (arm64), within the existing600s ceiling. No policy change or waiver; blocked findings=[] on both platforms, with existing component-negative and reviewed/unfixed dispositions retained. This is not blanket vulnerability clearance.

A bounded registry data read (no local image pull/load/execution) verified the exact copied473-byte tuple on both architectures, SHA256 e07c2c2d2110f80aec6d5522c5aa37adbdfa75d2c394ca85408932d5276da9fe, against Git. It selects Server3.3.2@4aeceb42 and the unchanged SDK/Workflow/Waterline/CLI versions. Security artifact13669414971 hashes to b874770326857befcbe5e63110503bbca414d42a9ff97685a9c6dc034091938f. Ordinary hosted teardown ran; no independent final host-resource-count receipt is claimed.

This completes #334's affected-consumer follow-through after accepted source/main custody and the full nine-surface runtime diagnostic. Source topic is absent; local/WIP refs remain. Server aliases and GitHub Release creation are still separate pending effects. Raw diagnostic review/retention is20:30UTC.