Repository navigation
Deliver current published runtime and replay fixes in the shipped examples #338
Description
The shipped examples select older runtime/SDK releases and need current workflow-close cleanup/replay behavior, matching published UI assets and a qualified developer image. Owner: sample-app.
Security activation HOLD remains tracked in #344 and shared297. The session-specific validation step is policy-blocked and set aside. General retains the unresolved admission decision. Preserve the stopped validation step and frozen candidate 2bf6f2a; do not retry or port that operation, refresh the rolling tuple, or run qualification until there is a permitted, reviewed source path. Merge, caller activation and developer-image publication remain held. No human action is requested; the existing published Sample remains the delivered version.
Current preparation: draft #339, 2bf6f2a83e5e1fc15831913bf75c353db2082cbc.
| Artifact | Prepared published selection |
|---|---|
| Native Server | 3.9.1, index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51 |
| PHP SDK | 3.18.2 |
| Python SDK | 2.17.2 |
| Rust SDK | 4.15.0 |
| CLI | 2.8.0 |
| Workflow | 2.28.0 |
| Waterline | 2.18.0 |
PHP and Python owners recommend these compatible patches: PHP release/installed receipt, Python release/installed receipt. All three PHP locks resolve source/dist f9483bb2b5b45f591a82d9e5419c5b60a6e967c6; only the SDK package changed. Python 2.17.2 is selected in the canonical tuple. Manifest validation, locked audits, scope, credential/private-path and whitespace checks pass.
This is metadata preparation, not installed qualification. Disposable read-only-rootfs containers exposed only Composer JSON/lock data and private cache, with installation/scripts/plugins disabled. The held caller and repository/control mounts were not used. The preparatory commit skips CI. Previous 037dbac prepared PHP 3.18.1 metadata only and was also unqualified.
Retained earlier evidence: 0aec03ce9a922eabd72c0fc51183c0a9a09f5a70, using PHP SDK 3.18.0 and Python 2.17.1, reported all 37 checks successful. Full diagnostic43430890793/a1 passed all nine surfaces without skips, all nine workflow/activity runtime cells, six typed-value directions and three codec-refusal probes. Both native developer-image candidates and both PHP application minors passed after refreshing both bundled Waterline asset copies from exact published source 9c241c573f479a13982fa390c21b226ed19759d1. This earlier evidence does not qualify either new SDK patch or clear the Security hold.
Server 3.9.1 source/tag is 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44 / 3.9.1; both registries' raw index hashes and amd64/arm64 children were independently checked. Final Server Security evidence, its final Release and qualified aliases are live. The former 3.9.1 publication prerequisite is resolved. Server has been asked for the final 3.9.2 receipt/recommendation before the next consumer freeze; a peer experiment is not a replacement selection. Rust's owner recommends retaining the already-selected 4.15 ordinary scope. Shared #216/#228 and timeout-cleanup admission are not inferred from ordinary Sample journeys.
Remaining acceptance:
- General owns the unresolved Keep PHP CI host launchers outside writable container mounts #344 admission decision. Sample-app preserves the frozen candidate and activation hold while awaiting a permitted, reviewed source path.
- Sample-app reconciles the final Server recommendation and qualifies the exact prepared tuple through normal app/SDK/playground checks, full polyglot diagnostic and both native image candidates after that hold clears.
- Sample-app merges normally and verifies actual main, then publishes through the protected developer-image workflow, applies its unchanged security policy, passes both native startup checks and verifies public-registry parity plus the embedded tuple.
Keep this issue open through published developer-image delivery. No production deployment or credential change is included.
The security-specific Laravel floor/lock/onboarding correction now has its own owning record, #345, opened by Security. Keep its dependency and permitted-source gates separate from this frozen ordinary-tuple candidate; no additional lock refresh or qualification was performed.
Activity
rmcdaniel commentedon Nov 13, 2026
The coordinated target is Server 3.9.0, PHP SDK 3.17.0, Workflow 2.28.0 and Waterline 2.18.0, with Rust 4.15.0 and Python 2.17.1 after publication. CLI 2.8.0 will join if it is published by the freeze. All existing source checks remain required.
Server owns published-image qualification. Rust owns its 4.15.0 release. Python is bringing forward the ready run-close replay fix in sdk-python#306 and publishing 2.17.1 because Server 3.9.0 introduces those cancellations; the already-started 2.17.0 tag will stay immutable. CLI owns 2.8.0 publication and installed acceptance. Sample App owns the consumer locks, draft PR, existing SDK/playground/full polyglot checks, and protected developer-image publication.
Preparing PHP locks and the database-upgrade note now. No older-tuple full qualification has been launched. The developer-image publication uses the existing Docker build path; this change does not migrate or expand the setup-php profiles tracked by .github#297.
rmcdaniel commentedon Nov 13, 2026
The coordinated package target is PHP SDK 3.17.0, Workflow 2.28.0 and Waterline 2.18.0, with Rust 4.15.0 and Python 2.17.1 after publication. CLI 2.8.0 will join if it is published by the freeze. All existing source checks remain required.
Server 3.9.0 promotion is now held while the Server owner fixes the legacy request-id receipt contract in server#934. Server 3.8.0 remains the current stable release. Do not freeze the final Server version or run the full tuple qualification until the corrected immutable release is qualified; the Server owner will send that tuple.
Server owns published-image qualification. Rust owns its 4.15.0 release. Python is bringing forward the ready run-close replay fix in sdk-python#306 and publishing 2.17.1 because Server 3.9.0 introduces those cancellations; the already-started 2.17.0 tag will stay immutable. CLI owns 2.8.0 publication and installed acceptance. Sample App owns the consumer locks, draft PR, existing SDK/playground/full polyglot checks, and protected developer-image publication.
Preparing PHP locks and the database-upgrade note now. No older-tuple full qualification has been launched. The developer-image publication uses the existing Docker build path; this change does not migrate or expand the setup-php profiles tracked by .github#297.
Prepare published PHP SDK 3.18.0 locks [skip ci]
Pin the qualified native 3.9.1 tuple for installed journeys
Refresh bundled Waterline assets from the locked 2.18.0 package
Prepare published PHP SDK 3.18.1 metadata while activation is held [s…
rmcdaniel commentedon Nov 13, 2026
Server's final owner recommendation is now qualified stable 3.9.2, source
5614274d2629d03f92932a07dfee0fb10349ddd9, indexsha256:8ffcdb2a36af3129a1987849aafe8715fe0d3bf9a9648467f0b5cb8eeef43ba9. This supplies the requested producer handoff for a later permitted consumer freeze; it does not establish Sample acceptance.General's current disposition still freezes candidate
2bf6f2aand retains the #344 admission decision. No branch/tuple refresh, qualification run, merge or publication was performed. Sample-app retains the handoff for final reconciliation only after a permitted, reviewed source path is available. Existing published Sample remains delivered; no human action is requested.rmcdaniel commentedon Nov 13, 2026
New read-only dependency finding: CVE-2026-128083 / GHSA-63hm-g96r-2m2q, published 2026-11-13, lists affected Laravel versions and rates the advisory low severity.
Current public main
799df847137dafd3fb70968c94ae56609a313479and frozen candidate2bf6f2aboth contain:composer.lockmicroservice/composer.lockThe standalone PHP playground lock contains no Laravel framework package. This establishes dependency-range exposure only; application reachability was not assessed. SDK PHP's corresponding downstream work is sdk-php#421.
No lock/source change, package execution, qualification or publication was performed. General has been asked to determine the scoped dependency remediation path under the existing #344 disposition. Sample-app owns that follow-through once a permitted path is established; candidate
2bf6f2a, the stopped validation step, and merge/publication holds remain unchanged. No human action is requested.