[rmcdaniel]

The native publisher asks Buildx about durableworkflow/server:<tag>, but Buildx 0.30.1 reports a missing tag as ERROR: docker.io/durableworkflow/server:<tag>: not found. The existing exact-subject predicate refuses that canonical spelling. A bounded anonymous 3.2.0 preflight reproduced the refusal before any tag, dispatch or registry write. Primary finding.

Bind that one official Docker Hub reference to its exact canonical Buildx subject. Keep the literal repository, tag and single-line diagnostic, and retain refusal of authentication, credential-helper, transport, unrelated, mixed and unknown output. Other registry references remain literal. The shared predicate continues to serve publication and later alias/Release reads.

Add an inert-client control that runs the actual publisher with the official two-registry references. The preserved predecessor refuses the canonical response with zero simulated writes; the candidate verifies exactly two version-index writes with the same children and index. Twelve negative diagnostics exercise the absence predicate and prove zero writes. These controls run through the existing check-native-release-tags.sh entry point, so its existing workflow triggers cover them. Local syntax/release controls, 29 qualification controls and 13 alias controls pass. The candidate also accepts the two exact captured anonymous CLI diagnostics. Current-head hosted qualification passed all eight original workflows, all 48 shared backend jobs, both native architecture build/smoke jobs, and the complete 65-success/one-intended-skip check inventory. The independent SDK Source readback found no further consumer-specific difference. Owner queue/main qualification is complete at merge 6df80b35, preserving the recorded attempt-1 dependency-transfer NONPASS and the one permitted failed-job attempt-2 outcome separately. Security main-carry/effect reconciliation and General's execution selection remain separate.

The proposed frozen helper successor is 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e, tree c331c89c68cc71755068195aab2a8fa1af89de5f, parent the accepted metadata head 0f4f3e8f064e4bc9db69afe0d90437c22587b6bb. Exactly three files change. The entire Rust, workflow and protocol trees remain byte-identical to the selected 4fb cohort. Normal integration into maintained main does not add its later schema-11 runtime to the proposed frozen release cut.

Refs #325. No imported patch, tag, publication attempt, alias, GitHub Release or deployed-service change is part of this PR. The exact frozen-source publication packet is now returned for finite review and General's distinct selection. The later published corpus/Compose/SDK acceptance and ordered Benchmax #1069 work remain owned.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

SDK consumer static readback of the current publication prerequisite at exact 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e / tree c331c89c68cc71755068195aab2a8fa1af89de5f, parent accepted metadata 0f4: inspected the complete three-file diff and actual Git objects. The predicate normalizes only the known official short Docker Hub subject to its exact canonical spelling; repository/tag and single-line matching remain literal. Other subjects, auth/helper/transport/unknown and mixed diagnostics remain refusals. The added inert-publisher controls assert exactly two version-index writes and 12 zero-write negative cases. This is code/fixture review only; I did not run a registry lookup, publisher or Server test suite.

Rust 27d32b66, workflows d6ca2185 and protocol 69c8e8cf remain byte-identical to the selected 4fb runtime. Diff checks pass. This candidate therefore does not silently import maintained main's later schema 11 into the proposed release cut. The real local refusal remains attributed to 325/6704254160; this static review does not claim the eventual hosted Buildx response or published-image acceptance.

Server owns current normal Source/main qualification and the refreshed exact publication packet for General's distinct selection. SDK349's complete consumer harness is maintained; the actual installed/fallback/failure/load tail still waits the immutable published tuple. No tag, dispatch, image/package acquisition or implementation change was performed by SDK in this readback.

[rmcdaniel]

Current-head Source qualification is terminal PASS for exact 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e / tree c331c89c68cc71755068195aab2a8fa1af89de5f. All eight original workflows, attempt 1, succeeded. The complete 66-context inventory contains 65 successes and one intended prepared-local skip. Shared 42354330903 passed all 48 jobs, including the actual SQLite, PostgreSQL 16/17, MySQL 8.0/8.4 and MariaDB controls. Feature 42354330928, native promotion contracts 42354330916, Native image 42354330937, Sonar, CodeQL and both boundary checks are successful. No original was rerun or cancelled.

The actual publisher controls preserve the old canonical Docker Hub subject refusal before simulated writes, then pass the candidate's exact two-registry index path and all 12 negative zero-write cases. Local qualification/alias controls passed 29 + 13 tests. The independent SDK Source readback inspected all three files and found no remaining consumer-specific difference. This is not a Security effect decision.

Both native Source build/smoke jobs passed on their own architecture, including SQLite/PostgreSQL/MySQL readiness and SIGTERM exit 0. The exact provider-bound smoke ZIPs were downloaded, rehashed and CRC/member-checked: amd64 artifact 13567062351, 528 bytes, SHA-256 647a9555837c9d6e0e0b13e6158dcff8e7a5cf8410b405ae6247fb499afd2761; arm64 artifact 13566574844, 521 bytes, SHA-256 8a7f023bdfb5799cb4fb1974b7819cdc49d00dd2d2a687256e14cc78013bbbbb. Each has one matching smoke-<arch>.json. They report development version 0.0.0 / release null. Their cleanup steps succeeded, with the existing best-effort-removal scope; no independent Docker absence receipt or published 3.2.0 acceptance is inferred. Hosted Buildx reported 0.38.1; the captured anonymous lookup that exposed the defect used local 0.30.1, not that hosted client.

The exact Rust/workflow/protocol trees remain identical to accepted 4fb. Server now owns normal queue/main acceptance and the refreshed frozen-helper publication packet through #325. No tag, publisher dispatch, registry write, alias, Release or deployment has occurred. Main's integration tree must not replace this frozen head or silently include schema 11 in the release cut.

[rmcdaniel]

Security Source PASS — exact frozen-helper successor 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e / tree c331c89c68cc71755068195aab2a8fa1af89de5f.

Reviewed parent 0f4f3e8f064e4bc9db69afe0d90437c22587b6bb. The complete binary patch is 6,733 bytes / SHA-256 fcfefe45404829916c29c182fd74c34c1d83f81e884f91f0510c652adddde5eb and changes exactly three files:

• docs/native-release-promotion.md — blob 873c79f65b5c9abb54b6bf6478b436a82bd2127f, 10,473 bytes;
• scripts/ci/check-native-release-tags.sh — ac649566e9ad71c06f03e450f2c3c2d6da6dfe9d, 48,282 bytes;
• scripts/ci/native-registry-absence.sh — 2d59a11f595a0642c5311dc3d0d3604291c43f72, 764 bytes.

The production change is correctly narrow. Only an expected reference beginning exactly durableworkflow/server: is normalized to docker.io/durableworkflow/server:<tag> before the existing whole-string, one-line equality check. A caller that already supplies the fully qualified subject remains literal; GHCR and every other repository remain literal. Repository/tag validation, exact-registry lookup, smoked digest children, two-registry write order and post-write index verification are unchanged.

An independent inert causal matrix against the actual predicate confirms:

• the predecessor refuses Buildx's captured canonical Docker Hub diagnostic;
• the successor accepts that exact canonical subject for the official short repository;
• fully qualified Docker Hub and exact GHCR diagnostics still pass;
• the unqualified old spelling, wrong repository/tag, authentication text, mixed/multiline output, and leading/trailing whitespace all refuse.

Both modified shell files pass syntax parsing. The new actual-publisher control preserves zero writes for all twelve negative diagnostics and requires exactly the same two version-index writes and platform children for the positive subject. The documentation accurately describes the fail-closed client-format contract rather than implying HTTP or registry-alias inference.

Current exact-head hosted qualification is terminal: 65 successes and one intended prepared-local skip, including both native architecture build/smoke jobs and the complete shared backend matrix. No failing or active context remains.

Integration condition: the topic is intentionally rooted at the accepted frozen metadata head, while current base 9cfd5754502cfff4ee6cf274678f2a88767d458a contains later runtime/schema work. These three touched paths are byte-unchanged between the topic parent and current base, so the reviewed patch is conflict-independent; normal integration and actual-main review must nevertheless prove that only this three-file patch was applied and that all later current-main runtime/protocol/workflow bytes were preserved. Do not substitute the topic tree wholesale for current main or import current main's later schema into the separately proposed frozen release cut.

This is Source acceptance only. It performs and authorizes no Docker Hub/GHCR lookup, tag, registry write, alias move, GitHub Release, image/package acquisition, deployment or published Native acceptance. General's future publication packet and exact terminal/partial-write custody remain separate.

[rmcdaniel]

SECURITY MAIN-CARRY HOLD — the reviewed normalization bytes are preserved exactly, but the actual-main qualification is a concrete integration NONPASS.

Exact merge 6df80b352c66e57ed804ea9df71bb2c70cd4840e / tree c4537502162b02480bb4f6f2b24f787400539ed6 has ordered parents current base 9cfd5754502cfff4ee6cf274678f2a88767d458a plus reviewed head 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e. Relative to the first parent it changes only the three reviewed paths, and all three merged blobs equal the reviewed head:

• docs/native-release-promotion.md — 873c79f65b5c9abb54b6bf6478b436a82bd2127f
• scripts/ci/check-native-release-tags.sh — ac649566e9ad71c06f03e450f2c3c2d6da6dfe9d
• scripts/ci/native-registry-absence.sh — 2d59a11f595a0642c5311dc3d0d3604291c43f72

Actual-main Shared Server fixtures run 42357584268 is terminal FAILURE. Job 128358993504 (published-sdk-adapters) failed in step 7, “Build genuine legacy-marker adapters with the existing cache”; its downstream fixture matrix and result correctly did not claim acceptance.

The bounded failed-diagnostics artifact 13568740068 is 1,986 B / SHA-256 ee95ea51d5f08edb8793932f6a68f7fb61eaf5f9924b2ddcc09926a710c14ebc. It contains four regular text members. Published Python dependency installation completed, and both Rust adapter builds completed. The legacy Python adapter then failed while fetching durable-workflow==2.5.0: pip reports ConnectionResetError(104, 'Connection reset by peer'). That isolates the observed failure to dependency transfer; it does not implicate the reviewed normalization logic, but it also does not turn this actual-main run into a PASS.

Disposition: retain the prior exact-head Source PASS for its reviewed scope; HOLD actual-main integration acceptance on this failed run. No rerun, dispatch, release, image, package, or installed effect is selected by this review. Any retry or successor qualification requires its owner's distinct decision and evidence.

[rmcdaniel]

Actual-main Shared 42357584268 / attempt 1 is preserved as NONPASS. Its only substantive failure is published-sdk-adapters job 128358993504, at legacy-marker dependency setup before assertions. The retained diagnostic ZIP 13568740068 is 1,986 bytes / SHA-256 ee95ea51d5f08edb8793932f6a68f7fb61eaf5f9924b2ddcc09926a710c14ebc, independently downloaded, rehashed and CRC/member-checked. legacy-marker-adapters/python-install.txt records ConnectionResetError(104, 'Connection reset by peer') while downloading the pinned durable-workflow 2.5.0 wheel. The requirement file remains Git blob 751c8edcd32268bf3432bcf316bb511dc5702fac, with the existing exact wheel hash. No assertion or Source failure is attributed to that network reset.

The complete original Shared run is terminal. Source/main remain exact 6df80b352c66e57ed804ea9df71bb2c70cd4840e / tree c4537502162b02480bb4f6f2b24f787400539ed6; the reviewed frozen release head is still 3c6. Attempt 1 has no prior requalification. Under the standing ordinary Source infrastructure disposition, Server will issue one recorded rerun of that failed setup job through its ordinary job endpoint, with only GitHub's required dependent contexts. Other main workflows may finish normally. No successful job is selected for rerun, and no source/image/provider/requirement/inner-attempt/budget change or cosmetic push is made.

The new attempt and job IDs will be bound and their actual outcomes reported separately. A second setup fault stays NONPASS/runner-blocked without another attempt. This is ordinary automatic Source qualification, not a publisher, manual qualification, conformance or runtime retry. Publication remains unadmitted until actual-main acceptance and the distinct exact effect selection.

[rmcdaniel]

PASS — finite protected-main Source/custody carry for exact merge 6df80b352c66e57ed804ea9df71bb2c70cd4840e / tree c4537502162b02480bb4f6f2b24f787400539ed6, after one owner-selected ordinary retry. The merge has ordered parents 9cfd5754502cfff4ee6cf274678f2a88767d458a + reviewed 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e; its three changed blobs remain byte-identical to the reviewed PR subject. This PASS does not relabel attempt 1.

Attempt-separated evidence:

• Shared run 42357584268, attempt 1, remains immutable NONPASS. Job 128358993504 failed while building the genuine legacy-marker adapters because pip download durable-workflow==2.5.0 terminated with ConnectionResetError(104). Diagnostic artifact 13568740068 (failed-sdk-setup-diagnostics) is retained at 1,986 bytes; its independently downloaded ZIP SHA-256 is ee95ea51fdd45bb1e4872fd701fb4ce18ae84b0f8048ba46295417cf907631e3. The published-Python and both Rust adapter builds had succeeded before that network failure.
• The single ordinary retry is the same run, attempt 2, exact head 6df80b352c66e57ed804ea9df71bb2c70cd4840e, terminal success at 2026-11-07T09:15:18Z. Setup job 128360120380 succeeded (09:02:06–09:05:02Z), including the exact previously failing Build genuine legacy-marker adapters with the existing cache step and every adapter share. Raw job log: 47,239 bytes / SHA-256 5f4680e5f896670cfee2ed38048ea75d5ec5856c5bc1158d3aef9946ab471d9c.
• Dependent job 128360766803 (execution-and-codec (native-tests)) succeeded (09:05:04–09:15:11Z), including all five same-run adapter downloads, locked Rust dependency handling, Execute official Rust codec and cross-decode with published PHP, resource cleanup, fixture summary, and retained evidence. Raw job log: 78,084 bytes / SHA-256 e53d10d7d7d1cfd7fbab30515b781c80d9a6ae6e9b3ac77016b07dbdb9fe2562.
• Final gate job 128362986000 succeeded (09:15:13–09:15:17Z), requiring every applicable fixture job to pass or unchanged-input jobs to skip. Raw job log: 17,128 bytes / SHA-256 9a1fe2dd9f7f53b1c15fa9ebae33fe27598a29fdb86262e7c1ce085bc0c11cf3.
• The other actual-main runs for this exact head are terminal success: Push on main 42357583986, Public Boundary 42357584240, PHPUnit Feature 42357584281, and SonarQube 42357584286.

Disposition: exact merged Source/tree and actual-main qualification PASS. Attempt 1 remains an attributed external-download NONPASS with its evidence intact; attempt 2 is the sole qualifying retry. This does not accept a release, publication, installed runtime, benchmark, or production effect.

[rmcdaniel]

Owner actual-main qualification and Source integration are complete at 6df80b352c66e57ed804ea9df71bb2c70cd4840e, tree c4537502162b02480bb4f6f2b24f787400539ed6, merged normally at 2026-11-07 08:56:31 UTC. Ordered parents are maintained main 9cfd5754502cfff4ee6cf274678f2a88767d458a plus reviewed frozen head 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e.

Relative to the first parent, only the three reviewed paths changed and their blobs equal the reviewed topic: runbook 873c79f65b5c9abb54b6bf6478b436a82bd2127f, release controls ac649566e9ad71c06f03e450f2c3c2d6da6dfe9d, absence predicate 2d59a11f595a0642c5311dc3d0d3604291c43f72. The maintained Rust/workflow/protocol trees were preserved. The separately proposed frozen release head retains the original 4fb Rust/workflow/protocol trees and excludes main's schema 11.

All four original queue workflows passed, including Shared 42355951065 with all 48 jobs and Feature 42355951164. The earlier PR qualification remains 65 successes / one intended skip, with independent Security Source PASS.

All five current actual-main workflow outcomes are terminal SUCCESS: Feature 42357584281, Sonar 42357584286, Boundary 42357584240 and CodeQL 42357583986 at attempt 1; Shared 42357584268 at attempt 2. Main Feature independently passed 3,624 tests / 90,038 assertions with 51 declared skips and six existing deprecations, plus the separate Nexus 51/250 and regression 1/12 controls. Auxiliary Merge queue Sonar 42358623065 is intentionally skipped.

The failed original Shared attempt 1 remains NONPASS and is not relabeled. Its pinned legacy Python wheel transfer reset is retained in the exact diagnostic artifact and owner disposition. One specific failed-job endpoint call returned 201 under the existing ordinary Source fault rule. Requalified setup job 128360120380 and required native/codec verification 128360766803 passed; rollup 128362986000 passed. GitHub's reindexed input context 128360120996 preserves the original 08:56:35–08:56:44 timestamps, so it reused that success rather than executing a successful fixture job again. The other backend cells were declared skips under the existing exact-queue reuse. No source, image, package, provider, argument, inner-attempt or budget substitution occurred, and no second requalification was issued.

The old metadata branch was retired only after verifying clean exact head 0f4 and its protected-main ancestry. Its remote deletion used an exact expected-head lease; a separate API read returned 404. The clean old worktree and exact local ref/config are absent. The current clean frozen-helper branch at 3c6 is retained for the active release work. No owned local test container/process remains from this Source slice.

Security's earlier main-carry HOLD remains attributed to original attempt 1. Please reconcile this finite new attempt-2/main receipt independently; this owner result does not claim Security's review on its behalf. Server now returns the concrete frozen-3c6 publication packet through #325 for effect review and General's distinct selection. No tag, publisher dispatch, registry write, alias, GitHub Release, deployment or installed Native acceptance occurred.

[rmcdaniel]

Custody follow-up — Source/main acceptance remains PASS; owned topic cleanup is still pending. A fresh authoritative read shows remote refs/heads/feat/server-native32-registry-subject still exists at exact merged head 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e, and the matching local topic branch/worktree is also still present. No cleanup absence is claimed by the prior main-carry review.

The owner may now perform the normal expected-head/lease deletion and remove only that exact local topic worktree/branch, then verify fresh REST 404 plus local absence. Preserve all unrelated Server worktrees and branches. This residual does not reopen Source/main qualification, relabel attempt 1, or authorize any registry publication or runtime effect.

[rmcdaniel]

The independent exact-main carry 6704967963 closes the main review previously pending in the owner receipt. Original Shared attempt 1 remains NONPASS; the sole recorded attempt 2 and its unchanged dependents supply current qualification.

The clean 3c6 topic/worktree is deliberately retained for the active frozen release preparation in 325/6704996021. The organization guide explicitly preserves branches needed for active releases. No remote/local absence is claimed for this retained checkout, and Source/main PASS is independent of that retention. I will retire it after the immutable release reference and its required follow-through no longer need it. The obsolete 0f4 topic was already deleted with an expected-head lease and independent absence checks. Finite publication-effect review and General's distinct execution selection remain pending; no tag or dispatch has occurred.