[rmcdaniel]

The default native image advances from Server 3.9.2 to 3.10.0, requiring every backend to stop replicas, back up state and explicitly upgrade its schema. Chart 2.0.0 follows the existing operator-action major rule. Templates and values keys remain compatible; the major boundary is the database operation and restore-required rollback.

The five-file change updates the authoritative chart/app record and generated defaults, image example, changelog and migration notes. SQLite moves 13→14, PostgreSQL/MariaDB 14→15 and MySQL 15→16. Existing schedules retain unavailable dispatch authority until a valid owning transition. Dispatch outcome, buffer count and latest workflow execution remain separate. PHP stays 2.11.8.

The complete technical packet records 19 successful exact-head checks/eight intended skips, exact Security source PASS, fully qualified native 3.10.0 and scoped customer upgrade evidence. The concrete maintainer major decision is recorded under the accepted organization release policy.

Merged normally at 00f20996a18d4795fa0a09319470df1f5160c079; its full tree 87a096affb3a92aeb9d6c4c066e99f4944e80163 equals reviewed ac22629c exactly. Completed remote/local topic branches are deleted and remote absence verified. Protected Helm publication 43487220214 and anonymous clean install passed. Final receipt and independent final Security PASS bind public OCI manifest sha256:182616f8edbaf056b2f6047fd1501e0790ec5087c42470b03ad5d2c8b89cd67b, package sha256:1b5a550b2f65c60c2ffe4c2d975c9578106abc6fe8396c31b1e41d1cf94aac7b and exact source revision ac22629c. All 28 packaged files match accepted source, and the public package equals the retained artifact package. Docs #539 and Waterline #310/#222 adoption remain separate under #1014. No #1204 fix, draining-upload/Cloud adoption or full shared #216/#228 claim is inferred.

[rmcdaniel]

Security exact-source/chart review of 11c091808e59979197c024cb2d7f690cc6c2de3d: HOLD for one contract inconsistency.

The five-file scope is as stated, and the 3.10.0 image identity, four backend schema increments, stopped-replica/backup/restore boundary, dispatch-summary distinctions, retained protocol versions, and excluded downstream authorities agree with the accepted Server source and release notes.

The proposed chart version conflicts with this chart's checked-in semver contract, however. docs/UPGRADING.md says:

• chart MAJOR is required when “a default was changed in a way that requires an operator action”; and
• chart MINOR is for “forward-compatible defaults” where “existing values keep working without changes.”

This PR changes the default native image from 3.9.2 to 3.10.0, while its new migration section requires every backend to stop all replicas, back up the database and external payload storage, explicitly run schema-upgrade, and restore the backup to roll back. It nevertheless changes chart 1.7.1 to 1.8.0. The later statement that crossing a Server minor requires “at least a chart MINOR” does not waive the stricter operator-action rule.

Please either select a chart-major version or introduce a separately reviewed, explicit semver-policy exception for this kind of appVersion migration before retaining 1.8.0. Existing historical version choices do not silently amend the published rule. No chart merge/publication or downstream selector approval is granted at this head; native 3.10 publication/promotion remains a separate gate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact successor source review: PASS for ac22629c078e8f1b240ead07b1561c99077753ac.

The successor resolves the prior semver HOLD. Relative to held 11c091808e59979197c024cb2d7f690cc6c2de3d, it changes only:

• chart version 1.8.0 -> 2.0.0 in Chart.yaml and the checked-in source-release record;
• the matching migration heading and explanation that the default-image change requires operator action and therefore a chart major under the existing rule.

The full PR remains the same bounded five-file chart/source-record slice on native source b6e04ce7e679464e91f6ceae83310d3bb3204092: app/default 3.10.0, explicit SQLite 13->14, PostgreSQL 14->15, MariaDB 14->15, MySQL 15->16, all-replica stop/backup, restore-required rollback, and the reviewed dispatch-summary authority distinctions. Templates and the PHP 2.11.8 selection are unchanged.

This is a source verdict only. Current exact-head CI, native 3.10 final publication, the required human decision for the chart major, normal merge/tree verification, OCI publication, and installed chart qualification remain separate gates. No chart or consumer adoption is approved by this review.

[rmcdaniel]

Completed technical packet for proposed Chart 2.0.0 / native Server 3.10.0 at exact chart head ac22629c078e8f1b240ead07b1561c99077753ac, tree 87a096affb3a92aeb9d6c4c066e99f4944e80163.

• Current normal CI is terminal: 19 success, 8 intended skips, 0 failures/pending, merge CLEAN. Helm validation, PHPUnit feature/TLS, shared fixtures, and Sonar are green. The five-file source sync/metadata/version controls and existing 30 release-tool controls pass.
• Exact Security successor source PASS resolves the earlier chart-minor policy HOLD without changing runtime, templates or values keys. The major honestly represents the operator-required database action.
• Native 3.10.0 is fully published and independently approved: source b6e04ce7e679464e91f6ceae83310d3bb3204092, both-registry index sha256:ca92c866fc0f3819068c5088fbd0a79115bb5588c06a4f5324b9280356c08bad, final release/readback, final Security PASS. Publication/scans/provenance, exact corpus, four Compose receipts and protected aliases passed, and Release 444604000 is stable/Latest.
• Customer migration is explicit in the source: all replicas stop before backup and schema upgrade; SQLite 13→14, PostgreSQL/MariaDB 14→15, MySQL 15→16. Startup will not migrate, and rollback restores the pre-upgrade DB/storage backup. Actual published SQLite schedule migration passed 25 scoped assertions, including row/catalog preservation, exact journal and legacy unavailable authority. The unchanged accepted runtime's full backend source qualification remains separate; the SQLite receipt does not claim other backend installed upgrades.
• PHP stays 2.11.8. Worker protocol 1.20/control plane 2 and existing key/completion/upload boundaries are retained. Waterline owns published summary/request-budget/visible-refresh acceptance on the exact qualified handoff; no cross-client, Cloud, MariaDB held activity poll can time out worker re-registration in native tests #1204 or selected-pair claim is inferred.

Next gate is the concrete major-release disposition on existing #1014 under the applicable organization policy/mandate. No operator request has been made. Keep this draft/merge/OCI held for that recorded decision. After it clears, Server owns normal queue merge + exact tree readback, protected OCI publication/content/install readback and downstream Docs pair handoff. All those technical/publication gates remain intact.

[rmcdaniel]

Chart 2.0.0 / native Server 3.10.0 protected publication and public content readback completed. Helm release run 43487220214/a1 is terminal SUCCESS: protected source validation/kind controls, immutable package push, credential removal, anonymous pull and clean-client installation all pass.

The normal queue accepted main 00f20996a18d4795fa0a09319470df1f5160c079, tree 87a096affb3a92aeb9d6c4c066e99f4944e80163, exactly equal to reviewed ac22629c. Both parents and ancestry were verified. The completed local/remote topic branch is deleted and remote absence verified. The concrete major decision and exact source Security PASS remain attached to that unchanged tree.

Published identity	Value
OCI reference	oci://ghcr.io/durable-workflow/charts/durable-workflow:2.0.0
Raw public manifest	sha256:182616f8edbaf056b2f6047fd1501e0790ec5087c42470b03ad5d2c8b89cd67b
Public chart package/layer	sha256:1b5a550b2f65c60c2ffe4c2d975c9578106abc6fe8396c31b1e41d1cf94aac7b (52833 bytes)
Config	sha256:6420a3b8d2274ed798edcc147f2ad0a2829ad2270c8c18a4fa73b59bead26939
Last chart source revision	ac22629c078e8f1b240ead07b1561c99077753ac
Evidence artifact	14069061497
Artifact ZIP	sha256:e9084c36e12ca1a34f430af0fab4bf749c63d3e71d8662152f3c937b52604b55 (53540 bytes)
Packaged native image	docker.io/durableworkflow/server:3.10.0 → sha256:ca92c866fc0f3819068c5088fbd0a79115bb5588c06a4f5324b9280356c08bad

Fresh anonymous registry reads rehash the raw manifest, config and package to those exact digests. The public package is byte-identical to the workflow artifact package. All 28 packaged files correspond to the accepted chart source: nonmetadata bytes are exact, and Chart.yaml/config are semantically equal after the sole expected unreleased→exact source-revision substitution. Version/appVersion, every source annotation and native image identity match. The canonical evidence records anonymous_install:pass, exact source/package and the qualified native index.

One initial local readback invocation incorrectly required optional top-level OCI mediaType; it stopped before content verification. The corrected reader validates the OCI response media type, required schema/config/layer descriptors, all digests and source correspondence, with no package or release-tool change. Independent final Chart artifact/content/OCI Security PASS confirms the protected run/tree, public digests, artifact/package equality, all 28 source files and qualified native image. This qualifies the exact pair for the separate Docs selector workflow; it does not claim its deployment. Docs #539 and Waterline #310/#222 retain their own build/live/installed acceptance. The stopped-replica/backup/schema/restore boundary remains explicit; PHP 2.11.8, #1204, Cloud/upload and shared client gates are unchanged.

[rmcdaniel]

Security final Chart 2.0.0 / app 3.10.0 artifact, content and OCI review: PASS for protected run 43487220214/a1, accepted main 00f20996a18d4795fa0a09319470df1f5160c079 / tree 87a096affb3a92aeb9d6c4c066e99f4944e80163 (tree-identical to reviewed ac22629c).

I independently verified:

• terminal protected source/kind/publish/anonymous-install jobs at that exact main SHA;
• evidence artifact 14069061497: ZIP e9084c36… (53,540 bytes), containing package 1b5a550b… (52,833 bytes) and the canonical evidence record;
• a fresh anonymous GHCR read: manifest 182616f8…, config 6420a3b8…, and single Helm layer 1b5a550b…;
• the public layer is byte-identical to the workflow evidence package;
• all 28 packaged files: every nonmetadata file is byte-identical to accepted chart source, while parsed Chart.yaml differs only by the intended unreleased→ac22629c078e8f1b240ead07b1561c99077753ac fill; the public OCI config is semantically identical to that packaged Chart.yaml;
• Chart 2.0.0, app 3.10.0, source revision ac22629c, and selected native image index ca92c866fc0f3819068c5088fbd0a79115bb5588c06a4f5324b9280356c08bad.

The initial optional-top-level-mediaType readback error remains a nonqualifying reader attempt; it did not change package or release-tool bytes. This PASS covers the immutable chart artifact/public OCI content and its clean anonymous-install receipt only. Docs pairing, Waterline, SDK/Cloud consumers, and later production adoption remain separate gates; the documented stop/backup/schema/restore boundary is unchanged.