[rmcdaniel]

Native 3.10 refuses an already-fired plain timer in a failed-run redrive prefix and rounds first reuse timestamps to whole seconds. Accepted #1215 (5221ed82, exact reviewed tree 270697b7) corrects both. This two-file release preparation documents the resulting behavior and selects 3.11.0 as the published Compose default.

The notes preserve ordered-pair/refusal boundaries, full fractional clocks, repeated original time and immediate-predecessor lineage, zero timer work, unchanged schema/protocol and historical lost-fraction limits. Core and installed SDK qualification remain separate.

All 21 release-head checks passed with eight intended path skips, exact Security/Core review, normal merge queue and accepted-main equality. Merged source/tag is da38c0ede9b15046fcab2bb0f25412c85a3e3404, tree 9e44b0a5807b0d221585a04e6da8664f63565898; completed topic branches are absent. All applicable release-main workflows passed, and the underlying runtime source/backend/corpus matrix and all five runtime-main workflows passed. The original pre-test MySQL mirror pull failure remains NONPASS alongside its single unchanged successful repeat.

Complete producer qualification binds both registries' immutable index sha256:39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6, both platform children/configs, smoke/scans/SLSA, exact-tag corpus and all four Compose receipts. The tagged read-only verifier and independent complete producer review pass. Installed handoff #980 gives the exact tuple and full-precision cold-worker cohort to PHP, Python and Rust owners with their own runner/profile gates intact.

Protected stable aliases and the final GitHub Release remain held for all three accepted published SDK replay receipts. The GitHub Release is absent; current selected pair stays Server 3.10.0 / Chart 2.0.0. Draft Chart #1219 prepares 2.1.0 but its merge/OCI and Docs selection remain separate. #980, Core #992 precision/reference follow-through, #1204 and Cloud adoption remain open within their own scopes. The retired PHP publisher/tags remain frozen and no installed or cross-mode outcome is inferred from producer qualification.

Current consumer disposition: Rust #980 is held at its policy-blocked/set-aside successor review; its original first-redrive 409 remains NONPASS and cleaned, with no successor action selected. Python #327 source preparation is normally integrated at 717beb7b / exact reviewed tree a4c31832, with successful main CI and all 20 check contexts terminal (18 success, two intended manual-cell skips). Source integration is complete; the complete execution/collection profile and actual installed evidence remain separate gates. Its actual installed result and the separately attributable physical timer-row observation remain pending; no accepted per-fixture producer count exists yet. Core reference precision source is accepted at 42bcc5d2 / tree faf9a71e, remains unreleased, and does not substitute for installed SDK outcomes. All three accepted published SDK receipts remain required for stable promotion. No alternate Rust runtime, alias dispatch or Release action is selected by this update.

General's coordination disposition retains the actual same-fixture physical-row criterion and leaves execution unselected because no complete permitted collection method/profile is accepted. General retains the unresolved boundary decision. No replacement collection implementation/effect or rerouting of the held Rust item is selected; producer and Python source integration evidence retain their existing scope.

[rmcdaniel]

Security source/release-notes review: PASS for exact 8d7ffd2e5d68c30d4632daaf9366864af4f20a35 / tree 9e44b0a5807b0d221585a04e6da8664f63565898 on accepted main 5221ed82b6303379e088a4402986e544cd04b65a.

• The complete diff is exactly docs/releases/3.11.0.md plus the published Compose default 3.10.0 → 3.11.0; no runtime, schema, workflow, permission, publisher, tag, or protocol file changes.
• The notes match the accepted Preserve replay clocks and reuse fired plain timers on redrive #1215 contract. Only a complete ordered plain TimerScheduled / TimerFired pair is reusable; the pair receives one fresh shared timer ID, creates no authoritative timer row/task, retains immediate-predecessor lineage, leaves source history unchanged, and resumes only the failed activity. Unsupported timer metadata and incomplete/reversed/duplicate/mismatched pairs retain their exact refusal classes.
• Clock authority is stated correctly: reused activity/marker/timer events preserve available fractional precision, the initial replay anchor remains the persisted source run start, and an already-recorded replay/reuse string passes through unchanged on another redrive. Historical fractions already omitted cannot be reconstructed; deadline formatting remains separate.
• The upgrade section keeps the accepted 3.10 schema versions and explicit earlier upgrade path. Worker protocol 1.20, control-plane version 2, codec and command shapes remain unchanged. It does not broaden redrive to signals, updates, child workflows or nonplain timers.
• The qualification language correctly separates source/backend evidence from immutable publication, Compose/scans/provenance, Core reference follow-through and actual published PHP/Python/Rust cold-process proof under Match Core's failed-run redrive: visibility carryover, eligibility in describe, reused markers and timers #980. It does not infer an installed result or Cloud adoption.
• git diff --check passes. I independently reran the inert native tag/alias/refusal controls and rendered Compose locally; they pass and select exactly durableworkflow/server:3.11.0 plus mysql:8.0 without starting a container.

The remote head remains exact. Current Sonar/Rust/PHP checks, including the unchanged failed-job rerun for the mirror-layer 404, remain source-merge gates. After merge, exact immutable image/corpus/Compose/scan/provenance and published-consumer receipts still gate aliases and final Release. This is not tag, publication, installed SDK, or #980 completion approval.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Release preparation is normally merged at da38c0ede9b15046fcab2bb0f25412c85a3e3404 (2026-11-13 22:21:00 UTC). Its parents are accepted runtime main 5221ed82 and reviewed release head 8d7ffd2e; complete tree 9e44b0a5807b0d221585a04e6da8664f63565898 exactly equals the reviewed/tested head. The merge commit is verified/valid. The complete delta from runtime main is exactly the 3.11.0 note and one Compose default line.

All 21 release-head checks passed with eight intended path skips, plus exact Security release review and inert tag/alias/Compose controls. All three queue workflows passed: PHPUnit/contracts, shared-fixture gate, public boundary. Local and remote merged topic branches are absent; the owned release worktree is clean at accepted main.

The four applicable release-main workflows (PHP feature, CodeQL, Sonar and public boundary) are observed separately and still finish before the immutable tag/publisher step. The unchanged runtime already passed its complete current source/backend/corpus matrix and all five runtime-main workflows; its one pre-test mirror failure and successful unchanged repeat remain separately recorded on #1215. No tag, image, alias or final Release is created from this merge receipt.

After current-main qualification, publish only the immutable 3.11.0 tuple through the existing protected path, then qualify artifacts, exact-tag corpus, four Compose cells and the declared actual published PHP/Python/Rust fractional cold-worker cohorts. Protected stable aliases/final Release and downstream Chart/Docs adoption retain their own gates. #980 remains open.

[rmcdaniel]

Bounded Core contract countercheck of exact 8d7ffd2e5d68c30d4632daaf9366864af4f20a35: the new release notes and Compose default match the reviewed plain-timer and clock slice. The notes require a complete ordered shared-ID timer pair, no successor timer row/task, original/repeated reuse clocks, unchanged retained timestamp strings, persisted run-start authority, and full precision only where it was retained. They keep unsupported timer kinds and installed Worker/cold-process proof separate. No source finding in these two files.

This is a read-only notes/contract review. It does not select an image or attest publication, platform, provenance or installed SDK results. Core #992's separate correction is draft Workflow #1138 and is still under its own focused/corpus/full gates.

[rmcdaniel]

All four applicable release-main workflows at accepted da38c0ede9b15046fcab2bb0f25412c85a3e3404 are terminal SUCCESS: PHP feature 43518550674, CodeQL 43518549275, Sonar 43518550644 and public boundary 43518550567. Accepted-main history, verified commit and complete reviewed tree 9e44b0a5 were checked again.

Created the previously unused immutable 3.11.0 Git tag, directly at that source, and read the remote ref back. Git reported the configured maintainer allowance for the tag-creation restriction; source/PR/queue/main gates had all passed before creation. The protected native publisher is 43521139955 attempt 1, dispatched from refs/tags/3.11.0 with exact input source da38c0ede9b15046fcab2bb0f25412c85a3e3404.

This starts immutable publication only. No image/index/platform identity is selected from the Git tag. Build/smoke/scan/provenance and anonymous registry readback, exact-tag corpus, all four Compose cells, actual published PHP/Python/Rust cold-worker precision receipts, then protected alias/final Release gates remain pending. The selected published pair stays 3.10.0 / Chart 2.0.0. Core #992 reference follow-through and #980 closure remain separate.

[rmcdaniel]

Independent Security review of the first immutable native 3.11.0 publication stage: PASS for the exact image tuple, platform metadata, scans and provenance only.

• Protected run 43521139955 attempt 1 is terminal SUCCESS on refs/tags/3.11.0, exact source da38c0ede9b15046fcab2bb0f25412c85a3e3404. The public tag points directly to that verified merge commit/tree 9e44b0a5807b0d221585a04e6da8664f63565898; its parents are accepted runtime main 5221ed82... and reviewed release head 8d7ffd2e....
• Fresh anonymous raw reads of GHCR and Docker Hub 3.11.0 are byte-identical OCI indexes, SHA-256 39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6. They contain exactly linux/amd64 child 8bc8400c4ff203c1e4d5c7f82028cfa1d429ab00a47a6e698453d8345ae4bcfc and linux/arm64 child 9f27c13363019d0d6f22d5aa7a04e520e106e64270e9f606fba68268f73a6b07, with no extra platform.
• Both child configs independently read back the expected architecture, non-root 1000:1000, native entrypoint, working directory, ports/volumes, source label da38c0ed..., tag 3.11.0, and run ID 43521139955.
• Both protected smoke jobs and both scan jobs succeeded. The scan summaries agree at 1 critical / 34 high / 0 with a fixed version. Retained scan artifacts are 14084180836 (amd64, uploaded-artifact SHA-256 b691e7b0...) and 14083866652 (arm64, 8010d4b3...). This records the existing no-fix baseline; it is not a blanket vulnerability waiver.
• gh attestation verify succeeds for the exact index and returns both GHCR and Docker Hub SLSA provenance statements. Each binds workflow native-release.yml, tag 3.11.0, source/build signer da38c0ed..., invocation 43521139955/attempts/1, GitHub-hosted runner and a verified Rekor timestamp.

Promotion has not been inferred: anonymous GHCR 3.10.0, 3.10, 3 and latest still equal the accepted ca92c866... index, while the public 3.11.0 Release is absent. Keep those aliases and final metadata held until exact-tag corpus, all declared Compose receipts, actual published PHP/Python/Rust full-precision cold-worker evidence and the protected selector checks pass. Chart, Docs, Cloud and downstream adoption remain separate.

[rmcdaniel]

The protected native 3.11.0 publisher 43521139955 attempt 1 is terminal SUCCESS at exact tag/source 3.11.0 / da38c0ede9b15046fcab2bb0f25412c85a3e3404, tree 9e44b0a5. Both architecture build/smoke jobs, index publication and both scans passed. The tagged read-only publication verifier independently validated both exact registry tags and both SLSA attestations against this source/tag/run/attempt.

Identity	Exact value
GHCR and Docker Hub index	sha256:39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6
linux/amd64 child	sha256:8bc8400c4ff203c1e4d5c7f82028cfa1d429ab00a47a6e698453d8345ae4bcfc
linux/amd64 config	sha256:1f72415d494737c9ae4b5f7d2a18cc8d152de07d1279513ff3dd7ab7d586cfef
linux/arm64 child	sha256:9f27c13363019d0d6f22d5aa7a04e520e106e64270e9f606fba68268f73a6b07
linux/arm64 config	sha256:de83ffe874067e092bad2f5460dbe467cf8e4fa45900358d7703ff7e2d580b14

Fresh anonymous registry reads agree on both platforms and exact source/tag labels. Both smoke receipts observe version 3.11.0, non-root 1000:1000, no-auth refusal and ready SQLite/PostgreSQL/MySQL backends with graceful SIGTERM exit 0. All four raw smoke/scan artifact ZIP digests match provider metadata: amd64 smoke 14082988791 / 42510aae…, arm64 smoke 14084041237 / 9a3d98f8…, amd64 scan 14084180836 / b691e7b0…, arm64 scan 14083866652 / 8010d4b3….

The fresh scans contain the declared 1-critical / 34-high / 11-advisory inventory with zero actionable fixed-version rows, identical platform fingerprint sha256:d5e5d3910643983cb1a6e428105e77c97ee5b96249c2cfca66a5d3eae6e5e246. This retains the existing no-fix disposition and grants no blanket vulnerability waiver. Independent Security immutable-stage PASS separately validates raw registry bytes, configs, scans and provenance.

The exact index is now dispatched from the 3.11.0 tag to published-image corpus 43524020818 and all four Compose cells 43524025828. Those canonical receipts remain pending. The complete producer handoff precedes actual PHP/Python/Rust fractional cold-worker execution under the existing owner/runner gates. Stable aliases, final Release, Chart/Docs selection and #980 closure remain held; current selected pair stays 3.10.0 / Chart 2.0.0.

[rmcdaniel]

Independent Security counter-review of published Compose run 43524025828 attempt 1: PASS for the four exact-index Compose receipts only.

Verified from the retained artifacts:

• all four jobs are terminal SUCCESS at tag/source 3.11.0 / da38c0ede9b15046fcab2bb0f25412c85a3e3404, index sha256:39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6;
• amd64 child 8bc8400c... and arm64 child 9f27c133... rehash exactly from the anonymous registry; their public manifest config digests equal the retained 1f72415d... and de83ffe8... receipts;
• workflow blob 09082357... and qualification-subject blob 0a2e804e... equal the tagged source tree;
• local and production profiles on both platforms report ready/serving, loopback binding, Worker registration, exact 3.11.0 cluster version and unset-token refusal; production also proves default-token refusal;
• every receipt reports exact owned container/network/volume counts zero with API absence verification.

Artifact IDs 14084103498, 14084651580, 14083119473, and 14084057483 each contain only receipt.json; their ZIP SHA-256 values are respectively 0e09b45a..., 774fd0df..., b250476e..., and 2055abbf....

This does not advance the still-running native parity/corpus run 43524020818, protected aliases, final Release metadata, or the published PHP/Python/Rust full-precision cold-worker gates. Release 3.11.0 remains absent at this review point.

[rmcdaniel]

The native 3.11.0 producer qualification is complete at the immutable tuple below. The exact tagged read-only verifier rechecked publication/SLSA provenance, the exact-tag corpus and all four Compose receipts, including provider artifact digests, source/workflow/subject bindings, runtime observations and zero remaining owned resources. This qualifies the producer for the separate installed SDK cohort. Stable aliases, final GitHub Release, Chart merge/OCI and downstream selection remain held for the actual published PHP/Python/Rust full-precision cold-process replay gates under #980.

• Tag 3.11.0, source da38c0ede9b15046fcab2bb0f25412c85a3e3404, tree 9e44b0a5807b0d221585a04e6da8664f63565898.
• Both ghcr.io/durable-workflow/server and docker.io/durableworkflow/server index sha256:39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6.
• Immutable publisher 43521139955 / attempt 1, exact-tag corpus 43524020818 / attempt 1, and four Compose cells 43524025828 / attempt 1 all succeeded at that source.

Platform	Child manifest	Image config
linux/amd64	sha256:8bc8400c4ff203c1e4d5c7f82028cfa1d429ab00a47a6e698453d8345ae4bcfc	sha256:1f72415d494737c9ae4b5f7d2a18cc8d152de07d1279513ff3dd7ab7d586cfef
linux/arm64	sha256:9f27c13363019d0d6f22d5aa7a04e520e106e64270e9f606fba68268f73a6b07	sha256:de83ffe874067e092bad2f5460dbe467cf8e4fa45900358d7703ff7e2d580b14

The corpus receipt artifact is 14085790455, API/actual ZIP SHA-256 4c89c1c27c2aeb69b614b7900ad169b38641f257a14d67cd03d7b46c77399b61. All seven corpus observations are exit 0, and its cleanup records zero containers/networks/volumes. Raw corpus evidence artifact 14085995205 has API digest f9e232970c32e9bcb6202a62f07d7c1d50972e46e8989faaa000687d2eae0ade. The separately checked Compose artifact IDs/digests and four job IDs are in the exact selection below. Each receipt independently binds the correct platform config and successful health/readiness/version/registration/token refusals, plus zero owned resources.

Prior immutable-stage identity/smoke/scan receipt, independent immutable-stage Security PASS, and independent four-cell Compose PASS remain scoped evidence. Fresh scans retain one critical / 34 high rows with zero actionable fixed-version rows, not a vulnerability-free claim. Exact corpus/selection counter-review is requested separately. GitHub Release 3.11.0 was confirmed absent by structured JSON 404.

The 1,488-byte canonical selection (including its trailing LF) hashes to SHA-256 970d3c12cba2d6683acd0d00a30081f789b401d2cd54fb4287e693db12d68abb. It is retained for review, not dispatched to the alias writer:

{"compose":{"cells":[{"artifact_digest":"sha256:0e09b45aa62f9629f1146dca33c1278d199626787051578adc8a3696eae336bb","artifact_id":14084103498,"job_id":132225187611,"platform":"linux/amd64","profile":"local"},{"artifact_digest":"sha256:b250476e37cbcb6e791ad74223a997df12fe74b4353a91884b5b775d8e33f48e","artifact_id":14083119473,"job_id":132225187864,"platform":"linux/amd64","profile":"production"},{"artifact_digest":"sha256:774fd0df4102c54562c230b243b97fe6963ed7044b74ee34f37fce05e71b3381","artifact_id":14084651580,"job_id":132225187813,"platform":"linux/arm64","profile":"local"},{"artifact_digest":"sha256:2055abbf38b9376d928aa732b696df083ce512dad6ff03c999ec048190259d8b","artifact_id":14084057483,"job_id":132225187941,"platform":"linux/arm64","profile":"production"}],"run_attempt":1,"run_id":43524025828,"runner_commit":"da38c0ede9b15046fcab2bb0f25412c85a3e3404","workflow_blob":"09082357d57e7c95746d2f815715bb91414cf112"},"corpus":{"artifact_digest":"sha256:4c89c1c27c2aeb69b614b7900ad169b38641f257a14d67cd03d7b46c77399b61","artifact_id":14085790455,"run_attempt":1,"run_id":43524020818,"runner_commit":"da38c0ede9b15046fcab2bb0f25412c85a3e3404","workflow_blob":"5130b55602951940869d215bee8a08c2dc9722d3"},"release":{"index_digest":"sha256:39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6","run_attempt":1,"run_id":43521139955,"source_commit":"da38c0ede9b15046fcab2bb0f25412c85a3e3404","tag":"3.11.0"},"schema":"durable-workflow.native-alias-promotion-evidence.v1"}

SDK owners must use this exact index/platform/source tuple and their own accepted runner/profile gates. The cohort requires an observed nonzero-fraction source TimerFired, unchanged workflow definition/fingerprint, cold replacement, first and repeated redrive, original-source history preservation, failed-activity-only execution and no repeated timer work. Existing runner/profile holds remain in force. Core #992 precision/reference follow-through, #1204 reliability, Cloud and wider redrive support remain separate. Draft Chart #1219 prepares 2.1.0 but has no published tuple. Current selected pair stays Server 3.10.0 / Chart 2.0.0.

[rmcdaniel]

Security counter-review of the complete native 3.11 producer selection: PASS for producer handoff only.

Independent exact checks:

• tag 3.11.0 resolves to source da38c0ede9b15046fcab2bb0f25412c85a3e3404 / tree 9e44b0a5807b0d221585a04e6da8664f63565898;
• both public 3.11.0 registry tags rehash to index sha256:39d218fc5f251a3e7c4ff1dcda06d9cc53f66c034f0c6d0f67e8371fd0cc97d6;
• exact-tag corpus run 43524020818/1 is terminal SUCCESS. Artifact 14085790455 has ZIP SHA-256 4c89c1c27c2aeb69b614b7900ad169b38641f257a14d67cd03d7b46c77399b61; its receipt binds amd64 child 8bc8400c..., config 1f72415d..., source/tag/workflow/subject, all seven zero exit statuses, and zero containers/networks/volumes;
• raw corpus evidence artifact 14085995205 rehashes to f9e232970c32e9bcb6202a62f07d7c1d50972e46e8989faaa000687d2eae0ade. The PHP, Rust, and embedded 97-case records all report pass, as do the service-call, schedule-catalog, namespace-delete-payload, retention-payload, and aggregate comparisons;
• corpus workflow blob 5130b556... equals the exact source workflow blob. The four Compose artifact IDs/digests/jobs remain exactly those independently reviewed in the prior four-cell PASS;
• the canonical selection is exactly 1,488 bytes including one trailing LF and rehashes to 970d3c12cba2d6683acd0d00a30081f789b401d2cd54fb4287e693db12d68abb;
• GitHub Release 3.11.0 is still structured 404. Fresh anonymous readback keeps both registries' 3.10.0, 3.10, 3, and latest aliases on the prior index ca92c866...; no alias dispatch is visible.

This qualifies the immutable producer tuple for the separately reviewed installed SDK cohort. It does not authorize stable-alias movement, final Release metadata, Chart selection, or downstream adoption. Keep those held for the actual published PHP/Python/Rust full-precision cold-process receipts and their independent runner/profile gates. The existing 1C/34H/0-actionable scan statement remains scoped and is not a vulnerability-free claim.

[rmcdaniel]

Security exact corpus and producer-selection counter-review: PASS, scoped to the immutable 3.11.0 producer handoff.

Independent checks establish:

• refs/tags/3.11.0 points to source da38c0e / tree 9e44b0a5807b0d221585a04e6da8664f63565898. The native-image-parity and published-compose workflow blobs are exactly 5130b556... and 09082357..., and subject blob 0a2e804e... resolves to scripts/ci/native-qualification-subject.json at that source.
• Publisher 43521139955, corpus 43524020818 and Compose 43524025828 are completed attempt-1 successes at the exact source. The corpus job and all four named Compose job IDs are terminal successes and match the selection.
• The downloaded corpus receipt is eligible, binds index 39d218fc..., amd64 child 8bc8400c..., config 1f72415d..., seven exit-0 observations and zero containers, networks and volumes. The retained embedded, PHP and Rust records and all five comparison records report pass at the same runner revision.
• All four downloaded Compose receipts are eligible and bind the exact profile/platform cells, index, source/tag, workflow/subject blobs, platform child/config digests, health/readiness/version/registration/token observations, and verified zero-resource cleanup. Their GitHub artifact IDs and API digests match the canonical selection.
• Fresh anonymous reads from GHCR and Docker Hub produce byte-identical index 39d218fc... with only amd64 child 8bc8400c... and arm64 child 9f27c133.... Each registry child resolves to config 1f72415d... or de83ffe8... as selected; the amd64 config labels source da38..., release tag 3.11.0, nonroot user and fixed native entrypoint.
• I rederived the canonical selection directly from the durable record: 1,488 bytes including one LF, SHA-256 970d3c12cba2d6683acd0d00a30081f789b401d2cd54fb4287e693db12d68abb.
• Promotion remains correctly absent: both 3.11 aliases are absent, both 3 and latest aliases remain ca92c866... for 3.10, and GitHub Release 3.11.0 remains structured 404.

This PASS qualifies only the producer tuple for the separate PHP, Python and Rust full-precision cold-process cohort. Stable aliases, final Release, Chart OCI/selection and downstream adoption remain held until those exact installed receipts and their independent gates pass. The scan record remains 1 critical / 34 high with zero actionable fixed-version rows, not a vulnerability-free claim.