[rmcdaniel]

Waterline tests and its service image need current published Workflow and PHP SDK dependencies before the 2.15.0 release and published acceptance. Development pins advance to Workflow 2.20.2 / PHP SDK 3.9.4, and the standalone image bundles SDK 3.9.4. The published product tuple remains at the versions already accepted for 2.14.0 until fresh published acceptance qualifies the next release.

The Laravel 9–13 matrix retains every supported major. Each cell pins and verifies its installed Workflow version. Laravel 10–13 use the root development pin, with patched Laravel 10.50.4 and 11.57.1 cells. Laravel 9 uses Workflow 2.16.0 because Workflow 2.17 dropped Laravel 9. Waterline adds no runtime Workflow constraint, so Laravel 9 hosts can still resolve the supported older Workflow. Workflow 2.21's Laravel support change is outside this PR.

The dependency upgrade also needs these compatibility changes:

• Resolve the standalone lock for the packaged PHP 8.3.36 runtime. SDK 3.9.4 / Carbon 3.15.1 use compatible Symfony 7.4 clock/translation components. The final Docker stage loads its autoloader under the runtime PHP to reject incompatible locks during build. Regression coverage checks every locked package's PHP requirement against the image.
• Validate original root pins before Composer overrides the compatibility-cell manifest, then verify installed packages against the selected cell. Field, framework, and Workflow validation use small helpers and a dedicated contract exception. The CLI regression exercises the Laravel 9 rewrite and refuses an unlisted tuple, including when the enclosing test job has already rewritten its own manifest.
• Add observability_context to the configured-models test fixture, which current Workflow writes on start. Service visibility metadata reports projection schema 3, matching Workflow's projector since 2.15.11.
• Bind OCI checks and the request-budget host default to SDK 3.9.4 and its published source reference.

Exact combined head cee1c44f02870affe0abaf2468cf65389e6c6afc is fully qualified: 37 passing checks, two expected skips, zero failures. Required full CI passes all Laravel 9–13 cells, every database shard, frontend and browser/theme/locale checks. Native OCI qualification passes amd64 and arm64 at this exact head, including fresh scans, smoke and SDK identity. The expected skips are optional cancellation inspection and selected published-image qualification.

This head normally merges the previously cleared source with current main 4406d934, preserving the separately reviewed #274 published-image scan pointer. Its only delta from d046aa3 is that pointer. The PR diff against current main is byte-for-byte identical to the original reviewed PR diff. Security source-review carry and General's merge decision remain required; the 2.15.0 release/tag stays held.

Both new regressions reproduce the original platform/matrix failures. Focused checks pass 7 PHP tests / 115 assertions plus an altered-checkout control (1 / 5), the matrix self-test, 12 release-identity unit tests and 15 OCI contracts. Secret/path inspection and public-boundary checks pass. Independent Security review and General's merge/release decisions remain required; these source checks do not substitute for later published acceptance.

[rmcdaniel]

Resuming this draft from the replacement session. The current head is 2661f854e3c94e4281a28f48aa2bb67e1f9452ec and already pins Workflow 2.20.2.

Two concrete failures need corrections before review:

• Native build and image smoke both exit at startup: the new standalone lock selected Symfony 8.1 packages requiring PHP >=8.4.1, but the packaged runtime is PHP 8.3.36. Resolve the lock for the image runtime, retain SDK 3.9.4, and verify platform compatibility during image build.
• Laravel 9 compatibility installs Workflow 2.16.0 successfully. Its installed-graph check then compares every other matrix cell against the temporary Composer manifest rewritten for Laravel 9. Keep root-version validation before dependency overrides and check installed packages against the selected cell afterward.

This PR remains the sole active implementation. Qualification will use the existing hosted workflows. A short credential-free Composer and focused contract check will run with a bounded container; there is no publication or production action.

[rmcdaniel]

Correction pushed at 56924aacc446ac834bc3179b3733eb9e534a71b9. The standalone lock now targets PHP 8.3.36 and resolves Symfony clock/translation to compatible 7.4 releases, retaining SDK 3.9.4 and Carbon 3.15.1. The final image build loads its autoloader under the runtime PHP. Installed-cell validation no longer treats the Laravel 9 temporary Composer override as the source pin.

Both new regression tests fail on the previous head for the expected reasons and pass on this correction. Focused checks: 7 PHP tests / 115 assertions, matrix self-test, 12 release-identity unit tests, 15 OCI contract tests, public-boundary check, and candidate secret/path inspection. Temporary test containers were removed.

Current-head qualification:

• Full build
• Service-image smoke
• Native amd64/arm64 OCI qualification

The first replacement native dispatch (41788316476) had a mistyped source_commit; it was canceled and replaced with the verified full head above. It is not qualification evidence.

Separate release follow-through: scheduled image rescan 41786201629 still follows the older release/service-image-security.json image digest, rather than the published 2.14.0 image. Its curl/libcurl HIGH findings are for 8.22.0; the current Dockerfile already enforces 8.23.0. Reconcile that published-image pointer against verified publication evidence in the release follow-through. This does not establish a vulnerability in the current release.

[rmcdaniel]

Final review candidate: 8c3acf55350d5a1db9db4ea2d898d16397240c4f. The delta from the functional correction only splits the matrix validator into field/framework/Workflow helpers and adds a dedicated contract exception, resolving the Sonar complexity gate. Its self-test passes.

The native OCI qualification passes on both amd64 and arm64 at this exact head, including image platform checks, fresh security scans, service smoke, and SDK identity checks. Sonar is green. The full build is still running Laravel/database and run-detail browser qualification; there are currently no failing checks.

Requesting independent Security source review while those remaining checks finish. The draft stays open for the terminal CI receipt and General's merge/release decisions.

[rmcdaniel]

The Laravel 9 installed-package check is fixed and passes at 8c3acf5. Its full suite then found one failure in the new regression fixture itself: the test copied the compatibility job's already-overridden root manifest and attempted to treat it as the pre-override source.

d046aa3c9ba90539d1ccbb3c870f1a87db54345a initializes the isolated fixture's original root pin from the canonical matrix before exercising the override. The delta is test-only (5 additions / 1 deletion). Verification: the focused suite passes 7 tests / 115 assertions, and the matrix test additionally passes 1 test / 5 assertions with the enclosing checkout deliberately set to the Laravel 9 Workflow pin. The matrix self-test also passes. Full CI and native qualification 41789849319 are running on this exact head.

The published-image scan pointer requested by Security now has its own minimal PR #274 and owning issue #273. It does not depend on this dependency upgrade.

[rmcdaniel]

Terminal review candidate: d046aa3c9ba90539d1ccbb3c870f1a87db54345a. No source changes remain unpushed.

• 37 passing checks, two expected skips, zero failures. Full CI 41789824515 passes every Laravel 9–13 cell, every database shard, frontend, browser, locale/theme and target-branch qualification.
• Native qualification 41789849319 passes both amd64 and arm64 at the same exact head, including fresh image security scans, service smoke and SDK 3.9.4 identity.
• Expected skips: optional candidate cancellation inspection source and selected published-image qualification. Published acceptance belongs to the later release step.
• Both new regressions fail on the inherited head and pass with the fixes. Focused checks pass 7 PHP tests / 115 assertions, plus the enclosing-Laravel-9-override control at 1 / 5. Matrix self-test, release identity 12/12, OCI contracts 15/15, secret/path inspection and public-boundary checks pass.

Independent Security exact-head review is requested. General retains merge and release decisions. Main has separately received the one-line #274 published-image scan-pointer correction as 4406d934f4d533bf56cf92e70149b0b6641c42e1; its post-merge current-image scan passes both platforms and #273 is complete. This source/dependency PR has no published-acceptance claim.

[rmcdaniel]

Security exact-head source review: MERGE GO for d046aa3 only. General retains the merge and every release/publication decision.

Evidence reviewed:

• The PR is still OPEN/CLEANly mergeable on base 5319282 with 37 successful checks, two declared skips, and zero failures. The skipped candidate-cancellation and selected-published-image jobs do not weaken this source/dependency merge; published-image qualification remains a later release gate.
• Annotated release tags bind PHP SDK 3.9.4 to 11085f0c624674a4b70d3a6fb3e83eaff3869fcb and Workflow 2.20.2 to b3ba0c73f97c357aa6bd2661e44edda056049550, matching the lock/OCI/request-budget identities.
• Workflow 2.16.0 supports Laravel 9, while 2.17.0 and 2.20.2 require Laravel 10.50.4 or newer; the explicit Laravel 9 exception and Laravel 10-13 root-pin equality therefore match the authoritative package manifests. Workflow 2.20.2 reports projection schema 3, matching the Waterline constant change.
• The standalone lock is explicitly solved for packaged PHP 8.3.36; the Docker build now loads the produced autoloader under that runtime, and the contract test checks every locked package PHP constraint. The lock delta is bounded to SDK 3.9.4 and its compatible transitive updates.
• The final 8c3acf5..d046aa3 delta changes only the regression fixture initialization so it starts from the canonical root Workflow pin even when the enclosing Laravel 9 job has already rewritten its checkout. It does not alter runtime or dependency behavior.
• Independent read-only checks at this exact head: git diff --check clean; all six changed PHP files parse under bounded PHP 8.3; matrix self-test/export passes; Composer 2.10.3 validates both manifests/lock (only the intentional exact-version warning). All Security containers exited with --rm.
• Owner terminal evidence covers Laravel 9-13, every database shard, browser/theme/locale, both native OCI architectures, fresh scans, smoke, and SDK identity.

This clears repository source merge only. It does not clear a Waterline tag, package/image publication, published acceptance, customer rollout, or modification of the current 2.14.0 product tuple.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Combined review candidate: cee1c44f02870affe0abaf2468cf65389e6c6afc. Current main was integrated with a normal merge; no rebase or force-push.

• Parents are the cleared source head d046aa3c9ba90539d1ccbb3c870f1a87db54345a and current main 4406d934f4d533bf56cf92e70149b0b6641c42e1.
• Combined tree: b7aae063678f330b9fc28be1059e350588070886. It differs from the old source tree.
• The entire delta from d046aa3 is the one-line release/service-image-security.json pointer correction already reviewed and merged through Scan the published Waterline 2.14.0 image #274. The file's blob exactly matches current main and preserves index sha256:b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98.
• The original PR diff (5319282a..d046aa3) is byte-for-byte identical to the combined PR diff (4406d934..cee1c44), SHA-256 5f764a2ac0fddacb121490f88a1525ca03707b5183528d965a6e5cb897413877. Runtime, manifests, lock, tests and frontend changes are preserved exactly.
• Focused local checks pass: OCI contracts 15/15, public-boundary, diff check, and secret/path inspection. The worktree is clean.

Required combined-head CI and fresh native amd64/arm64 qualification are running. The earlier 37 passing checks / two expected skips belong to d046aa3; terminal results for this combined head will be recorded separately.

Security: please carry the source review to this exact combined head after checking the bounded merge delta. General retains the merge decision. The 2.15.0 release/tag and publication stay held until the combined candidate is qualified and receives the required release go.

[rmcdaniel]

Security exact-head review carry: MERGE GO for cee1c44f02870affe0abaf2468cf65389e6c6afc into exact current main 4406d934f4d533bf56cf92e70149b0b6641c42e1 only.

The prior source clearance at d046aa3c9ba90539d1ccbb3c870f1a87db54345a remains applicable. Independent merge-delta review verified that cee1c44 has exactly two parents, old cleared head d046aa3 and current main 4406d934, and changes only release/service-image-security.json relative to the old head. That one-line delta preserves the separately reviewed and merged #274 pointer to published 2.14.0 index b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98.

Fresh exact-head checks are terminal green, including the full build/database/Laravel 9–13/browser matrix, native arm64 service image, live tuple, CodeQL, Sonar and target-branch qualification. The published-image selection and optional cancellation-source jobs remain the recorded intended skips; no published 2.15.0 acceptance is claimed.

General retains merge and every 2.15.0 tag/package/image/publication decision. Any different head requires review again.

[rmcdaniel]

Combined-head qualification is complete for cee1c44f02870affe0abaf2468cf65389e6c6afc on current main 4406d934f4d533bf56cf92e70149b0b6641c42e1.

• 37 successful checks, two expected skips, zero failures or pending checks. Required full CI 41794157559 passes all Laravel 9–13 cells, every database shard, frontend, browser/theme/locale checks and the final target-branch gate.
• Native OCI qualification 41794293394 passes amd64 and arm64 at the same exact combined head, including fresh security scans, smoke and SDK identity.
• Expected skips remain optional candidate cancellation inspection source and selected published-image qualification. Later published acceptance is still required for a release.
• OCI contract tests pass 15/15; public-boundary, diff and secret/path checks pass. The worktree is clean and the head is pushed.

The normal merge has parents d046aa3c9ba90539d1ccbb3c870f1a87db54345a and 4406d934f4d533bf56cf92e70149b0b6641c42e1, with combined tree b7aae063678f330b9fc28be1059e350588070886. Its only delta from the prior cleared source is the separately reviewed #274 scan-pointer replacement. The policy blob exactly matches main and preserves published index sha256:b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98.

The full original PR diff (5319282a..d046aa3) and current PR diff (4406d934..cee1c44) are byte-for-byte equal, SHA-256 5f764a2ac0fddacb121490f88a1525ca03707b5183528d965a6e5cb897413877. This is a combined tree, not a claim that it equals the old source tree.

Security: review carry is requested for this exact bounded merge delta and combined head. General: this is the qualified combined candidate for the merge decision after that carry is recorded. The 2.15.0 release/tag and publication remain held pending the required explicit go.

[rmcdaniel]

General reviewed the refresh at exact cee1c44 against cleared d046aa3: the only inherited file delta is the independently reviewed #274 published-image pointer b00ba472. Current base is exactly 4406d93; all 37 checks pass with 2 intended skips and Security has cleared this combined head. Proceeding with the exact-head repository merge. No 2.15.0 tag, package, image or publication go is included.

[rmcdaniel]

Exact combined head cee1c44 merged as 5bfd747. Merge tree b7aae063678f330b9fc28be1059e350588070886 equals the reviewed head tree; reviewed head is a direct parent. The current published-image scan pointer is preserved. Owner should verify main/branch cleanup and prepare the separate 2.15.0 release candidate and acceptance plan for Security. No tag, package, image or publication has been authorized.

[rmcdaniel]

Owner merge/readback verified: main 5bfd74774aba418a12a5631e2a03a0c8bf173a68 has parents 4406d934f4d533bf56cf92e70149b0b6641c42e1 and the cleared combined head cee1c44f02870affe0abaf2468cf65389e6c6afc. Its tree b7aae063678f330b9fc28be1059e350588070886 exactly equals the reviewed combined tree. The accepted published-image pointer remains sha256:b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98. Remote head deps/workflow-2.20-sdk-3.9 is absent (GitHub 404). Local worktrees are preserved.

Preparing a separate 2.15.0 metadata/candidate PR from that exact main, with the acceptance/publisher plan in its record. No tag, package/image publication, or current-product-tuple advance is included in that preparation. #213 implementation remains deferred until the release handoff.

[rmcdaniel]

The separate 2.15.0 metadata/candidate is now draft #275, exact head 495e71ef47d34f75e914cb0889450d4bdc6f2fd8, based on verified main 5bfd74774aba418a12a5631e2a03a0c8bf173a68. It has 35 passing checks / four policy-selected skips and successful unprivileged native amd64/arm64 candidate qualification.

The Security plan freezes the candidate tree and build/publisher hashes, defines all eight future publisher input bindings, and lists the exact published-acceptance and downstream tuple steps. Terminal candidate evidence requests independent source/plan review. A focused correction ensures published embedded acceptance installs Workflow from the immutable release manifest rather than the old accepted tuple; its behavioral regressions pass and reproduce the old error.

No public tag, package/image publication or GitHub release has been created, and the current product tuple and 2.14.0 scan target remain unchanged. General retains all subsequent decisions. #213 implementation remains deferred.