[rmcdaniel]

The scheduled security workflow still scans the superseded 2.14.0 index. Change only release/service-image-security.json stable_image to the independently accepted fixed Waterline 2.15.0 index, sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e. Preserve the scanner digest and 24-hour database-age policy.

This is the narrow surveillance source correction assigned in #275, based on actual main 6169c60baab602540a1ae3cc13c790eaf0fbdc6f. It does not change the accepted image or release classification. General retains merge and any later rescan decision; no dispatch is part of this draft.

Fresh binding before the change:

• Anonymous index bytes/provider digest, both platform manifests/configs and BuildKit attestation descriptors match the accepted 2.15.0 artifact.
• Immutable tag object 0ac99f5b732e03aa20ca1688ee8f7a9e8bc9fb60 peels to 275bd59334726cdaa40594618b673eedaedbabe6; both configs and public Packagist source/dist agree.
• Signed GitHub provenance for the index and both platform manifests verifies against the protected publisher identity, source 275bd593, GitHub-hosted runners and publisher 41828299130 attempt 1.

Validation at 877751ba7b87fe51b122fca58152db1554aaf886: existing OCI/security contracts 15/15, published-provenance contracts 4/4, exact one-value JSON comparison and diff/added-content checks pass. The local public-boundary script stopped on the host's older Bash (mapfile unavailable); ordinary exact-head Public Boundary passes. All 39 provider checks are terminal: 35 successes, four policy-selected skips, zero failures/pending. Security source PASS covers this exact head/base. Fresh head/base/terminal-rollup readback matches the reviewed source after General lifted the broad incident hold. General retains the normal merge decision.

After exact-head Security review and General's separately accepted pointer merge at actual main Q, General will decide whether to dispatch the existing no-input service-image-security.yml. Fresh platform inventories and provider digests remain required before claiming a 2.15.0 rescan. No local image/scan/build was run. Release/latest, observer, tuple/examples, stopped inspector/evidence work, downstream and Cloud gates remain held; old P=M publication clearance does not transfer to this branch or current main.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Owner exact source and identity packet — scan-pointer draft

General's narrow source assignment is #275 / 6634919331. This draft is head 877751ba7b87fe51b122fca58152db1554aaf886, tree 8c6d0415226b882e5570c6fe128e513c3880c554, parent/actual main 6169c60baab602540a1ae3cc13c790eaf0fbdc6f.

The entire delta is one value in release/service-image-security.json: replace the superseded 2.14.0 index with docker.io/durableworkflow/waterline@sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e. Scanner remains aquasec/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c; database maximum age remains 24 hours. Every other tracked file is unchanged. The existing no-input scheduled/dispatch workflow remains byte-identical, SHA-256 350c01de49b35265a816c1d65a15a1456d5ad7f307b417b68b9f532ed891816d.

Fresh anonymous registry observation at 2026-11-04 15:41:31 UTC hashed the fixed tag's index bytes to the exact candidate and matched its provider digest header. Existing repository provenance guards accepted the four-descriptor index and each BuildKit attestation subject/predicate pair. Each fetched manifest/config hashed to its advertised digest:

Platform	Manifest	Config	BuildKit attestation manifest
linux/amd64	sha256:c8aa5bd25b6e490955c310cd4930344056e6de8283cd1cf31b90a398392f291d	sha256:9eb4300a97553c462690b7511cfb3e1fbae697a21357efbcda908b857b0f1519	sha256:8c530a9eafcf6d3759fa8680fc13f973ece6030637826c30601221cfe6aa9a6a
linux/arm64	sha256:69143a41326569982984dddddd3e76d72e6be84d93291164223f2bf39e8cc789	sha256:447a5ea73fc10cc0228b5664c12effcdd57b85562a002af38d954129c92a224b	sha256:dc306bf54d37414e0ee2e78d291f7cc67c52cb5f8d8c6fdd70cd38ba066f0ec4

Both configs retain release tag 2.15.0 and source 275bd59334726cdaa40594618b673eedaedbabe6. A fresh remote Git read retains annotated tag object 0ac99f5b732e03aa20ca1688ee8f7a9e8bc9fb60, peeling to that source; public Packagist 2.15.0 source/dist agree. Actual main remains the separate 6169c60 above.

Fresh GitHub API attestation bundles for the index and both platform manifests were cryptographically verified against their freshly hashed raw manifest bytes with official hash-verified GitHub CLI 2.103.3. All three enforce repository durable-workflow/waterline, certificate identity https://github.com/durable-workflow/waterline/.github/workflows/service-image-publish.yml@refs/heads/main, source digest 275bd59334726cdaa40594618b673eedaedbabe6, and denial of self-hosted runners. Current API repository ID and signed source-repository ID both equal 559768001; the verified workflow/signer/source digest is the same immutable source, runner environment is github-hosted, and invocation is 41828299130 / attempt 1. This is read-only verification of published statements and manifests; no image layers were retrieved.

Validation so far: existing OCI/security policy contracts 15/15, published-provenance contracts 4/4, exact JSON equality except stable_image, one-file/one-value diff, and added-content/secret/private-content checks pass. These are synthetic contract tests, not a fresh image scan. Native public-boundary execution stopped on the host's older Bash (mapfile unavailable); ordinary push Public Boundary 41860932201 passes. Ordinary exact-head PR CI, including build 41861006141, is pending.

No local image build/scan, protected dispatch, tag, release, registry, observer, tuple/examples, native inspector, stopped evidence/observation or Cloud action was performed. The completed fixed-image publication keeps its original acceptance and historical build-scan deadline. This pointer source correction grants no old P=M authority to current main or this head. Exact-head Security review and General's merge remain required; only after a separately accepted pointer merge at actual Q may General decide the existing no-input rescan. Fresh exact-platform inventories/provider digests remain a later gate; no 2.15.0 rescan is claimed here.

[rmcdaniel]

Owner CI reconciliation — source merge held

At 2026-11-04 16:02:43 UTC, exact head remains 877751ba7b87fe51b122fca58152db1554aaf886. Provider rollup has 29 successes, four policy-selected skips and six nonterminal checks: the four MySQL shards and PostgreSQL are marked in_progress; target-branch qualification is queued. Build run 41861006141 is also nonterminal.

The five database logs are already downloadable and contain completed PHPUnit summaries and post-job cleanup, with zero ##[error] markers. Their latest recorded timestamps are below. These logs are supplementary diagnostics, not terminal CI acceptance:

Job	Cases / assertions	Reported skips	Final log timestamp (UTC)
MySQL 1/4	139 / 1,763	24	15:51:38
MySQL 2/4	185 / 2,290	0	15:52:14
MySQL 3/4	167 / 2,422	9	15:53:24
MySQL 4/4	286 / 2,741	1	15:52:12
PostgreSQL	777 / 9,120	35	15:53:34

Each reports one PHPUnit deprecation and no failure/error count. Fresh REST run/jobs reads, a no-cache read, direct PostgreSQL/target check-run reads, and the PR rollup still agree on the nonterminal metadata; completion cannot be inferred from the logs. No retry, cancellation, workflow dispatch or status write was performed to resolve that mismatch.

The exact source/provenance packet, one-value diff and passing local policy/provenance contracts remain unchanged. The draft stays held for authoritative terminal CI and exact-head Security disposition before General's merge decision. No 2.15.0 rescan or other operational action is claimed or assigned here.

[rmcdaniel]

Security exact-head review — source clean, provider-terminal HOLD

I independently re-read #277 at head 877751ba7b87fe51b122fca58152db1554aaf886, base 6169c60baab602540a1ae3cc13c790eaf0fbdc6f, and tree 8c6d0415226b882e5570c6fe128e513c3880c554. The complete delta remains the single accepted stable_image pointer move to Waterline 2.15.0 index sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e; the scanner identity, 24-hour database age bound, workflow blob, and every other tracked input are unchanged. Independent public index/platform/attestation and PR-ref analysis reads found no source blocker.

Final exact-head disposition is held on authoritative provider state. The current PR rollup has 29 successes, four expected path-policy skips, zero failures, and six nonterminal checks: all four MySQL shards plus PostgreSQL still report IN_PROGRESS, while Target branch qualification remains QUEUED. Completed visible steps and retained job logs are useful diagnostics, but they are not terminal check conclusions and cannot be promoted into acceptance.

No retry, rerun, status mutation, merge, or scan dispatch is authorized by this review. Resume the final Security disposition only after GitHub returns terminal authoritative conclusions for this unchanged head/base, or after a separately reviewed supported provider-recovery path. Any source/base change requires a fresh carry. All later no-input scan, Release/latest, observer, tuple, examples, native-inspector, downstream, Cloud, and #275 cohort/stop gates remain separate and held; old P=M authority remains excluded.

[rmcdaniel]

Security final exact-head source disposition — PASS; operational gates remain held

I independently reconciled the authoritative terminal state for draft #277 at head 877751ba7b87fe51b122fca58152db1554aaf886, base 6169c60baab602540a1ae3cc13c790eaf0fbdc6f, and tree 8c6d0415226b882e5570c6fe128e513c3880c554. The PR is CLEAN and mergeable.

The complete source delta remains one value in release/service-image-security.json: the accepted stable image pointer moves from Waterline 2.14.0 index sha256:b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98 to accepted 2.15.0 index sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e. The scanner remains aquasec/trivy:0.76.1@sha256:790fd66d1697395d8693d1acaa1ea702406a20f109b6fc7bac8db623eca6c06c, the database maximum age remains 24 hours, and every other tracked input is unchanged. The prior exact-head public index/platform/provenance and source review remains current; PR-ref open CodeQL alerts are empty.

The provider-terminal gap in my held disposition is now closed by authoritative GitHub state. The unchanged head has 35 successful checks, four expected path-policy skips, zero failures, and zero pending checks. Build run 41861006141 now reports all database shards, PostgreSQL and target-branch qualification terminal SUCCESS; CodeQL, Public Boundary, Sonar, service-image smoke and the published tuple checks are also terminal on this exact head. No conclusion is inferred from retained logs.

PASS for this exact source/base pair and its normal source integration only. Any source or base change requires a fresh carry review. The current GitHub Actions/Pages incident and General's fleet-wide merge hold remain binding; this terminal exact-head evidence does not authorize a merge during that hold. After provider recovery, re-read the exact head/base and rollup before General's single normal merge decision. No duplicate rerun is required solely because the exact-head checks completed during the incident.

This is not a scan or operational acceptance. The existing no-input rescan decision, fresh database/provider freshness at execution, exact platform inventories and digests, Release/latest, observer, tuple/examples, native inspector, downstream/Cloud, and every #275 cohort/stop gate remain separate and held. Old P=M authority remains excluded. I performed no image pull, layer download, build, local scan, dispatch, merge, registry, Release or production action.

[rmcdaniel]

Owner terminal source packet — General incident merge hold preserved

Exact source remains head 877751ba7b87fe51b122fca58152db1554aaf886, base/current main 6169c60baab602540a1ae3cc13c790eaf0fbdc6f, tree 8c6d0415226b882e5570c6fe128e513c3880c554. The branch is clean and fully pushed, labelled agent:waterline, and remains a draft.

Authoritative provider state has converged: all 39 exact-head checks are terminal, with 35 successes, four intended skips, zero failures/pending. Build 41861006141, attempt 1, reports terminal success for the unchanged push/PR head, including all database shards, PostgreSQL and target-branch qualification. This replaces the earlier nonterminal CI state in the diagnostic hold record; acceptance is based on the provider conclusions, not log inference. No rerun, cancellation, check-status write or extra qualification dispatch occurred.

Security's final exact-head source PASS was read back exactly, SHA-256 ca1c0ff018da10850bdcdd376554624f313f62ec11388cf4e31d1b86f9d9df11. It closes the prior provider-terminal gap for this source/base pair only. The original source/provenance packet remains unchanged: only stable_image moves to accepted index sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e; scanner digest and 24-hour age limit are preserved, and existing local OCI/security/provenance contracts pass 15/15 plus 4/4. Fresh anonymous index/children/config/tag/source and three signed publisher bindings were established before the edit.

General's incident merge hold remains binding. After recovery, reread exact head, actual base/main and terminal rollup; any source/base change requires fresh carry review before General's one normal merge decision. Terminal same-head checks do not require a duplicate rerun solely because they completed during the incident.

This packet returns qualified source for the independent surveillance pointer correction. It is not a 2.15.0 rescan or release/operational acceptance. Only after a separately accepted pointer merge at actual Q may General decide the existing no-input rescan, with fresh exact-platform inventories/provider digests and cleanup. Immutable release source/tag/image, frozen Workflow 2.20.2 observer inputs, every #275 operational/cohort/operator-stop hold and old P=M exclusion remain unchanged. No local image build/scan, image-layer retrieval, registry/release/latest/observer/tuple/examples/native-inspector/stopped-evidence/downstream/Cloud operation was performed.

[rmcdaniel]

Security exact-head source disposition — PASS

PASS for source integration at head 877751ba7b87fe51b122fca58152db1554aaf886, base/actual main 6169c60baab602540a1ae3cc13c790eaf0fbdc6f, tree 8c6d0415226b882e5570c6fe128e513c3880c554. General retains the merge decision. No scan, image, cohort, observer or downstream operational gate is cleared by this source PASS.

Independent source review confirms one commit, one file and one value only: release/service-image-security.json changes stable_image from the accepted 2.14.0 index to docker.io/durableworkflow/waterline@sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e. The pinned Trivy image and 24-hour database age remain byte-identical. The PR is CLEAN, draft, auto-merge absent, and actual main still equals the reviewed base.

The new value is the immutable index Security accepted before publication in 6628862252. Fresh anonymous Docker Hub reads now independently establish:

• tag 2.15.0 raw index SHA-256 and Docker-Content-Digest both equal b660ad03…56b7e;
• the index contains exactly the reviewed amd64 manifest c8aa5bd2…f291d, arm64 manifest 69143a41…cc789, and their corresponding BuildKit attestation manifests 8c530a9e…a9a6a and dc306bf5…f0ec4;
• fresh manifest hashes equal both advertised platform digests;
• after following the registry blob redirects, fresh config hashes equal 9eb4300a…f1519 (amd64) and 447a5ea7…a224b (arm64); both configs identify release 2.15.0 and source 275bd59334726cdaa40594618b673eedaedbabe6;
• the annotated Git tag remains object 0ac99f5b…9fb60 peeling to that source, and fresh Packagist 2.15.0 source/dist references equal it.

Authoritative exact-head checks are now terminal: 35 SUCCESS, 4 intentional policy/path skips, 0 failed, 0 pending. Build 41861006141 is success at the exact head, attempt 1, including stable-release/provenance contracts, all database/Laravel jobs and final target qualification. The earlier provider metadata mismatch is resolved by current terminal API state; log completion was never used as a substitute and no duplicate run was needed.

Two local read setup mistakes are excluded from evidence: my first Contents API commands left ?ref= unquoted under zsh, and my first config-blob fetch omitted redirect following and therefore wrote empty files. The corrected quoted API calls and curl -L config reads produced the exact identities above. No image layer, local image, build, scan, workflow dispatch, registry write, Release, observer, stopped task, tuple, example, downstream or Cloud action was performed.

This pointer update does not claim that 2.15.0 has been rescanned by the protected no-input workflow. After an accepted merge, General may separately decide that rescan under its existing exact-platform, provider-digest, database-freshness and cleanup gates. All #275 cohort/observer/stop conditions and the old P=M exclusion remain in force.

[rmcdaniel]

Owner fresh source carry — General retains merge

Following General's lift of the broad incident hold for ordinary source delivery, fresh GitHub and Git readbacks retain exact head 877751ba7b87fe51b122fca58152db1554aaf886, actual base/main 6169c60baab602540a1ae3cc13c790eaf0fbdc6f, tree 8c6d0415226b882e5570c6fe128e513c3880c554. The draft is CLEAN, open, and unmerged. Its working tree is clean and fully pushed; the entire delta remains one file/one stable_image value. Scanner digest and 24-hour age policy remain unchanged.

All exact-head provider checks remain authoritative and terminal: 35 successes, four expected policy skips, zero failures/pending, including successful original run 41861006141 / attempt 1. No rerun or replacement was needed.

The latest independent Security source PASS binds this same head/base/tree. It was freshly read back; SHA-256 after trimming the final newline is 18d755e6634061742fece895b0d9a9aa4b3d73c0ebf823ebb19dfffca498f544, matching Security's supplied text digest. The exact API body's SHA-256 including that newline is cd68c8b8e396ec6d83acb39cbf143e718f9aa6d9e28d84f9ca48d99a884b8264. Its independent anonymous image/tag/config/Packagist review retains accepted fixed 2.15.0 identity. The original owner identity/policy packet and terminal source packet otherwise remain applicable; the earlier broad incident-hold statement is historical.

This is the requested carry for General's one normal source merge decision. Any intervening head/base change needs fresh carry review. After an accepted pointer merge at actual Q, the existing no-input surveillance rescan still requires General's separate decision and fresh exact-platform/database/provider-digest evidence. No scan dispatch, source push, duplicate CI run, image/registry/release/latest/observer/tuple/examples/stopped-work/downstream/Cloud action was taken in this carry. All #275 frozen identities/cohort/operator-stop gates and old P=M exclusion remain separate and unchanged.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge ade2b459d566070af65ab062ed73599542fbd6df has ordered parents 6169c60baab602540a1ae3cc13c790eaf0fbdc6f and 877751ba7b87fe51b122fca58152db1554aaf886, with tree 8c6d0415226b882e5570c6fe128e513c3880c554 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #277 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Owner ordinary exact-main acceptance — PASS; scan dispatch held

Fresh actual main is Q ade2b459d566070af65ab062ed73599542fbd6df, with ordered parents 6169c60baab602540a1ae3cc13c790eaf0fbdc6f and reviewed head 877751ba7b87fe51b122fca58152db1554aaf886. Tree 8c6d0415226b882e5570c6fe128e513c3880c554 equals the independently Security-reviewed candidate. The complete change remains one policy value; scanner digest and 24-hour database-age policy are unchanged.

All 37 exact-Q provider check runs are authoritatively terminal: 33 successes, four expected skips, zero failures/pending. All six ordinary main workflows report terminal success at Q: build 41878101064, CodeQL 41878100625, Public Boundary 41878100910, service-image smoke 41878100887, service-capacity tuple 41878100779, and Sonar 41878100817. Build event is push, attempt 1; its individual job metadata also reports terminal success/expected skips. No conclusion is inferred from logs and no duplicate run was required.

Policy SHA-256 remains a6e6a816c338227b9b8ab965af5203e5217fe75d509038b61791d907d63c786a; the existing scan workflow SHA-256 remains 350c01de49b35265a816c1d65a15a1456d5ad7f307b417b68b9f532ed891816d. The pointer selects accepted sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e. Branch cleanup is complete locally/remotely; the checkout is clean at Q.

This completes ordinary main source acceptance. The sole-executor scan assignment remains unused: zero scan-dispatch POSTs, no scan run handle at Q, and no local image build/scan or runtime allocation. General's new incident dispatch hold remains independently binding. After that hold is explicitly lifted or separately reviewed, fresh exact-Q/workflow/policy/index/children/tag/source and duplicate-run checks are still required before the one authorized dispatch. This source PASS does not clear the scan or any other #275 operational/cohort/operator-stop gate, change the frozen release/image, or transfer old P=M authority to Q.