[rmcdaniel]

Operators need to see which open runs retain a version decision below a proposed minimum, including runs whose decision cannot be established. This adds a read-only Version usage page with all-state counts, explicit unknown reasons, exact instance/run links and live cursor paging. Missing markers and unavailable provenance remain unknown; there is no branch-removal verdict.

Embedded mode uses the accepted VersionUsageQuery::page() entry point and fixes namespace scope before the read. Service mode uses the official PHP SDK's typed workflowVersionUsage() call, including its capability discovery, authentication and request budgets. Older readers return an explicit 501 without counts. Query identities and cursors survive host trimming, signed thresholds stay exact, malformed responses fail, and late responses cannot replace a newer query.

Validation: 25 PHP response-contract controls and 10 controller tests (81 assertions), all 209 frontend tests, production asset build and manifest verification. The synthetic browser check passes 48 locale/theme/reflow/zoom/contrast cases with keyboard submission, exact links, opaque cursor continuation and refusal/recovery. Visual inspection also corrected a dark-theme read-only input contrast problem. These are source and UI tests, not installed-backend acceptance.

Refs #325 and the accepted cross-repository work. The embedded contract is accepted at Workflow c93cadad. The PHP SDK source interface is SDK #427, reviewed at bed228f1, and has not shipped. Published producer/SDK support and installed embedded/service acceptance remain required before #325 closes. This draft stays separate from the 2.18.1 security patch delivery.

Exact source 09c2713a has independent Security PASS and Sonar PASS. Current-head hosted checks are terminal: 29 successes, 3 declared skips, 5 PHP-setup HTTP 404 failures and their dependent target-branch aggregate failure. All database and visual checks passed. The setup failures are the shared archive dependency addressed by #324 and durable-workflow/.github#404; they occurred before this implementation ran. No merge or published-backend acceptance is claimed.

[rmcdaniel]

Security whole-source review: PASS for exact 47c269bf8d7129f5b4c37b64ee92ec9d645dd5b0 / tree a5b7075db60bc0842a4efed30f2f6b25db567436, scoped to the read-only version-usage consumer.

I reviewed all 31 changed paths plus the adjacent Waterline authentication middleware, backend namespace configuration, remote exception rendering, accepted Workflow c93cadad producer, and reviewed SDK PHP bed228f1 reader boundary.

The source keeps the important trust properties intact:

• the normal Waterline authentication boundary still covers the route; service mode fixes the configured namespace before the SDK call, while embedded cluster-wide mode remains the existing explicit operator scope;
• raw query identities and opaque cursors are recovered before host trim middleware, bounded, and refused before either reader on malformed/foreign input;
• embedded mode calls only VersionUsageQuery::page(), and service mode requires the typed SDK method plus its control credential, advertised capability, namespace, and request budget—there is no raw HTTP fallback;
• both backend and browser consumers require the exact v1/query identity, reconciled all-state counts, recorded classification, open statuses, binary run ordering/upper bound, complete first terminal pages, full nonterminal pages, and cursor progress;
• unknown reasons remain unknown, failures/unavailable readers never become empty or current cohorts, and neither the API nor UI invents branch-removal authority;
• the UI binds continuation pages to the prior upper bound and last run, preserves exact run links, aborts stale reads, and retries the same refused opaque cursor.

No source/security finding on this exact head. This does not borrow delivery from the producer or SDK reviews: current-head CI, published Workflow/SDK support, and installed embedded/service acceptance remain required, and no runtime, branch-removal, or publication action is approved by this source PASS.

[sonarqubecloud]

Quality Gate passed

Issues
39 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.2% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The source successor is 09c2713a14ce7b68127ae18748d51f60ca1537b9 / tree f91ffaaf7706ecdc876177db54197ff5766264ee, directly after the independently reviewed 47c269bf.

This addresses the observed Sonar findings: the fully intercepted synthetic browser origin uses HTTPS; count/paging/run validation and controller error mapping are separated without changing their guards; loading and the keyboard-scrollable table use native output/section elements. Entered input values are not recorded by the contrast observer. Production assets were rebuilt and their manifest hashes verified.

The same 35 PHP tests / 81 assertions, all 209 frontend tests, and 48 source-browser locale/theme/reflow/zoom/contrast cases pass on this successor. Minimum measured text/control contrast is 5.42:1. The table retains keyboard focus for horizontal scrolling.

The four completed PHP-dependent failures on the predecessor are each the shared installer’s HTTP 404, before this implementation executes. The shared replacement remains blocked on the organization ruleset transition in durable-workflow/.github#404; it is not a failed version-usage assertion. Fresh source CI and the narrow independent rebind remain required. Published producer/SDK and installed embedded/service acceptance are still unfinished #325 work.

[rmcdaniel]

Security narrow successor review: PASS for exact 09c2713a14ce7b68127ae18748d51f60ca1537b9 / tree f91ffaaf7706ecdc876177db54197ff5766264ee, relative to reviewed 47c269bf8d7129f5b4c37b64ee92ec9d645dd5b0 / tree a5b7075db60bc0842a4efed30f2f6b25db567436.

I reviewed all nine changed paths and found no source/security regression:

• the PHP validator split retains the same closed response/count/run shapes, exact query identities, all-state reconciliation, first-page completeness, full nonterminal pages, advancing opaque cursor, run ordering/bounds, and recorded unknown/classification rules;
• the embedded and remote controller extractions retain the same capability gate and 422/501/502 error mapping;
• the JavaScript split retains the same signed-32-bit input rules, byte-order continuation boundary, counts/paging/classification checks, stale-read refusal, and retry behavior;
• output and the named section preserve native status/region semantics, while the scroll region remains keyboard-focusable;
• the synthetic browser origin is now HTTPS but every request is still intercepted and refused unless its origin is exactly https://waterline.invalid; no external request is admitted;
• the rebuilt app.js and components.css bytes match the MD5 identities recorded in mix-manifest.json, and the source delta is whitespace-clean.

This rebind is source-only. Current-head CI, published Workflow/SDK availability, and installed embedded/service acceptance remain separate required gates; this review does not borrow them from the predecessor or infer them from the synthetic browser fixture.