[rmcdaniel]

Workflow 2.28.1 raises the Laravel floors to ^12.72.0|^13.41.0 for the three November security advisories and refreshes active policy, fixture and example locks. Historical result locks remain unchanged. Runtime, schema and feature source are byte-identical to immutable published 2.28.0.

This is the narrow maintenance backport accepted as c090506c, tree 43577e98, on release/base-2.28.1. It preserves the declared PHP minima, including PHP 8.3 for the HTTP example. Product train is exactly 2.28.1. Other main features and the set-aside #1130 release path are outside this patch.

Published and qualified: Stable/Latest 2.28.1, public Release 444999472. Immutable annotated tag 98021fdb points to accepted c090. Ordinary Packagist P2 and the public dist both select c090. Published ZIP SHA-256 is 11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f; all 1,296 exported bytes/executable semantics match source. Exported Laravel contract SHA-256 is 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7.

Validation:

• Exact corrected source full dispatcher 43530294507 passes, with full quality, unit/coverage, backend/corpus and upgrade checks. The accepted merge tree equals the reviewed/tested 7376 source. All declared-minimum lock/platform controls pass; the original PHP 8.3 lock incompatibility and local worker-clock race remain recorded with their corrections.
• Protected published Release Verification 43554066029 passes all six jobs: normal registry package install with zero advisories and five Laravel 12/13 journeys across PHP 8.2/8.3/8.4, stable v1 1.0.82 → embedded 2.28.1 → rollback 1.1.1.
• Independent terminal package/installed Security PASS, followed by public Release HTTP 200, Latest API and normal-P2 readback. The earlier tag-triggered run 43536522238 remains NONPASS for stale normal-P2 propagation; its wait, guards and tag were not changed.

Documentation adoption is live through Docs #545. Protected Pages 43559604709 passed at accepted 4e85eba5; independent producer readback confirms that the public stable selector exactly equals accepted source (SHA-256 fbbe991205d82a231bdd228173cef9c20c20d82933c4235c4773474ec08bea63). The Docs owner records all 48 public pages/eight locales and preserves the separate PHP bridge/other-consumer scope.

Final publication and consumer handoff. Workflow #1133 is complete. SDK #422, Sample #345 and affected embedded consumers retain their own source/installed/deployment gates. The merged topic is independently absent; the maintenance branch and immutable tag are retained. No PHP Server or 2.29 release is selected.

[rmcdaniel]

Security source/lock rebind: PASS for draft 8b6942f21f97b0fc5ae725ddd7051cf6a48a22d9 / tree a759b7d78247aa12d72dd46eb77a5af6e2f65b17, scoped to the narrow 2.28.1 preparation.

Independent comparison establishes:

• the PR base 8ac207dafcce76858941061fe65bd29810930fbf is exactly immutable tag 2.28.0;
• the patch changes exactly 20 paths; after excluding root composer.json and CHANGELOG.md, all 18 remaining blobs are byte-identical to the reviewed Laravel-floor source at 7ddff6b3938dbdd5002485a91cc3fbec0fad71d7;
• root composer.json equals that reviewed source except for the intentional exact product train 2.28.1; PHP remains ^8.2 and the selected Laravel floors are exactly ^12.72.0|^13.41.0;
• the changelog adds only the dated 2.28.1 security-floor entry and does not carry the unreleased redrive/Saga/timeout-cleanup/entity-reference entries from main;
• the entire runtime src/ tree, feature tests and fixtures are byte-identical to published 2.28.0; no schema, runtime behavior or unrelated feature source is included;
• git diff --check is clean, and neither a 2.28.1 tag nor GitHub Release exists.

This clears only the exact source/lock backport composition. Keep the PR draft. Exact-candidate ECS/Stan/unit/coverage/feature, affected installed consumers, package/archive identity, protected publication, registry readback and downstream selection remain required before any tag. This verdict does not retry or replace the set-aside #1130 step and does not authorize 2.29 or any retired PHP Server release.

[rmcdaniel]

General product/backport-scope disposition: PASS for 8b6942f21f97b0fc5ae725ddd7051cf6a48a22d9 as a narrow 2.28.1 security maintenance candidate from published 2.28.0.

I independently compared its complete tree with immutable 2.28.0 (8ac207da) and the reviewed advisory successor 7ddff6b. All runtime PHP, feature tests, schema, workflows and publisher bytes are unchanged from 2.28.0. Eighteen of the twenty changed files are byte/mode-identical to that advisory successor, including the active locks, security/upgrade policy, minimum-PHP regression controls and measurement guidance. The only remaining differences are the security-only changelog and root Composer product train 2.28.1; the new Laravel constraint is the selected ^12.72.0|^13.41.0. The existing PHP floor remains unchanged.

This is the selected security-release scope. Keep entity references, retained Saga, new child-start APIs and other unreleased main work out of this patch artifact. They retain their own acceptance and release work. In particular, this does not select or retry the stopped #1130 qualification, its caller/runtime packet or a 2.29 release.

Workflow retains exact source/lock Security rebind, the complete quality/backend inventory, affected installed consumers, normal accepted-source/publisher eligibility and exact package/tag/readback gates. No tag, publication, installed result or override of those gates is supplied by this product/backport verdict.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.08%. Comparing base (8ac207d) to head (7376de5).

Additional details and impacted files

@@                 Coverage Diff                  @@
##           release/base-2.28.1    #1141   +/-   ##
====================================================
  Coverage                94.08%   94.08%           
====================================================
  Files                      633      633           
  Lines                    86584    86584           
====================================================
  Hits                     81466    81466           
  Misses                    5118     5118           

Flag	Coverage Δ
v2	94.08% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rmcdaniel]

The local 2.28.1 feature cohort stops at shard 3 with one failure (525 cases / 4,866 assertions): testTaskWatchdogReclaimsExpiredActivityTaskLease expected the frozen October close time but observed actual November wall time. The exact candidate's complete hosted workflow passed independently. The local failure remains NONPASS.

Source diagnosis: the feature harness starts two queue workers in setUp. This test manually drives its workflow and watchdog under a frozen past clock. Its wake helper clears the background throttle and runPass(false) re-arms a short normal throttle, allowing a live worker to expire the same attempt with its real clock. Several other synchronous cases already stop those workers explicitly.

A test-only successor now stops the unrelated queue workers before installing the frozen clock. Every original lease, closure, history, retry and dispatch assertion remains unchanged; production source and publisher files remain byte-identical to 2.28.0. Focused causal checks and a fresh complete feature/candidate gate are next, with exact source rebind before tagging. The 8b review and results retain their original scope; nothing has been tagged or published.

[rmcdaniel]

General maintenance-scope rebind PASS for 7376de5e809e21ca5916700abe678c0c02c68e59, as a test-only successor to the reviewed 2.28.1 candidate 8b6942f.

The entire delta is three added lines in testTaskWatchdogReclaimsExpiredActivityTaskLease: stop the fixture's existing background queue workers before the manually driven case installs its frozen clock. It changes no production source, runtime behavior, publisher, version/train, package constraints or lockfile. The original lease, close-time, history and retry assertions remain intact. The helper controls only the test harness's queue workers.

This stays within the selected security maintenance scope. The full ordinary dispatcher 43523060857 independently passed on 8b with 23 successful jobs and five intended skips; that is separate evidence from the maintenance PR's four checks. Its outcome does not replace the newly required exact-successor controls and fresh normal dispatcher/full feature completion. The original local frozen-clock failure stays NONPASS. Normal accepted-source merge, immutable tag/train, existing Release Verification and registry/downstream readback still precede delivery. No tag, #1130 retry, 2.29 selection or retired PHP Server release is supplied by this source rebind.

[rmcdaniel]

Security exact successor rebind: PASS for 7376de5, scoped to the test-only correction on the already reviewed 2.28.1 source.

The complete delta from reviewed 8b6942f is exactly three lines in tests/Feature/V2/V2WorkflowTest.php. It stops the fixture queue workers before this manually driven watchdog case installs its frozen Carbon clock. The same class already uses this isolation pattern in synchronous selection cases. Every production, lock, policy, version, publisher and package byte remains unchanged; the original workflow, lease, retry, close-time, history and dispatch assertions are untouched. Diff hygiene is clean.

The original local wall-clock race remains a NONPASS observation and is not relabeled. This clears only the exact source composition. Keep the draft and require exact-head normal dispatcher, full unit/coverage/feature completion, affected installed consumers, package/archive identity, protected publication and registry/downstream readback before any 2.28.1 tag. No 2.29 selection or set-aside 1130 retry is inferred.

[rmcdaniel]

Exact security-only head 7376de5e809e21ca5916700abe678c0c02c68e59, tree 43577e9831cccfdfe1d50cb3603ca2bb1be194bf, has completed its pre-tag source qualification.

• The existing full source dispatcher 43530294507 is terminal SUCCESS at this exact head: style/static, corpus, all six MySQL and six PostgreSQL shards, MariaDB/tracing, and both installed stable-v1 → source-v2 → rollback journeys on PHP 8.2/Laravel 12 and PHP 8.3/Laravel 13. Covered unit: 6,022 cases / 82,423 assertions / 49 declared skips, 15 PHPUnit notices, no failures/errors. Combined unit/MySQL line coverage is 93.88%, passing the 93.08% ratchet. Unit Clover SHA256: 8501cf93d109a7ca13f4c51e6845144eedc8855d84cd59caf7f33642a48be76f.
• The fresh local full six-shard MySQL run passes 3,018 cases / 31,090 assertions, no failures/errors, three existing PostgreSQL-only projection-trigger skips. One full collected inventory matches all six JUnits exactly once: zero missing, extra or duplicate identities. Inventory SHA256: f5a0191b0f36094dd57bf940998583145d82878f7b3db978f6a72ddaf9c7996c.
• The committed product train, source-release getter, root PHP/Laravel constraints and embedded-v2 authority agree on 2.28.1 and ^12.72.0|^13.41.0. The emitted committed-source platform manifest is SHA256 c2941a7fc03f227df1974fdaf68037f0f8f756466a8d677ed7f37afea7f24243. This is a pre-tag source check; actual published-package verification remains next.
• All 2,444 tracked source blobs and declared Git modes remain exact. All recorded local QA IDs, services and the owned network are independently absent. Old 8b uncovered unit remains 6,022 / 82,418 / 49 skips; every unit/runtime/config/fixture input equals 7376. Its redundant covered-unit attempt was stopped after the fresh current-head CI passed and retains exit 137, not a PASS. Original frozen-clock local failure and the causal old-fixture failure remain NONPASS.

Independent Security and General source/lock/fixture reviews retain their exact scopes. The patch has 21 changed paths from immutable 2.28.0; all runtime, schema, workflows and scripts remain byte-identical to that published base. No 2.28.1 tag exists yet. Next: normal non-bypass merge to the maintenance base, exact tested-tree verification, a new immutable 2.28.1 tag, then the unchanged push-tag Release Verification with actual registry/source/contract and installed published journeys. No #1130 retry, 2.29 selection or unrelated main feature enters this patch.

[rmcdaniel]

PR #1141 merged normally to the maintenance base at c090506cafa011335fcd5db07b7da79945fe83db. Its tree 43577e9831cccfdfe1d50cb3603ca2bb1be194bf exactly equals the reviewed/tested 7376 tree; its parents are immutable 2.28.0 and the reviewed security head.

New annotated tag 2.28.1 has tag object 98021fdb3c277e41413b3ec87da578b90fac8325 and resolves to that accepted maintenance commit. The product train is exactly 2.28.1. GitHub tag creation used the repository's existing OrganizationAdmin creation exception; no rules were changed. Published-tag update/deletion protection has no bypass actors, and no published tag was moved or reused.

The unchanged push-tag Release Verification 43536522238 is running against that exact accepted source. Actual Packagist availability, installed package/source/contract readback and the published upgrade journeys remain gates. No GitHub Release or downstream acceptance is claimed yet. The security-only maintenance branch does not move main or include Entity/child/Saga/clock source.

[rmcdaniel]

The first push-tag Release Verification 43536522238 is terminal NONPASS: its normal Composer P2 metadata wait exhausted the fixed 20 attempts without listing 2.28.1. Product installation/platform-contract and published upgrade jobs did not run. No installed qualification is claimed.

The separate Packagist package API already lists 2.28.1 at accepted source c090506cafa011335fcd5db07b7da79945fe83db, with the exact patched requirements. Its public dist SHA256 is 11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f; all 1,296 exported file bytes and executable modes match git archive of that accepted commit. The exported Laravel authority SHA256 is 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7, declaring PHP ^8.2 and Laravel ^12.72.0|^13.41.0.

The normal P2 endpoint still lists 2.28.0 as latest and returns a 900-second cache lifetime. The active push webhook returned HTTP 202; no hook/rule/registry setting was changed. The tag remains immutable. Next: observe the normal P2 endpoint exposing this exact source, then use the existing Release Verification manual dispatch from accepted main for tag 2.28.1. No rerun-attempt admission bypass, widened wait, new workflow, #1130 retry or changed tag is proposed. GitHub Release and consumer qualification remain pending.

[rmcdaniel]

Security bounded read-only accepted-tag/package review: PASS for immutable source and public archive identity; registry/installed qualification remains open.

• Annotated tag object 98021fdb3c277e41413b3ec87da578b90fac8325 resolves to accepted maintenance commit c090506cafa011335fcd5db07b7da79945fe83db. Its tree 43577e9831cccfdfe1d50cb3603ca2bb1be194bf exactly equals the reviewed and tested 7376de5 tree.
• The Packagist package API entry for 2.28.1 binds both source and dist to that exact commit and declares PHP ^8.2 plus Laravel ^12.72.0|^13.41.0.
• The actual public dist is SHA-256 11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f. All 1,296 exported file bodies and executable-mode semantics equal git archive from the accepted commit.
• The exported resources/laravel-embedded-upgrade-contract.json is SHA-256 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7, matching the accepted source.
• No GitHub Release exists for 2.28.1.

The normal Composer P2 endpoint still lists 2.28.0 as latest and returns max-age=900. Therefore protected run 43536522238 remains a valid NONPASS: its 20 bounded waits exhausted before installation, platform-contract checks or published upgrade jobs ran. This review does not relabel that run or authorize a moved tag, bypass, widened wait, GitHub Release or downstream acceptance.

Next gate: after normal P2 exposes 2.28.1 at the exact accepted source, use the existing Release Verification manual dispatch from accepted main and review the installed published-package journeys.

[rmcdaniel]

Additional read-only registry diagnosis: Packagist metadata changes now records durable-workflow/workflow updated at 2026-11-14 00:47:45 UTC and its dev metadata at 00:50:08 UTC. This independently proves Packagist accepted the repository update.

The normal P2 object still lists 2.28.0 and reports Last-Modified: Fri, 13 Nov 2026 03:31:21 GMT. Packagist documents this exact race: after an update action, P2 can remain outdated during internal mirroring, and consumers should wait until its Last-Modified is at least the update action time. See https://packagist.org/apidoc under Track package updates.

Therefore the current evidence points to provider-side P2 propagation lag, not a failed GitHub hook. Do not spend or expose a Packagist credential on a duplicate refresh while the accepted update is already present in the provider feed. Keep the first protected verification NONPASS and continue the existing bounded P2 observation; dispatch the accepted-main manual verification only after P2 exposes exact source c090506cafa011335fcd5db07b7da79945fe83db.

[rmcdaniel]

Security read-only Packagist propagation diagnosis at 2026-11-14 02:10 UTC:

• the public package API already lists 2.28.1 / normalized 2.28.1.0, source and dist reference c090506cafa011335fcd5db07b7da79945fe83db, timestamp 00:45:51 UTC;
• the install-facing P2 feed still contains no 2.28.1 entry;
• the P2 response is the same 453,508-byte object with ETag "6af68489-6eb84", Last-Modified: Fri, 13 Nov 2026 03:31:21 GMT, and 900-second public cache policy. The CDN reports that object cached at 00:49:08 UTC;
• a unique read-only query URL plus Cache-Control: no-cache returned the same ETag, last-modified value, length and absent entry. This is not just the first edge response observed by the failed verifier;
• the ~dev P2 feed also contains no 2.28.1 entry.

Therefore protected run 43536522238 remains a valid terminal NONPASS at the registry-install boundary even though the package API and public archive identities are correct. Do not retry the unchanged verifier until the ordinary P2 feed exposes the exact c090 record. No Packagist metadata refresh/update request, credential use, tag movement, release creation or verification rerun was performed by this diagnosis. The Workflow release owner retains any authorized normal reindex/propagation action.

[rmcdaniel]

Normal Packagist P2 propagation is now verified at 2026-11-14T03:54:09Z. The ordinary https://repo.packagist.org/p2/durable-workflow/workflow.json response lists 2.28.1, with both source and dist bound to accepted c090506cafa011335fcd5db07b7da79945fe83db, product train 2.28.1, PHP ^8.2, and Laravel ^12.72.0|^13.41.0. Response SHA-256 is f239e71f673a828519bbaa45948c7c98e7cf1845fc50321226d6c265b0acc641; Last-Modified is 2026-11-14 03:38:05 GMT, later than the accepted provider update feed. This is the normal index, with no mirror, cache-bypass selector, moved tag or widened wait.

The original protected push-tag run 43536522238 remains NONPASS for the earlier stale index, before installation. A fresh invocation of the existing manual Release Verification is now 43554066029, from accepted main 42bcc5d2, selecting tag 2.28.1 and sqlite_timer_qualification=false. The verification scripts remain byte-equal to the tag; the reviewed workflow-only APT setting is unchanged by subsequent Core integration.

Installed/package verification and its final independent readback remain required before the GitHub Release and qualified downstream handoff. No #1130 timer qualifier, packet, caller, runtime or 2.29 selection is invoked.

[rmcdaniel]

Security independent terminal package/installed readback for Workflow 2.28.1: PASS in the maintenance-release scope.

I independently read protected workflow-dispatch run 43554066029, exact accepted-main head 42bcc5d28f45b1ebbe94fa77662bb190e0d051ba. It is terminal SUCCESS. The primary published-package job and all five upgrade jobs completed successfully.

Current Packagist P2 independently resolves durable-workflow/workflow 2.28.1 to exact source and dist reference c090506cafa011335fcd5db07b7da79945fe83db, with php ^8.2 and laravel/framework ^12.72.0|^13.41.0. The protected package job installed durable-workflow/workflow (2.28.1) with Laravel 13.42.0, reported No security vulnerability advisories found, completed the platform/conformance checks, and retained terminal outcome pass with caller-owned Composer cleanup pass.

The published upgrade journeys each ended status=passed, preserving stable v1 1.0.82, selecting embedded v2 2.28.1, and proving rollback 1.1.1 for:

• Laravel 13 / PHP 8.4
• Laravel 13 / PHP 8.3
• Laravel 12 / PHP 8.2
• Laravel 12 / PHP 8.4
• Laravel 12 / PHP 8.3

This closes the exact normal-P2, published-package installation and maintained upgrade-matrix gates for 2.28.1. The original pre-propagation push failure remains historical NONPASS. This verdict does not create or approve a GitHub Release, retry #1130, select a 2.29 release, or qualify unrelated downstream/installed cohorts.

[rmcdaniel]

Workflow 2.28.1 is published and qualified. Stable/Latest GitHub Release 444999472 is public, non-draft and non-prerelease, published at 2026-11-14T04:00:11Z from maintenance branch release/base-2.28.1. Annotated tag 98021fdb3c277e41413b3ec87da578b90fac8325 remains unchanged and points to accepted c090506cafa011335fcd5db07b7da79945fe83db, tree 43577e9831cccfdfe1d50cb3603ca2bb1be194bf.

The ordinary Packagist P2 index selects exact 2.28.1 source/dist c090506c. The published archive SHA-256 is 11f4a4b41995a2d94d886c5191885c7a779d95d5169bb48a1d63259a00cb7f2f; all 1,296 exported file bytes and executable semantics match the accepted source export. Exported Laravel contract SHA-256 is 153a261371272e0fa8e0a6e79dbe425b9adc311cbe596ce0237575a78b0828a7: PHP ^8.2, Laravel ^12.72.0|^13.41.0.

Protected Release Verification 43554066029 is terminal SUCCESS, six successful jobs. It verifies the normal published package and install (zero security advisories), then all five Laravel 12/13 journeys across PHP 8.2/8.3/8.4: stable v1 1.0.82 → embedded 2.28.1 → rollback 1.1.1, all passed. Independent terminal package/installed Security PASS is durable. Public Release HTTP 200, GitHub Latest API and normal P2 were independently read back after publication.

This is the security-only patch from published 2.28.0. Runtime, schema and feature source remain identical to 2.28.0. SDK #422 can now add this new versioned authority fixture and repeat its unchanged strict embedded-to-service transition. Sample #345 and affected embedded consumers retain their own source/installed/deployment gates. Historical fixtures stay immutable. No Saga/Core/child feature acceptance, PHP Server release, disabled #419/#420 execution, #1130 retry, or 2.29 publication is implied.

The original tag-triggered verification 43536522238 remains NONPASS for the earlier stale normal-P2 index. Its wait, guards and tag were not changed. The merged topic is independently absent; the maintenance branch and immutable tag are retained.

[rmcdaniel]

Workflow 2.28.1 Docs adoption is delivered: Docs545 final receipt. Exact reviewed head e80f81b0b4a78606bf9ddeadd85f1711ea85b9e6 merged as 4e85eba5df4d0ac6ae987c2808c9b7d028375227 with full tree equality. All 14 head checks, all 12 actual-main checks and protected Pages 43559604709 succeed. All 48 public pages/eight locales select the current Workflow pin and preserve the current floors, named history, independent PHP bridge requirements, exact contract/publication links and reviewed guide text. Canonical/v2 model projections pass.

The public selector is byte-identical to accepted source, SHA256 fbbe991205d82a231bdd228173cef9c20c20d82933c4235c4773474ec08bea63; only Workflow 2.28.0 → 2.28.1 changed. Installers, specifications, catalog and other artifacts remain unchanged. Final normal P2 and versioned-contract readback reproduce c090 source/dist, PHP ^8.2, Laravel ^12.72.0|^13.41.0 and contract SHA153a. Archive SHA11f4/1296 files and the named producer package/installed evidence remain bound. Owned build container and remote branch are independently absent; source is clean.

This completes the Docs current-package/floor adoption slice. Historical result tuples and older release contracts stay historical. It supplies no PHP SDK strict-transition, new runtime/schema/feature, #1130 or 2.29 acceptance. SDK, Sample App, Waterline, Cloud and other installed/deployed consumers retain their own gates.