[rmcdaniel]

Moves the site's stable tuple from Server 3.0.5 / chart 1.0.3 to Server 3.3.2 / chart 1.1.0. It also documents the 3.0.x → 3.3.2 upgrade, which changes the native schema from 8 to 11. This follows the pattern of #437.

Chart tuple recorded

• Chart: 1.1.0, appVersion 3.3.2, image docker.io/durableworkflow/server:3.3.2.
• Source: chart source 0eea994a7f4796ceaec536604c7bd48af11124e2 (server#1117 head, merged as f3408663).
• Publish: Helm Chart Release run 42644498343. All three jobs succeeded, including the chart-testing kind install.
• OCI manifest: sha256:fd670cad2d12453f5d9923bacaec2ab6fba02ff7fe82570eee8f01f66bf73e89. This is the run's Digest: log line. An anonymous GHCR read returns the same Docker-Content-Digest, and the body hashes to it.
• Package digest: sha256:a72dc4fda8a1c8913d19ad6611558e938a74c6dc109dd973a8bfcbce799c2e5d. It comes from the run's helm-chart-release-evidence artifact (helm-release-evidence.json chart.package_digest), and the run log's "Anonymous OCI install passed … (sha256:a72dc4fd…)" line shows the same value. It is also the manifest's single chart layer. I downloaded that blob anonymously and it hashes identically, as does the artifact's durable-workflow-1.1.0.tgz. The packaged Chart.yaml says version 1.1.0 / appVersion 3.3.2, and its docs/UPGRADING.md is byte-identical to the file at 0eea994a.
• qualification_url: the readback on server#1117. ⚠️ That comment names the run, the OCI digest, the versions, the image and the source revision, but not the package digest. compatibility.md describes the receipt as recording "OCI/package digests". Either add a one-line follow-up with the package digest on #1117, or point qualification_url at the run instead (that is what afe563b did first).

What changes

• static/stable-releases.json: server 3.3.2, helm-chart 1.1.0, and the helm_chart block (app_version, both digests, source_commit, qualification_url). updated_at was already 2026-11-09.
• tests/kubernetes-workers/artifacts.json: Server 3.3.2 pinned by index sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. The hosted Published SDK workers on Kubernetes check is the gate for this pin. The SDK cohort is unchanged.
• docs/deployment.md:
  • New section, Upgrading from Server 3.0.x to 3.3.2 (#native-schema-upgrade-3-0-to-3-3). It lists the schema path: 8 → 11 on MySQL, MariaDB and PostgreSQL, and 8 → 10 on SQLite. It notes that the Server refuses with native_schema_upgrade_required and gives the Compose steps: stop, back up, then run --rm --no-deps server schema-upgrade, then start. It covers the PostgreSQL CREATE INDEX write block, the MySQL/MariaDB native_schema_upgrade_incomplete resume, and rollback only by restoring the backup.
  • The Helm section gains a paragraph for chart 1.1.0: scale to zero, back up, native.schemaUpgrade.enabled=true, the manual Job for GitOps, and why helm rollback doesn't help.
  • Both link the chart's Chart 1.1.0 / Server 3.3.2 UPGRADING section and the 3.3.0 upgrade notes.
• docs/polyglot/server.md:
  • The cluster-info example and the protocol note now use the 3.3.2 image.
  • The example adds supported_sdk_versions, client_compatibility (abridged) and the child_workflow_start_turn / condition_wait_occurrence_deadline capabilities.
  • The old note said native_unqualified includes supported_sdk_versions/client_compatibility. That is now wrong, because 3.1.0 serves both, and it is replaced.
• docs/polyglot/database-support.md:
  • The page is now bound to 3.3.2 release evidence: the release run smoke cold-starts amd64 and arm64 on SQLite, PostgreSQL 17 and MySQL 8.0 (digest-pinned). The exact-index Compose smoke 42602031026 runs 4/4 cells on mysql:8.0@sha256:62fb722c…. Both are accepted in the 3.3.2 delivery record.
  • The page says plainly that these are start/health smokes on empty databases. They are not upgrade, capacity or TLS qualification, and they report no engine patch version. No MariaDB receipt was found for 3.3.2. The 3.0.5 receipt stays as history.
• Translations: the same three pages in all seven locales, and their source-hashes.json entries for those three files only.
• Not changed:
  • The takeover statements ("qualified on the published 3.0.4 image") and the runbook pin a051f57f.
  • The note "takeover is planned for deprecation in the 3.1.x line". It is now historical-sounding, but I didn't check it against the Server repo, so it is left for a separate decision.

Evidence (local, lab4, amd64)

• Image probe: durableworkflow/server@sha256:4aeceb42… on SQLite, bounded to 1 CPU / 512 MiB.
  • /api/ready returns ready.
  • /api/cluster/info returns version 3.3.2, implementation rust, control plane 2, worker protocol 1.20, and the supported_sdk_versions / client_compatibility values shown in the example.
  • Worker register with protocol 1.0 → 201; 1.20 passes the version check (422 because the capability manifest is missing); 1.21 → 400 unsupported_protocol_version.
• Compose upgrade rehearsal (published 3.3.2 Compose file, MySQL 8.0, empty database):
  1. 3.0.5 runs healthy.
  2. 3.3.2 refuses with native_schema_upgrade_required.
  3. docker compose … run --rm --no-deps server schema-upgrade prints {"backend":"mysql","from_schema_version":8,"schema_version":11,"status":"upgraded"}.
  4. 3.3.2 comes up healthy and reports 3.3.2.
  5. 3.0.5 then refuses with native_schema_newer_than_binary.
• SQLite rehearsal: 3.0.5 database → 3.3.2 refuses → schema-upgrade prints from_schema_version 8 → schema_version 10.
• These are local controls on empty databases, not a qualification of upgrades with data, PostgreSQL or MariaDB.

Checks run

I ran these in a disposable node:24 container (uid 1000, --cpus 2 --memory 3g, removed afterwards), the same way qualification.yml does.

• Install: npm ci --ignore-scripts and npx --no-install patch-package.
• npm run build with DOCS_TRANSLATION_BASE=origin/main (42e3eed): passed. This includes:
  • dependency-security, node-toolchain, identity, helm-chart pairing, install-sdk, installer-source and server-config-reference;
  • the translation-update test and check-doc-translations.js ("Translation updates match reviewed English sources for 3 changed guides in all seven other locales", and code blocks match in all locales);
  • localized links, browser security headers, the Docusaurus build for all 8 locales, and llms generation.
• npm test: passed.
• scripts/public-artifact-versions.js: buildArtifactPins() resolves Server 3.3.2, chart 1.1.0, Git tag 3.3.2, the Compose URL at 3.3.2 (HTTP 200) and the UPGRADING URL at 0eea994a.
• Not run locally: the Kubernetes worker-guide qualify.py (kind). The hosted check on this PR covers it.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud