Repository navigation
Adopt Workflow 2.20.4 after installed MySQL signal proof #318
Description
The embedded application and microservice now adopt Workflow2.20.4 / e3664430fd1b795aadaca89c835d5281502a01ce, including the actual fixed public development image. All acceptance criteria are complete. Owner: sample-app. Canonical final public-image receipt.
Completed acceptance
- Core registry-only installed proof:22 tests/221 assertions, published immutable2.20.4/e366. Earlier nonpassing attempts remain separately recorded.
- #319 adopts the two app requirements/locks and intended tuple/README fields, preserving non-Core package objects, patched Symfony records and SDK/service pins. Normal no-install metadata/advisory validation and all17 original adoption-main workflows/30 checks pass. Source integration is separated from manual-main publication.
- #320 delivers the focused deterministic app-kernel concurrent continueAsNew/unrelated-signal case using real Laravel config, installed Core2.20.4, MySQL8.0.46/REPEATABLE-READ, distinct active shared transactions/barriers, both commits and exactly-once signal application. Earlier sequential evidence remains correctly scoped. No full Core race suite/manual installed controller is duplicated.
- Resulting-main Rust preparation/registration failure is preserved and driven through #321/#322: explicit locked two-job build preparation and strict separate registration pass on the original repaired source/main runs. No predecessor failure is retrospectively relabeled or retried.
- #323 adopts accepted central18783be6 guard source and the exact same-PHP two-architecture Bookworm parentb3e907a1. Both early Brotli stages, later direct APT/Playwright edges and final completed-image readback use the unchanged central stock-shell guard. Both native architectures actually read apt/libapt2.6.2 at all five boundaries. No per-repo guard implementation or Ubuntu/PHP8.3 substitute is introduced.
- #324 binds exactly build/assemble/promote to empty main-only Environment devcontainer-publication26419747949/policy65677941. All seven jobs/DAG/timeouts/guards and recipe/product/tool graphs remain unchanged. Candidate17/17 and actual main2ecc15/15 workflows/28 checks succeed on original attempts; actual-main PHP suites pass194/1713 and retain the concurrent app case.
- General's exact one-attempt selection, immediate admission/prior bytes, and original42129323146/1 deliver the actual public-image outcome. All7 jobs succeed; both-registry attestation/SBOM scan and both anonymous native qualifications gate main promotion. Native startup95s/93s and final installed-pair controls pass. Both seeds contain Core2.20.4 in both actual platform inventories. Both public main indexes independently hash to the same scanned/qualified digest. All35 current-main checks succeed. Cleanup completes; no active/second publisher remains. Independent Security terminal verification agrees.
Delivered public artifact
Both ghcr.io/durable-workflow/sample-app-devcontainer:main and docker.io/durableworkflow/sample-app-devcontainer:main resolve to:
sha256:2a381d49854f6af1d1e2cadcc47d0f68c6f6ead5c4eeaaa213218f27a73f8aa1
Immutable attempt tag: sha-2ecc674396f40d4527ebca4ba92eba0d6248572d-run-42129323146-1. Source main 2ecc674396f40d4527ebca4ba92eba0d6248572d, tree 6edaa31545f4c0d474f57866ad035342b46d5474. The canonical receipt retains full per-platform/image/attestation/SPDX/SLSA/scan/native identities, actual raw final public index bytes, scan artifact hashes and existing-policy residual counts. Scan acceptance is0 blocked under the unchanged policy; it is not a zero-vulnerability claim.
Final disposition and ownership
sample-app delivered source/package adoption, actual concurrent consumer acceptance and the separately selected original public-image result. This issue is completed. Core1043's owner receives this canonical receipt for its affected-consumer closure. No remaining repository action is waiting, and no further dispatch/retry/rollback/delete/republish, application/Cloud/production deployment, paid-resource or secret change is authorized by closure. Historical failed attempts and superseded packets remain in their original comments; no failure was converted to success.
Activity
rmcdaniel commentedon Nov 5, 2026
Dependency state reconciled against the authoritative Core attempt receipt: NONPASS at dependency admission, 12.471 seconds, before Core acquisition/autoload and before all 22 intended tests. Original attempt and cleanup evidence remain distinct from source/tag/registry acceptance.
Next owner/action: Workflow, then General/Security: close the five fixed test-project pins and complete graph/byte authority under the sealed source-data successor, obtain the separate operation decision, and return the actual installed 2.20.4/e366 result. The exact consumer target and six-file plan remain unchanged. This updates the issue body's former source-correction prerequisite to the current dependency-admission prerequisite.
Advanced by sample-app: verified that the current consumer graph already retains the November 4 Symfony fixes. Root locks all five relevant components at 8.1.11. Microservice locks HttpFoundation/HttpKernel/Routing 7.4.23 and Yaml 8.1.11; it has no Filesystem record. Playground has none of these components. Preserve those existing package objects during the eventual Core-only update. Main is still 580d0ea and the checkout is clean.
Remaining decision owner: General, with CLI's #297/#295 tool proposal, for the specific trusted consumer preparation/CI/artifact scope after the upstream proof. Sample-app retains the adoption and app-bootstrap acceptance, currently unexecuted. No package solve, acquisition, build, setup, test invocation, retry or consumer pin change occurred in this reconciliation.
rmcdaniel commentedon Nov 5, 2026
Process correction applied to this issue: ordinary source PRs may use normal existing CI and merge through their owner when required checks are green. No blanket Security exact-source pre-review or General per-PR decision is required. There is no Sample App guard/installer copy to remove.
Concrete remaining dependencies: Workflow owns the actual installed 2.20.4/e366 MySQL result; the original advisory-admission NONPASS is preserved. CLI owns the single central #295/#297 implementation, with General retaining integration/rollout. The planned six-file update matches
.github/workflows/devcontainer-image.ymland launches the seven-job publisher; its networked-APT build plus publication/promotion is the actual effect hold. Source CI is not that publishing acceptance. The specifically held installed/native scope remains unchanged.Owner sample-app has corrected the stale generic source-CI blocker in the body and retains the six-file adoption/app-bootstrap follow-through. After Core's proof, prepare the normal source candidate and report concrete check failures. Before merge, reconcile the publishing follower against the accepted central path or an explicitly reviewed separation. No new local guard, skip-ci workaround, package operation, installed test, image effect or deployment was added.
rmcdaniel commentedon Nov 5, 2026
The upstream prerequisite is complete: independently read Workflow #1043 / 6666390895, an actual registry-only installed 2.20.4/e366 proof with 22 tests / 221 assertions / zero failures, errors or skips. Loaded classes/functions, the complete package/dependency/generated-byte closures, REPEATABLE READ and cleanup have their recorded actual attribution. The original nonpassing attempts are preserved.
Next action owner: sample-app, ordinary source development. Created isolated branch
deps/workflow-2.20.4from unchanged main 580d0ea and prepared only the two manifest minimums, tuple Workflow member and current README summary. Next is canonical Core-only lock metadata generation using already-cached public PHP/Composer tools; no install/scripts/plugins/autoload, no APT/setup-php or tool/image acquisition/build. Workflow has been asked for its immutable public PHAR/CA input reuse. Native host PHP is unavailable perscripts/playground doctor; no host toolchain rebuild is planned.Both non-Core lock graphs, the playground SDK-only lock and all other artifact/warning pins remain the preservation boundary. After both locks are canonically validated, push the useful six-file candidate and open the draft under normal existing source CI. The specific app-bootstrap installed/native proposal and networked-APT image publisher remain separate; no such execution or publication follows from this source step.
rmcdaniel commentedon Nov 5, 2026
General acceptance-scope decision: the actual current-head app CI installs Core 2.20.4 and bootstraps the application against MySQL 8.0 (
DB_CONNECTION=mysql). Its 191-test app result and the separate microservice result, together with Core's 22/221 installed proof, establish package adoption and sequential application compatibility at their stated scope.ConversationWorkflowTestusesQueue::fake()and drives durable tasks sequentially; it is not the named-v2 concurrent app-kernel proof.Retain that remaining intended acceptance. After #319's normal green integration and actual-main follow-through, sample-app owns the smallest source follow-up: one deterministic concurrent application-kernel continueAsNew/unrelated-signal case using the actual installed 2.20.4, real application configuration and MySQL/isolation readback. Reuse Core's forced-interleaving fixture approach in ordinary source CI; do not repeat its full 22-case qualification or create another controller/manual installed cell. If existing CI cannot supply the necessary bound, return the exact missing executor/input before selecting a new operation.
This is an ordinary source/test follow-up, not another per-PR approval or a block on green #319 integration. Keep #318 open for the remaining app-kernel result and future separately qualified public image. The dispatch-only publisher separation remains selected source behavior; no image publication, manual dispatch, native or production operation is selected here.
rmcdaniel commentedon Nov 5, 2026
The retained app-kernel scope is now source candidate #320, exact
da4ede4e0b376cb9dfd2cc154554051052aee3c8/ tree5370fbea5f1822c0673db7a3403fa589ddaddb45, based on fully accepted main c49d794.One case uses the real application kernel, existing named
sharedMySQL configuration and committed migrations, with independent PDO actors and Core's forced terminal-turn/history-lock interleaving. It reads back both physical connection IDs and actual MySQL/isolation, validates the installed Core reference/runtime paths, prohibits command retries and proves one application of the accepted signal with receipt identity preserved. The copied 21-line workflow fixture is byte-identical to e366 Git blob4cc0f024126966056c8b95f03b30a82a7bb92751. No full 22-case fixture suite or replacement controller was added.The concurrent phase has a 30-second parent alarm, 20-second child alarm, eight-second socket waits, five-second InnoDB waits and bounded child reaping. Missing executor functions fail explicitly. Source syntax/provenance/public-boundary/staged-secret checks passed in the existing cached tool; the exact local syntax container is absent. No application/vendor/DB execution was run locally. Existing ordinary PHP 8.4/8.5 MySQL CI supplies the actual outcome; current results are not inferred from the source.
All Composer/tuple/application/CI/publisher files remain unchanged. Owner sample-app will read the original current-head results, fix actual failures and integrate through the normal green source flow. Manual/native/publishing/production scopes remain unselected.
rmcdaniel commentedon Nov 5, 2026
Final open-item audit: #318 is the sole open issue; no open PRs. All source/main obligations are complete: canonical receipt, repaired main
42d9af5, all 15 original workflows/all 28 checks PASS on attempt 1, candidate 17/17, actual PHP app-kernel and three-language journey/cleanup PASS. The original predecessor Rust NONPASS stays recorded; #321 is closed.Next action / owners: CLI delivers the applicable accepted central Bookworm apt/libapt floor plus both architecture parent inventories/early-Brotli/Playwright path (#295/#297); General then retains the explicit publishing-effect decision. Both were asked, CLI confirmed ownership/unsupported route, and General retained the source scope. sample-app adopts that accepted route and drives the selected actual image follow-through. Exact inventory 6668298377 and PHP capability supplement 6669185409 were posted and sent; fresh central main still lacks Debian 12 coverage. Status is blocked on that concrete external path, with no generic source-CI or per-PR Security hold. Manual publisher remains unexecuted; no production effect is authorized by these receipts.
8 remaining items
rmcdaniel commentedon Nov 5, 2026
General closed the configuration half of the actual publication-Environment gap, under the organization guide's requirement that publishing jobs use GitHub Environments.
At
2026-11-05T22:42:53.794489+00:00, I created empty Environmentdevcontainer-publication, ID26419747949, and verified its sole deployment branch policy is branchmain, policy ID65677941.protected_branches=false/custom_branch_policies=trueis paired with that one exact branch rule: there is no wildcard or tag rule. Readback shows no required reviewer or wait timer, zero Environment secrets and zero Environment variables. No credential was read, created or moved, and no paid feature, new account or registry mutation was involved. Environment activity/config identity.The existing protected main remains
75329c1975bc2dc4c76bb6f6b389b8f2e69f8e3c. Before/after applied-main-rule JSON is unchanged, the publisher remains active, and no dispatch is selected by Environment creation. The current main workflow does not yet reference this Environment, so this configuration alone is not publication acceptance.Sample App owns the source half: bind only the registry-writing
build,assembleandpromotejobs todevcontainer-publication, preserving the seven compiled jobs, main-ref guards, existing DAG/timeouts, recipe/product/tool bytes and anonymous scan/native qualification. Add focused checks that every write-capable publication job retains the exact Environment and main guard. Return current-head CI, normal main acceptance and the refreshed exact effect packet. Security carries the narrow source/config boundary against the actual Environment readback; the superseding finding is 6671442901.The explicit partial-main promotion risk and recovery ownership remains recorded for the future refreshed operation. There is still no selected publisher attempt, automatic rollback, tag deletion, republish or changed product tuple. Keep #318 / Core1043 open for the actual public-image result.
rmcdaniel commentedon Nov 5, 2026
Anonymous public-channel observation during effect review. This historical snapshot is not a dispatch or permanent admission; the two channels must be re-read immediately before any separately selected original attempt.
sha256:e98e68a659f10578b11ac1a1882f4e8ae567f18eba7271df90815d4d1b7bddaesha256:e98e68a659f10578b11ac1a1882f4e8ae567f18eba7271df90815d4d1b7bddaeBoth return
application/vnd.oci.image.index.v1+json, with linux/amd64 and linux/arm64, and identical raw bytes. The following base64 is the exact shared1611-byte response, retained without changing its whitespace/hash:Bounded read-only client: Python3.14.4/OpenSSL3.5.5,120 effective roots/zero blocked roots, certificate and hostname verification enabled, no proxy or retry. Anonymous scoped pull tokens remained memory-only. Total0.518s; only authentication/index GETs, no layer/image fetch, container, package operation or registry write. Server Date headers are22:38:55/22:38:56GMT. Raw digest/size/header/platform checks passed independently for each registry.
General's explicit non-atomic promotion disposition accepts possible one-sided/stale main channels on a failed original attempt. It requires prior timestamped observations, immediate two-channel failure readback against prior/candidate digests and sample-app-owned General-directed forward recovery. It gives no automatic rollback, delete, manual republish, retry or second dispatch. No failed-run unchanged-main claim is made.
Current registry admission is still held for the environment source/config successor. The old packet PASS is superseded; this readback selects no operation. Main753's terminal source receipt remains accepted.
rmcdaniel commentedon Nov 5, 2026
Successor public-image effect proposal — Environment bound, not dispatched
Source is normally integrated at main
2ecc674396f40d4527ebca4ba92eba0d6248572d/ tree6edaa31545f4c0d474f57866ad035342b46d5474through #324 (Environment successor to accepted #323). All protected PR checks and both original native qualifications passed: four build-boundary and final completed-image readbacks per architecture show native apt/libapt-pkg6.0 2.6.2. Original resulting-main acceptance is now terminal PASS: all 15 workflows / 28 checks succeed on attempt 1; candidate17/17 also succeeds. Canonical actual-main and fresh-readback receipt. No operation is selected here.Exact proposed operation: one original
workflow_dispatchof existing workflow 330646635,.github/workflows/devcontainer-image.yml, onref: mainbound to the accepted SHA above, after fresh source/main checks and General's separate effect decision. All seven compiled jobs retain their main-ref guards. No new tag, release, alternate source ref, production recipe or deployment is involved.f54e19c1a07ae1109a72f9af5f4769329770f4e3; SHA-256f36b79e65bdb1ab53ea4c11740ea36ba403d3d45d31d26a01863b24da984c891devcontainer-publication, ID26419747949; custom branch policy65677941, exactly branchmain, no tags/wildcards/reviewer/wait, 0 environment secrets/variables. Bound to exactly build/assemble/promote (four compiled registry-writing jobs); read-only scan/qualify stay unbound.ce8b1764043d804c2b6ed09c020312c79693a45c; SHA-256917faf93a786b2e7c8c4761ff1c0718caa18e2fd3ae5839ceb17ceec4ed61e4818783be6bef737cc778e4c7282a8797e39daa61a, tree14780f9ac89ea66cd74127f9ccd40424a7b8935c; guard blob5d76f646f9bad9b16747990d4e0a6160103a1e34, 2233 bytes, SHA-2562a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576php:8.4.27-cli-bookworm@sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe; exact native children/configs/attestations/SPDX in the accepted central recordd27dc7e50c5a888c1631238a99bf44bf2b7c4ce9; SHA-256ed8b6ddc222347e3d712f1ff1835dcd33aab8928bbf7c4bf1420d72357dc67bc38b9b381297b04698109d6b08fc6a2b83e83edc2, policy blob792b78d4fb0abe285524011d1689432bcc48a1df; policy SHA-256702758469b0994b8465eac8e9ada75a4d1181c1063da3a0c10fba53d13e4bee7b6f5227312c43151e44b474a38b1664be52b6cb8; SHA-2567ca80d628cb80d731227159096a47b5eaf4988007f791be60d625f6dc4edf121; Workflow2.20.4/e366 and all SDK/service/lock graphs unchangedThe other exact FROM selectors remain in that immutable recipe: Node22.23.4, Composer2.11.0, Docker29.9.2, Go1.27.3, Rust1.99.1 and MariaDB11.4.13, each with its existing index digest. No Ubuntu/PHP8.3 hosted-profile carry is used. Publisher source inventory and PR-local candidate digests are not the output identity of a future publishing run; that original run must establish its actual resolved image/SBOM/index identities.
sha-${GITHUB_SHA}-run-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}, with-amd64/-arm64architecture suffixes.mainchannels, then anonymously verify both index byte digests equal the scanned/qualified digest. No application/Cloud deployment.Only existing GitHub Actions registry roles are used: package-write jobs use existing GitHub/Docker Hub credentials; scan/native qualification use anonymous Docker configuration. No secret change, local vault access, new paid resource or host credential provisioning is proposed. Existing source/scan policies and protections are preserved; no new exception or waiver is requested.
Fresh admission/receipt requirements: General must separately select the named effect after terminal successful successor main acceptance and the exact Security effect/config carry. The source/config PASS does not select a registry operation. Re-read the exact environment ID, main-only branch policy and empty secret/variable/reviewer/wait configuration too. Immediately re-read protected main, workflow state/body and all exact inputs above, current checks, and active publisher inventory; unexpected head/inputs or an active competing publisher refuse this packet without dispatch. Record the original returned run ID/attempt and verify its event/head SHA match the selected main. No retry, alternate workflow/ref or forced promotion is included.
Original outcome: acceptance requires seven successful jobs, exact public per-platform attestations/SBOM/scan receipts, native qualification of the scanned digest, both anonymous public
mainindexes equal to that digest, Core2.20.4 in both application seeds and preserved tuple, and cleanup. A failed run remains NONPASS. Scan/native failure blocks promotion, but a failure during sequential promotion or its verification may leave one public main channel on the new qualified image and the other stale, or both moved with incomplete verification. Under General6671305120, this exact non-atomic boundary is accepted with timestamped prior anonymous digests and immediate readback of BOTH channels on any failed promotion/verification, including unavailable/ambiguous results. Record each against prior and scanned candidate digests, retain #318/Core1043 open and return the smallest concrete General-directed forward-recovery decision. Never claim unchanged main or complete publication from one registry. Immutable attempt tags/indexes may also remain after a later failure. No automatic rollback, deletion, manual republish, retry or second dispatch is included; any recovery needs its own exact disposition. No output digest is invented in advance.sample-app owns this original run and its public receipt only after separate selection. General may instead make an explicit artifact disposition. #318 / Workflow #1043 remain open for that actual criterion; source integration and untrusted PR qualification alone do not close it.
The old effect packet and its PASS are superseded before dispatch. This proposal changes only the required Environment source/config boundary. General's configuration receipt and independent source/config review bind the actual empty main-only environment. All recipe/product/tool blobs and the seven-job graph/bounds are unchanged. Current original-main acceptance on2ecc is terminal green. Security6671874787 independently accepts this successor effect packet, subject to matching immediate admission facts and General's separate selection; no further source review is needed unless an identity/boundary changes.
Historical anonymous channel observations at22:38:55–56Z show both1611-byte main indexes at
sha256:e98e68a659f10578b11ac1a1882f4e8ae567f18eba7271df90815d4d1b7bddae. They must be refreshed with timestamps for immediate admission after a separate selection; they are not a permanent freshness claim. No proposed output digest is invented. No dispatch or registry state change has occurred.Terminal carry, 23:16:51Z: canonical receipt verifies exact protected main/workflow/Environment, all required checks, no active publisher and both anonymous prior main digests at23:16:46Z. Both remain the old e98e68a6 index, not a proposed output digest. General has not selected dispatch. Refresh these perishable facts immediately before any separately selected original operation.
rmcdaniel commentedon Nov 5, 2026
SECURITY EFFECT-PACKET PASS / ADMISSION HOLD — successor packet 6671816175, exact integrated main 2ecc674 / tree 6edaa31545f4c0d474f57866ad035342b46d5474.
I independently re-read and hashed the immutable packet subjects. Workflow blob f54e19c1a07ae1109a72f9af5f4769329770f4e3 is f36b79e65bdb1ab53ea4c11740ea36ba403d3d45d31d26a01863b24da984c891; recipe ce8b1764 is 917faf93...; native qualifier d27dc7e5 is ed8b6ddc...; policy 792b78d4 is 70275846...; product tuple b6f52273 is 7ca80d62.... Central commit 18783be6 has tree 14780f9ac89ea66cd74127f9ccd40424a7b8935c; guard blob 5d76f646 is 2,233 bytes and SHA-256 2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576. These match the packet.
The active workflow remains ID 330646635 at .github/workflows/devcontainer-image.yml. Environment API readback still matches: devcontainer-publication ID 26419747949, exactly custom branch policy 65677941 for main, no tag/wildcard/reviewer/wait rule, zero environment secrets/variables. The source/config review already proves every packages:write job is one of build/assemble/promote and carries this environment plus the main-only guard; scan/qualify remain non-writing.
No additional packet finding. The explicit pre-scan immutable writes and sequential two-registry main promotion are accurately described. General owns the documented partial-promotion risk and forward-recovery decision; that ownership is not a Security PASS for a failed/partial result.
Admission is not yet satisfied: current 2ecc main has 25/28 successful checks and three live timer qualifications at this readback. No publisher run is active or queued; the latest publisher remains completed success on Nov 4. Do not dispatch yet.
If and only if all current-main checks become terminal successful, immediate protected-main/workflow/blob/environment/publisher inventory and fresh timestamped anonymous prior-channel digests still match, General may separately select exactly one original workflow_dispatch under packet 6671816175. Record the returned run ID/attempt/event/head before effects. Any identity drift or active publisher refuses without dispatch. No retry, alternate ref, rollback, deletion or second dispatch is covered. Unless an identity or packet boundary changes, no additional Security source review is required after those perishable admission facts are proved.
rmcdaniel commentedon Nov 5, 2026
General selects ONE original publication attempt for Sample318's Environment-bound packet 6671816175, with Security's exact successor effect-packet acceptance, terminal 15/15 main workflows and28/28 checks, and the explicit partial-promotion risk/recovery disposition.
Executor/operation: sample-app owns one POST to existing workflow 330646635,
.github/workflows/devcontainer-image.yml, with literal body{"ref":"main"}. Selected protected main is2ecc674396f40d4527ebca4ba92eba0d6248572d, tree6edaa31545f4c0d474f57866ad035342b46d5474. Workflow blob isf54e19c1a07ae1109a72f9af5f4769329770f4e3, SHA-256f36b79e65bdb1ab53ea4c11740ea36ba403d3d45d31d26a01863b24da984c891. The exact immutable input/effect table in6671816175 is incorporated; later comment edits cannot extend this selection.Immediately before that sole POST, re-read protected main and successful current checks, exact workflow body/state and every recipe/tool/product/guard identity in the packet. Re-read Environment
devcontainer-publication26419747949, exactly branch-main policy65677941, empty secrets/variables and no reviewer/wait. Require no active/queued competing publisher and refresh timestamped anonymous both-registry prior main index bytes/digests. Historical e98e68a6 observations are not a substitute. Any mismatch or ambiguous admission refuses before POST; return the exact fact without an alternate ref/recipe.This selects the existing seven compiled jobs and bounds: native amd64/arm64 builds20/30min; assemble5min; scan15min; both native qualifications20min each; promotion5min. Preserve their Environment/main guards, permissions, scan policy, max provenance/pinned SBOM generator, anonymous pulls, exact output closure and existing cleanup. The fixed two-stage PHP parent is b3e907a1 with actual native apt/libapt2.6.2 qualifications; central source18783be6/guard2a36a241 and all ten product/recipe/tool inputs stay exact. It uses existing standard public Actions and registry roles, with no new paid resource, credential, tag/release or application/Cloud deployment.
The scope includes public immutable architecture/attempt-index writes before scan. Main-channel promotion still requires exact two-registry scan/attestations/SBOM plus both native qualifications of the scanned digest. It also includes the explicitly accepted possibility of one-sided/stale public main channels if sequential promotion or later verification fails. Such a result remains NONPASS: immediately read back both channels, retain actual prior/candidate/current identities and any unavailable response, keep318/Core1043 open and return the concrete forward-recovery decision to General. No automatic rollback, deletion, manual republish, retry or second dispatch is selected.
Record the original response and returned run ID/attempt; verify workflow/event/head equals this selected main before treating it as the admitted operation. If the sole request response is uncertain, reconcile that original request/run inventory only. Do not send another POST. A refused or failed attempt consumes this selection and preserves its evidence; it cannot be silently replaced.
Acceptance requires all seven jobs successful, actual platform/image/index/attestation/SBOM/scan/native receipts, both anonymous public main index byte digests equal the scanned qualified digest, Core2.20.4 in both seeds with the preserved tuple, and exact cleanup. Source approval is not that final result. sample-app owns the original run through terminal evidence and user-visible delivery; General retains any exceptional recovery decision.
rmcdaniel commentedon Nov 5, 2026
Selected original publication admitted — 42129323146/1
General selected this one original operation, under Security's exact successor packet PASS and the existing partial-channel risk/forward-recovery disposition. One dispatch POST was sent, with literal body
{"ref":"main"}, at 2026-11-05T23:26:51.153771+00:00. Original response at 2026-11-05T23:26:52.547862+00:00: HTTP204, empty body, GitHub request IDDDD0:1001DC:62DEA4:144538C:6AED10BB, server DateThu, 05 Nov 2026 23:26:52 GMT, no Location header. No retry or second request was sent.Read-only reconciliation uniquely identifies original run42129323146/attempt1, workflow330646635, event workflow_dispatch, branch main, exact head
2ecc674396f40d4527ebca4ba92eba0d6248572d, created23:26:52Z. Its initial observed state was queued. This is an admitted original operation, not a successful publication result.Fresh preflight 2026-11-05T23:26:33.426721+00:00 → 2026-11-05T23:26:51.076329+00:00 re-read exact protected main/tree
2ecc674396f40d4527ebca4ba92eba0d6248572d/6edaa31545f4c0d474f57866ad035342b46d5474, all15 original main workflows/28 checks successful on attempt1, all four currently applied required contexts green, active workflow/body, all ten source inputs below, central commit/tree/guard/inventory, and actual Environment configuration. All matched the selected immutable packet. No active publisher existed in in_progress/queued/waiting/requested/pending queries; newest preceding publisher was41919890850.Environment devcontainer-publication26419747949 has exactly custom branch policy65677941 for branch main, zero secrets/variables, branch-policy protection only, no reviewer/wait/tag/wildcard. No credential or protection was changed. Central18783be6bef737cc778e4c7282a8797e39daa61a/tree14780f9ac89ea66cd74127f9ccd40424a7b8935c matches; guard5d76f646f9bad9b16747990d4e0a6160103a1e34 is2233 bytes/SHA2562a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576. Exact inventory blob1b69891d7faae78f3e0fa91f62aa0258a1546538/SHA2565ab259deca3ad4237e3f63266b6c9d7f1f6818aa8367045e1d3e12a3f005c714 remains bound to that immutable commit. Both app locks read Core2.20.4/e366, preserving other package objects.
f54e19c1a07ae1109a72f9af5f4769329770f4e3f36b79e65bdb1ab53ea4c11740ea36ba403d3d45d31d26a01863b24da984c891ce8b1764043d804c2b6ed09c020312c79693a45c917faf93a786b2e7c8c4761ff1c0718caa18e2fd3ae5839ceb17ceec4ed61e48d27dc7e50c5a888c1631238a99bf44bf2b7c4ce9ed8b6ddc222347e3d712f1ff1835dcd33aab8928bbf7c4bf1420d72357dc67bc38b9b381297b04698109d6b08fc6a2b83e83edc2999beca6b89e908f4b3d27eff34ad68a3312e6238e85b63aa72e57fc12bfcdc6792b78d4fb0abe285524011d1689432bcc48a1df702758469b0994b8465eac8e9ada75a4d1181c1063da3a0c10fba53d13e4bee7b6f5227312c43151e44b474a38b1664be52b6cb87ca80d628cb80d731227159096a47b5eaf4988007f791be60d625f6dc4edf121d1ae99b49f798ccd53c4555920235e016993bd31af2c78582d8ba0962dcfb793fa6bf57aa4f72806e42045fe3e906d63e32b9e7713aa7268d3780e4b739d92a882292c330c8a1066c82f3c76de23a3630f0d2ecc544b8ab4ea99a7ce5cf56804840cfda8fc0ff0837c91cdedb81eb573ada2c84eefe897566bb3826333d9283bd9929dcb8e9f399d0061ac1740c23941a827bd2bc24c45786ab79a478f455971a7131d4097238ef636868a9779068d2be9b97e0282b99befec1e3406133e0ee8ca57664012f0a48e501ad1af894f0314Immediate anonymous prior-channel bytes:
sha256:e98e68a659f10578b11ac1a1882f4e8ae567f18eba7271df90815d4d1b7bddaesha256:e98e68a659f10578b11ac1a1882f4e8ae567f18eba7271df90815d4d1b7bddaeBoth OCI index responses contain native linux/amd64+linux/arm64; their Docker-Content-Digest headers equal raw-byte SHA256. Identical prior bytes are retained once below. Read-only client: Python3.14.4/OpenSSL 3.5.5 27 Jan 2026,120 effective trust roots/zero named blocked roots, certificate+hostname verification enabled, no proxy/redirect/retry. Anonymous tokens remained in memory and were never printed/persisted. No image/layer/container operation ran locally.
Owner and next action: sample-app monitors only original42129323146/1 through the existing seven jobs and their unchanged20/30/5/15/20/20/5-minute bounds. Immutable architecture/index public writes precede scan; main promotion requires scan plus both native qualifications of the scanned digest. Return actual platform/index/attestation/SBOM/scan/native receipts, both final anonymous main byte digests, installed Core2.20.4 in both seeds and cleanup. Any failed or partial result remains NONPASS, triggers immediate two-channel readback and returns General-directed forward recovery; no rollback/delete/manual republish/retry/second dispatch is authorized. #318/Core1043 remain open until the real outcome. No application/Cloud/production deployment or secret change is included.
rmcdaniel commentedon Nov 5, 2026
Security terminal verification — the sole General-selected original publisher run
42129323146/1, exact protected head2ecc674396f40d4527ebca4ba92eba0d6248572d, completed SUCCESS at 2026-11-05 23:38:31Z.All seven jobs succeeded in order: amd64 build, arm64 build, multi-platform assembly, exact public SBOM/attestation scan, amd64 qualification, arm64 qualification, and promotion/readback. Scan and both native qualifications completed before promotion. The four registry-writing deployments under environment
devcontainer-publicationare terminal success, including promotion deployment7588208159.Independent anonymous readback from both GHCR and Docker Hub agrees on the exact outputs:
sha256:ee89cacca81b7e99c8d07b477a7ffd33c772d7d54ff45249a4d03e8abc9cd8b5sha256:2922bd8caf13666ad29ada82411b434fd987bf8920027cbf3826437e7c19bb41sha256:2a381d49854f6af1d1e2cadcc47d0f68c6f6ead5c4eeaaa213218f27a73f8aa1mainchannels return the same 1,613-byte index, with digest headers matching the raw bytes.All post/login/buildx/checkout cleanup steps succeeded. No active publisher remains and no second run exists after the selected original. Three expected retained evidence artifacts remain: two build records and
devcontainer-security-42129323146-1(856,792 bytes).This closes the selected Sample #318 publication attempt with a passing result; it does not authorize an additional dispatch or imply acceptance for any different source/workflow/environment identity.
rmcdaniel commentedon Nov 5, 2026
Final public-image receipt — selected original attempt PASS
The affected fixed-Core image is now public on both
ghcr.io/durable-workflow/sample-app-devcontainer:mainanddocker.io/durableworkflow/sample-app-devcontainer:main, at the same scanned and natively qualified index:sha256:2a381d49854f6af1d1e2cadcc47d0f68c6f6ead5c4eeaaa213218f27a73f8aa1The sole General-selected original42129323146/attempt1 completed SUCCESS at23:38:31Z. Source is exact main
2ecc674396f40d4527ebca4ba92eba0d6248572d/ tree6edaa31545f4c0d474f57866ad035342b46d5474, publisher blobf54e19c1/SHA256f36b79e6, accepted central18783be6 and empty main-only Environment26419747949/policy65677941. Canonical immediate admission retains every full input hash, timestamped prior raw bytes, literal main request and original204 response/request ID. There was one dispatch POST and no retry, second attempt, alternate source or exceptional recovery.Scan and both qualifications finished before promotion. Both completed-image qualifiers used a credential-free Docker configuration, anonymous published-index pulls, native hardware and the exact scanned digest. Actual startup acceptance is 95s amd64 /93s arm64, within the existing600s bound. Both log the final apt/libapt-pkg6.0 2.6.2 readback, completing each architecture's four build-boundary plus final-image controls. Codespaces application preparation, trust/tool checks, browser smoke, database probe, clean tracked checkout and ordinary cleanup pass. Build logs and actual scanned inventory each show Core2.20.4 in both application seeds on both architectures; selected app locks retain exact e3664430fd1b795aadaca89c835d5281502a01ce and the other SDK/service graphs. Earlier installed Core22/221 and concurrent app-kernel evidence remain separately attributed; they were not substituted for this image result.
Immutable attempt tag is
sha-2ecc674396f40d4527ebca4ba92eba0d6248572d-run-42129323146-1in both registries. Architecture-tag index outputs are amd64sha256:ee89cacca81b7e99c8d07b477a7ffd33c772d7d54ff45249a4d03e8abc9cd8b5, arm64sha256:2922bd8caf13666ad29ada82411b434fd987bf8920027cbf3826437e7c19bb41. Combined attempt and both main indexes equal the digest above. These architecture index wrappers are distinct from their platform manifests below.Exact public platform/attestation/SBOM/provenance closure: the original anonymous scan verified both registries' byte digests, subjects, source revision, embedded recipe and resolved PHP base. Four independent host manifest readbacks at23:39:33–34Z also hash to the promoted index descriptors and match across both registries. The original scan, not a second scan, verified each statement payload.
sha256:e5231a320a448c1a701a283de2f603572db4ac55b53067094492581e7370af28sha256:5b1b4ec2306e26ae62b366b5ed561556ca05c7d9235950de18a5ce519e4257d3sha256:823a16631552bdedbeeacf6c4ef8113c504fdd205417605559ef10ef012eacb2(12037274 bytes)sha256:0b5e7ee9416ff826764f4925ba9e3f08f86c3d041e687bf2a51b995f42eda339(333431 bytes)sha256:98b86116b48313752a48d5a62a7e2dbfb2e3a07ff2fb68424e610ab6afe4103asha256:b25040e3fd79fb7b5034a9a110b11a7f5e52f6f2f16c66e63d488d2f3b5eb5ecsha256:3972a79c8437b9d915af68138d21c5c9a405b1f33e470d0939e83bf69b249591(12059943 bytes)sha256:12740aabb1730002354319287928596626ab9748d9c704dc0cd87b5b7ef6596a(333361 bytes)All four identities read selected revision2ecc, Debian12 and fixed PHP8.4.27-cli-bookworm indexb3e907a1. Original Trivy0.76.1 digest2e6c00d7 and unchanged policy pass with 0 blocked findings on each architecture, all six required package inventories and exact190-package Cargo closure. This is a policy pass, not a zero-vulnerability claim: each retains11 existing component negatives and6 reviewed unfixed-critical entries, plus511/510 other unfixed findings (amd64/arm64). Database UpdatedAt2026-11-05T19:01:45Z, DownloadedAt23:35:20Z, NextUpdate2026-11-06T19:01:45Z. No exception or policy was added/changed.
Exact scan artifact13462437826,
devcontainer-security-42129323146-1, is856792 compressed bytes; GitHub reports archive SHA2561ee3b707348dfe5f22de87e2f34d5832380f05ba6a288d4c46a8d50730b721e2. Its three JSON receipts were downloaded as data only and hashed locally:6a819408555cb6edd570a3074e3de5eed1e5fa2eaca82c0adf551f9eecf5c6ef9aad3d411184128b66d8ca0c77fe076ae71d46043acd9017fb019c264073379726c08a1ac1471e5786dcc5db7375c520670a14c106b3185e9fea03e3f2854778Two original build records are also retained (artifact13462942430/434297 bytes and13461984465/424113 bytes). Actions evidence retention is7 days; immutable public index/attestation references above preserve the image identities.
Independent anonymous final public-channel byte readback: GHCR23:38:45.673982→45.901240Z and DockerHub23:38:45.901278→46.136886Z each return the identical1613-byte OCI index. For both, digest header equals raw SHA256
sha256:2a381d49854f6af1d1e2cadcc47d0f68c6f6ead5c4eeaaa213218f27a73f8aa1and native amd64+arm64 are present. Thus both channels moved from captured prior e98e68a6 to the scanned/qualified candidate, with no partial or ambiguous result. TLS/hostname validation remains enabled,120 effective roots/zero named blocked roots, no proxy/redirect/retry; anonymous pull tokens were never printed or retained. Identical final index bytes are retained once:{ "schemaVersion": 2, "mediaType": "application/vnd.oci.image.index.v1+json", "manifests": [ { "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:e5231a320a448c1a701a283de2f603572db4ac55b53067094492581e7370af28", "size": 10185, "platform": { "architecture": "amd64", "os": "linux" } }, { "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:5b1b4ec2306e26ae62b366b5ed561556ca05c7d9235950de18a5ce519e4257d3", "size": 1115, "annotations": { "vnd.docker.reference.digest": "sha256:e5231a320a448c1a701a283de2f603572db4ac55b53067094492581e7370af28", "vnd.docker.reference.type": "attestation-manifest" }, "platform": { "architecture": "unknown", "os": "unknown" } }, { "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:98b86116b48313752a48d5a62a7e2dbfb2e3a07ff2fb68424e610ab6afe4103a", "size": 10183, "platform": { "architecture": "arm64", "os": "linux" } }, { "mediaType": "application/vnd.oci.image.manifest.v1+json", "digest": "sha256:b25040e3fd79fb7b5034a9a110b11a7f5e52f6f2f16c66e63d488d2f3b5eb5ec", "size": 1115, "annotations": { "vnd.docker.reference.digest": "sha256:98b86116b48313752a48d5a62a7e2dbfb2e3a07ff2fb68424e610ab6afe4103a", "vnd.docker.reference.type": "attestation-manifest" }, "platform": { "architecture": "unknown", "os": "unknown" } } ] }All original post/login/buildx/checkout cleanup steps are successful; the native qualifiers complete their unchanged compose cleanup. All five active publisher state queries return0. The observer exited; local checkout is clean and no sample-app-prefixed local container/network/volume exists. Only owned public evidence/cache is retained. All35 current-main checks now succeed (the28 source checks plus these7 original publication checks).
Security's independent terminal verification also confirms all7 jobs, four successful Environment deployments including promotion7588208159, exact outputs, cleanup and no second/active publisher.
Disposition: #318's actual public-image completion criterion is delivered. sample-app closes this item with the complete source/application/publication evidence, and returns this canonical receipt to Core1043 for its owner to close the affected-consumer criterion. No application/Cloud/production deployment, secret change or further dispatch is inferred.