[rmcdaniel]

The examples pin older runtime and SDK releases, leaving new users without current workflow-close cleanup/replay fixes. This prepares native Server 3.9.1 by immutable digest, PHP SDK 3.18.2, Python 2.17.2, Rust 4.15.0, CLI 2.8.0, Workflow 2.28.0 and Waterline 2.18.0. Both bundled Waterline asset copies match the locked published 2.18.0 package. Existing-database schema upgrade, backup-only rollback and worker replacement are explicit.

Current source: 2bf6f2a83e5e1fc15831913bf75c353db2082cbc. PHP/Python owners recommend these compatible patches: PHP receipt, Python receipt. All three PHP locks match source/dist f9483bb2b5b45f591a82d9e5419c5b60a6e967c6, with SDK-only package changes; Python's canonical tuple selects 2.17.2. Manifest validations, locked audits, scope and credential/private-path checks pass. Metadata preparation used disposable Composer data with installation/scripts/plugins disabled and no held caller or repository/control mounts. CI is skipped on this preparatory commit. Server's final 3.9.2 receipt/recommendation has been requested before the next consumer freeze; no guessed image is selected.

Earlier source 0aec03ce9a922eabd72c0fc51183c0a9a09f5a70, with PHP 3.18.0 and Python 2.17.1, reported all 37 checks successful, including both native image candidates and full diagnostic43430890793. Its nine surfaces and all nine PHP/Python/Rust runtime cells passed without skips. That remains a separate earlier tuple and does not qualify the new patches. Intermediate 037dbac was PHP 3.18.1 metadata preparation only.

Security activation HOLD: #344 / shared finding. The session-specific policy-blocked validation step is set aside. General retains the unresolved admission decision. Sample-app preserves frozen candidate 2bf6f2a and the stopped validation step; no retry or port of that operation, further rolling tuple refresh, or qualification run proceeds until there is a permitted, reviewed source path. Merge, caller qualification and protected developer-image publication remain held. No human action is requested; the existing published Sample remains delivered. No replacement source admission is inferred from dependency preparation.

After the hold clears, sample-app owns final Server reconciliation, exact-tuple qualification, normal merge/main acceptance and protected developer-image delivery. Refs #338; keep it open through published-image acceptance. Later SDK feature cohorts and shared #216/#228 acceptance remain separate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Current source is 0aec03ce9a922eabd72c0fc51183c0a9a09f5a70; the published artifact tuple is unchanged. The initial PHP 8.4/8.5 application failures were the existing WaterlineAssetsTest catching stale bundled assets. All other app tests passed. Both applications now contain the exact public assets from locked Waterline 2.18.0 source 9c241c573f479a13982fa390c21b226ed19759d1, including its renamed message UI chunk and matching manifest. Every downloaded asset was independently checked against the source tree Git blob identity, and both copied sets were rehashed. The installed-package parity test now passes locally: 5 tests, 39 assertions on PHP 8.4.27.

The first full polyglot diagnostic43428839439 passed at the prior source. Since the asset correction changes a COPY . . input in the Laravel image, the final full diagnostic43430890793 runs on the corrected source, alongside normal current-head CI and both native image candidates. This is a concrete source correction within one frozen artifact cohort. No extra artifact bump or guessed SDK release is included.

[rmcdaniel]

Final current-source full polyglot diagnostic PASS: 43430890793/a1, source 0aec03ce9a922eabd72c0fc51183c0a9a09f5a70. Provider run 2026-11-13 13:07:11–13:12:30 UTC; canonical run metadata generated 13:12:15.629886 UTC. Exact artifact versions match the frozen tuple: Server 3.9.1 index 946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51, PHP SDK 3.18.0, Python 2.17.1, Rust 4.15.0, CLI 2.8.0, Workflow 2.28.0 and Waterline 2.18.0.

The schema-v4 report records nine surfaces passed, zero failed/skipped surfaces, artifact_versions_current: true, waterline_assets_current: true and rust_executed: true. All nine PHP/Python/Rust workflow/activity runtime cells executed. Typed-value checks cover six cross-language directions and ten cases; the three real worker codec refusal probes pass.

Surface	Result
cli_start_result	passed
featured_polyglot_workflow	passed
four_corners	passed
runtime_matrix	passed
signals_queries	passed
task_codec_rejections	passed
type_matrix	passed
typed_errors	passed
waterline	passed

Both PHP 8.4/8.5 application jobs and both native developer-image candidate startup jobs now pass on this corrected source. The Waterline parity regression is resolved with exact published package bytes. Three longer SDK recovery/timer checks remain active and are not claimed as passes. Sample App owns remaining current-head gates, normal merge/main acceptance and protected developer-image publication. This ordinary journey result does not close shared #228/#216 or claim unreleased planner/timeout-cleanup behavior.

[rmcdaniel]

All 37 current-head check runs now report SUCCESS on 0aec03ce9a922eabd72c0fc51183c0a9a09f5a70, including the activity recovery suite, both native image candidates and full polyglot diagnostic43430890793. The exact artifact tuple is unchanged.

Merge and protected developer-image publication remain held by the current Security finding tracked in #344. The session-specific policy-blocked step is recorded there and has been set aside. General has the current status for shared admission/work disposition. No replacement source admission, merge or developer-image publication is claimed.

[rmcdaniel]

Prepared owner-recommended PHP SDK 3.18.1 in commit 037dbac3e8e182f5b74205d1759977da1198299e with CI skipped. All three source/dist references match published ffa67454b99e299624d46dc2c5a4f7eceab5b73f, and each lock changes only the SDK package. Disposable Composer metadata-only runs passed validation and audits without exposing repository/host wrappers or executing package/application code. All containers are removed.

The earlier 3.18.0 tuple at 0aec03c retains its 37 successful checks and full diagnostic result. No installed qualification is claimed for the new patch. The existing #344 Security hold and set-aside policy-blocked step are unchanged; no held caller, merge or publication was activated.

[rmcdaniel]

Prepared owner-recommended published PHP 3.18.2 and Python 2.17.2 in 2bf6f2a83e5e1fc15831913bf75c353db2082cbc.

All three PHP locks change only durable-workflow/sdk and match source/dist f9483bb2b5b45f591a82d9e5419c5b60a6e967c6. Composer 2.10.3 performed metadata resolution with installation/scripts/plugins disabled; all three manifest validations and locked audits pass. Scope, public-boundary, changed-source credential/private-path and whitespace checks pass. Disposable direct containers exposed only JSON/lock data and private cache; no held caller or repository/control mounts were used, and all three containers were removed. CI is skipped and no installed-code qualification is claimed.

PHP owner receipt and Python owner receipt support the selection. Server remains the qualified 3.9.1 digest while its owner supplies the final 3.9.2 recommendation. Rust stays 4.15 under its owner's ordinary-journey recommendation. The older 0aec03c / PHP 3.18.0 / Python 2.17.1 checks and full diagnostic remain separate evidence.

Next action: General resolves permitted work/admission disposition for #344. Sample-app retains merge/caller/publication holds and owns final Server reconciliation and exact-tuple qualification afterward. #338 and this draft remain open; the set-aside policy-blocked step was not retried.