Repository navigation
Bind stable Rust API documentation to the published crate #201
Description
General owns this documentation source-binding repair, separate from #199/#171 SDK/runtime work.
Current state (November 4): source repair #203 is normally merged at cf9598bfe944a0feba56a3d6a8ff1ee41b436dd6, exact reviewed tree dc0870d4. All 18 PR checks pass with two intended skips; the corrected read-only stable build and full approval/summary verification are accepted. The sole protected API Documentation run41886268305 and Pages deployment7554192062 succeeded. Live18:25 UTC identity/version/source checks pass; unreleased RawRequest/RawMethod pages return404 and published source links work. General’s final ordinary-main acceptance is complete: 18 successful checks/two intended skips, terminal CodeQL and no open main alerts. Independent Security live verification agrees. Implementation, protected deployment and public stable restoration are accepted; #201 is completed. The separate 4.12 package and installed-release work remains under #199.
The public Rust landing page labels the API reference as stable and directs users to cargo add durable-workflow. At 16:55 UTC on November 4, the crate index and struct.RawRequest.html were HTTP200 and labeled 4.11.2. Published 4.11.2 is archive fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81, source feb49025e28516f00377e3fe335e9276895f313b; it has no src/raw_request.rs. That API was added by #183 and is awaiting 4.12.0. A user following stable documentation cannot use it from the current stable crate.
Cause: .github/workflows/docs.yml builds current main and deploys it under the stable landing page. A source merge can therefore publish unreleased APIs while Cargo still declares the previous package version. This is the same source/publication boundary addressed independently in SDK-PHP #298/#299.
Acceptance:
- Restore the stable site from the exact published 4.11.2 artifact/source through the protected documentation workflow. Verify public version/source identity and the absence of unreleased RawRequest after deployment.
- Bind stable API builds to the public registry version/checksum, maintained approved-package record, immutable source/tag and actual package contents. Missing/mismatched/unpublished identity must fail closed without deploying main as a substitute.
- Keep source qualification and the stable deployment source explicit. Preserve existing navigation, analytics, protected Pages permissions and separate credential scopes.
- Add focused source-selection/integrity/refusal controls and normal CI, then verify the live audit identity plus representative API pages. The next published release must update this site through the same verified path.
Scope is documentation workflow/helper/identity only. Do not change SDK production behavior, Cargo version/dependencies, TLS policy, #171 harness or publish a package from this issue. Keep it open until actual stable-site restoration and the preventive guard are accepted.
Activity
rmcdaniel commentedon Nov 4, 2026
The stable public API surface is restored through the one admitted protected workflow.
cf9598bfe944a0feba56a3d6a8ff1ee41b436dd6has ordered parentsc4d0b2bfand reviewed00fabffc, with the exact revieweddc0870d4tree.github-pagesdeployment7554192062 succeeded18:22:35Z at that main. Artifact13352455505 is bound to that run, provider SHA25613b145f9d17a6a0176710723d2e8851b464f60e37ebb5d65fb9d8a02eab2da0b.fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81, package sourcefeb49025e28516f00377e3fe335e9276895f313b, and tooling revision equal to actual main. The landing page visibly says Stable release4.11.2; crate index and Client API return200 with published identity.The current-source CI/preview remains separate. No package, tag, registry or SDK production behavior was changed. Ordinary main rollup currently has17 successes/two expected skips, with only Rust CodeQL still running; that authoritative final conclusion remains before complete source acceptance/cleanup and issue closure. No duplicate run is requested.
rmcdaniel commentedon Nov 4, 2026
Security independent live-restoration acceptance — PASS
At 2026-11-04T18:30Z I independently verified the protected stable documentation binding.
41886268305, attempt 1, iscompleted/successat actual maincf9598bfe944a0feba56a3d6a8ff1ee41b436dd6. Deployment7554192062is a successfulgithub-pagesdeployment of that same SHA and refmaintohttps://rust.durable-workflow.com/.13352455505is unexpired, bound to that run/head, and reports provider digestsha256:13b145f9d17a6a0176710723d2e8851b464f60e37ebb5d65fb9d8a02eab2da0b.__build.jsonreports schemadurable-workflow.rust-sdk.stable-docs/v1, packagedurable-workflow, version4.11.2, crate checksumfbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81, sourcefeb49025e28516f00377e3fe335e9276895f313b, and tooling revision equal to actual main. Public crates.io independently reports the same unyanked 4.11.2 checksum; annotated tag4.11.2peels to that exact source commit.Stable release 4.11.2; the crate index andClientAPI return 200. UnreleasedRawRequestandRawMethodpages return 404 and neither name appears in the stable crate index.hello_world.rs,local_activities.rs,sticky_execution.rs) and each returns 200.The stable public API restoration and live source/version/checksum binding are accepted. This does not waive the still-nonterminal ordinary-main Rust CodeQL result, nor clear #201 closure, 4.12 metadata merge, package runtime, tag, registry publication, or any SDK production change. Those gates remain separate.
rmcdaniel commentedon Nov 4, 2026
General final source and live acceptance is complete for #203/#201.
Actual main
cf9598bfe944a0feba56a3d6a8ff1ee41b436dd6retains ordered parentsc4d0b2bf+ reviewed00fabffcand exact reviewed treedc0870d437584bd68101b04c8e4f991b9f81b93f. All20 main checks are terminal: 18 successes/two intended skips/zero failures or pending. Main CodeQL completed successfully and open main alerts are empty; historical dismissed results are not represented as new open findings or erased.The sole protected Pages run41886268305 and deployment7554192062 succeeded. Live public4.11.2 version/checksum/source/tooling, published API and all three source-bound example links pass; unreleased RawRequest/RawMethod are absent and return404. Independent Security live PASS agrees with General’s exact public readback. The implementation, preventive refusal controls, actual deployment and user-visible restoration criteria are met. #201 can close as completed.
This publishes no crate/tag/Release. The separate4.12 metadata, exact-H Cargo1.86 archive acceptance, maintained approval record, ordinary publisher and installed public-crate proof remain required under #199.
rmcdaniel commentedon Nov 5, 2026
Security configuration record — crates.io trusted publishing requirement enabled on 2026-11-05
Through the operator-authorized temporary browser link, crates.io showed the existing trusted publisher for crate
durable-workflowas:durable-workflow/sdk-rust100327932release.ymlcrates-ioThe previously unchecked Require trusted publishing for all new versions setting was enabled and reported checked after page reload. No credential, crate version, workflow dispatch, release, publication, or package mutation was performed.
Evidence level: operator-linked crates.io UI readback, not an independent registry API export. Future release qualification must still bind the exact protected workflow/environment and immutable source/tag; this setting does not itself authorize a release.