[rmcdaniel]

Approve the exact qualified 4.16.0 package from source afc2b2ff8960ac2e080ffec765c66f59200cd544, Cargo 1.86.0, SHA-256 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc (116 canonical files). This diff contains only the two generated approval/summary records.

The final summary binds published native Server 3.9.1 source 7d7ad9d6…, index 946c65eb…, amd64 child b0f2bf2a…, and runner b3480de…. Lifecycle/deadline checks and cleanup pass; summary SHA-256 8a08457143bce64333045c67a55496ad28c15ae27d1b65aedfe45275021c553a. Internal archive/source/approval verifier, public-boundary and credential/private-path scans pass.

Separate same-package/same-Server feature evidence is on #256 and #257: actual seven-metric emission/Prometheus; 300 × 10 KB inline completion; over-cap structural failure with zero partially scheduled activities; same-worker follow-up and clean shutdown. The original fixture shutdown NONPASS remains preserved; runner correction #257 was independently reviewed and merged, without changing package bytes.

Independent exact-head package review and all required checks must pass before immutable tagging/protected publication. Registry identity plus actual published-crate repeats and downstream delivery remain afterward. #238/#254/shared #228 stay open; #216 is a separate installed retry cohort, with no PASS inferred here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security generated-record/package approval PASS for exact head 38796b8f3dc1fd94d455f9ad147778116951a6ce (tree 1b01fb0835ab3a2a76b84b0f79659dd3fbdc1c1b).

The diff is exactly the two generated 4.16.0 approval files. Independent checks confirm:

• the committed summary bytes hash to 8a08457143bce64333045c67a55496ad28c15ae27d1b65aedfe45275021c553a, exactly the approval's summary_sha256;
• the approval and summary contain the same sorted, unique 116-file package set and canonical list digest 5d0cd440842b7aed0795e99dbf5ac18ced33f3b460a170c461570cda8e2d4932;
• package/VCS/source identity is exact durable-workflow 4.16.0 at afc2b2ff8960ac2e080ffec765c66f59200cd544, Cargo 1.86.0, crate SHA-256 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc, unchanged after the cells;
• the acceptance binds reviewed runner b3480de83b30764b6d4237f5de243a49d9a22f61 to qualified Server 3.9.1 source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44, index 946c65eb…, and executed amd64 child b0f2bf2a…;
• lifecycle and deadline cells both report the exact 3.9.1 cluster and pass, the overall/check outcomes pass, and cleanup reports no errors or local/container/network leftovers;
• the repository's strict approval/summary parser accepts the committed records, and all 40 release-package trust/negative controls pass locally.

The separately recorded archive-only same-package evidence binds the same source/archive/Server/runner tuple: all seven metrics and Prometheus shape; 300 × 10 KB success; a single non-retryable 60 × 450 KB structural failure with zero partial activities; same-worker follow-up; bounded shutdown and cleanup. The original long-poll shutdown NONPASS remains preserved and is not used as approval evidence.

Current exact-head required checks must finish green before merge/tag. This PASS authorizes neither a tag nor publication by itself. Protected publication, registry checksum/VCS readback, exact published-crate lifecycle/deadline/metrics/fan-out repeats, downstream delivery, shared #228 closure, or installed #216 acceptance remain separate gates.

[rmcdaniel]

Final package approval #258 merged at ab8cae5eeb9c2aa701a997a2593e0ecd933a57a4 after Security's exact-head PASS and all required checks. The remote approval branch is deleted and confirmed absent. Main's committed approval/archive/source verifier passes.

Annotated immutable tag 4.16.0, object 32a41155924c18e8d3947288eda8c4fa165c1dd0, peels exactly to approved source afc2b2ff8960ac2e080ffec765c66f59200cd544; package SHA-256 remains 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc. Protected release run 43432093783 is active from maintained main above. No published availability or post-publication acceptance is claimed yet.

Owner sdk-rust will verify registry/tag/archive identity, run fresh registry-only lifecycle/deadline plus metrics/within-over-follow-up acceptance on qualified Server 3.9.1, verify API documentation and coordinate root adoption. Sample App explicitly retains published 4.15 for its already-frozen in-flight ordinary cohort; it does not claim the new large-fanout slice. Its later SDK adoption is separate, avoiding an unnecessary repeated tuple run. #238/#254 remain open through the applicable published checks and documentation delivery; #216 is separate.

[rmcdaniel]

4.16.0 is published. All four protected release jobs passed in run 43432093783, including isolated credential upload and fresh registry verification. The final GitHub Release is live.

Independent registry metadata, fresh archive and strict approval/source verifier match approved SHA-256 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc and clean source/tag afc2b2ff8960ac2e080ffec765c66f59200cd544. The fresh consumer lock binds the official registry source and that checksum, with no patch/vendor/config override.

Registry-installed lifecycle/deadline acceptance against qualified published Server 3.9.1 index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51, amd64 child sha256:b0f2bf2a37e8b229282362acb26d9ed511596ebdd366ea4e53bd9f16008a356e, source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44: PASS, with clean teardown/no leftovers. Registry Worker/metrics feature repeats are next; API docs run 43432730516 is active. Issues remain open until those results and relevant documentation follow-through; no #216 or native timeout-cleanup claim is inferred.

[rmcdaniel]

Published 4.16.0 installed acceptance: PASS

Exact published tuple: Rust 4.16.0, registry/archive SHA-256 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc, clean source/tag afc2b2ff8960ac2e080ffec765c66f59200cd544; native Server 3.9.1, source 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44, index sha256:946c65eb70e8b4b7c4694be8a181c9669d46c3408b80d4e44d96f2030ea3cf51, executed Linux amd64 child sha256:b0f2bf2a37e8b229282362acb26d9ed511596ebdd366ea4e53bd9f16008a356e. Public runner fixture is reviewed commit b3480de83b30764b6d4237f5de243a49d9a22f61 (#257); package/source bytes remain the approved ones.

Fresh registry consumer: exact lock source/checksum verified, no patch, vendor or local Cargo config. Actual tests against the same disposable published Server:

• PASS: 300 × 10 KB inline arguments without payload storage, exact result and 300 ActivityCompleted events.
• PASS: 60 × 450 KB individually valid arguments exceed the advertised aggregate budget; managed worker records one non-retryable structural-limit WorkflowFailed, with zero ActivityScheduled/ActivityCompleted from the rejected batch.
• PASS: another workflow completes on the same worker, then bounded clean shutdown. The completion-limit test passed in 80.01 seconds.
• PASS: all seven shared metrics, real workflow/activity ready-age observations and positive queued workflow age, paired counts/durations, completed/failed activities, HTTP-error observation, and official Prometheus exposition with the pinned tag contract. Metrics test passed in 1.12 seconds.

Separate registry-only lifecycle/deadline acceptance also passes. Every run cleaned its owned containers/networks; no leftovers. The prior candidate shutdown NONPASS is preserved and is not substituted for this result.

Publication 43432093783, final Release, and API docs 43432730516 all pass. Fresh API build identity is 4.16.0 / checksum above / source above / tooling ab8cae5eeb9c2aa701a997a2593e0ecd933a57a4.

Scope: the larger allowance requires explicit limits.max_workflow_task_completion_bytes; older producers retain the conservative ordinary cap. This tuple qualifies the Rust completion/metrics behavior, not other SDKs, every backend, #216 caller-key retries or native timeout-cleanup. Root docs adoption is being driven by its owner. Sample App keeps its already-frozen 4.15 ordinary cohort, which does not claim this large-fanout slice; no redundant tuple run is required for that unchanged scope.

[rmcdaniel]

Independent post-publication identity countercheck: PASS for Rust SDK 4.16.0.

I independently fetched the public registry artifact and read the maintained repository/tag rather than reusing the owner’s local archive:

• crates.io/static download SHA-256 is exactly 89f6418ca72e1c6e13495281aab131417c5ddcee1946bfc1a22b1e63cc2b11cc, size 604913, with exactly 116 archive entries;
• the sparse crates index records 4.16.0, the same checksum, yanked: false, and rust_version: 1.86;
• archive .cargo_vcs_info.json names afc2b2ff8960ac2e080ffec765c66f59200cd544 with an empty path_in_vcs;
• annotated tag object 32a41155924c18e8d3947288eda8c4fa165c1dd0 peels to that exact source commit;
• maintained main is ab8cae5eeb9c2aa701a997a2593e0ecd933a57a4 and its tracked approval/summary verifier accepts the freshly downloaded archive with Cargo 1.86.0: approval-record SHA 3ea327d0308720fb0fc725a5573791271c85c78b40bd62c57bb0a16ff09bef3a, file-list SHA 5d0cd440842b7aed0795e99dbf5ac18ced33f3b460a170c461570cda8e2d4932, acceptance-summary SHA 8a08457143bce64333045c67a55496ad28c15ae27d1b65aedfe45275021c553a, Server 3.9.1 index 946c65eb..., and summary_verified: true;
• live https://rust.durable-workflow.com/__build.json reports version 4.16.0, the same crate SHA/source, and tooling ab8cae5...;
• GitHub Release 444252808 is public (draft: false, prerelease: false) for tag/name 4.16.0; its empty asset list is consistent with registry publication rather than a divergent attached archive.

This closes the post-publication identity gate only. The owner’s ongoing registry-only Worker/metrics repeat and the separate Unicode/request-key #216/#1207 boundary remain independently attributed; this PASS does not generalize either result.