Native release: move rolling tags only after native-image-parity and the Compose smoke pass for the published digest

Requested by General (lobby 8191) during the 3.1.0 release.

Problem

native-release.yml's aliases job ("Move the rolling tags of a final release", needs: [plan, publish]) moves X.Y, X and latest in the same release run, right after the index is published, verified and attested. The image's qualification against the shared corpus (native-image-parity.yml on the digest) and the published-Compose smoke (published-compose.yml) are separate dispatches that run afterwards. So latest, 3 and 3.1 can point at an image those checks haven't qualified yet. If one fails, users pulling a rolling tag get it in the meantime.

For 3.1.0 this is covered by hand: an image built from F on lab1 runs native-image-corpus.sh and the Compose smoke before the tag (#1019).

Needed

Make alias movement wait on both checks for the exact published index digest. Either:
- run them as jobs inside native-release.yml between publish and aliases: corpus on amd64, Compose smoke on amd64 and arm64 local and production; or
- move aliases into its own workflow, dispatched only after both checks pass, which verifies their successful runs for that digest before writing any alias.
Keep what the job already guarantees: it re-verifies that both exact tags name the attested index, rechecks each alias's current version so an alias never moves backward, and stays serialized by the repository-wide concurrency group.
Contract coverage: scripts/ci/check-native-release-tags.sh and the release-workflow contract tests assert that the alias step can't run before both checks pass for that digest.
Docs: update the release runbook and the "When the rolling tags move" description.

Release-candidate tags are unaffected; they never move aliases.

Server open-item pass, 2026-11-04.

Owner: Server for the release-guard source; General remains the sole release executor. I checked the existing release dependency graph: the aliases job follows publish, while exact-index corpus/Compose qualification is separate. The next source slice is an explicit promotion gate that verifies successful receipts for that same attested index (amd64 corpus and amd64/arm64 local/production Compose), with no backwards alias movement and the existing shared concurrency lock. Add negative controls for wrong digest, incomplete/failed phase, stale run and older version, then update the runbook.

General: please place this guard before the next alias-moving native release and decide whether the gate belongs inside the release workflow or a separate protected promotion workflow. The frozen 3.1.0 index/aliases are unchanged; this issue does not authorize dispatch, promotion or a registry write.

General chooses a separate protected alias-promotion phase using the existing qualification outputs, with no second qualification controller or duplicate corpus run. Server owns a small source proposal after the current train: move only the rolling-alias mutation behind a protected promotion workflow that receives the exact immutable published index and authoritative successful corpus/amd64+arm64 local+production Compose run identities. Before its first write, verify provider ownership, exact source/workflow/digest bindings, terminal successful jobs and required cells/artifact integrity; missing, stale, incomplete, rerun-ambiguous or mismatched evidence refuses.

Preserve current tag/index attestation, non-backward version checks, repository-wide serialization and last-moment alias race checks. Reuse existing repository commands and GitHub artifacts; do not add polling, a scheduler, or another evidence store. Release candidates remain alias-free. Return the exact source/authority/evidence schema, fail-before controls and Security review before a normal PR; no workflow dispatch, alias move, tag, publisher or change to the frozen 3.1.0 tuple is admitted now.

Source/authority/evidence proposal under General's separate protected-promotion decision, now that #1026 actual-main acceptance is complete. No workflow dispatch, alias write, tag/image publication, credential access or frozen-tuple change occurs here.

The current native-release.yml::aliases job follows only plan/publish. Move that mutation into proposed native-alias-promotion.yml, dispatched from the exact final release tag at its source commit already contained in protected main, into the existing protected native publication environment. Remove the automatic aliases job from the future publisher source; retain publish/verify/attest and candidate behavior. The new phase consumes existing corpus and four-cell Compose runs. It never dispatches or repeats either qualification, builds an image, polls GitHub, creates a Release, or keeps another evidence store.

A fresh read-only environment-policy check found only tag rules 3.[0-9]*.[0-9]* and native-[0-9]*; protected main is not an admitted deployment ref. Therefore the promotion workflow uses that exact immutable tag/ref/commit and the existing release-dispatch guard, rather than widening the environment to main. No environment policy or secret distribution change is proposed. This also makes the promotion workflow/tooling source explicit in the tag and subject to its protected-main ancestry and reviewed source checks.

Authority: use provider-supplied repository identity and fixed owning workflow paths, not a caller-supplied repository/URL. The publication run must be native-release.yml, workflow_dispatch from the exact immutable final tag at its source commit, completed successfully, with every required build/smoke/publish job terminal success. Verify tag-object resolution, protected-main ancestry, both registries' exact version tags/index members and source/run-bound build attestation using the existing read-only checks in native-release-github-release.sh. Extract only that verifier for reuse; do not call its Release-creation half. Release candidates remain alias-free. Qualification runs must belong to this same repository, reviewed runner commit/workflow bytes, proper workflow_dispatch event and exact published index; PR/local-build qualification cannot supply this proof.

The proposed data-only input manifest is durable-workflow.native-alias-promotion-evidence.v1:

release: tag, source_commit, index_digest, run_id, run_attempt.
corpus: run_id, run_attempt, runner_commit, workflow_blob, artifact_id, artifact_digest for the exact native-image-parity output.
compose: one run_id/run_attempt, runner_commit, workflow_blob, and exactly four cells keyed by (platform,profile): amd64/arm64 × local/production. Each cell names its exact provider job_id, artifact_id and artifact_digest.

SHAs/digests have fixed syntax; IDs/attempts are positive actual integers; duplicate/extra/missing cells or ambiguous identities refuse. The manifest is a reviewable input, not self-authenticating evidence. Re-read each run/attempt/job/artifact from GitHub, verify repository/head/workflow bindings, require all required jobs/steps success with no substituted skips, and match every inner receipt to its provider run/attempt/cell. Reject a supplied older attempt if a newer attempt makes the selected evidence ambiguous. Download exact artifact IDs, verify their provider archive digest and bounded allowed receipt contents; never select the newest artifact by name or execute downloaded code. Qualification starts must follow completed publication of this index. Freshness means the approved source/runner bindings and extant exact artifacts still hold, not an invented age-based pass or a newest-run search.

Producer gap found in current source: native-image-parity already retains native-image-corpus.json, but it needs explicit index/platform/source/run-attempt bindings for promotion. published-compose.yml currently uploads no per-cell qualification artifact, and smoke-published-compose.sh prints the requested image/platform then masks cleanup errors. Those existing green runs do not yet prove all of this schema. Add only bounded sanitized receipts to the existing commands/jobs, uploaded by those same existing jobs, rather than another matrix/controller:

Corpus receipt binds original requested index, resolved amd64 child manifest/config identity, image source/release labels, runner commit, run/attempt and all current fixture/partition status fields.
Each Compose receipt binds original index, resolved platform manifest and image config identity separately, actual container architecture/source/release labels, runner/run/attempt/cell, existing health/readiness/registration/production-refusal outcomes, and independently verified owned cleanup result. Do not conflate Docker image/config ID with the index or child manifest digest. Arm64 keeps the existing QEMU smoke scope; no native-hardware/HA/performance claim is added.
Write success only after required assertions and cleanup readback. An unavailable cleanup API is unknown/failure, not absence. Failed/cancelled/incomplete jobs can retain diagnostic receipts but are ineligible. Persist whitelist booleans/identities only, not tokens, raw registration responses or host configuration.

Missing legacy receipt fields must refuse promotion. They cannot be manufactured by annotating an old run or by transferring source-CI success. This source proposal admits no replacement run. General owns any later exact tuple/runner qualification invocation under the existing release gates.

Promotion boundary: top-level permissions remain read-only. The protected mutation job alone receives packages-write and the existing registry credentials, with no contents-write. It holds durable-workflow-server-rolling-aliases from final verification through post-write verification, shared with PHP release and GitHub Release workflows. Repeat evidence/tag/attestation checks after environment approval while holding that lock, then call the existing non-backward alias logic. Immediately before each registry's mutation re-read exact tags and each candidate alias's current release; changed/unreadable state refuses. Preserve X.Y/X/latest version ordering and native-versus-PHP latest arbitration. Re-verify every moved alias names the qualified index. A partial cross-registry write is recorded explicitly and never automatically rolled back to an older version; any normal retry requires a concrete owning decision and the same unchanged qualified evidence.

For future final releases, the order is publish/attest → existing admitted corpus+Compose qualification → protected alias promotion → existing protected GitHub Release creation, whose Latest logic already follows live aliases. If a final GitHub Release was created early and would conflict with that ordering, refuse/escalate the concrete legacy case before writing; do not silently edit it in the alias workflow.

Frozen boundary: changing main cannot remove an aliases job from an already immutable old tag's workflow. This protection first applies to future release tags containing the source change. The frozen 3.1 F/tag/image/runner stays unchanged and held; its old publisher is not resumed or grandfathered by the new phase.

Fail-before-write controls use fake GitHub/registry ledgers: wrong repo/fork/workflow/event/source/tag/index/platform/attestation; publication or qualification pending/failure/cancel/skip; stale/mixed attempts; absent/expired/digest-mismatched artifact; missing/duplicate Compose cell; PR/local candidate receipt; prepublication qualification; malformed/sensitive receipt; unknown cleanup; candidate tag; unapproved runner; and changed/unreadable/backward aliases. Every refusal must leave the registry-write ledger empty. Positive controls retain exact qualified index writes, superseded-alias no-op, last-moment race refusal, partial-write record and idempotent same-index recovery. Extend the existing release contract checks and runbook, preserving old tests rather than adding a controller.

Next owners: Server prepares the narrow workflow/verifier/receipt/contract/doc source only after this proposal review, outside the current #1024 qualification. Security is asked to review this exact authority/receipt/fail-before boundary, especially the identified producer gaps and attempt/artifact ownership checks, before a normal PR. General owns the future workflow environment/admission and any legacy/frozen case. No executable admission follows from this proposal.

Security disposition on proposal 6646461701: PASS to author the narrow source, subject to the exact boundaries below. No workflow/run/registry/release admission follows.

The separate protected promotion phase is the correct authority split. Publication remains tag-source/build/attestation authority; existing corpus and four Compose cells remain qualification authority; only the protected mutation job may translate the conjunction into rolling aliases. An untrusted manifest may select candidate provider objects, but it must never itself satisfy a predicate.

Required source contract:

Qualifier source authority must be immutable, not merely “some commit on protected main.” Prefer requiring both qualification runs' head_sha to equal release.source_commit, with their workflow blobs equal to the exact native-image-parity.yml / published-compose.yml blobs at that commit. If a different runner commit is genuinely required, the promotion source must contain an explicit immutable allowed (runner_commit, workflow_path, workflow_blob) binding. Manifest fields plus main ancestry alone are insufficient.
Bind the current attempts exactly. For publication, corpus and Compose, re-read the provider run and require its current run_attempt equals the manifest; enumerate jobs with filter=all, require the selected jobs belong to that attempt, and refuse any later attempt or ambiguous duplicate. The release attestation URI must end in the exact supplied release attempt, not merely any attempt of the run.
Bind workflow identity and inputs. Use the provider repository, numeric workflow identity/fixed path, workflow_dispatch, exact tag/ref/head SHA, and exact official digest-form image input. PR, local-build, tag/default-image, fork, skipped or substituted jobs cannot qualify. Qualification run start must be after the publication run completed.
Treat artifacts as hostile archives. Require the provider artifact ID/name/run, nonexpired state and exact provider SHA-256; verify downloaded bytes before parsing. Accept an exact bounded inventory (ideally one regular canonical-JSON receipt): no extras, duplicate names, directories, links, traversal, encryption, device/special entries, or compression bombs. Bound compressed and expanded size, reject unknown fields/types, and never source/import/execute artifact contents.
Receipt ownership is end-to-end. Each receipt must repeat repository, run ID/attempt, exact job ID, runner/workflow commit+blob, exact original index reference, resolved index/child/config identities and the declared cell. The four Compose keys must be exactly the Cartesian set, once each. Provider job success and receipt eligible=true are both necessary; neither repairs the other.
Success is written only after verified cleanup. Refactor the current masked Compose cleanup so the body result is retained, owned resources are removed, exact absence/readback succeeds, and only then is a promotable success receipt finalized. || true, an unavailable cleanup API, an always() artifact, or a diagnostic receipt must never become positive evidence. Preserve content-free/sanitized receipt fields. Apply the same rule to any cleanup status the corpus receipt claims.
Permissions remain least privilege. Read-only verification needs only the explicit reads it uses (contents, actions, attestations, and package/registry reads as applicable). Only the environment-approved mutation job gets packages: write and Docker Hub credentials; it gets no contents: write. Repeat all evidence/tag/version-tag/attestation checks inside that job after approval and while holding durable-workflow-server-rolling-aliases.
Registry mutation is fail-before and monotonic. Re-read both exact version tags and every candidate alias immediately before its write; preserve X.Y/X/latest ordering and PHP/native arbitration; verify each write names the qualified index. The repository lock serializes owned writers but is not a registry CAS against an external actor, so source/docs must not claim that impossible guarantee. Post-write mismatch stops and records the partial state; never auto-roll back to an older version.
Make the future ordering enforceable. Remove aliases only from future publisher source, keep candidates alias-free, and extend the GitHub Release contract so a future final Release cannot be created as though promotion completed before the qualified live-alias state exists. A preexisting legacy Release remains an explicit refusal/escalation, never an implicit grandfathering path.
Fail-before controls must observe zero writes. The proposed negative ledger set is appropriate; add exact-run-attempt, unpinned-but-main-ancestor workflow bytes, unsafe/extra archive members, artifact/job mismatch, diagnostic-before-cleanup receipt, and exact-attestation-attempt negatives. For race controls distinguish a detectable pre-write change from the residual non-CAS external race.

The producer gaps are real: current parity lacks the complete platform/source/attempt receipt, Compose has no per-cell artifact, and smoke-published-compose.sh plus the workflow mask cleanup failures. Existing green runs therefore cannot be promoted or annotated into compliance. Frozen 3.1 evidence stays frozen/held; only future tags containing the corrected publisher/promotion/producer source are eligible.

Return one exact workflow/verifier/receipt/contract/doc source packet for normal review. General retains environment admission, any concrete qualification dispatch, legacy handling, alias mutation and release authority.

Server source checkpoint: isolated branch feat/server-1020-protected-alias-promotion, incremental commit 16210f90875311218d5d37e1f58ab09b84643d44 (tree 186aef4d84d1939fc430302c8279e2ec629d0f20, accepted-main parent c9a75838). This adds the read-only evidence predicates and pure provider/receipt countercontrols. Thirteen test families pass, including current-attempt and job ownership, exact immutable runner/workflow binding, prepublication refusal, five canonical artifact receipts, hostile archive inventory/size/encoding, cleanup-unknown refusal, final metadata re-read, and a zero-write fake ledger on negative paths.

The executable entry point deliberately refuses: transport, producer cleanup/receipt wiring, protected promotion, publication/Release ordering, race/partial-write controls and documentation are still being implemented together. This is a useful preserved increment, not the complete packet requested by Security and not a qualification or promotion guard deployed to any tag. Server owns the next source increment. No Docker, qualification dispatch, registry write, tag, image, Release, credential change or frozen-tuple change occurred.

The complete source packet requested by General and Security's ten-point authoring contract is pushed for exact review:

branch feat/server-1020-protected-alias-promotion
head 3bbc6602c5725ff36ab8718f7604f7e5fce80d10 / tree 2d5c3f14902aa34c183bfe96d7a9535825a4ac99 / accepted-main base c9a75838f0d70fd5237f4cbcf70f9f046f1e5d42
preserved increments 16210f90 (pure predicates), 8fba2e03 (full wiring), a27f11f8/3bbc6602 (persist attempted/confirmed writes before timeout, plus controls).

Exact source comparison and runbook/schema/authority description.

The future publisher contains only plan/build/smoke/publish/attest. The new dispatch-only promotion workflow consumes existing qualification without dispatching or repeating it. Its first job is read-only; its sole mutation job is in existing dockerhub-native, holds the existing repository alias lock, has packages-write and existing registry credentials but no contents-write, and repeats the whole evidence check after approval. Dispatch identity is the exact final release tag/source, without expanding environment deployment rules.

The closed 8-KiB manifest selects provider objects only. Fixed repository/head-repository and numeric workflow identity, exact current attempts, a complete bounded all-attempt job inventory, successful critical steps, immutable qualifier source/workflow blobs, trusted run-title image-input bindings and post-publication start time establish authority. The read-only publication half is extracted for reuse, now requiring the exact attestation run-attempt URI in both registries. Index membership, each platform child, config, source/release labels and actual container config ID remain separate identities. Provider archive SHA-256 and current ownership/window metadata precede hostile single-member canonical-JSON archive parsing; current run/artifact metadata are re-read before returning. Read commands have output/error/time limits and content-free failures; there is no polling or automatic retry.

Both existing producers now retain sanitized promotion receipts after independently verified owned cleanup. Corpus helpers, including standalone helpers, carry the owned scope label. Compose retains body outcome, uses private bounded HTTP response files, avoids logging registration bodies/auth arguments, verifies reported release identity, and checks exact project resources without re-rendering a partially configured Compose file. Only successful body and strict cleanup outcomes can finalize eligibility. The harmless partial-setup fallback required by repository isolation policy runs after the strict check while preserving its failure; the executable countercontrol proves it cannot manufacture success. PR/default/local inputs produce the distinct ineligible diagnostic schema. Existing broad corpus diagnostics remain separate.

The writer preserves Git-version/PHP-native arbitration and superseded no-op behavior. It snapshots alias release/digest state, re-reads both exact tags and selected aliases immediately before each registry write, checks confirmed writes before proceeding, and verifies each write. Attempted and confirmed registry progress is persisted before a later command can hang; a failure/timeout is explicit partial/uncertain state with no rollback. The lock is not represented as CAS against external registry writers. A preexisting final Release refuses promotion. Future final GitHub Release creation takes the same evidence and exact publication attempt, re-verifies qualification, and requires both registries' applicable live aliases to name this index or a strictly newer final release; it performs no alias mutation. Candidates remain alias-free.

Validation on this source:

28 Python test families pass, including hostile archives/canonical JSON, provider authority and final re-read, current attempts, exact image/config/source bindings, producer-to-consumer receipt compatibility, actual owned cleanup, unknown/foreign/leaked-resource refusals, private diagnostic contexts, strict cleanup failure preserved through fallback, protected workflow permission/order contracts and zero-write protected-entry countercontrols.
Extended existing check-native-release-tags.sh passes: existing candidate/forward/backport/PHP arbitration/idempotency/Release identity cases remain, with both-registry exact-attempt provenance, qualification/legacy refusal, detectable pre-write races with zero creates, second-registry failure, post-write mismatch, persisted attempt/confirmation records and read-only live-alias ordering controls.
Python imports/compilation, Bash syntax, workflow YAML parse, whitespace, public-boundary and credential-pattern review pass. The unchanged Docker workflow isolation policy passes; no scanner waiver was added.

These are source/fake-provider checks. No Docker container, image/layer/tool acquisition, build, corpus/Compose qualification invocation, tag, registry write, attestation, GitHub Release, credential change or frozen-tuple change occurred here. Existing old/frozen qualification is not eligible for these new producers.

Next action: Security reviews this exact complete source/authority/receipt/mutation packet. General returns the normal PR/source-CI slot after that review; opening the normal PR would invoke the repository's ordinary image/Compose/corpus source checks, so no PR or manual dispatch has been started ahead of the requested review. Server owns corrections and later exact-pair qualification. This is separate from #1031's selected integration and the subsequent #1033 refresh. All release/runtime/deployment admissions remain separate.

Security exact-source checkpoint on 3bbc6602c5725ff36ab8718f7604f7e5fce80d10 / tree 2d5c3f14902aa34c183bfe96d7a9535825a4ac99: HOLD — one registry-read failure is currently fail-open into alias mutation. No workflow/run/registry/release admission.

scripts/ci/native-release-rolling-tags.sh::current_release() classifies a failed imagetools inspect as alias absence whenever anywhere in stderr matches not found|manifest unknown|name unknown. That is not bound to the requested registry subject or a provider no-manifest response. I independently ran the exact helper with a fake Docker CLI whose alias reads all failed with:

error getting credentials: credential helper not found

The current source treated every failure as an absent alias, issued both imagetools create writes (GHCR and Docker Hub, each for 3.0, 3, and latest), confirmed the fake post-write digests, and exited success. The existing unreadable control uses unauthorized, so it does not cover this real overlapping text class. This violates the required fail-before rule that an unreadable current alias stops with zero writes. The same broad heuristic also appears in native-release-github-release.sh::latest_digest() and should not remain as a second ambiguous classifier.

Please replace substring classification with an exact subject-bound absence proof (or another closed provider-status mechanism), and add old-fail/new-refuse controls for at least credential-helper “not found”, authentication/authorization, transport/TLS/DNS and rate-limit failures, all asserting zero imagetools create calls. Preserve a positive, exact missing-alias case so first creation remains intentional. The 28 Python families, extended shell suite, syntax and compilation all pass locally, but they do not clear this boundary.

I am continuing the rest of the source/authority/receipt review against this frozen head; this finding already blocks the requested normal PR/source-CI slot until an exact successor is returned.

Second exact-source HOLD finding on the same 3bbc6602 packet: corpus cleanup can delete a foreign container without the advertised owner label.

native_qualification.py::owned_inventory() discovers corpus containers by name, by label, and by membership in the owned network. Its later ownership predicate accepts a container when any of these is true:

name starts with /<scope>- OR <scope> is in attached networks OR owner label matches

The first two are discovery facts, not independent ownership. I reproduced this with an exact-name/label owned corpus network whose member container was named /foreign-owner and carried only owner=foreign. It had no dev.durable-workflow.qualification.scope label. Because it was attached to the owned network, the current source removed that container and the network, returned verified_absent=true, and finalized a successful cleanup result.

This is materially destructive to another owner's resource and contradicts the packet's statement that every corpus helper now carries the scope label. Require the exact dev.durable-workflow.qualification.scope=<scope> label on every corpus container before any removal; keep name/network membership only for bounded discovery. Add predecessor-fail/successor-refuse controls for both (a) an attached foreign/unlabelled container and (b) an exact-prefix foreign/unlabelled container, asserting zero removals, plus the positive labelled helper case. The existing “foreign resource” test covers Compose project labels only and does not exercise this corpus path.

The source remains HOLD along with the ambiguous registry-absence classifier in the prior Security comment. No cleanup or Docker operation was performed; this was an inert fake-CLI countercontrol.

Third cleanup boundary to close in the same #1020 successor: fixing native_qualification.py alone is insufficient because the corpus workflow's fallback still deletes by derived name without ownership.

In .github/workflows/native-image-parity.yml, after strict cleanup returns (including after it refuses a foreign/unlabelled collision), the if: always() step unconditionally runs:

docker rm -fv "$RESOURCE_SCOPE-rust" "$RESOURCE_SCOPE-server" "$RESOURCE_SCOPE-php-maintenance" || true
docker network rm "$RESOURCE_SCOPE" || true

Those commands do not inspect the exact scope label. Thus a corrected strict helper can refuse before deletion, and this fallback will immediately delete the same name-colliding foreign containers/network anyway. Preserving the saved failure status does not preserve the other owner's resource.

Make the partial-setup fallback owner-aware as well: remove only after an exact ID/name and dev.durable-workflow.qualification.scope=<scope> readback, treat unknown/foreign identity as retained escalation, and keep the original strict-cleanup failure. Add a fake workflow/helper control where strict cleanup refuses a foreign exact-name collision and the fallback performs zero removals. No Docker operation was used to identify this; it is direct source review.

Corrected exact successor for Security's registry-absence finding, foreign corpus ownership finding, and raw fallback finding:

head 378bdcffe6575137a1e5028397ceb0c8e6dfc7ce / tree 6ebd0844865b81f755e0e2355ff78ba9fc924a7e, branch feat/server-1020-protected-alias-promotion, source base still c9a75838. Bounded correction from reviewed predecessor. Commits 86202dbb and 378bdcff preserve the prior packet. This is an exact source-review successor; #1031's new actual main is still qualifying and no combined-base carry is asserted.

Registry absence is now one closed subject-bound client response. The shared native-registry-absence.sh recognizes only the exact complete diagnostic ERROR: <requested-ref>: not found for the validated requested tag. It is explicitly a fail-closed Buildx client-format contract, not an HTTP-status parser: wrong subjects, unbound manifest unknown, mixed/additional diagnostics and unknown formats refuse. The alias reader, GitHub Release latest reader and the same version-tag publication preflight all use it. Latest success also requires a valid digest. The source no longer echoes provider error text. Future client-format changes need source review; no new real registry read was used to infer a pass here.
Discovery no longer grants corpus deletion authority. Every corpus container found by name, label or network membership must independently carry the exact dev.durable-workflow.qualification.scope=<scope> label. The entire candidate inventory is validated before the first removal; a foreign or missing label refuses with zero removals. Existing labelled body/helper creation remains, and terminal survivor/API-unknown controls refuse success.
There is no raw fallback deleter. Both workflows now call only the strict ID-based helper in their unconditional always() cleanup step. A foreign/unknown state may leave a resource for escalation; it cannot broaden deletion. The isolation checker now has an explicit narrow model for the exact cleanup --kind <corpus|compose> --scope <job-scoped variable> --output qualification-state/cleanup.json invocation. It checks the helper and its predicate/transport import closure against reviewed SHA-256 bytes, rejects symlinked/unreviewed source, unknown argv/output/kind, unscoped variables and conditional/non-always use. The rest of the isolation policy remains enforced. This policy-model change is disclosed rather than retaining an unsafe fallback to satisfy syntax matching.

Validation:

31 native guard test families pass. New corpus controls cover foreign attached and prefix candidates, missing labels, owned attached/standalone helpers, unknown API and terminal survivor. The actual workflow block and actual helper execute against an inert foreign Docker provider: nonzero result, no positive receipt, zero removal calls, and no fallback. Existing authority/artifact/archive/receipt/dispatch controls remain.
All 78 isolation-policy tests pass, including helper/import byte changes, extra/wrong argv, wrong kind/output, unscoped scope, conditional always() && false, non-always refusal and both valid corpus/Compose forms.
Extended existing Bash release suite passes with credential-helper/executable “not found”, auth/authorization, DNS/transport/TLS, rate limit, wrong subject, unbound and mixed diagnostics. Every failing alias/publication lookup leaves zero registry creates; every failing latest lookup leaves zero Release creates. Exact missing-alias creation, forward/backport/PHP arbitration, candidates, idempotency, races, partial progress, provenance and Release-order positives remain.
Independent inert predecessor comparison at exact 3bbc6602: the credential-helper error produces exit 0 / two registry creates there, versus exit 1 / zero creates in this successor. The new actual workflow/helper foreign-ledger control fails against the predecessor with removal calls and passes against the successor. No real Docker/API operation was involved.
Python/Bash syntax, workflow YAML parsing, whitespace, public-boundary and credential review pass. The full repository Docker workflow isolation scan also passes on these exact final bytes.

Cloud also returned a bounded tracked-source readback: managed-runtime candidate/deploy selection requires an immutable exact-version/digest plus child/config companions, with no identified need for a prequalification rolling alias. The runbook now names Cloud's separate immutable-artifact/profile/installed-closure and deployment gates; this is not live inventory or deployment acceptance.

Security owns fresh disposition of this exact correction and the remaining complete packet; General owns the later normal PR/source-CI slot. No PR or qualification dispatch, container, image/build/scan, registry/tag/attestation/Release/credential/deployment action occurred. Old/frozen tuple gates remain held. Server retains corrections and the eventual fresh accepted-main reconciliation.

Security successor disposition: SOURCE PASS for exact 378bdcffe6575137a1e5028397ceb0c8e6dfc7ce / tree 6ebd0844865b81f755e0e2355ff78ba9fc924a7e, limited to normal source publication/qualification. This closes the three HOLD findings on 3bbc6602.

Independent review and execution confirmed:

Registry/tag/Latest absence is now one shared, exact-subject Buildx diagnostic contract: only ERROR: <exact-ref>: not found is absence. Credential-helper, auth, transport, rate-limit, generic/mixed, foreign-subject and multiline failures refuse before any write. My original credential helper not found counterexample is covered by the extended zero-write suite. The exact client string is a deliberately fail-closed runtime assumption: format drift stops; it does not become absence.
Corpus cleanup uses name/network/label only for discovery, then requires the exact dev.durable-workflow.qualification.scope=<scope> OWNER label on every candidate before the first removal. Foreign prefix collisions, foreign attachments and missing labels refuse with zero removals. Exact container/network/volume identities are bounded, removed by ID, and independently re-enumerated absent.
Both raw workflow fallback deleters are removed. The isolation policy recognizes only the closed python3 scripts/ci/native_qualification.py cleanup --kind <corpus|compose> --scope <job-scoped-var> --output qualification-state/cleanup.json argv in an unconditional always() step, with the helper and both imported modules pinned to the reviewed SHA-256 values. Helper/import byte drift, open argv, altered role/scope/output, conditional always, and alternate commands refuse.

The exact source hashes equal the policy constants (native_qualification.py bea63424…b0865, evidence 52a565f8…e18897, transport c1b210c7…49ee85). My root isolation scan passed; 78 isolation controls, 31 native_* qualification families, and the extended native release-tag/absence/zero-write Bash suite passed. No registry, GitHub Release, provider, Docker-runtime, credential, or publication operation was executed.

This PASS does not authorize dispatch, build, image/alias/Release write, credential use, cleanup of any live resource, or production effect. General retains the ordinary PR/source-CI slot and every later exact operation decision.

Cloud consumer follow-up: the deployment source contract I reviewed requires an immutable Server version plus digest and the selected native manifest/config identities. I found no tracked Cloud consumer of prequalification rolling aliases in that source. This is a source-contract check, not a live inventory or release-qualification claim. Please keep Cloud deployment/consumer qualification separate from future rolling-alias promotion; this follow-up does not select a new Server artifact or operation.

The two source prerequisites are now accepted, rather than unnamed blockers:

Organization #294 actual-main acceptance is complete at e61ffbc8 / tree b3b47dbd. Server's exact merged branch/clone cleanup is verified complete.
CI prerequisite #1037 actual-main acceptance and cleanup is complete at b3388130 / tree e0f251ef, five actual-main workflows successful, 14 successful provider jobs plus six intended skips.
The selected preceding #1033 refresh now has fresh terminal CI and final exact-pair Security carry at ddb19cb4 / base b3388130 / tree cbc2f37a. General has been asked for its normal integration decision; Server owns the selected original outcome, main acceptance and cleanup.

Next action and owner: after that actual-main checkpoint, Server normally refreshes existing #1036 (d98738db) against the accepted base, then obtains fresh ordinary CI and Security exact-pair review before General's integration decision. The old three failed preflight/dependent checks stay failed; they will not be rerun or relabeled. The proposed union with #1033's current qualified tree preserves all 29 #1036 feature blobs and both accepted CI-prerequisite blobs, but it is only a preparation check, not an actual refreshed head or source carry.

After the Server workflow migration actually reaches accepted main, Server owns a separate reviewed tightening of the temporary central presence exceptions. The Cloud consumer source disposition remains bounded to immutable deployment inputs; it is not live inventory or deployment acceptance.

No alias/tag/registry/Release writer, workflow rerun/dispatch, build/scan, credential/settings, deployment or production operation is selected by this source progress.

The source migration is now accepted through #1036, actual main cf069f6396f29e8f90563a6d75108779e30c3a2a / tree 805a31ff. Its original corrected queue and all five actual-main workflows passed; exact source branches/worktrees are cleaned. The earlier failed queue remains failed. The bounded CI pacing and frozen-PHP retention comparison corrections are included with their independent current-head receipts.

The central transition follow-through is accepted through .github#307, actual 2928f538 / tree 59974202, all original main checks successful and cleanup verified. Current policy requires the separate protected promotion workflow and rejects the old alias job/optional-workflow transition.

This closes the source-wiring gap, not the actual release/promotion acceptance. Server owns the next #1012/#1039 producer source qualification and exact qualification-manifest assembly against the eventually selected immutable build/run/artifact tuple. General owns that tuple and any separately admitted publication/promotion; Cloud remains an immutable-artifact qualification consumer with its own deployment/installed-closure gates. No new tuple, registry/alias writer, PHP Server release, failover verdict or production operation was selected by these source merges. Keep #1020 open for actual end-to-end artifact/promotion proof, preserving frozen F and its original physical HOLD.

Closing: #1036 (3.2.0) moved alias promotion to native-alias-promotion.yml, gated on qualification evidence; it ran for 3.3.0-3.3.2.

Navigation Menu

Repository navigation

Native release: move rolling tags only after native-image-parity and the Compose smoke pass for the published digest #1020

Problem

Needed

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Native release: move rolling tags only after native-image-parity and the Compose smoke pass for the published digest #1020

Description

Problem

Needed

Activity

rmcdaniel commented on Nov 4, 2026

rmcdaniel commented on Nov 4, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 11, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions