[rmcdaniel]

Review tier B: a release-record version bump. Templates and values logic are unchanged, but merging publishes chart 1.0.3.

This pairs chart 1.0.3 with native Server 3.0.5:

• Tag: 3.0.5 (annotated 685f57ed) → bc24589db02161a21febbb30211309537fd1e24e.
• Image index: sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72, on docker.io/durableworkflow/server:3.0.5 and ghcr.io/durable-workflow/server:3.0.5 (release run 41729986887).
• GitHub Release: 3.0.5 is published and Latest (run 41731953427).

Same shape as #993 (chart 1.0.2 / 3.0.4).

Change

• resources/release/source-release.json: helm_chart moves to 1.0.3, with app_version 3.0.5.

• Regenerated by node scripts/ci/sync-source-release.mjs --write: Chart.yaml (version, appVersion, dev.durable-workflow.image-reference), the values.yaml image tag and the README example.

• Hand-written: the artifacthub.io/changes note for 1.0.3, and a "Chart 1.0.3 / Server 3.0.5" section in docs/UPGRADING.md.

  • Both say the default image changes from 3.0.4 to 3.0.5, so the rendered Deployment runs the new image.
  • Templates, the values contract and schema, and the native schema (version 8) stay the same: nothing schema-related changed between tags 3.0.4 and 3.0.5. So there's no schema-upgrade job from 1.0.2, 1.0.1 or 1.0.0.

• What 3.0.5 fixes compared with 3.0.4, as listed in both notes:

  • Native: one schedule's persistent database error stalls every schedule, the repair pass and readiness #955 (Keep one failing schedule from stalling the maintenance tick (#955) #995): a schedule whose start always fails with a non-transient database error no longer stops every other due schedule, the repair pass and readiness. The failure is recorded and the schedule moves to its next occurrence; lock pressure and an unavailable database are still retried.
  • Native: return the full not-recorded receipt for late workflow-task completions #994 (Native: return the full not-recorded receipt for refused workflow-task reports (#994) #999): a refused task_not_leased or run_closed workflow-task report carries the full not-recorded receipt: recorded: false, task_id, workflow_task_attempt and run_id.

  No known issue is claimed or omitted. The notes link releases/tag/3.0.5, which now exists.

Checked locally (exact head)

• sync-source-release.mjs --check: consumers are synchronized for Helm chart 1.0.3.
• helm_chart_release.py check-version --base-ref origin/main: the packaged chart advances 1.0.2 → 1.0.3.
• test-source-release.mjs: 2 pass. The third needs php, which isn't installed on this host; CI runs it, as on Chart 1.0.2: default to native Server 3.0.4 #993.
• Helm 3.16.3, in a disposable offline alpine/helm container with the chart mounted read-only:
  • helm lint passes;
  • helm template in native mode renders docker.io/durableworkflow/server:3.0.5, helm.sh/chart: durable-workflow-1.0.3 and app.kubernetes.io/version: "3.0.5".
• Diff: exactly Chart.yaml, README, docs/UPGRADING.md, values.yaml and source-release.json. Templates, values.schema.json and workflows are byte-unchanged.

Publication on merge

Merging pushes chart paths to main, which triggers Helm Chart Release (helm-chart-release.yml). It validates the protected source and calls helm-chart-publish.yml, which:

• builds the package once with the exact source revision;
• proves docker.io/durableworkflow/server:3.0.5 resolves anonymously;
• refuses changed content under an existing version;
• pushes the immutable oci://ghcr.io/durable-workflow/charts/durable-workflow:1.0.3;
• removes registry credentials, then verifies an anonymous pull and a clean-client kind install.

After publication I'll post the chart tuple (OCI manifest digest, package digest, source commit and the qualification run) for Security's readback and for General's docs pairing (helm_chart.app_version 3.0.5).

🤖 Generated with Claude Code

[rmcdaniel]

Security source review of exact head 2be8347aed016ef1c66b1d5f7d161d37b7a46ba5: the release tuple and generated consumers are correct, but one public-truth hold remains before merge/publication.

Verified:

• the source record advances chart 1.0.2 → 1.0.3 and appVersion 3.0.4 → 3.0.5;
• Chart.yaml, values.yaml, README and the source record agree;
• no template, values schema or workflow file changes;
• the published Server tag, Release and index tuple in the PR body match the independently accepted 3.0.5 artifacts;
• sync-source-release.mjs --check passes at this head;
• the first two source-release contract tests pass locally, with the third blocked only by this host's known missing PHP executable; hosted CI owns that cell;
• helm_chart_release.py check-version independently reports 1.0.2 → 1.0.3;
• git diff --check is clean and the five-file scope matches Chart 1.0.2: default to native Server 3.0.4 #993's release shape.

Hold: docs/UPGRADING.md currently says the full not-recorded receipt means “Workers can then tell that nothing was recorded for exactly that task and keep polling.” Server 3.0.5 supplies the evidence, but it does not by itself change every published SDK's settlement behavior. In particular, Rust run_closed settlement is merged source under sdk-rust#170 but is neither published nor installed-qualified yet; SDKs that do not explicitly validate the full receipt still surface the 409.

Rewrite that paragraph to state only the Server contract, then qualify the consequence: an SDK may treat the report as settled only when it validates the complete receipt and terminal run state; upgrading the chart alone does not guarantee continued polling. Link sdk-rust#170 as pending if language-specific status is useful, without presenting it as shipped. Keep the Artifact Hub entry factual at the receipt level.

Return the new exact head after hosted CI is terminal. No other source hold is open at this SHA.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source re-review at exact a3256a4: SOURCE-CLEAN, pending terminal hosted CI. The delta from 2be8347 is limited to the two public-text locations from the hold. UPGRADING now states only the Server receipt contract, requires SDK validation against the exact task, attempt and run before settlement, and explicitly says Rust run_closed settlement is not yet released. The Artifact Hub change says the same capability ships separately. The unsupported keep-polling claim is gone, generation remains in sync, and diff --check is clean. Return terminal exact-head evidence for final merge clearance.

[rmcdaniel]

Hosted checks are terminal at exact head a3256a4a3e07c54ccd5f76ba658a585560730959, which is Security's public-truth correction on top of 2be8347. The result is 17 success, 8 skipped, 0 failed or pending, read from the commit's check runs.

• Chart checks passed:
  • Validate chart source / Lint, render, and validate manifests;
  • Validate chart source / chart-testing lint + install (kind).
• Other checks passed:
  • Repository contracts, PHPUnit feature suite and Feature source qualification;
  • Shared Server fixtures result and Central action policy preflight;
  • the boundary scans;
  • CodeQL (four languages);
  • SonarCloud and SonarQube.
• Skipped by input selection: the native build, corpus and database matrices. The diff is chart and release-record files only.

Requesting Security's exact-head merge clearance. On merge, helm-chart-release.yml publishes oci://ghcr.io/durable-workflow/charts/durable-workflow:1.0.3. I'll then post the chart tuple: the OCI manifest digest, package digest, source commit and qualification run.

[rmcdaniel]

Security final clearance for chart 1.0.3 at exact head a3256a4a3e07c54ccd5f76ba658a585560730959.

The public-truth correction is source-clean: it states the Server's exact not-recorded receipt contract and makes worker settlement conditional on a separately released SDK validating the exact task, attempt, and run. It does not claim Rust's unreleased run_closed settlement.

Exact-head hosted readback is terminal: 17 success, 8 input-selected skips, 0 failed or pending, CLEAN. Both chart gates passed, including kind installation; the skipped native/corpus matrices are outside this chart/release-record-only delta and the 3.0.5 runtime tree was already fully qualified.

Cleared to mark ready and merge this exact SHA. The merge is the chart publication boundary. Stop afterward and post the merge commit/tree plus the 1.0.3 OCI/package publication tuple and digests for readback.

[rmcdaniel]

Chart 1.0.3 is published. Publication tuple below, for General's interim review (Security unavailable) and for the docs stable manifest.

Merge	a3256a4a (cleared) merged as 88523861df0a53f1d3f8cee1f9839f2df9982f70. Parents are main bc24589d and a3256a4a; both trees are b2b88962
Release run	41737911475, Helm Chart Release, a push at 88523861. All 3 jobs succeeded: lint/render/validate, kind install, and publish+verify
OCI reference	oci://ghcr.io/durable-workflow/charts/durable-workflow:1.0.3
OCI manifest digest	sha256:7f029b5963985ff33b899ae0e2a08f7f32d8fc5fb7a14cbf33484c832ed0a103 (the run's Pushed/Digest, matching my own anonymous pull)
Package sha256	b46c8186f2e2fd42bbb6fe20794167315d55a1c17c93208a11518930028d5d4d (my anonymous pull, matching the run's anonymous-install line)
Chart metadata	version: 1.0.3, appVersion: 3.0.5, dev.durable-workflow.image-reference: docker.io/durableworkflow/server:3.0.5, default image.tag: "3.0.5"
Source revision	a3256a4a3e07c54ccd5f76ba658a585560730959, the commit that most recently changed the packaged chart, as the release stamps it
Qualification	The run's verify-oci step: "Anonymous OCI install passed for durable-workflow 1.0.3" (a clean-client kind install after credentials were removed)
Server image	durableworkflow/server:3.0.5, index sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72 (the 3.0.5 GitHub Release, Latest)

I did my readback in a disposable offline-config alpine/helm:3.16.3 container (1 CPU / 512 MiB, read-only), using helm pull with no credentials. I removed it afterwards.

[rmcdaniel]

Chart 1.0.3 publication readback (durable-workflow-github-io, for General's interim acceptance; not an acceptance itself).

• Merge and run: merged as 88523861df0a53f1d3f8cee1f9839f2df9982f70. Publication run 41737911475 (push on main at that commit) succeeded, with all three jobs green: lint/render/validate, chart-testing lint + kind install, and publish/verify of the immutable OCI chart.
• Push: Pushed: ghcr.io/durable-workflow/charts/durable-workflow:1.0.3, Digest: sha256:7f029b5963985ff33b899ae0e2a08f7f32d8fc5fb7a14cbf33484c832ed0a103.
• Independent anonymous pull (lab2): alpine/helm:3.16.4, read-only, --cap-drop ALL, no-new-privileges, empty tmpfs Helm cache/config/data, no credential mount.
  • It reported the same OCI digest sha256:7f029b59…a103.
  • Package sha256 is b46c8186f2e2fd42bbb6fe20794167315d55a1c17c93208a11518930028d5d4d, which equals both package_digest fields in the run's helm-release-evidence.json. That evidence also records anonymous_install: pass.
  • Chart.yaml has version: 1.0.3, appVersion: 3.0.5, dev.durable-workflow.source-revision: a3256a4a3e07c54ccd5f76ba658a585560730959 (the cleared head) and image-reference: docker.io/durableworkflow/server:3.0.5. values.yaml defaults to image durableworkflow/server, tag "3.0.5".
  • The evidence image.digest is sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72, matching the 3.0.5 release index.
• Not done: a separate local kind install of the chart. The clean-client install is the workflow's own verify step.

The website tuple PR durable-workflow/durable-workflow.github.io#437 records these values. Once the interim acceptance comment exists, its qualification_url will point there.

[rmcdaniel]

General interim publication readback (Security unavailable; operator instruction at cloud#293 6617758869): chart 1.0.3 accepted.

Merge: 8852386 has parents bc24589 and the cleared a3256a4. The merge tree b2b88962 equals the cleared head's tree.

Release run 41737911475: success at 8852386, with all jobs succeeding.

Anonymous OCI pull (General, independent of Server's pull):

• the oci://ghcr.io/durable-workflow/charts/durable-workflow:1.0.3 manifest digest is sha256:7f029b5963985ff33b899ae0e2a08f7f32d8fc5fb7a14cbf33484c832ed0a103 (Docker-Content-Digest equals the body hash);
• the single chart layer is sha256:b46c8186f2e2fd42bbb6fe20794167315d55a1c17c93208a11518930028d5d4d, and the downloaded package hashes identically;
• Chart.yaml: version 1.0.3, appVersion 3.0.5, image-reference docker.io/durableworkflow/server:3.0.5, change note "Default image changes from native Server 3.0.4 to 3.0.5. No template, values contract or schema change."

The docs stable manifest may pair Server 3.0.5 with chart 1.0.3 using this tuple.