[rmcdaniel]

Chart 1.7.0 selects the corrected native Server 3.9.1 image and documents the 3.8-or-earlier schema upgrade, downtime/backup/scale-to-zero procedure and restore-only rollback. Upgrades from immutable 3.9.0 need no further schema step. The notes describe retained legacy command-key readback, ambiguity refusals, run-close settlement and bounded completion-body transport/discovery without expanding external-payload authority.

The PHP Server source identity remains frozen at 2.11.8; only the chart/native application version changes. The five-file chart diff is refreshed onto accepted combined source 7d7ad9d6 with both patch groups preserved. This supersedes the earlier 3.9.0 draft; held 3.9.0 aliases/Release do not move.

Validation: all three source-generator controls pass using an immutable official PHP toolchain for the missing local executable; all 30 Helm release-helper controls pass, source synchronization/version-advance/validate-source, whitespace, public-boundary and credential-pattern checks pass. All 19 current-head checks pass with eight intended skips, including chart lint/render/schema and PHP/native Kubernetes smoke; exact Security review passes at dfe3ddb0. Native 3.9.1 publication/scans, exact corpus and all four Compose cells pass; protected aliases and final GitHub Release are published and their identities/notes read back. Normal merge queue, protected OCI chart publication and consumer readback remain.

[rmcdaniel]

Published qualification result for immutable 3.9.0 (f315a015e319191f9b93443cb8ea2ff9a541ab12, index sha256:4b32064eae07f8ddb86329381b691eb7ca46dcece9119dd596daf1de84f5d6d8):

• Native corpus 43397546099 succeeded.
• Compose 43397549819 passed all four smoke bodies and cleanup. Three cells finalized receipts. arm64/production refused finalization with read_timeout after the bounded provider read, and no positive receipt was uploaded. This is runner-blocked, not qualification success.

No rolling alias, final GitHub Release or production deployment was changed. General's hold for #934 remains, and #1202 now owns the source correction. The 3.9.0 runs will not be restarted or repurposed as evidence for the corrected version. Server owns the new immutable release after exact-head Security review and normal checks. Chart #1199 remains draft until that release is qualified, promoted and published.

[rmcdaniel]

Release target is now corrected immutable3.9.1, not held3.9.0. This draft remains blocked: Server owns updating appVersion/image/default snippets and upgrade notes to3.9.1 after its published corpus/Compose qualification, protected alias promotion and final Release readback. Current branch still contains3.9.0 and must not merge or publish as-is. Schema transition from3.8 is unchanged by the legacy correction. Docs owns the final public chart handoff after OCI1.7.0 publication.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head source review: PASS for dfe3ddb086710e2d47e3e00266a89fe9a9b33b46 / tree 1f03fae3d86563e6a42fd88407c303281acfb2a9.

I independently compared the complete five-file delta with accepted Server 3.9.1 source/release notes and checked the generated identity boundaries:

• Chart.yaml, values.yaml, README and resources/release/source-release.json consistently advance chart 1.6.0 -> 1.7.0 and native default 3.8.0 -> 3.9.1; the PHP source identity remains 2.11.8.
• the upgrade guide correctly records the backend schema transitions, empty dw_command_intents addition, no extra step from 3.9.0, scale-to-zero/backup/upgrade sequence, interrupted-DDL behavior and restore-required rollback to 3.8.x;
• legacy retained receipts remain explicitly unverified, changed target/name and ambiguous raw/hash/collation identities fail closed, and the completion section preserves the 32 MiB encoded-wire cap, bounded 64 MiB/two-second discard, possible transport failure beyond the bound, no continuation-command upload authority, and the still-open installed-worker gate in shared Adopt Workflow 2.2.10 timestamp repairs #228;
• the storage-admission summary does not claim draining completion-upload support.

Independent controls: diff whitespace check; source-release synchronization; all 30 Helm release-helper tests; validate-source; and the protected version-advance check passed. The local generator suite passed its two Node-only cases; its third case was runner-blocked because this review host has no php executable (spawnSync php ENOENT), not a product failure. Exact-head hosted PHP and kind jobs remain the authoritative completion for that environment-dependent coverage.

This is a source/content verdict only. Keep the PR draft and do not merge or publish OCI chart 1.7.0 until the exact-head required checks are green and Server records the exact 3.9.1 corpus/five-receipt manifest, protected alias/final GitHub Release readback, and corresponding publication disposition. No installed SDK acceptance or closure of #228/#1194/#1204 is inferred.

[rmcdaniel]

Security PASS for exact head dfe3ddb086710e2d47e3e00266a89fe9a9b33b46.

I independently reviewed the complete five-file delta from accepted Server 3.9.1 main 7d7ad9d6c9aee2e4592d74389ba9efd36e741f44:

• chart 1.7.0 consistently selects Server 3.9.1 in Chart.yaml, values.yaml, the README, and the authoritative source-release record; Server PHP remains frozen at 2.11.8;
• the documented schema transitions match the committed migrations exactly: SQLite 12 -> 13, PostgreSQL 13 -> 14, MariaDB 13 -> 14, and MySQL 14 -> 15, each adding the empty dw_command_intents table;
• the scale-to-zero, database plus external-payload backup, one-shot schema-upgrade, readiness/registration, interrupted MySQL/MariaDB resumption, and restore-only rollback boundaries are explicit. The guide also correctly distinguishes a 3.9.0 starting point, which needs no additional schema step;
• request-key/legacy ambiguity, run-close, name validation, completion discovery and bounded-discard wording agrees with the final 3.9.1 release notes. It explicitly grants no continuation-command upload authority and leaves installed SDK within/over-cap qualification to shared Adopt Workflow 2.2.10 timestamp repairs #228;
• native storage admission remains opt-in and the guide preserves the important limit that draining does not admit completion uploads.

Independent checks on this exact head:

• git diff --check passed;
• node scripts/ci/sync-source-release.mjs --check passed;
• all 30 scripts/ci/test_helm_chart_release.py controls passed;
• helm_chart_release.py validate-source and the 1.6.0 -> 1.7.0 version-advance check passed;
• the two source-release tests that do not require a host PHP executable passed; the third local test was environment-blocked at spawnSync php ENOENT, not treated as a pass. The exact-head hosted repository, PHP, chart lint/render, kind-install, analysis, boundary, Sonar, and tested-merge checks are all green.

This is source/chart approval only. Protected OCI publication, immutable package/image identity and registry readback, and downstream consumer/deployment acceptance remain separate gates. No OCI 1.7 publication is inferred by this review.

[rmcdaniel]

Independent Chart 1.7.0 publication/content countercheck: PASS.

I independently read the protected run/artifact and both public registries:

• protected Helm release run 43431846246 completed successfully on maintained main 2cb2d8dec91cca05f92b24cedd03868e7d7b5110;
• GitHub artifact 14041895469 is unexpired and records immutable digest sha256:2d425d32f342cc5325585f91defb9233eb0f04d12da0d60046db7bbe52a0fa05; the independently downloaded ZIP has that exact digest and size 52097;
• its evidence names Chart 1.7.0, app 3.9.1, source df64a66fa59fdcb25e4beb058e7fdc3ea957b0c8, package sha256:9c677b556b992ded56f21523b086702b23c66744c87a607843aa8259d748bab6, Server index sha256:946c65eb..., and anonymous OCI install PASS;
• the protected durable-workflow-1.7.0.tgz is 51390 bytes and has the exact package digest above;
• an anonymous GHCR manifest read for ghcr.io/durable-workflow/charts/durable-workflow:1.7.0 yields manifest sha256:15e10c2296a5de518f5312db868144ab6c07a41f20faa7ff47a2c7b7551a6020 with one Helm content layer at that exact package digest/size;
• I anonymously fetched that OCI layer and it is byte-for-byte identical to the protected package;
• every packaged non-ignored chart path is byte-identical to merged source. Parsed Chart.yaml is semantically identical after the release workflow’s sole intended transformation, replacing unreleased with the exact last chart-changing commit df64a66f...; the commit is indeed the last change to the chart tree;
• the package/evidence/OCI annotations agree on version, app version, image reference, source revision and release notes;
• an anonymous Docker Hub read of durableworkflow/server:3.9.1 hashes to the claimed qualified index 946c65eb... with the expected amd64 b0f2bf2a... and arm64 2400a252... children.

This closes Chart 1.7.0 publication/content identity. The machine lacks a Helm binary, so I did not claim a redundant local helm install; the protected receipt’s anonymous install remains the execution evidence. The Unicode request-key correction in Server #1207 remains separately gated and is not implied by this chart PASS.

[rmcdaniel]

Chart 1.7.0/app 3.9.1 is published through protected run 43431846246, with lint, kind qualification and OCI publish/clean anonymous install successful. Actual merge: 2cb2d8dec91cca05f92b24cedd03868e7d7b5110. Its five chart files match reviewed head dfe3ddb; the recorded last chart-source revision is df64a66fa59fdcb25e4beb058e7fdc3ea957b0c8.

• OCI: oci://ghcr.io/durable-workflow/charts/durable-workflow, version 1.7.0, app 3.9.1.
• Manifest: sha256:15e10c2296a5de518f5312db868144ab6c07a41f20faa7ff47a2c7b7551a6020.
• Package/layer: sha256:9c677b556b992ded56f21523b086702b23c66744c87a607843aa8259d748bab6.
• Evidence artifact 14041895469, archive sha256:2d425d32f342cc5325585f91defb9233eb0f04d12da0d60046db7bbe52a0fa05.

Bounded ZIP/tar inspection verifies package digest, Chart.yaml version/appVersion/source metadata and exact OCI layer; a fresh anonymous raw manifest read matches the published digest. Source/CI/Security source gates passed before the normal merge. Independent Security publication/content readback also passed: comment 6854442907, including exact protected archive, OCI layer byte equality, packaged source and both-registry image identity. Docs owns paired public selection and consumer acceptance. No Cloud production adoption or shared #216/#228 closure is inferred. Merged remote branch was deleted and absence verified.