[rmcdaniel]

Four independent changes for Rust Server #325, batched to save a CI cycle.

1. Qualify a native image over the shared fixture corpus (875ad3878)

Release-candidate qualification has to compare the published native image with the published PHP reference, not only a source build.

• native-image-corpus.sh <image> runs the image the way an operator would: its own entrypoint, user and maintenance loop, with SQLite in its /app/database volume. It records the shared corpus on SQLite against published PHP 2.11.4, embedded PHP and that image, then compares the three records.
• Fixture selection matches the Shared Server fixtures corpus part. update-validation and service-calls are recorded separately through the same helper, with PHP's maintenance loop stopped (Rust Server train: MySQL statement closes (#714), update validation, policy-map JSON, worker history presentation #723, Investigate first-call PHP service rate rejection during SQLite maintenance #796).
• The image must be pinned by digest, or be the job's own local build. Containers use dw-parity-<run>-<attempt>-<job>, the name the shared PHP maintenance window expects.
• It writes a durable-workflow.native-image-corpus.v1 receipt naming the image reference, the image id, the PHP reference, the runner revision and each step's status.
• native-image-parity.yml runs on dispatch with an image digest. A PR that changes the comparison or its helpers builds the image from its own source into the runner's daemon and compares that build, so the comparison is tested before it is relied on. Nothing is pushed, and an always step removes the containers.

2. Publish native release candidates from native- Git tags (2e1b63e15)

This follows the tag scheme General chose: a native RC is its own Git tag, native-<version>, and the image tag drops the prefix.

• verify-release-tag-source.sh takes RELEASE_TAG_PREFIX, which is either empty (PHP; behavior and messages unchanged) or native-.
• native-release-publish.sh accepts only native-<version>.
• check-native-release-tags.sh proves release.yml's push-tag filter matches no native- tag and still matches 2.11.4 and 2.12.0-rc.1. It runs from the Native image workflow.

3. External-worker completions meet the pending-count limits (02dbad62b)

Core 2.14.1 shipped Workflow #933's package side (#939), so the 2.11.4 reference refuses an external-worker completion that would pass the pending activity, child or timer limit. Native now checks each schedule_activity, start_child_workflow and start_timer before writing it.

• The counts match Core 2.14.2's StructuralLimits guards.
• The refusal is Server 2.11.4's WorkerController answer: 422 structural_limit_exceeded with the limit kind, current value and configured limit. Nothing is written and the task keeps its lease.
• DW_V2_LIMIT_PENDING_ACTIVITIES, _CHILDREN and _TIMERS are honored with PHP's defaults (2000, 1000, 2000).

4. Give native publication its own empty Environment and secret names (33a653f4a)

native-release.yml used the PHP release's dockerhub Environment and the repository's Docker Hub pair. Native now uses the dockerhub-native Environment and NATIVE_DOCKERHUB_USERNAME / NATIVE_DOCKERHUB_TOKEN, and the workflow fails closed while they are absent: each job signs in to Docker Hub before it builds, so a dispatch pushes nothing.

The fifth commit, 98334052b, records the image parity script's Composer install in composer-sinks.json. It uses the same confined run-composer.sh call as the fixtures workflow.

d51dd139c pulls the pinned Composer image before the MySQL, PostgreSQL and SQLite fixture jobs and the image parity job run, using pull-images.sh's registry retries. This PR's previous run lost two fixture jobs to a Docker Hub HTTP 500 on that image (run 40474209808). Every other pinned image those jobs use was already pulled this way.

Checks run

• Native image parity, locally, against an image built from this branch's source (image id sha256:d6cd5bd2…), with PHP reference bee30cde…: the PHP, embedded and native records, the comparison, and the separate update-validation and service-calls records all pass (71 cases in the main selection).
• Pending limits: SQLite lib 338/338 and execution 562/562 on this branch rebased onto main after Move the Shared Server fixtures reference to published 2.11.4 #805. pending_limits passes on PostgreSQL, MySQL and MariaDB.
• Policies: both organization policies and check-native-release-tags.sh pass.

Part of #325. Nothing is published or dispatched.

🤖 Generated with Claude Code

[rmcdaniel]

General's release-control review accepts c3f36e2a6 and e75a082d9 as present in d8c6497e626ec9dfaebef34608eb1019409148bb.

The full immutable native-<version> Git tag remains bound to the planned full commit. Only the literal prefix is removed for the image tag. The current PHP release filter excludes native-prefixed tags and retains ordinary stable/RC tags. All three native release jobs use the dedicated publication environment and distinct secret names, with Docker Hub authentication before GHCR publication. Existing digest smoke, non-overwrite, two-registry index equality and attestation controls remain intact.

The actual input/tag guard passed in an isolated container with network disabled. It stops the verifier/publisher before any API or registry call. This review ran no Rust build or native publication.

Please remove the private operations reference and credential-install coordination from the new public workflow header before merge; the technical absent-credential/fail-closed explanation is sufficient. That comment cleanup needs no further implementation review. Owner CI and the existing first-publication prerequisites still apply. This is a scoped release-control acceptance, not a claim that the native/runtime changes or all hosted checks have passed.

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud