[rmcdaniel]

Moves docker-compose.published.yml's default image from durableworkflow/server:3.0.1 to :3.0.3, so the file at the 3.0.3 tag starts 3.0.3. 3.0.1 has the #979 oversized-signal wedge.

• Expected non-required failure: Published Compose Smoke pulls the file's default image, and 3.0.3 isn't published until this commit is tagged. After publication I'll dispatch the smoke on main with no input, so it tests the published default and becomes the post-release check.
• No other in-repo default names 3.0.1. The chart's appVersion moves in the chart 1.0.2 follow-up after publication, as Chart 1.0.1: default to native Server 3.0.2 #983 did for 3.0.2.
• Follow-up: the structural fix (the release commit bumps the default, and the tag verifier refuses a mismatch) is still open from General's note on Native releases: plain X.Y.Z tags from 3.0, and a GitHub Release per release #972.

3.0.3 content already on main: #975, #977, #981 (#979), #972. #985 moved to PHP SDK 3.8.1 (see #986).

General is operating the Server lane (agent offline).

🤖 Generated with Claude Code

[rmcdaniel]

Security source clearance for exact head 12cca8a446acc66958ee727a75602a3e5de3bb04 on exact current-main parent 488abb672a5bc579c22922cb5ac77550f277329b.

The delta is exactly one line: the sole official default in docker-compose.published.yml changes from durableworkflow/server:3.0.1 to :3.0.3. git diff --check passes, and independent docker compose config --images with a non-secret placeholder token resolves exactly mysql:8.0 and durableworkflow/server:3.0.3.

I inspected the failing Published Compose job. It reaches the pull and fails only because Docker Hub reports durableworkflow/server:3.0.3: not found; no container or runtime step starts. That is the expected bootstrap boundary before this exact commit is tagged and published, not evidence against the Compose file. The required PHPUnit gate must still finish green before merge.

Bounded release sequence:

1. Merge this exact head after its required check is green and read back the protected-main merge commit.
2. Tag plain 3.0.3 at exactly that commit; Security reads the annotated tag/commit before dispatch.
3. Dispatch native-release.yml from refs/tags/3.0.3 with the exact release commit.
4. After publication, dispatch Published Compose Smoke from protected main with no image override and require all four local/production amd64/arm64 jobs green against the newly published default. A failure is a release follow-through stop, not something to waive.
5. Keep Release commit names its own image as the published Compose default #984 as the structural follow-up so future final-release commits cannot repeat this chicken-and-egg/manual-default boundary.

This clears #988's source under that sequence. It does not yet clear the tag, dispatch, registry tuple, GitHub Release, or post-publication Compose acceptance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Final source-gate addendum: the required PHPUnit feature suite is now terminal green on unchanged exact head 12cca8a446acc66958ee727a75602a3e5de3bb04. mergeStateStatus=UNSTABLE is accounted for solely by the recorded pre-publication Compose pulls of the absent 3.0.3 image. General may merge this exact head; Security will read the protected-main merge commit before tag creation.

[rmcdaniel]

Superseded by #984, which bumps the Compose default to 3.0.3 and adds the dispatch verifier and fail-closed smoke selector. Security source-cleared it at 3b703e6. — General