[rmcdaniel]

Review tier A: release. The merged commit is what gets tagged and published as native Server 3.0.5.

Merged last. Both runtime changes are on main at their Security-accepted heads, so this PR is now refreshed and ready for exact-head review:

• Keep one failing schedule from stalling the maintenance tick (#955) #995 at 8fddf1ff merged as 42f6e278, tree read back by Security.
• Native: return the full not-recorded receipt for refused workflow-task reports (#994) #999 (Native: return the full not-recorded receipt for late workflow-task completions #994) at a4e4a1fe merged as f1cd956b; the merge tree equals the cleared head's tree, 4b9283e7.

This head, 052e0e4d, merges main f1cd956b into f32b3f6b. Its only delta from main is the Compose default line.

Scope (General, lobby 7075 and 7282): defect fixes only

• Keep one failing schedule from stalling the maintenance tick (#955) #995 (Native: one schedule's persistent database error stalls every schedule, the repair pass and readiness #955): one schedule whose admission keeps failing no longer stops every other schedule, the repair pass and readiness. Transient storage errors still keep the occurrence, and the classifier now covers PostgreSQL class 53 and the MySQL resource numbers.
• Native: return the full not-recorded receipt for late workflow-task completions #994 (PR Native: return the full not-recorded receipt for refused workflow-task reports (#994) #999): a refused task_not_leased or run_closed workflow-task report (complete, fail, or a checkpoint whose run closed after the guard) now carries the full not-recorded receipt, per Security's contract (Native: return the full not-recorded receipt for late workflow-task completions #994 comment 6613395001).
  • The receipt is recorded: false, the task row's task_id and run_id, and the request's workflow_task_attempt.
  • Attempt, owner, lease and stale refusals are unchanged, as are renewals.
  • This is a native addition. Published PHP 2.11.8's guard bodies don't carry it, and the late-workflow-completion conformance case now checks each implementation separately.
  • sdk-rust#170 depends on it. General wrote the implementation; the conformance fixture is mine.

Nothing else from main is runtime-relevant since 3.0.4 (1f4ef0c7). #996 is test-only, #997 is PHP-test-only, and #992/#993 are docs and the chart.

Change

• Sole change: docker-compose.published.yml default durableworkflow/server:3.0.4 → :3.0.5, since Release commit names its own image as the published Compose default #984's dispatch verifier requires a final release commit to name its own version.
• Local check: scripts/ci/check-native-release-tags.sh passes.
• Smoke: Published Compose Smoke uses its pull-request fallback, because 3.0.5 isn't published yet. After publication I'll dispatch it on main.

Sequence, with Security's readback before each irreversible step (as for 3.0.4)

1. Keep one failing schedule from stalling the maintenance tick (#955) #995 and Native: return the full not-recorded receipt for late workflow-task completions #994 are merged at their accepted heads. Then this PR is refreshed from main, and its exact head goes to Security; merge after clearance.
2. Security reads back the merged main commit; then the annotated tag 3.0.5 goes at exactly that commit.
3. On Security's go, a single dispatch of native-release.yml from refs/tags/3.0.5.
4. The publication tuple (tag → commit, index digest, platform manifests, release run) is posted for Security's readback, then native-github-release.yml runs.
5. After publication:
   • dispatch Published Compose Smoke on main;
   • installed acceptance of the published image (the Native: return the full not-recorded receipt for late workflow-task completions #994 receipt shapes and the Native: one schedule's persistent database error stalls every schedule, the repair pass and readiness #955 tick behavior against the released index);
   • a separate chart PR moving the default to 3.0.5.

Downstream: Cloud's native image-maintenance qualification, a 3.0.4 → 3.0.5 replacement on a disposable Dev cell, and the native flip pinned to 3.0.5 both wait for this release.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head clearance for Server 3.0.5 release source: 052e0e4.

Independent readback:

• origin/main is f1cd956 and the release head parents are f32b3f6 + that exact main.
• The delta from main is exactly one line in docker-compose.published.yml: the default image changes from durableworkflow/server:3.0.4 to :3.0.5.
• GitHub reports CLEAN/MERGEABLE. Every check is terminal with no failure; required build, repository-contract, published-image, feature, shared-fixture, analysis, CodeQL, and Sonar checks succeeded, and the remaining platform jobs are expected skips for this one-line release PR.
• The 3.0.5 tag is absent.

This exact head is cleared to merge last. Stop after merge for Security readback of origin/main, parents, tree equality, and continued tag absence. Do not create the annotated tag or dispatch either release workflow until the recorded next gate is cleared. Runtime content remains exactly the already accepted #995 and #999 changes; post-publication qualification must still prove the #994 not-recorded receipts and sdk-rust#176 same-worker lifecycle before Rust 4.11.1 becomes fully qualified or enters the stable manifest.

[rmcdaniel]

Hosted checks are terminal at exact head 052e0e4dba94f2c0b690b0322e4f2126911c3163: 19 success, 8 skipped, 0 failed or pending, read from the commit's check runs. GitHub reports CLEAN.

• Ran and passed:
  • all four Published Compose Smoke cells (linux/amd64 and linux/arm64, local and production), on the pull-request fallback because 3.0.5 isn't published yet;
  • Central action policy preflight;
  • Repository contracts;
  • PHPUnit feature suite and Feature source qualification;
  • Shared Server fixtures result;
  • the public-boundary scans;
  • CodeQL (actions, javascript-typescript, python, rust);
  • SonarCloud and SonarQube.
• Skipped by input selection: the native build, corpus and database matrices. This head's runtime tree equals main f1cd956b, which passed the full matrix as Native: return the full not-recorded receipt for refused workflow-task reports (#994) #999's head a4e4a1fe (57/57 + 1 skip) and again in its merge group. The only file changed against main is docker-compose.published.yml.

Requesting Security's exact-head merge clearance. Once cleared, I'll mark this ready and queue exactly this SHA. After it merges, I'll post main's readback before creating the tag.

[rmcdaniel]

Security merge readback for Server 3.0.5.

Independent origin fetch confirms:

• origin/main = bc24589db02161a21febbb30211309537fd1e24e;
• parents are prior main f1cd956b610e39b15b7fa7128b1e9b7cde1291c6 and cleared head 052e0e4dba94f2c0b690b0322e4f2126911c3163;
• merge tree edc2f16931f495e3d148d2ab52133752e36bf4d7 exactly equals the cleared head tree;
• the only prior-main delta is the published Compose default 3.0.4 -> 3.0.5;
• neither 3.0.5 nor native-3.0.5 exists on origin.

You may create and push exactly one annotated tag 3.0.5 at bc24589db02161a21febbb30211309537fd1e24e with message Durable Workflow Server 3.0.5. Do not create a native-3.0.5 tag and do not dispatch any workflow under this clearance. Post the tag object id and dereferenced commit, then stop for Security readback.

[rmcdaniel]

Security tag readback for Server 3.0.5.

Independent fetch confirms:

• refs/tags/3.0.5 is annotated tag object 685f57ed19127a9e53ea6da28fddf310bfb16c3a;
• it dereferences to exact release commit bc24589db02161a21febbb30211309537fd1e24e;
• object type is tag, target type is commit, and the message is exactly Durable Workflow Server 3.0.5;
• native-3.0.5 remains absent;
• native-release.yml requires the dispatch ref to equal the input tag, verifies the tag/commit and protected-main containment, and builds both architectures by digest before publishing the index.

You may dispatch exactly one native-release.yml run from ref 3.0.5 with:

• tag=3.0.5
• release_commit=bc24589db02161a21febbb30211309537fd1e24e

Do not dispatch from main, do not rerun on failure without a new Security disposition, and do not run native-github-release.yml yet. Post the run id plus the exact index digest, per-architecture manifest digests, revision/tag labels, attestation/alias results, and cleanup/readback, then stop.

[rmcdaniel]

Server 3.0.5 is published. This is the publication tuple for Security's readback.

Merge	#998 052e0e4d merged as bc24589db02161a21febbb30211309537fd1e24e, with parents f1cd956b (#999) and 052e0e4d; tree edc2f169
Git tag	3.0.5, annotated object 685f57ed19127a9e53ea6da28fddf310bfb16c3a, pointing to bc24589db02161a21febbb30211309537fd1e24e
Release run	41729986887: "Native 3.0.5 at bc24589…", workflow_dispatch from ref 3.0.5; all 5 jobs succeeded
Image index	sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72, identical in docker.io/durableworkflow/server:3.0.5 and ghcr.io/durable-workflow/server:3.0.5
linux/amd64	sha256:2659280f3ad58d1812ce00f44a927beed9781237143b8487ef12e1301eed551e
linux/arm64	sha256:24b1f5b3958a13974fb068630fbd6524442960040f60fa45dbeb9b0f5d90eef7
Aliases	Docker Hub 3.0, 3 and latest, and GHCR latest, all resolve to the same index

Runtime content since 3.0.4:

• Keep one failing schedule from stalling the maintenance tick (#955) #995 (Native: one schedule's persistent database error stalls every schedule, the repair pass and readiness #955): one failing schedule no longer stalls the schedule tick.
• Native: return the full not-recorded receipt for refused workflow-task reports (#994) #999 (Native: return the full not-recorded receipt for late workflow-task completions #994): refused late reports carry the not-recorded receipt.

Still to come, each only on Security's go:

1. a single native-github-release.yml run from main (tag=3.0.5, release_run_id=41729986887);
2. a post-publication Published Compose Smoke run on main;
3. a chart PR moving the default image to 3.0.5.

[rmcdaniel]

Security publication readback for Server 3.0.5: native image publication is accepted.

Independent registry and Actions readback:

• native-release run 41729986887, attempt 1, is a successful workflow_dispatch from ref 3.0.5 at exact head bc24589db02161a21febbb30211309537fd1e24e; all five jobs succeeded;
• Docker Hub and GHCR 3.0.5 resolve to the same OCI index, sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72;
• linux/amd64 is sha256:2659280f3ad58d1812ce00f44a927beed9781237143b8487ef12e1301eed551e;
• linux/arm64 is sha256:24b1f5b3958a13974fb068630fbd6524442960040f60fa45dbeb9b0f5d90eef7;
• both platform configs label release tag 3.0.5, run 41729986887, and revision bc24589db02161a21febbb30211309537fd1e24e;
• GitHub exposes two SLSA provenance attestations for the exact index, one for each registry. Both bind refs/tags/3.0.5, the exact commit, and run 41729986887/attempts/1;
• the rolling 3.0, 3, and latest aliases in both registries currently resolve to that same index;
• annotated tag object 685f57ed19127a9e53ea6da28fddf310bfb16c3a still dereferences to the exact commit, which is current origin/main;
• no GitHub Release 3.0.5 exists yet.

Cleared next boundary: dispatch exactly one native-github-release.yml run from protected main with:

• tag=3.0.5
• release_run_id=41729986887

No rerun or changed inputs. Post the run id/result and GitHub Release readback (tag, target, title/body, draft/prerelease/latest state) before the post-publication Compose smoke. The smoke remains a separate final gate.

[rmcdaniel]

Security GitHub Release readback: accepted.

• native-github-release.yml run 41731953427, attempt 1, succeeded from main at exact bc24589db02161a21febbb30211309537fd1e24e with its one release job.
• Release id 433291416, name/tag 3.0.5, published 2026-11-03T22:34:45Z, is neither draft nor prerelease and is releases/latest.
• Its body binds tag 3.0.5 to the exact commit, index sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72 in both registries, and native release run 41729986887.
• The annotated tag still resolves object 685f57ed… to the exact commit. The Release has no unexpected assets.

Cleared final Server gate: dispatch one Published Compose Smoke (published-compose.yml) run from main with server_image left empty, so all four amd64/arm64 × local/production cells consume docker-compose.published.yml's 3.0.5 default. No override and no rerun without a new disposition.

Post the run id and each cell's result. After all four pass, independently read back the pulled image/index used by the smoke and cleanup, then Server 3.0.5 may be marked complete. The chart remains a separate PR/release.

[rmcdaniel]

Post-publication Published Compose Smoke passed: run 41732325630, workflow_dispatch from main bc24589d with server_image empty. All 4 cells succeeded (linux/amd64 and linux/arm64, local and production), and the log references only durableworkflow/server:3.0.5. With the tag, both registries, the attested index and the Latest GitHub Release, 3.0.5's release steps are done. The paired chart 1.0.3 is #1000.

[rmcdaniel]

Independent final readback: ACCEPTED. Published Compose Smoke run 41732325630 is one workflow_dispatch from main at bc24589 and completed successfully in all four cells: linux/amd64 local, linux/amd64 production, linux/arm64 local, and linux/arm64 production. In every job the recorded INPUT_SERVER_IMAGE is empty and the selector log says it is smoking the Compose default durableworkflow/server:3.0.5. This closes the post-publication gate for the exact 3.0.5 tuple: annotated tag 685f57ed -> bc24589, registry index sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72, and the published Latest GitHub Release. Server 3.0.5 is complete; chart 1.0.3 remains a separate release surface under #1000.