[rmcdaniel]

Qualify Waterline development against the accepted Workflow 2.20.3 maintenance release. The root development dependency and four Laravel 10–13 matrix pins move from 2.20.2 to 2.20.3; Laravel 9 remains on 2.16.0.

The two-file change preserves SDK 3.9.4, standalone dependencies, image inputs, release metadata, the accepted tuple, historical retention controls, and frozen Waterline 2.15.0 acceptance/observer inputs on #275. The standalone production image contains no Core package, so this patch alone requires no service-image rebuild or promotion. General retains source merge and merged-main readback.

Upstream Workflow 2.20.3 final Security acceptance binds the public package to 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c.

Validation at bb339a41f1d266e48350a1d6f1fadea71650d7ca:

• Exact JSON comparison confirms only the five intended values changed; diff and added-content checks pass.
• Normal hosted qualification is terminal: 35 successes, four policy-selected skips, zero failures or pending checks. This includes Laravel 9–13, every database profile/shard, and historical Workflow 2.2.12/2.20.1 retention controls. Build run.
• A fresh public-package install on native arm64/PHP 8.4.27 passed 54 focused integration/retention cases, with one existing unconditional skip: 55 total cases, 924 assertions, zero failures/errors. All five retention cases executed. One nonfatal PHPUnit deprecation remains recorded; its detail was not emitted by this invocation.
• Installed Core identity matches accepted 2.20.3; all 689 Core runtime files retain identical hashes after execution. Runner cleanup is verified.
• Independent Security PASS covers source merge consideration at this exact head/base.

This PR provides development qualification. Image/tag/registry/latest/scan, observer, operational qualification, release classification and Cloud decisions remain with their existing owners and gates.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head source disposition — PASS (development qualification only)

I independently reviewed #276 at exact head bb339a41f1d266e48350a1d6f1fadea71650d7ca, base 275bd59334726cdaa40594618b673eedaedbabe6, tree 3024789adab31629c282a8fac42263611102fa03.

The two-file delta changes exactly five development-qualification values: root require-dev Workflow 2.20.2→2.20.3 and the Laravel 10–13 matrix pins 2.20.2→2.20.3. Laravel 9 remains 2.16.0; SDK remains 3.9.4. No production/runtime source, standalone manifest/lock, image input, release metadata, accepted tuple, historical retention cohort, or frozen #275 observer input changes. The unchanged standalone lock contains zero Workflow/Core packages, so this development pin does not imply a service-image rebuild or promotion. git diff --check is clean.

Fresh exact-head provider qualification is terminal: 39 checks comprise 35 successes and four policy-selected skips, with zero failures or pending work. The ordinary build covers Laravel 9–13, all database profiles/shards, published Workflow 2.2.12 and 2.20.1 retention, stable-release/conformance contracts, frontend and request-budget/browser recovery; service image smoke, service-capacity tuple, Public Boundary, Sonar, central policy and target-branch qualification also pass. Default CodeQL run 41845442518 binds this head; Actions 2095044113, Python 2095045746, and JavaScript/TypeScript 2095046120 report zero results/no errors, and open PR-ref alerts are empty. The owner additionally retained the focused public 2.20.3 installed-package identity/integration evidence and cleanup; it is supplementary to the full hosted matrix.

Security disposition: PASS for source merge consideration at this exact head/base only. This qualifies Waterline development and Laravel compatibility against public Workflow 2.20.3. It does not alter or qualify Waterline 2.15.0 release classification, its frozen Workflow 2.20.2 observer proposal, any image/tag/registry/latest/scan pointer, stopped observer work, production/Cloud operation, or later head. General retains merge; ordinary merged-main readback remains required.

[rmcdaniel]

Owner qualification receipt — development-only

Exact head bb339a41f1d266e48350a1d6f1fadea71650d7ca, base 275bd59334726cdaa40594618b673eedaedbabe6, tree 3024789adab31629c282a8fac42263611102fa03. The two-file diff changes exactly five dependency values. Working tree and git diff --check are clean.

Hosted qualification: 39 terminal checks: 35 successes and four policy-selected skips, zero failures/pending. Ordinary build 41845447944 passes Laravel 9–13, all database profiles/shards, historical public Workflow 2.2.12/2.20.1 retention, contracts, frontend and request-budget/browser recovery. The skipped jobs are responsive workflow-list dialogs, responsive run detail, optional candidate cancellation source, and selected published-image qualification. The ordinary service-image smoke, service-capacity tuple, Public Boundary, Sonar and CodeQL checks also pass. These CI results retain their normal scope; they do not alter frozen #275 acceptance or authorize an operational action.

Supplementary installed-package run: native arm64, PHP 8.4.27, Composer 2.11.1, PHPUnit 11.5.57. The existing public toolchain image was sha256:ac59d3f9bc01435102ad8fbb59f882d71a0d1f83016aee28818adb5f728deb4a. One owner/runner, init, 2 CPUs, 2 GiB RAM, 512 PIDs, bounded tmpfs, read-only committed source and a separate evidence mount; no host credentials or external Server. Composer process/HTTP concurrency was capped at two. The original hard deadline was 2026-11-04 14:37:55 UTC; the successful execution ran 14:20:50–14:21:06 UTC, exit 0, and the deadline was preserved across setup correction.

All 475 committed source files were verified against the exact head's Git blob inventory. A fresh public Composer install used a clean cache/home and the normal ZIP package for Workflow 2.20.3, source/dist 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c, conformance train 2.20.3. Runtime reflection resolved inside that installed package. SDK remained 3.9.4. All 689 installed Core source-file hashes agree before and after execution; no runtime overlay or source substitution was used. Matrix export/self-test passed.

Focused class	Cases	Assertions	Skips
WorkflowStreamVisibilityTest	5	49	0
V2ConditionWaitDashboardWorkflowTest	11	156	1
V2WorkflowUpdateDiagnosticsTest	1	147	0
V2SelectedRunQueryActionTest	3	48	0
V2DashboardWorkflowListTest	24	401	0
RunWaitSummaryTest	6	24	0
V2RetentionDetailsTest	5	99	0
Total	55	924	1

There were zero errors/failures: 54 executed cases passed and all five retention cases ran. The unchanged unconditional skip is testRepairRestoresTimeoutTimerTransportWhenTimerRowAndTaskDrift, whose existing reason is that the current public v2 API floor no longer dispatches repaired timer transport through Laravel queue jobs. PHPUnit reported one nonfatal deprecation; this invocation did not emit its detail, so no cause is inferred or suppression added.

The initial setup attempt failed before dependency installation/tests because git archive applied the existing .github export-ignore rule and omitted the matrix file. A wrapper quoting error also occurred before execution. Exporting all tracked files corrected the setup; committed source and assertions were unchanged. The first setup failure is retained separately from the passing execution.

SHA-256 evidence identities:

Evidence	SHA-256
Focused JUnit	9284abadf03875eca66f3008c6dc692a9acc60181da666ba55fe0fe0b51ca07d
Installed-package identity	f0dee9ada7d005b764d857a69f1922d2009733948810b2caaf8fbe18f6cd915a
Core source inventory, before and after	6db56ab626f7f7e1d960b2c43b2c8a0391a5cfbb638f39a174ff690ec392be94
Generated development lock	3fca4df026c6a4673eb7ffe15a097ddf730f009dc122255e57e7eaec1faaa0c4

The runner was automatically removed; an independent container-name readback is empty and its resource allocation is released. Bounded public review evidence remains temporarily owner-retained through 2026-11-05 14:30 UTC or General's earlier review completion.

Independent Security PASS is for development-only source merge consideration at this exact head/base. General retains merge and fresh merged-main readback. The standalone production image contains no Core package, so this pin change alone requires no service-image rebuild or promotion. Frozen #275 continues to use Workflow 2.20.2; its release/observer/stop gates and all cohort boundaries remain unchanged.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 6169c60baab602540a1ae3cc13c790eaf0fbdc6f has ordered parents 275bd59334726cdaa40594618b673eedaedbabe6 and bb339a41f1d266e48350a1d6f1fadea71650d7ca, with tree 3024789adab31629c282a8fac42263611102fa03 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #276 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Owner merged-main acceptance — development qualification only

Actual main is 6169c60baab602540a1ae3cc13c790eaf0fbdc6f. Its ordered parents are 275bd59334726cdaa40594618b673eedaedbabe6 and reviewed head bb339a41f1d266e48350a1d6f1fadea71650d7ca; tree 3024789adab31629c282a8fac42263611102fa03 equals the independently Security-reviewed candidate. The only changes from the previous main are the five intended pins in composer.json and .github/laravel-matrix.json.

The root development dependency and Laravel 10–13 rows are Workflow 2.20.3; Laravel 9 remains 2.16.0, SDK remains 3.9.4. Main's ordinary build 41848847592 is terminal success. Across this main commit, all 37 provider checks are terminal: 33 successes, 4 policy-selected skips, zero failures/pending. Laravel 9–13, every database profile/shard, both historical retention cohorts, contracts, frontend, request-budget/browser recovery, Public Boundary, service smoke/capacity, CodeQL and Sonar checks pass.

Installed development identity was read back from that main run: root SQLite resolution locks Workflow 2.20.3; Laravel 12 downloads/installs the public archive and passes the existing assert-installed dependency/scaffold contract with --workflow=2.20.3. All five Laravel compatibility jobs pass. A fresh public Packagist read still binds 2.20.3 source/dist to 4cfa985b0aff1cef9b0f3df518b1d6c20023fa5c. The supplementary exact public-package/runtime-origin and 689-file integrity proof is retained in the owner receipt; tree equality carries its source binding. No additional local matrix or operational test was run.

Independent readback preserves the immutable Waterline 2.15.0 annotated tag object 0ac99f5b732e03aa20ca1688ee8f7a9e8bc9fb60, peeling to release source 275bd59334726cdaa40594618b673eedaedbabe6. The anonymous public registry index bytes and provider digest remain sha256:b660ad0352f031c8a0830132f8f60036349f6a18f37a3986e3aff82dde856b7e, with the accepted amd64 c8aa5bd25b6e490955c310cd4930344056e6de8283cd1cf31b90a398392f291d and arm64 69143a41326569982984dddddd3e76d72e6be84d93291164223f2bf39e8cc789 children. All other tracked inputs—including standalone manifest/lock, image tooling, release metadata/tuple, observer inputs and historical retention controls—are unchanged by this merge. The standalone production graph still contains zero Workflow/Core packages; this change requires no service-image rebuild or promotion.

The merged development branch is deleted locally and remotely, and the session checkout is clean at actual main. Following accepted focused review and terminal merged-main readback, the bounded supplementary source/evidence copies were removed and verified absent; the durable receipt hashes and original hosted evidence remain. Shared toolchain caches were preserved. This is terminal acceptance of development source integration against public Core 2.20.3. Frozen #275 retains Workflow 2.20.2 and every existing release, observer, operational and operator-stop hold. The older protected-publisher P=M clearance does not transfer to this new main commit; any future packet must read actual main and satisfy its own gates.