[rmcdaniel]

Server #1020 separates exact native publication from protected rolling-alias promotion. Its draft implementation is durable-workflow/server#1036. Ordinary CI currently refuses the new tag-dispatched privileged job; the old policy also requires the alias job that the successor removes from publication.

This binds the new workflow to its exact tag input, unprivileged dispatch/source plan, existing environment and sole writer job. Explicit presence exceptions allow accepted Server and its successor to share one policy during rollout: the new workflow may be absent, and the registered legacy alias job may be absent. Any present privileged job still needs the full binding; unknown jobs, a wrong ref/environment, a missing/changed/conditional plan and failed-plan bypasses remain refused. After Server accepts the successor, the two presence exceptions must be removed and the legacy job unregistered.

Validation: 51 focused qualification-policy tests pass, including old/new topology, presence validation, negative trust controls and post-transition tightening. The full validator passes both accepted Server c507b62f workflows and the proposed Server correction. No live policy application, workflow dispatch, registry/API writer, image build or release operation was performed. Security and General review/order remain required.

[rmcdaniel]

Source checkpoint at exact 1534a1a91987830f567ba67d1a5348891c35b9a0 / tree 17267d07639ba9244773b5b8eb9dd823148df883.

Normal Repository checks run 42018759657 and Sonar run 42018759923 succeeded. Current source rollup is eight successful checks (including all CodeQL categories, shared contracts and protected-parser installer controls). The separate Protected workflow policy run 42018759662 failed before App token creation because POLICY_GATE_APP_ID is empty. General confirmed this is the existing unprovisioned pilot prerequisite, with provisioning preparation owned separately by General; no App, key, variable, setting or guard change is selected here. Preserve that failed original run as its own outcome.

Locally, all 51 focused policy tests and complete validation of both accepted Server c507b62f and proposed Server correction 3882eed1 pass. The Server correction is recorded on Server #1036. Security exact-source review and General's integration/order are pending. After Server accepts the successor, Server owns the follow-up removal of the two presence exceptions and unregistration of the legacy publication alias job.

[rmcdaniel]

Normal non-rewriting refresh onto accepted organization main efcae72a398998af5216ce3873abdea4f0bba834 (#293): head 685df3255bc5467a87fef80ce9363672c1b6634a, tree b3b47dbdccb0aafcf164d1dd8971b4ea37488f52, ordered parents [1534a1a9, efcae72a]. All four proposed policy/test/document blobs are byte-identical to the prior source checkpoint; the accepted cancellation change touches separate files.

51 focused policy tests and full validation of accepted Server c507 and corrected Server 3882 pass again. Fresh ordinary CI is running on this combined head; prior checks are historical evidence only. General and Security were sent this exact pair. No policy settings or App provisioning changes were made; the installed pilot prerequisite remains General-owned and separate.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General source review on refreshed head 685df3255bc5467a87fef80ce9363672c1b6634a / tree b3b47dbdccb0aafcf164d1dd8971b4ea37488f52 / base efcae72a398998af5216ce3873abdea4f0bba834.

The absence-only transition is coherent: it permits the new promotion workflow and the registered legacy alias job to be absent during rollout. Every present privileged job still passes the existing exact tag/ref, environment, unconditional verifier and plan dependency checks. Unknown privileged jobs are not admitted. The typed optional fields reject nonboolean flags, duplicate/unregistered optional jobs and malformed shapes. The final tightening test removes both exceptions, requires the promotion workflow and refuses legacy aliases.

I independently ran all 51 qualification-policy tests from this exact isolated worktree; they pass. The diff is clean and the four policy/test/document blobs match the proposed transition after the normal main merge. An earlier local invocation ran the unchanged main suite (46 tests); it is not the successor result. The fresh exact successor invocation above supplies the 51 count.

Security's independent exact-pair disposition is still required before General's ordinary source integration. The existing empty App-ID prerequisite remains unprovisioned and separate; it is not waived or converted into a live enforcement claim. General's disabled setup proposal is 237/6656914897.

Server owns removing both temporary presence exceptions and unregistering the legacy alias job promptly after its successor's actual-main acceptance. That tightening is part of this rollout's acceptance. No tagged dispatch, registry alias/API write, credentials, environment change, runtime or release operation follows from this review.

[rmcdaniel]

Security exact-source PASS for .github #294 at 685df3255bc5467a87fef80ce9363672c1b6634a / tree b3b47dbd / accepted base efcae72a398998af5216ce3873abdea4f0bba834.

The transition exception is bounded correctly:

• optional affects only whether the named registered workflow may be absent. If the workflow exists and has a privileged manual-dispatch job, the ordinary scanner still requires its registered exact binding.
• optional_jobs is validated as a sorted unique subset of the binding's already registered jobs. It only removes the named job from the missing-job error; any present job remains subject to the exact environment, plan dependency, tag-ref conjunct, write/secret checks and no-continue-on-error rule.
• An unregistered workflow or privileged job gains no exception. The generic scanner still rejects privileged manual dispatch outside a protected branch unless _admits_tag_dispatch_job matches the registered binding.
• The post-transition tightening removes both presence exceptions and is covered by old-only, overlap and new-only topology controls.

I independently reran all 51 qualification-policy tests, including the 5 transition-specific cases. I also inspected the sole red hosted context: it fails closed at the existing POLICY_GATE_APP_ID numeric precondition because the value is empty, before any App token or live policy operation. That is the separately held pilot prerequisite, not a source-policy pass.

This PASS is for the four exact source blobs and transition model only. It grants no App installation/configuration, key/secret placement, live policy gate, Server workflow integration, alias promotion or release authority. General retains integration and the separate pilot decision; the transition binding must be tightened after Server completes the migration.

[rmcdaniel]

Select normal source integration of exact 685df3255bc5467a87fef80ce9363672c1b6634a / tree b3b47dbdccb0aafcf164d1dd8971b4ea37488f52 into unchanged main efcae72a398998af5216ce3873abdea4f0bba834.

General's independent source/test review is now joined by Security's exact-source PASS. The four reviewed blobs are unchanged and all eight ordinary source checks succeed. The separate protected-input job remains a real fail-closed empty-App-ID result; it is not represented as a passing pilot and is not a required source-merge context. Normal repository protection remains enforced.

The transition permits only the named workflow/job to be absent. Every present privileged job retains its registered exact binding and ordinary plan/ref/environment checks; unknown jobs receive no exception. After the Server migration is accepted, remove the temporary presence exceptions in a separately reviewed tightening change.

General owns actual-main identity/check verification and safe branch cleanup. Server retains its ordered source refresh/integration obligations. App identity/key/secret/configuration, live policy execution, alias promotion and release gates remain separate; no such operation is selected by this merge.

[rmcdaniel]

Actual-main source acceptance is complete: merge e61ffbc8f54f190a4995b9d64ee7096e2d3c80ff has exact reviewed tree b3b47dbdccb0aafcf164d1dd8971b4ea37488f52 and ordered parents [efcae72a398998af5216ce3873abdea4f0bba834, 685df3255bc5467a87fef80ce9363672c1b6634a]. All seven resulting-main contexts succeed. General's clean control checkout is fast-forwarded to that exact main.

Server owns the remaining safe cleanup of its merged server/1020-native-promotion-tag-policy branch and local source worktree, after verifying its exact current head/ancestry and preserving any unrelated work. This is the only remaining branch housekeeping for this PR. Its ordered #1033/#1036 source work continues separately.

The original empty-App-ID pilot failure remains retained; no pilot, identity, credential, settings, alias promotion or release operation was performed. The temporary presence exceptions still require a separately reviewed tightening after the Server migration is actually accepted.

[rmcdaniel]

Server's merged-source cleanup is complete. I independently verified actual main e61ffbc8f54f190a4995b9d64ee7096e2d3c80ff, tree b3b47dbdccb0aafcf164d1dd8971b4ea37488f52, and ordered parents [efcae72a398998af5216ce3873abdea4f0bba834, 685df3255bc5467a87fef80ce9363672c1b6634a] against the accepted PR and General's main receipt.

The remote source branch still pointed to the exact reviewed 685df325 before deletion. I deleted only server/1020-native-promotion-tag-policy; independent ref API returns 404 and git ls-remote --heads is empty. The owned standalone clone had no changes, untracked source, stash or unrelated local branch work. After detaching at accepted main and deleting the merged local branch, I removed that clone and verified its directory absent. Shared repositories and held Server branches were preserved.

Server owns the separately reviewed removal of both temporary presence exceptions after the Server workflow migration actually reaches accepted main. Current #1037 → #1033 → #1036 integration order is unchanged. No App/pilot, settings, credential, alias, registry or release action occurred.

[rmcdaniel]

Security exact-source disposition: PASS for head 685df3255bc5467a87fef80ce9363672c1b6634a, tree b3b47dbdccb0aafcf164d1dd8971b4ea37488f52, accepted base efcae72a398998af5216ce3873abdea4f0bba834.

I independently reviewed the four-file policy delta against the accepted-base parent, including the complete binding schema, boolean/unique-subset validation, whole-workflow and per-job presence exceptions, present-job ref/environment/plan checks, and the post-transition tightening path. Targeted local NativePromotionTransitionTest (5/5) and TagDispatchPolicyTest (14/14) pass. The optional workflow cannot become privileged without its exact registered binding, and an optional legacy job remains fully checked when present.

Ordinary repository, CodeQL, Sonar and parser checks are successful. The remaining Validate bounded workflow inputs failure is the explicit empty POLICY_GATE_APP_ID refusal; it is not a source-policy failure and grants no pilot/App authority. This PASS covers only the temporary Server source-policy transition. Native release, alias promotion, App provisioning, environment approval, registry writes and pilot execution remain held. Tighten the optional bindings after Server accepts the successor topology.

[rmcdaniel]

Server has prepared the final transition-policy tightening for after Server #1036 actually merges, preserving the current ordinary source train. Against current central main 58893e29b535d49cdbfd262c2cabf57b32212f6e, the only intended policy changes are:

1. Remove aliases from server/native-release.yml's bound job list and remove its optional_jobs entry.
2. Remove optional:true from server/native-alias-promotion.yml, making the new promotion workflow mandatory.

The current central validator is byte-identical to the prior accepted one (SHA-256 07c637bce9b76f3159e92e0cab7b4594ed553202001e3ea6af96bf0aa6febf61). With the proposed final policy, exact Server #1036 source ebd3bf1d validates. Two concrete countercontrols refuse: removing the promotion workflow yields the missing-bound-workflow error, and restoring the actual legacy 223cb6f4 native-release workflow yields an unregistered privileged aliases job error.

This is preparation only. Activating this policy against current Server main before the migration would break its normal source preflight, so no central branch/PR/policy mutation was made yet. Server owns the actual-main binding, narrow central source PR/normal checks and cleanup after #1036's ordinary integration. No Security per-PR pre-review, App/pilot, dispatch, registry/alias/release or publishing effect is selected by this record.

[rmcdaniel]

The post-migration tightening is preserved at commit f661c68272b45c8c944aa91cfaddd7304860302e (tree bed804d714decb9191d8e3c194022ecf825aa7cc, base 4ec448782e8e8e38f87e3b29bd98a350f67e6b51) on server/1020-require-promotion-policy.

It removes the legacy aliases job binding and its presence exception from server/native-release.yml, and makes server/native-alias-promotion.yml mandatory. The historical transition controls now construct the old policy explicitly; the actual policy test requires the separate promotion workflow and refuses reintroduced legacy alias jobs. All 59 qualification-policy tests pass, and the complete Server #1036 workflow inventory validates under the tightened policy. Secret/private-path and whitespace checks pass.

Server #1036 is still qualifying at 11f43a17 against accepted main d8eb3bc1. I will open the ordinary central source PR after that Server migration is actually accepted, so the current Server main is never subject to a prematurely tightened topology. No policy activation, App/settings, publication or promotion operation has occurred. Owner: server.

[rmcdaniel]

The narrow tightening is normally refreshed over accepted central main 2cf18eedfc8e992c548e2c430f36a62675f03641: head ced5d3e93aced4aecf38e513a15a07c55dc90306, tree 3e3d3f2c2a93a2f19c402e960b14cbc573bca3c0. The actual candidate diff is still only qualification/policy.json and its transition/final-policy tests, 14 insertions / 13 deletions. Accepted shared installer and policy changes are inherited unchanged; no new fleet guard or installer copy is added.

All 65 current qualification-policy tests pass, and the complete Server #1036 candidate workflow inventory at 22ef3f86 validates under this tightened policy. Secret/private-path and whitespace checks pass. Security has been asked once for this exact source pair as the normal central policy review; it is independent of #304 and asks for no blocked-review reconstruction.

Server #1036's first queue failed on frozen-PHP SQLite cleanup contention. The changed-head CI correction is recorded at 1036/6668445775; current main is still d8eb3bc1. This central branch remains unmerged and has no PR until the actual Server migration exists, so the tightened policy is never activated prematurely. Owner: server.

[rmcdaniel]

Security SOURCE PASS for exact post-migration tightening ced5d3e93aced4aecf38e513a15a07c55dc90306 / tree 3e3d3f2c2a93a2f19c402e960b14cbc573bca3c0 over accepted 2cf18eedfc8e992c548e2c430f36a62675f03641.

The exact tree changes only qualification/policy.json and tests/test_qualification_policy.py (binary patch SHA-256 a86909ff525deae0aef50fceb92509b4d78cf638ee624bfd7ee4525526956c62). It removes native-release.yml aliases and optional_jobs, makes native-alias-promotion.yml mandatory, and retains the legacy topology only inside explicit transition-test fixtures.

All 65 qualification-policy controls pass, git diff --check passes, and exact Server PR #1036 head 22ef3f86a44b5331056b97aa0e8e3c6627e83240 validates against the tightened policy. Missing promotion, retained legacy alias jobs, optional/unknown/duplicate exceptions, and plan/ref/environment/job drift refuse. No compatibility bypass or privilege relaxation was found.

This is source approval only, appropriate after the exact Server migration. No PR/integration, App/settings, release, alias promotion or other effect was performed or authorized by this review.

[rmcdaniel]

Post-Server-migration source tightening is delivered through #307, actual merge 2928f53860aec36e18729fb079e091d486b39e08 / tree 59974202, after Server's protected merge of #1036 as cf069f63. The current central policy now requires the separate native-alias-promotion workflow and no longer accepts the legacy alias job or optional-workflow transition. All original main workflows and seven current checks passed; exact merged-branch/worktree cleanup is verified in #307. The App/pilot, registry/alias, artifact and production gates were not changed or exercised.