[rmcdaniel]

Server's normal integration of server#1036 moved rolling aliases into a separate protected promotion workflow. The central workflow inventory still accepts the retired native-release.aliases job and treats native-alias-promotion as optional, so it can accept a regression to the old topology.

Require native-alias-promotion and remove both transition exceptions. Tests keep the historical transition fixture explicit and prove the current policy rejects missing, optional, unknown or retired alias jobs. This changes only qualification/policy.json and its focused controls; it does not install the App/pilot, change settings, dispatch a workflow or promote an artifact.

Validation: 65 qualification-policy controls pass. The current policy validates the exact accepted Server cf069f63 workflow inventory. Both changed blobs are byte-identical to the prior Security-reviewed ced5d3e9 source; this normal refresh is head 94572162 / base 40b4ddcb / tree 59974202. All nine current checks pass, including both required contexts. Renewed exact-pair Security source carry is recorded for this head. Earlier checks are not transferred.

[rmcdaniel]

Security bounded exact-pair source carry for draft #307:

• current remote head 94572162751c17f0b29bc84c148a3a826176d158, base 40b4ddcb51a0f9faaa2de3f981a8e75e8154e674, tree 599742023590e938f167a58f5133dcea1044fc93;
• the PR delta is still exactly two paths: qualification/policy.json and tests/test_qualification_policy.py;
• those two current blobs are byte-identical to the exact pair reviewed at ced5d3e9: respectively d0dc3fa3e17257f0f013d59dee4fcb4296e02cb8 and bf7f565170d5f898160c5948b938dfdc7b3d293c;
• the change removes the legacy native-release aliases/optional-jobs allowance, requires native-alias-promotion, and keeps legacy topology only as explicit test fixtures. No App/settings, dispatch, release, or promotion effect is in this pair.

Disposition: SOURCE PASS for this exact two-blob pair. This is a byte-identity carry of the earlier bounded review, not a carry of old hosted checks. Fresh required CI remains authoritative and must finish normally before integration; no failed or pending check is relabeled.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normally merged through the current branch protections at 2026-11-05 21:22:05 UTC after all nine current checks and exact Security source carry passed. No admin bypass, required-check waiver, automatic merge request or queue retry was used.

Actual main is 2928f53860aec36e18729fb079e091d486b39e08, independently matched by Git and REST to reviewed tree 599742023590e938f167a58f5133dcea1044fc93 and ordered parents [40b4ddcb, 94572162], with verified GitHub signature. The earlier bounded central main window had already been released after H5's original build started; that operation ref was not changed by this source integration.

Original actual-main workflows are Repository checks 42112003203, SonarQube 42112003334 and dynamic CodeQL 42112003120, all attempt 1 and currently running. I own their terminal verification and safe exact merged-branch/worktree cleanup. No PR check is relabelled as a main result.

The Server migration prerequisite is actual cf069f63 from normally merged server#1036; its original queue qualified the separate promotion topology. This central source now requires it and rejects the retired alias job/optional workflow transition. No App/settings, dispatch, registry/alias promotion, runtime or release operation occurred.

[rmcdaniel]

Actual-main source acceptance and safe cleanup are complete for this change.

Actual merge 2928f53860aec36e18729fb079e091d486b39e08, tree 599742023590e938f167a58f5133dcea1044fc93, ordered parents [40b4ddcb, 94572162], independently reconciles Git/REST and verified GitHub signature. All three original main workflows passed at attempt 1: Repository checks 42112003203 (two successful jobs), SonarQube 42112003334 (one), dynamic CodeQL 42112003120 (three). All seven actual-main check runs are terminal SUCCESS, including the current required Shared contract tests and SonarCloud Code Analysis. This commit has no legacy status contexts; their empty combined-status response is not a pending check. No historical result was transferred.

After exact remote head 94572162, a clean owned checkout and ancestry in accepted main were verified, the merged source branch was deleted normally. Independent remote listing is empty and REST returns 404. Its local branch and clean detached worktree are removed; other agents' checkouts and active branches were preserved.

The post-migration transition exception is now gone: actual Server cf069f63 has the separate protected promotion workflow, and accepted central policy requires it while refusing the retired alias job, a missing workflow, an optional declaration or unknown drift. This completes the source follow-through from #294 and server#1036. App/pilot provisioning, publishing, promotion and production remain separate; none occurred in this integration.

[rmcdaniel]

Security SOURCE PASS carry — exact PR head 94572162751c17f0b29bc84c148a3a826176d158 / tree 599742023590e938f167a58f5133dcea1044fc93 / base 40b4ddcb51a0f9faaa2de3f981a8e75e8154e674.

The only changed paths are qualification/policy.json and tests/test_qualification_policy.py; both blobs are byte-identical to the previously reviewed ced5d3e93aced4aecf38e513a15a07c55dc90306 source (policy blob d0dc3fa3…, test blob bf7f5651…). The policy removes the legacy native-release alias/optional-job compatibility and requires native-alias-promotion.yml; exact accepted Server cf069f6396f29e8f90563a6d75108779e30c3a2a inventory validation passes.

Independent bounded verification: 65/65 qualification-policy tests pass and all nine PR checks completed successfully. PR #307 merged normally as 2928f538…; current central main retains the exact reviewed blobs.

This is source carry only. It does not authorize or attest a settings change, dispatch, promotion, publication, or release operation.