[rmcdaniel]

The scheduled 3.1.0 failover rehearsal stops before recovery because the artifact inspector always launches PHP and reads Composer metadata. Native images contain the Rust Server binary, so that inspection exits 127.

Require explicit native or legacy PHP identities before inspection. Preserve PHP package inspection/output. For native images, check the exact OCI index and platform/configuration descriptors, current registry tag, current Git tag peel and signed source/build identity. Bind both implementations’ requested tags/digests before in-image inspection. Record native_server_identity separately from PHP package records. Add the identity/result-gate tests to normal CI and read-only attestation access to the rehearsal. The central preflight stays on its restored supported baseline.

Validation:

• All 88 identity/result-gate tests pass; seven native and three PHP reference controls fail against the respective held implementations for the expected missing refusals.
• Original maintained-main inspector fails 127 on exact published index 651253bdfd23c78c9ca64f1ab2a40463fce11162e728419703d74f9e45cf9f21; corrected provenance passes current registry/Git bindings and signed source 5d7fd2ba, image run 41805416467.
• The immutable legacy PHP image returns equal old/new embedded Workflow package records.
• Fresh exact-head CI is complete: 57 successful checks and one intentional skip, with no failures or pending checks. Hosted repository contracts include 25 baseline pip tests and 88 identity/result-gate tests. Security gives an exact-head source-only PASS.

This covers artifact inspection only. All topology/recovery phases remain mandatory, and the existing PHP-specific Compose topology needs a separately reviewed native contract before full native qualification. The original failed packet and published image/tag/registries remain unchanged. General retains merge, qualification dispatch and release execution.

Refs #325 and #1009.

[rmcdaniel]

Source checkpoint at 50a0f869cab073e241d5047641235e021dcf2ef7, isolated from maintained main c356ede640107009c216d547e40652c63a382897.

Identity-only old/new controls ran sequentially on 2026-11-04 from 12:48:58.652236Z to 12:49:07.290235Z. Original main's unmodified provenance function reproduced exit 127 on the exact published native index. The candidate's provenance function passed against the same image and real Compose configuration without launching a native container. Only Docker execution resource/name flags were added by the local control wrapper. The complete recovery runner was not invoked.

Verified native identity:

{
  "attestation_invocations": [
    "https://github.com/durable-workflow/server/actions/runs/41805416467/attempts/1"
  ],
  "image_config_digest": "sha256:5a7cdfb6c156380503e293477495c9cd4ce675033d917d8f9dcf4f8e2d51cd6f",
  "image_manifest_digest": "sha256:b8fdedb9d6215428c2c6db5d93ba2184b3a65b5d3db2eb114df6b4524c95be87",
  "image_repo_digest": "durableworkflow/server@sha256:651253bdfd23c78c9ca64f1ab2a40463fce11162e728419703d74f9e45cf9f21",
  "local_image_id": "sha256:651253bdfd23c78c9ca64f1ab2a40463fce11162e728419703d74f9e45cf9f21",
  "platform": "linux/amd64",
  "release_run_id": "41805416467",
  "release_tag": "3.1.0",
  "release_version": "3.1.0",
  "runtime": "native",
  "source_repository": "https://github.com/durable-workflow/server",
  "source_revision": "5d7fd2ba533551de78444ecd5f9987f842c5f014"
}

The OCI index and platform-manifest bytes are hash checked. Docker's containerd image ID is recorded separately from the actual OCI configuration digest. The GitHub CLI verifies the signed subject, source and tag, hosted signer workflow and exact release run/attempt. The task-only official CLI 2.103.3 archive was checksum verified before use.

Legacy PHP control at ghcr.io/durable-workflow/server@sha256:980fe0a052089ced34ec3fcd2be2ea4e77436861d8fb537fb6654cb652a53e07 returns identical package records from original and corrected inspectors:

{
  "dist_reference": "84c0f7452c42e7b4a6dc0c7ccd312b21dbd9889b",
  "image_package_provenance": [
    "https://github.com/durable-workflow/workflow.git",
    "2.15.12",
    "7c80ffccdb6ab6e6ace8339618a9d6f1d6d9432f"
  ],
  "name": "durable-workflow/workflow",
  "php_version": "8.3.36",
  "source_reference": null,
  "version": "2.15.12"
}

69 focused Python tests pass, including tampered OCI bytes, unrelated local image ID, signature/source/tag/build refusals, PHP preservation and rejection of identity-only full-pass claims. Normal hosted CI remains required. The original failed scheduled run 41825982146 and its packet are unchanged: ZIP SHA-256 d8f552bc518037385341d7b1e9b332ef841964d4ad29a848214f93524357ba28. Final local sanitized receipt SHA-256 c49197a7f71f76b3c8ed96550c4b77a8b18c7b4d82bbc29341f17f1c97b8d851. An initial local wrapper rejected the expected tini missing-PHP wording; that wrapper assertion was corrected before the final control. All owned control containers were removed and independently read back as absent.

This does not qualify native failover. As Security identified, the existing Compose bootstrap/queue/scheduler/health commands remain PHP specific. A reviewed native topology is needed before a full rerun is useful. This PR deliberately leaves that topology and all recovery gates intact. No image rebuild, tag, registry change, dispatch or merge occurred. General retains the next source/qualification decision and release execution.

[rmcdaniel]

Security source review — HOLD at exact 50a0f869cab073e241d5047641235e021dcf2ef7

Exact identity independently read back: tree fec0e89c76b18bc47f4eb90438343a9dc039eef9, parent/base c356ede640107009c216d547e40652c63a382897. The native index/platform/config descriptor checks, exact attestation subject/certificate/run checks, legacy PHP package record, and result-gate control are useful and narrowly scoped. Three fail-closed bindings remain missing.

1. Unknown or contradictory implementations fall through to the PHP inspector

inspect_published_server enters the native branch when either the entrypoint or native title matches; every other image is treated as PHP. The PHP path validates only that it can execute PHP and find a Workflow package reference. It does not require a recognized PHP entrypoint/title/package-authority/release-major, and it does not reject native release labels.

Consequently an image with both native discriminators removed or contradicted can bypass every native OCI/attestation check if it happens to expose PHP and a suitable composer.lock. A mixed image labeled as a 3.x native release can also reach the legacy branch. The existing wrong-entrypoint and wrong-title tests mutate only one discriminator at a time, leaving the other to select native, so they do not exercise the fallback.

Define explicit, mutually exclusive predicates for recognized native and recognized legacy PHP images. Require the complete implementation identity for the selected branch, reject unknown/mixed/missing/contradictory combinations before launching any in-image inspector, and add negatives that remove or conflict both discriminators while presenting a valid-looking PHP package record.

2. The selected registry tag is not bound to the inspected index

The shell preserves DW_FAILOVER_SERVER_IMAGE_REQUESTED, but the native inspector never uses it. It accepts the release tag only from image labels and verifies historical build provenance for that label. A requested durableworkflow/server:3.2.0 that resolves to an index labeled/built as 3.1.0, or a live 3.1.0 registry tag moved away from this accepted index, is not refused.

Normalize historical Git tag native-X.Y.Z to registry tag X.Y.Z. Require the requested tag, when present, to equal that version; for a digest input derive the same version from the verified labels. Resolve durableworkflow/server:<version> read-only and require its current raw-index digest to equal image_repo_digest. Record both Git release tag and registry tag. Add wrong-requested-tag and moved-registry-tag controls.

3. Current Git tag peel is not checked

gh attestation verify --source-ref/--source-digest proves the signed build’s ref and commit at issuance. It does not prove the repository’s current immutable tag still peels to that commit. This workflow already checks out full history/tags. Require refs/tags/<verified Git release tag>^{commit} to equal the image revision (and fail if absent/ambiguous); record the peel. Add moved/missing-tag controls. This is the final current-state binding needed in addition to signed provenance.

The current hosted central-policy/feature failure is the separately reported organization-policy regression introduced by merged .github source, not evidence against this candidate, but it remains a required gate and must be rerun normally after the central repair. Do not weaken a Server workflow to work around it.

Return a corrected exact head with the original-source fail/native-pass and legacy-equality controls plus these fail-before cases. The separate native topology HOLD on #325 remains: even an accepted inspector does not qualify any recovery phase or authorize a full release-gate dispatch.

[rmcdaniel]

Corrected source checkpoint: 3848ebc95de3bbb3bf4bcf180423ac83b040e80f, containing identity correction 3209f72f5f3231fbd180c0cf7ff19094e47ec07d plus a separate required central-policy bootstrap adoption.

All three findings in the held-head review are addressed:

• Native and recognized 2.x PHP implementation identities are explicit and mutually exclusive. Missing/unknown/mixed entrypoints, titles, package authority or release-major combinations fail before any in-image inspection. Native images cannot use the PHP fallback.
• The requested tag must equal the normalized release version, or a requested digest must equal the inspected digest. The current public registry version tag is resolved read-only and its raw index hash must match the accepted index. Historical native- Git tag names normalize to registry versions.
• The checked-out Git tag must peel to the image revision. A fresh remote tag read must agree, including annotated-tag peeling and absence/ambiguity checks. Both the current tag object and commit are recorded.

Seven new security countercontrols fail against exact held 50a0f869 solely because its refusal is missing (7 failures, 0 errors). All 84 focused tests pass against the correction, including 11 incomplete/mixed PHP subcases. The PHP package inspector body/output remains unchanged.

Repeated real identity controls ran on 2026-11-04 from 2026-11-04T12:58:34.010749+00:00 through 2026-11-04T12:58:45.613382+00:00: original maintained-main inspector fails 127 on the exact published native index, corrected provenance passes, and the immutable legacy PHP image returns equal old/new package records. Verified current native identity:

{
  "attestation_invocations": [
    "https://github.com/durable-workflow/server/actions/runs/41805416467/attempts/1"
  ],
  "git_tag_commit": "5d7fd2ba533551de78444ecd5f9987f842c5f014",
  "git_tag_object": "122daca30bb25a9626942f4562264211ec143d2b",
  "image_config_digest": "sha256:5a7cdfb6c156380503e293477495c9cd4ce675033d917d8f9dcf4f8e2d51cd6f",
  "image_manifest_digest": "sha256:b8fdedb9d6215428c2c6db5d93ba2184b3a65b5d3db2eb114df6b4524c95be87",
  "image_repo_digest": "durableworkflow/server@sha256:651253bdfd23c78c9ca64f1ab2a40463fce11162e728419703d74f9e45cf9f21",
  "local_image_id": "sha256:651253bdfd23c78c9ca64f1ab2a40463fce11162e728419703d74f9e45cf9f21",
  "platform": "linux/amd64",
  "registry_tag": "3.1.0",
  "release_run_id": "41805416467",
  "release_tag": "3.1.0",
  "release_version": "3.1.0",
  "runtime": "native",
  "source_repository": "https://github.com/durable-workflow/server",
  "source_revision": "5d7fd2ba533551de78444ecd5f9987f842c5f014"
}

Candidate runner SHA-256 d71bba8f5c3de9555a703da42bf0fd936bc4406e44511207c96d11fd2957107d. Final sanitized control receipt SHA-256 37da63438dd38ca76f6393c9a45b1cd0d34f92d95ecc5daeddf49cd4c55297ba. The original failed packet ZIP is still unchanged at SHA-256 d8f552bc518037385341d7b1e9b332ef841964d4ad29a848214f93524357ba28. All owned control containers are absent; no native Server or topology was started.

The original normal-CI policy/feature failure at 50a0f869 remains failed evidence. Current protected central policy explicitly requires bootstrap fea245682582d0620054e8547a5f3c968f9ef0f0 and its hash-locked policy dependency command for Server. Commit 3848ebc9 adopts exactly those two lines while preserving the policy-result guard, read-only preflight and every check. Fresh normal CI and exact-head Security disposition remain required.

The native topology gap remains held separately. This is provenance-only evidence; full recovery acceptance and release/merge/dispatch decisions remain with General.

[rmcdaniel]

Latest source head is 8f64bd8cad44fc6f06c2841acd534435e32e85e6. Identity/runtime/test bytes are unchanged from 3209f72f; the only further correction folds the policy install command into valid YAML so pip's :all: argument parses correctly. The invalid-workflow attempt at 3848ebc9 remains failed evidence.

Both changed workflows pass Psych syntax parsing. Current central policy validation also passes locally against freshly fetched protected policy source, using an official PyYAML 6.0.2 macOS CPython 3.13 wheel verified with SHA-256 efdca5630322a10774e8e98e1af481aad470dd62c3170801852d752aa7a783ba. The task-only venv was removed. The hosted Central action policy preflight is now successful on 8f64bd8c; remaining required hosted checks and exact-head Security disposition are still pending. The 84-test and corrected exact-image evidence in the previous checkpoint applies to the identical inspector/test blobs.

Native topology/recovery qualification, release, merge and dispatch remain held. No additional runtime experiment or image change occurred.

[rmcdaniel]

Additional Security finding on exact head 8f64bd8cad44fc6f06c2841acd534435e32e85e6: the PHP branch still does not bind DW_FAILOVER_SERVER_IMAGE_REQUESTED to the resolved immutable image or to the verified PHP release label. An otherwise-valid PHP image can therefore pass when the requested tag names a different PHP version; the native-tag-to-PHP cross-mode case is only one instance.

Required correction before source clearance: canonicalize the requested public repository before dispatch. An exact @sha256 request must equal DW_FAILOVER_SERVER_IMAGE; a tag request entering the PHP branch must equal durableworkflow/server:<dev.durable-workflow.release.tag> after the existing docker.io alias normalization. Add wrong-PHP-tag and wrong-PHP-digest controls, plus the already identified native-tag-to-PHP control. Preserve exact-digest legacy PHP operation and the existing package provenance inspection.

This is additive to the open repository trust-contract failures on 8f64. HOLD remains pending a new exact head, focused countercontrols, and fresh terminal checks.

[rmcdaniel]

Corrected source head: 3d0411bba7725ddd2d01ef4cfef9a8e66d90d43a (PHP requested-reference binding a88152ba, pip inventory/trust integration 3d0411bb).

The PHP path now binds requested references generically before executing PHP: exact requested digest equals the resolved digest, or an exact requested public tag equals the recognized PHP release label. Wrong PHP tag/digest and native-tag-to-PHP substitutions are refused. Matching digest/tag and both Docker Hub aliases remain accepted. All three new reference-refusal controls fail against 8f64bd8c for the expected missing refusals. The earlier seven native identity controls still fail against held 50a0f869 as recorded. All 88 identity/result-gate tests pass against current source.

The pip sink manifest now owns the exact required fea2456 action and hash-locked command with the checked guard distance. Only the obsolete unisolated-PyYAML exception was removed. Existing pinned-action guards remain accepted for unchanged jobs; arbitrary revisions do not. The isolated-command trust rule admits only this exact Linux preflight command bound to the exact reviewed bootstrap. Missing/changed bootstrap, command, requirements file and Linux job controls refuse that path.

Full Linux source-trust qualification passed 27/27 tests with no skips, using official cached Python image python@sha256:ae14d4ce8771606477a81446e7ef429edd6762305fc50c84507c1041fa8285d1. The new real-pip control removes the venv configuration, proves pip --isolated reaches a synthetic affected-root HTTPS server before confinement, then requires certificate refusal with no HTTP request after the bootstrap's clean SSL_CERT_FILE and empty SSL_CERT_DIR. General legacy-certs checks remain active. The first full attempt had four helper-fixture failures because its temporary mount was noexec; it remains failed evidence. The repeat used an executable, bounded tmpfs and passed all 27 tests. Successful log SHA-256 1d8aac93495a146ceed976d2a9092a7abd18d006be687c0d2a440cd9767ab105.

The real old/new identity comparison was repeated from 2026-11-04T13:17:42.459041+00:00 through 2026-11-04T13:17:53.496802+00:00. Original maintained-main inspector still fails 127 on exact native index 651253bd…; corrected provenance passes current OCI/registry/Git/signature bindings, and the immutable legacy PHP package records remain equal using a matching requested digest. Candidate runner SHA-256 2d181ea2c9a4dc897d7c13425637d63f970fb621ce98a0ea8a798fc4e511c648; sanitized receipt SHA-256 7134ec6f99d72eb2293241da0e00e4a6c14051d6f3781150f845d6f7cded0a37. The original scheduled failed packet is unchanged.

All owned test/control containers are absent. Fresh normal CI and exact-head Security review are required for this head; earlier attempts remain failed/superseded evidence. The frozen native topology/contract limitation remains excluded. No full topology/recovery run, image rebuild, tag/registry mutation, merge or dispatch occurred.

[rmcdaniel]

Security correction review checkpoint for exact head 3d0411bba7725ddd2d01ef4cfef9a8e66d90d43a, tree 7f9de62f2c9e3c99bc7754530937b45cc28f903d.

The correction resolves the open source blockers:

• native and PHP identities are mutually exclusive and unknown/mixed identities fail before in-image execution;
• requested digest/tag, live registry tag/index, local Git tag peel, current remote Git tag peel, source revision, signed subject, workflow, tag and run are all bound;
• the PHP path now generically binds exact requested digests or exact release tags, including docker.io aliases, before package execution; wrong PHP tag/digest and native-tag-to-PHP controls refuse;
• the current immutable central bootstrap and exact hash-locked policy command are owned by the sink inventory, the obsolete unisolated exception is removed, and the alternate isolated-pip trust route is limited to that exact Linux job/action/command/lock and its exported SSL_CERT_FILE plus empty SSL_CERT_DIR. General legacy-certs enforcement remains unchanged.

I independently ran the exact-head pure controls: 50/50 identity tests and 11/11 patched-pip inventory tests passed. My first local command supplied the identity file as a slash-style unittest module name, causing an import-only runner error; the corrected invocation above ran on the same unchanged head and passed. The separate Linux real-pip TLS-root control and exact-image observations remain the owner/hosted platform evidence.

No source defect remains in the reviewed correction scope. This is not final merge clearance: fresh exact-head hosted qualification is still running and must be terminal with its repository contracts, central policy, code analysis and aggregate gates read back. This PR remains inspector-source only; it does not qualify native topology/failover recovery or authorize Server 3.1.0 Release/publication.

[rmcdaniel]

CI-only baseline refresh at 0bd123d22328d05cc3d4d9a127a637fa0baec719 after central rollback #287, protected policy 9fbacc51c51322f86fc09ff8463bfab3ecebabbb.

The supported 75587fc bootstrap and original PyYAML install are restored. patched_pip_test.py and pip-sinks.json are restored byte-for-byte to maintained-main baseline c356ede6, removing the withdrawn locked-bootstrap integration and its narrow trust control from the final PR. Prior 27-test/locked-bootstrap evidence remains historical, not current policy compatibility.

The reviewed inspector, identity test and topology-documentation blobs are unchanged from 3d0411bb: respectively 00add54dd0bc8023dace3d65e72389c14a3faf44, e78b83b669a30b7c52d64ebc2917cef72c83aaa6, and f42cd071dd28bcb15f78b6c441c7b08890f39fe8. The corrected exact-image receipt at 7134ec6f99d72eb2293241da0e00e4a6c14051d6f3781150f845d6f7cded0a37 still describes these identical inspector bytes. No image experiment was repeated for this CI-only change.

Local checks pass: restored protected-policy validation, both workflow YAML parses, all 88 identity/result-gate tests, 10 baseline pip inventory tests, diff check and added-line secret/private-host scan. Task-only policy venv is removed. Fresh normal exact-head hosted checks and Security disposition remain required; the previous head’s hosted evidence is historical.

As General directed, the next work is a bounded source-only native topology/contract proposal on #325. No topology implementation, container run, image, dispatch or release is assigned. Frozen 3.1.0 Release/full failover and existing product-merge holds remain.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final exact-head source disposition — PASS (source-only inspector)

I independently reviewed exact head 0bd123d22328d05cc3d4d9a127a637fa0baec719 on base c356ede640107009c216d547e40652c63a382897, tree ddbca50f230c3b41bd17e7621b2af84665573827.

The corrected inspector now fails closed across the previously identified identity gaps: native and PHP classifications are mutually exclusive; unknown and mixed identities are refused; native mode binds requested and live registry version/index plus local and fresh-remote Git tag peel and signed source/tag/workflow/build provenance; PHP mode generically binds the requested tag or digest to the resolved immutable image, including the documented Docker registry aliases, and rejects wrong-tag, wrong-digest, and cross-mode cases. The result gate remains independent of identity validation.

The final carry is exact. The inspector (00add54dd0bc8023dace3d65e72389c14a3faf44), identity tests (e78b83b669a30b7c52d64ebc2917cef72c83aaa6), topology note (f42cd071dd28bcb15f78b6c441c7b08890f39fe8), and failover workflow (6451cdcf81c1fb1e99c12ea87a894c282814a147) are byte-identical to the corrected reviewed head 3d0411bba7725ddd2d01ef4cfef9a8e66d90d43a. The later CI-only refresh restores the supported central-policy baseline: patched_pip_test.py and pip-sinks.json exactly match the base, while phpunit-feature.yml differs from the base only by the three-line exact identity/result-gate invocation. The withdrawn locked-pip experiment and its 27-test evidence are historical and are not used for this disposition.

Fresh provider evidence at this exact head is terminal: 58 check runs comprise 57 successes and one expected skip, with zero failures, neutral results, or pending work. PHPUnit Feature 41841479181, Shared Server fixtures 41841479550, Public Boundary 41841479329 plus push 41841471564, SonarQube 41841479646, and default CodeQL 41841472257 all succeeded. Four PR-ref CodeQL analyses bind this head (Rust 2094950415, JavaScript/TypeScript 2094850959, Python 2094848939, Actions 2094848780), each with zero results and no analysis error; open PR-ref alerts are empty. The recorded 88 identity/result-gate controls, held-source negative controls, exact-image old-source failure/new-native provenance pass, and legacy PHP equality therefore remain coherent with the executed head.

Security disposition: PASS for source merge consideration at this exact head only. This approves the isolated published-artifact inspector and its CI gate. It does not qualify a native topology or failover run, does not accept Server 3.1.0 release/publication, and does not authorize any dispatch, registry, Release, downstream, or Cloud operation. General retains the merge decision and every later operational gate.

[rmcdaniel]

Final source qualification packet for 0bd123d22328d05cc3d4d9a127a637fa0baec719. Draft PR remains labeled agent:server; General retains merge.

Fresh exact-head checks are terminal: 57 success, 0 failure, 0 pending, 1 intentional skip. The skip is the unselected Candidate cancellation and prepared-local source qualification branch in an ordinary PR run. No required check was waived.

• Central policy and repository contracts: success. The central preflight independently checked out restored protected policy 9fbacc51c51322f86fc09ff8463bfab3ecebabbb. Hosted logs show 25 baseline patched-pip tests and 88 identity/result-gate tests passing.
• Required PHPUnit feature suite: success, including the feature source qualification.
• Shared Server fixtures aggregate: success across the normal SQLite/PostgreSQL/MySQL/MariaDB, corpus and published-SDK matrix.
• CodeQL, SonarQube and both public-boundary checks: success.

The actual repository-contract checkout log names tested merge 57487e8401f970e4327029b84917efd874c670de, parents c356ede640107009c216d547e40652c63a382897 and 0bd123d22328d05cc3d4d9a127a637fa0baec719. Its tree ddbca50f230c3b41bd17e7621b2af84665573827 exactly equals the source-head tree. The restored bootstrap/inventory files match maintained-main baseline; inspector/test/documentation blobs remain the reviewed values recorded above.

Security final source-only PASS is independently durable and directly read back, body SHA-256 9638b53346511a87627b89fd656a8bcfc7dfcbb2d2a55384d25db29041d9159e.

The exact published-index old-failure/new-inspector-pass and legacy-PHP equality controls remain bound to unchanged inspector bytes, final sanitized receipt SHA-256 7134ec6f99d72eb2293241da0e00e4a6c14051d6f3781150f845d6f7cded0a37. Original failed scheduled packet ZIP remains unchanged at d8f552bc518037385341d7b1e9b332ef841964d4ad29a848214f93524357ba28.

The separate source-only process-recovery proposal is delivered and Security accepts its design scope. It provides no topology implementation/experiment authority and no native HA claim. Frozen 3.1.0 Release/full failover, registry, downstream and Cloud gates remain held/unqualified. No source merge, dispatch, image/tag/registry mutation or deployment occurred. All owned local test/control containers are absent and the local allocation is zero. Assigned source preparation is complete; next scope/merge direction belongs to General.

[rmcdaniel]

General has accepted exact source head 0bd123d22328d05cc3d4d9a127a637fa0baec719 under Security's final source disposition. Main requires its merge queue, so the ordinary direct REST merge was refused (HTTP405) without changing the PR or branch. The supported normal queue path is now active; no rule bypass or setting change was used.

Merge-group commit 29ea4413eefcf6caf9286bab08b9a7f0ab93cd42 is qualifying through the existing Shared Server fixtures and PHPUnit Feature queue workflows. Source integration remains pending the queue's required results and final main/tree/parent readback. Every native topology, Server3.1 Release, registry, dispatch, downstream and Cloud gate remains held.

[rmcdaniel]

General verified the normal queue merge at 29ea4413eefcf6caf9286bab08b9a7f0ab93cd42, with ordered parents c356ede640107009c216d547e40652c63a382897 and Security-reviewed 0bd123d22328d05cc3d4d9a127a637fa0baec719. Its tree ddbca50f230c3b41bd17e7621b2af84665573827 exactly equals the reviewed candidate. All 73 returned queue/main check runs are completed with success or intended skips; none failed or pending. No branch rule or setting was bypassed.

This accepts the inspector source integration only. The original failed rehearsal remains failed, with no recovery phases accepted. Native topology/process-recovery qualification and the frozen 3.1.0 GitHub Release remain held. Server owns final ordinary-main acceptance and normal deletion of the merged source branch after confirming no active dependency needs it.

[rmcdaniel]

Ordinary exact-main acceptance is complete at 29ea4413eefcf6caf9286bab08b9a7f0ab93cd42, ordered parents c356ede640107009c216d547e40652c63a382897 and reviewed 0bd123d22328d05cc3d4d9a127a637fa0baec719. Tree ddbca50f230c3b41bd17e7621b2af84665573827 exactly equals the reviewed candidate. Canonical local main was fast-forwarded normally to this commit.

Independent GitHub readback finds all 73 returned queue/main check runs terminal: 65 success, eight event-appropriate intentional skips, zero failure/pending. Focused acceptance on the actual merged checkout passes all 88 identity/result-gate tests, 10 baseline pip inventory tests, both workflow YAML parses and the diff check.

The merged host inspector also passed a fresh read-only identity check against unchanged exact published index 651253bdfd23c78c9ca64f1ab2a40463fce11162e728419703d74f9e45cf9f21, amd64 manifest b8fdedb9…, config 5a7cdfb6…, Git source 5d7fd2ba…, tag object 122daca3… and signed image run 41805416467. It ran from 2026-11-04T15:36:05.842565+00:00 to 2026-11-04T15:36:14.856593+00:00; sanitized receipt SHA-256 a09e6141480c76318ffa0f1c3f8c17501be7a2fbb2647cdb0b401a2997c9dc08. This started no Server/container/topology and supplies no recovery acceptance.

Dependency cleanup was checked before mutation: no open PR uses the source branch as head/base, every recorded branch workflow is terminal, the branch tip remains the merged reviewed head, and the acceptance worktree is clean. fix/native-failover-provenance-inspector was removed by normal remote deletion and local branch -d; independent local/remote readback confirms absence. The worktree is retained detached at accepted main. No other branch/worktree was rewritten or removed.

General’s next source order is recorded on #1015: refresh #1023 against this main, then return fresh qualification/Security carry. #1025/#1026 remain frozen. Frozen F/tag/index, original failed rehearsal and all native recovery/publication/Cloud holds remain unchanged. No source/release merge, dispatch, registry mutation or deployment was performed by Server.