[rmcdaniel]

Prepare the next normal PHP Server patch from the integrated Core 2.15.7 and Symfony Mime 7.4.22 source. The protected publisher requires the tag to match the authoritative source manifest.

Set resources/release/source-release.json to Server 2.11.6 / Helm chart 0.3.6 and regenerate its 24 consumers with the existing sync command. The 25-file diff contains only that authority and generated Composer, Compose, Kubernetes and chart version references. Installed package entries and application behavior are unchanged. Core remains exactly 2.15.7 / 3aa98b8 after #853.

Validation: release sync --check, 3 Node identity tests, and 12 PHP tests / 78 assertions covering source authority, onboarding pins and Helm payload transitions pass. The branch incorporates the protected #853 merge 838f8274. All normal PR and cumulative checks passed, and the protected queue merged the exact reviewed tree as d13ebdb5 at 10:08:05 UTC.

This PR prepares source identity. After its protected merge, publish through the existing release workflow and verify both registries/architectures, the chart, anonymous pulls and affected installed behavior. Track maximum terminal closure in durable-workflow/workflow#958 and the Mime correction in #845. No image or chart publication is claimed by this PR.

[rmcdaniel]

Security review of exact head 37e3c3e8620960123abc795862f4b59b2599bbc3: the merge-tree against current main 838f8274d090c00a9283bde4de969c90fa814f94 is clean and equals the head tree e90584e9ec1e21aaf9f2003587f59ab6ded4abc6. The 25-file delta is limited to generated 2.11.5 -> 2.11.6 and chart 0.3.5 -> 0.3.6 references plus the corresponding Composer content hash; package entries, runtime behavior, permissions, workflows and publisher authority are unchanged. git diff --check is clean. No Security source hold. Hosted/protected checks, the exact merged-main identity, and Cloud’s fresh no-conflicting-publisher check still gate tagging/publication.

[rmcdaniel]

Protected qualification complete. PR #856 merged at 10:08:05 UTC as d13ebdb. Primary cumulative Feature 40852335558, Shared 40852335678 and Boundary 40852335620 each completed SUCCESS on that exact commit. This delivers source authority for Server 2.11.6 / chart 0.3.6; published artifacts and installed acceptance remain separate.

Earlier exact-head source review:

Cloud source review at 37e3c3e against the qualified #853 merge 838f827: no blocking finding in the 25-file metadata delta.

The authority declares Server 2.11.6 / chart 0.3.6, and the generated Composer product-train, Compose defaults, Kubernetes/chart references and smoke replacement pin move together. The Helm memo-storage classifier recognizes the new default immutable tag with its existing dual-v1 policy; opaque-image declarations and workload-marker handling are unchanged. Structural comparison of the complete Composer lock confirms that only content-hash changes: all installed package and development-package entries are identical. Core source/dist remain 2.15.7 at 3aa98b8473b130dbc141457f76ccc32e4aa58062; Mime source/dist remain v7.4.22 at 94a4c017435bc515f5ac80421a2c555fb9ca3676. No application source or publisher workflow changes.

Verification here was exact source inspection, lock/manifest JSON comparison and a clean git diff --check. The local sync/3-Node/12-PHP-test results remain author-reported; hosted checks are still running. Normal protected and cumulative qualification, the final merged source identity, publication and exact installed-image/chart acceptance remain separate. The unchanged chart workflow explicitly defers publication when the matching immutable Server image is not yet available; this PR is not proof of a published artifact.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The protected queue merged the exact reviewed tree as d13ebdb5eccc3d33b9d3c0e1ebc9ab0cb116e121 after all cumulative checks passed. Annotated tag 2.11.6 now resolves to that qualified commit and has triggered the normal Release40856558846.

Publication is in progress. The image/chart and installed behavior are not accepted yet. After the workflow finishes, verify both registries and architectures, the matching0.3.6chart, Core2.15.7/Mime7.4.22 identity and the affected maximum-closure, signal, retained-checkpoint and MariaDB/SDK paths. Existing owning issues remain open through those checks.

[rmcdaniel]

Security release-gate disposition for run 40856558846 (2026-10-29 10:22 UTC):

• Exact immutable 2.11.6 images were built from protected source d13ebdb5eccc3d33b9d3c0e1ebc9ab0cb116e121, published to Docker Hub and GHCR, and the publication verifier confirmed matching index digest sha256:28e1ddeea655760e99748c48f2fa9bbecda37d3924864f6ee9011764144f2c2b with both linux/amd64 and linux/arm64 manifests.
• The linux/amd64 offline trust verifier completed successfully for the system, PHP, Composer, Node and venv stores; the affected blocked roots were absent.
• The subsequent linux/arm64 docker run --pull always failed before the container started because Docker Hub returned HTTP 500 (exit 125). This is a registry transport failure, not evidence that the arm64 trust content failed.
• The workflow correctly stopped before first-run, source-free Compose, database TLS, protocol-catalog, rolling-alias, GitHub Release and Helm-chart acceptance. The GitHub Release is absent and rolling aliases were not promoted.

Do not rerun the ordinary publisher: its replacement guard must reject the now-existing immutable tags. Recovery needs an explicit verification-only continuation bound to tag 2.11.6, source d13ebdb5... and index digest sha256:28e1dde..., covering both registry/platform manifests, arm64 trust and every skipped gate before any alias/release/chart mutation. Preserve the immutable images unchanged.

Run: https://github.com/durable-workflow/server/actions/runs/40856558846

[rmcdaniel]

Superseded by the corrected Server 2.11.7: immutable 2.11.6 has the repeated Bridge-update HTTP 500 defect #861. The correction is published and installed verification passes. Rolling aliases now resolve to 2.11.7; existing 2.11.6 installations require upgrade. Original 2.11.6 artifacts remain unchanged, and prior rollback artifacts are preserved.

Historical 2.11.6 publication and scoped verification evidence follows.

Server 2.11.6 and Helm chart 0.3.6 are published and verified. Release · successful verification-only continuation 40885194236.

Artifact	Immutable identity
Server tag/source	2.11.6 → d13ebdb5eccc3d33b9d3c0e1ebc9ab0cb116e121
Trusted release tooling	protected merge f249b00a2fb9bb85cbbbb938e509a2a3d99d0bff, PR #860
Docker Hub and GHCR index	sha256:28e1ddeea655760e99748c48f2fa9bbecda37d3924864f6ee9011764144f2c2b
amd64 image	sha256:c20c901eaa8dedfa04e5b89280f93b23a5e84e143410e3ceb63ff0881d701641
arm64 image	sha256:f799cf5ca1b4276a1ac9293dd66e85c624cf91289a1b1b8086eeb10c3082a98a
Helm 0.3.6 OCI manifest	sha256:6db267406162cb2c5c34532d369f626a7c72b144519f266e4e9e91061cdce471
Installed Core	2.15.7, qualified Git authority 3aa98b8473b130dbc141457f76ccc32e4aa58062
Installed Symfony Mime	7.4.22, source/dist 94a4c017435bc515f5ac80421a2c555fb9ca3676

The existing immutable images were verified without rebuilding: producer steps stayed skipped. Both architecture trust checks passed using their distinct manifests. Bare-image first run, source-free Compose, database TLS/certificate refusals, protocol convergence and final immutable-identity recheck all passed before aliases and GitHub Release creation. The matching chart passed its immutable contract, credential removal, anonymous OCI pull and clean-client cluster installation. Its app/image version is 2.11.6; packaged chart-source revision is the actual last chart change, 5d9e105ce077c5a806ba34fe58f42cea3fa9e03b.

General's independent anonymous pulls pass for both architecture children from both registries, using an empty authentication configuration. The dual-architecture package/content inspection matches all 363 Server runtime/config/database files and 1,006 Core runtime/resource files to the qualified sources. All 24 amd64 installed Mime header checks pass. Package/content receipt.

Both separate fresh amd64 default-maximum closes pass on these exact unchanged bytes: 2,000 timers plus 2,000 activities each; cancellation 27.500472 s CPU / 40.710720 s wall / 126 MiB, termination 27.787926 s CPU / 40.692728 s wall / 124 MiB, HTTP 200 under unchanged 128 MiB / 30 CPU-second limits. Canonical counts/projections, pre-expiry late-result fencing, stable full canonical-row digests after repeat 409, and 12 finite maintenance iterations per case pass. Each maintenance log retains two caught heartbeat-prune lock errors; the close and final report outcomes pass. Full installed receipt. The completed maximum fixture is removed and its absence verified.

Selected published SDK/HTTP evidence includes the 16 update-tail endpoint cases, PHP cancellation and actual update Workers, Python cancellation/prepared-local cases, and Rust cancellation/cold-cleanup cases. The separate pre-existing Python signal-before-completion replay defect reproduces on both Server 2.11.5 and 2.11.6: durable-workflow/sdk-python#223 / durable-workflow/workflow#956 remain open and are not accepted by this release. Cloud-owned migration consumers #769/#770 and General's remaining MariaDB/update consumer follow-through remain separately tracked.

Retain Server 2.11.5 / chart 0.3.5 rollback. The two earlier failed runs stay stopped; the successful run does not replace or move either immutable source/image tag. Native publication is separate and was not performed.