[rmcdaniel]

Service-mode journeys and the developer image currently default to Native Server 3.3.0. Update their shared artifact tuple to the published 3.3.1 image at sha256:775e83d5584cd49722ecde379efa8be3cc0a0ba935f7d31131c70bcddb2ef788, which includes the seven qualified read/write reductions from server#1099. Point the README at the machine-owned tuple for current versions. SDKs, Workflow, CLI and Waterline stay at their existing published versions.

Native publication, the published PHP replay/anchored checks, the exact Compose matrix and the shared corpus have passed on this image. This PR's normal checks must qualify the changed consumer tuple. After merge, General will run the full runtime matrix and publish/verify the developer image so its baked-in default also resolves to 3.3.1. No benchmark improvement is claimed.

Server release record: durable-workflow/server#325

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Source acceptance PASS on 636f34d84bc8f1840b54713c497e08cda9ba60a7, tree 5854913392f5fbe4ac1acc41c1ecf59f5c0c90e9, base/current main 0a7942deac66770dc4d9931041dc236251e9411a. All 36 checks and all 20 original workflows succeeded on attempt 1; zero statuses, cancellation or rerun. The exact two-file delta is 1,749 bytes / SHA256 88fea83130ee0f56c610bacfdd77c28dc518ccb2e34391814234069d249ac3ce.

Both native candidate developer-image builds and Codespaces startup qualifications passed. Published PHP/Python/Rust timers, activity recovery and the other ordinary consumer journeys passed on the pinned Server 3.3.1 tuple. The full diagnostic matrix and published developer image remain separate follow-through.

General selects one ready/merge operation with this exact head and a final tree/parent/signature readback. The topic stays until actual-main checks are terminal and successful. Then publish/verify the developer image; the full runtime diagnostic may run on this exact merged tuple in parallel with main checks. Native aliases and the GitHub Release remain unselected.

[rmcdaniel]

#331 merged once at 04:30:01 UTC as 49e9636758604835eb56fb74d6b58576839380ed. The signature is valid, parents are [0a7942de, 636f34d8], and tree 58549133 equals the qualified source. Current main is that merge. Its ordinary push checks are running; the topic is retained.

General selects one polyglot-validation.yml dispatch on main at this exact tuple, with full_runtime_matrix=true, covering all nine runtime surfaces plus the PHP/Python/Rust task-codec refusal probes. It runs on the published Server 3.3.1 digest 775e83d5584c… with the unchanged published SDKs. Prior dispatch count on this merge is zero. One attempt, no retry or cancellation; report by 05:20 UTC. Source/main checks remain required before developer-image publication. No image publication, alias or GitHub Release is selected by this runtime dispatch.

[rmcdaniel]

Published-tuple full runtime diagnostic PASS: run42562269288, attempt1, exact merged main 49e96367.

All nine required surfaces passed with none skipped: CLI start/result, the featured workflow, four corners, the full workflow/activity language matrix, signals/queries, task-codec refusals, type matrix, typed errors and Waterline. All nine PHP/Python/Rust workflow/activity combinations completed. Each language's repeated queries preserved state and its signal round trip passed. All three task-codec probe sets rejected unsupported envelopes before handlers/completion. Rust actually executed, and Waterline assets matched the installed package.

The report binds this run/attempt and source, Server 3.3.1 at sha256:775e83d5584cd49722ecde379efa8be3cc0a0ba935f7d31131c70bcddb2ef788, PHP SDK3.11.0, Python SDK2.14.1, Rust SDK4.12.0, Workflow2.22.0, Waterline2.13.2 and CLI2.3.3. Required and observed versions agree. The ordinary teardown step passed; this workflow emits no independent final resource-count receipt.

This completes the selected full diagnostic. It is not a benchmark or an unrun broad Server aggregate. Main's remaining timer workflows and the rebuilt/published developer image are still owed before release follow-through. No alias or GitHub Release was changed.

[rmcdaniel]

Actual-main custody passed on 49e9636758604835eb56fb74d6b58576839380ed: signed and verified, ordered parents [0a7942de, 636f34d8], tree 58549133 equal to the reviewed source. All 30 checks succeeded, zero statuses, and all 17 workflows succeeded on attempt 1 (16 ordinary main workflows plus the separately selected full diagnostic). No retry or cancellation occurred.

General selects exact-head topic cleanup and one devcontainer-image.yml publication on this unchanged main. Both native builds, exact public SBOM policy, anonymous published startup qualifications and final channel digest checks remain mandatory. The publication has no version override. Report by 06:35 UTC; no retry or cancellation is selected. This remains developer tooling publication, with no Cloud production adoption or Native alias/GitHub Release effect.

[rmcdaniel]

Developer-image publication and independent readback passed: run 42564090798, attempt 1, source 49e96367.

All seven protected workflow jobs succeeded: both native architecture builds, index assembly, exact public SBOM scans, both anonymous startup qualifications and main-channel publication. Startup qualification took 105 seconds on amd64 and 93 seconds on arm64, within the existing 600-second bound. Both public main indexes independently return byte-identical content at sha256:32fa2c19f623514b35b7107bfe3af3bc470dc39d9cd2ad3195f9979925891aaa.

The security artifact's ZIP hash matches GitHub metadata, with zero blocking policy rows on either architecture. Existing component-negative and reviewed/unfixed dispositions remain; this is not a blanket claim of zero vulnerabilities.

A bounded read of each exact COPY layer also verifies the 473-byte embedded artifact tuple against Git blob 8b3feee8, SHA256 d5a1989bf0baf5080a3cc14f90a2fc06fb79e5645f7c04e671e4839a4a51fe4e. Both architectures contain the 3.3.1 tuple. That read fetched only the small content-addressed tuple layers after manifest/config validation; it made no local engine call, image pull/load or execution.

Together with exact source/main custody, the full nine-surface diagnostic and ordinary consumer checks, this completes the selected Sample App follow-through for Native 3.3.1. No Cloud production adoption occurred. Local readback captures are bounded to the November 9 20:30 review; hosted security receipts retain their existing seven-day expiry.