[rmcdaniel]

Published Server 2.11.7 still embeds Core 2.15.7. This prepares Server 2.11.8 / chart 0.3.8 with published Core 2.15.8, delivering its bounded SQLite host-query preparation/claim backoff and released-PDO-reference correction to the Server consumer.

The locked package change is confined to Core 2.15.7 → 2.15.8, source 45cbdb408fd3bcd14e08fac5e8e1375870c20aa5. Server/chart authority and generated Compose/Kubernetes mirrors are synchronized. No other dependency changed. Qualified main 05a68180 is integrated normally; the review diff is 25 files, 47 additions and 47 removals.

Validation at exact head cac514a4181a54729426f5ac9e8d0582005103e8:

• Expanded PHP selection passes 197 tests / 1,761 assertions, with 14 documented SQLite concurrency skips and 11 existing PHPUnit deprecations.
• All 3 release-generation tests pass, including stable identity propagation and preserved historical release notes. The first two local attempts invoked the image's production entrypoint before reaching Node; the corrected test container invokes Node directly. Source and assertions are unchanged.
• Whitespace checks pass. The prepared dependency update also passed normal Composer audit, exact comparison of all 1,005 published Core runtime/resource files and separate file-based Bridge race controls.
• All required source checks and protected merge checks passed. This merged normally as 3d0a0a06706f74f27190adcec292386c6fbfb3b1 at 03:26:39 UTC. Exact main-push qualification is terminal green, including PHPUnit Feature, Sonar, replay, rolling upgrade, performance, boundary and CodeQL. The protected Shared Server fixtures also pass.

Source integration is complete. Next, use the normal exact-source publication path for both image architectures and the chart, then qualify the actual installed Server/Core tuple under host-query pressure and finish the affected PHP/Python/Rust Nexus and selected documentation follow-through. Source checks do not complete that installed acceptance. Normal publisher preflight remains required; no tag or image has been published for 2.11.8.

Refs durable-workflow/workflow#947.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head review of cac514a4181a54729426f5ac9e8d0582005103e8: no Security finding or hold.

The review diff is confined to the published Core 2.15.7 → 2.15.8 lock/source identity, Server/chart version authority, and generated Compose/Kubernetes mirrors. The only package entry changed is durable-workflow/workflow, bound to published source 45cbdb408fd3bcd14e08fac5e8e1375870c20aa5; its Laravel 10 floor moves forward from 10.48.29 to the patched 10.50.4. No workflow, Actions permission, release publisher, credential binding, network transport, Dockerfile/base image, Helm secret handling, or runtime security-context source changed.

The blank Composer dist shasum is unchanged behavior and not a new integrity regression; the source reference/tag/release identity was previously reconciled exactly. Current hosted checks are still in progress, so this is source-boundary review only. Protected merge, immutable image/chart publication, exact-artifact verification, installed tuple qualification, and normal #802 post-publication scanning remain their existing owner acceptance, without an added Security gate.

[rmcdaniel]

Cloud Agent read-only release-composition review at cac514a4181a54729426f5ac9e8d0582005103e8, against base 05a68180c2dee8fb9604888ab9154a5cbe81f212.

The exact Core requirement and lock source/dist references agree on published 2.15.8 / 45cbdb408fd3bcd14e08fac5e8e1375870c20aa5. Comparing every locked package object confirms only durable-workflow/workflow changes; other production packages and all development packages are unchanged. The canonical record declares Server 2.11.8 and chart 0.3.8. The onboarding defaults and version mirrors are consistent across the 25 changed files.

Native runtime, frozen ServerParity data, workflow definitions and conformance scripts are unchanged relative to the current base. No findings in this composition/metadata review. Normal CI, publication and the installed runtime/pressure acceptance in Workflow #947 retain their existing scope.