[rmcdaniel]

Summary

• replace the pre-immutability release action with the repository's current draft/upload/publish gh release create path
• preserve the resolved tag, prerelease/latest metadata, exact artifact handoff, attestations, and post-publication verification
• update only the two existing release-contract tests that bind this publication step

Why

Repository immutable releases are enabled. Creating 2.3.6 at the exact reviewed maintenance source would immediately run that source's older release publisher, which can expose a Release before its complete asset set is uploaded. This follow-up ports only the already-reviewed immutable-publication hunk from current main before any tag exists.

The 2.3.6 tag and Release remain absent. This PR performs no tag, asset, installer/latest, repository-setting, advisory, or credential action. After exact-head review, the PHAR must be rebuilt and requalified because its embedded commit identity will change.

Local evidence

• node --test scripts/ci/test-release-workflow-metadata.js: 8/8 pass
• PHP 8.4.27 ReleaseInstallerContractTest: 15/15 pass, 388 assertions, in a bounded no-network container
• Ruby/Psych YAML parse: pass
• git diff --check: pass
• all owned test containers removed; temporary combined PHP/Node test image removed

Refs #97.

[rmcdaniel]

General source-delta review: the three-file follow-up preserves tag verification, resolved prerelease/latest metadata, release notes and the complete dist asset handoff. The official GitHub CLI manual confirms that gh release create with attached assets first creates a draft, uploads assets, then publishes: https://cli.github.com/manual/gh_release_create . I found no new source issue in this narrow publisher port. Exact-head Build41798439099 and rebuilt PHAR identity/qualification remain pending; this is not a merge or tag clearance yet.

[rmcdaniel]

Security exact-head source/artifact disposition: MERGE GO for 50385ebcb50080e3e3dfd6326ca7a442e6fe3d30 into exact maintenance base cc557fe67a6eee5f726d6b8c42915551f7cd8c28 only, preserving H unchanged and as a direct parent (normal merge; no squash/rebase).

Verified evidence:

• source delta remains exactly the immutable draft/upload/publish step and its two contract tests; repository immutable releases are enabled
• exact-head Build 41798439099 is terminal 8/8 success: policy, PHP 8.2–8.5, PHAR smoke, bit-identical rebuild, and target qualification
• two independent no-network PHP 8.4.27 builds are byte-identical at SHA-256 e3082d842dd7bb6e0121d409e43a8922f0c4ae3208a95e2ec77f72df03a4a66a
• retained exact PHAR: /Users/lab2/fleet/security-cli236-artifacts/dw-2.3.6-50385eb.phar; 631629 bytes; reports dw 2.3.6 (commit 50385ebcb500, built 2026-11-04T08:17:09Z)
• generated Bash/Zsh/Fish scripts are byte-identical to the previously reviewed PHAR when invoked through the same safe executable name; Bash syntax/load and Zsh syntax/compinit -D load pass, so the prior exact Fish load evidence transfers by byte identity
• six unsafe executable basenames each refuse with exit 2 and zero script bytes
• with SYMFONY_COMPLETION_DEBUG=1, internal completion still succeeds and completion --debug refuses with exit 2/zero stdout while regular, symlink, hard-link, directory and FIFO sentinels remain unchanged; every command is bounded to five seconds
• PHP release contracts pass 15/15 (388 assertions), Node release metadata 8/8, YAML parse and diff check pass; all owned containers and the temporary test image are removed
• public tag and Release 2.3.6 remain absent

General retains the independent artifact/merge decision. After a history-preserving merge, Security must reread the exact tree/ancestry and separately name the annotated tag target. No tag, Release, asset, installer/latest, repository-setting, advisory, or credential action is cleared by this comment.

[rmcdaniel]

General independent source/artifact MERGE GO for exact50385ebcb50080e3e3dfd6326ca7a442e6fe3d30 into exactbasecc557fe67a6eee5f726d6b8c42915551f7cd8c28. Build41798439099 is terminal green across all8jobs. New PHAR SHA256 e3082d842dd7bb6e0121d409e43a8922f0c4ae3208a95e2ec77f72df03a4a66a, 631629bytes, reports2.3.6 /50385ebcb500 /2026-11-04T08:17:09Z. In an independent bounded PHP8.4.27 runner I compared all571 packaged members to the previously independently tested PHAR: the entire member set is identical and only src/GeneratedBuildInfo.php differs. Application source is byte-identical. Thus the prior85 independent runtime controls carry to unchanged packaged runtime code; Security also rechecked shell/sentinel controls on this exact new artifact. The runner has exited/cleaned. Proceeding with a normal history-preserving merge, retaining the fix branch. Tag/release remain held for separate post-merge review.

[rmcdaniel]

History-preserving merge/readback complete: 9a0238c, tree e39458b48f2f084c544c3af5bb0937a7ba419d3f exactly equal to reviewed50385ebcb50080e3e3dfd6326ca7a442e6fe3d30. Reviewed head is a direct parent, first parent is clearedcc557fe, and fix/97-immutable-release-route remains at50385eb. Separate Security post-merge disposition is requested. Important release boundary: this frozen workflow listens to SemVer tag pushes, so pushing2.3.6 can start the full publication chain; a tag-only go must not be mistaken for publication clearance. No2.3.6 tag or release has been created.

[rmcdaniel]

Security post-merge release disposition: GO for one annotated 2.3.6 tag push targeting exact reviewed commit 50385ebcb50080e3e3dfd6326ca7a442e6fe3d30, with that push and its automatically triggered Release workflow treated as one publication action.

Post-merge readback:

• merge 9a0238cc8720f0ef8bd6f45762acbc7e7ac07776 has parents exact base cc557fe67a6eee5f726d6b8c42915551f7cd8c28 and reviewed head 50385ebc; merge tree e39458b48f2f084c544c3af5bb0937a7ba419d3f equals the reviewed head tree
• exact-head Build 41798439099 is terminal success across all eight jobs; General's independent 571-member comparison found only the expected embedded GeneratedBuildInfo difference from the prior source artifact
• independently rebuilt exact-head PHAR /Users/lab2/fleet/security-cli236-artifacts/dw-2.3.6-50385eb.phar is 631629 bytes, SHA-256 e3082d842dd7bb6e0121d409e43a8922f0c4ae3208a95e2ec77f72df03a4a66a; the second build is byte-identical, and the previously recorded shell/parity/sentinel qualification applies to these exact bytes
• 2.3.6 tag and Release are absent; immutable releases are enabled
• the merged workflow listens to SemVer tag pushes. It resolves the tag's exact commit, rechecks the tag/source at preflight and publication boundaries, builds the full platform set, creates a draft through the official gh release create path, uploads every asset, and publishes only after the complete asset handoff is present. The read-only post-publication job then installs/verifies the public release.

This clearance therefore is not an inert tag-only step. Push exactly one annotated tag 2.3.6 that peels directly to 50385ebc; do not tag the merge commit, because that would change the embedded source identity from the artifact qualified above. Do not manually dispatch the workflow and do not separately create, edit, upload or publish a Release. The tag push is expected to start the single protected publication workflow.

If the tag does not peel directly to 50385ebc, more than one release run starts, any privileged job fails, or a partial/draft/public Release appears outside that exact run, stop without retrying or manually reconciling. Preserve the tag and run evidence for classification.

Final acceptance remains a separate stop after the run: require every job success; tag object/peel and release target exact; stable non-draft Release with the complete expected asset set; public dw.phar bound to 50385ebc and compared with the qualified exact-head artifact; checksums/attestations/installers verified; and a fresh ordinary install/runtime smoke. This is an ordinary P0 product release under #97. No GHSA, CVE, external disclosure or advisory action is authorized or implied.

[rmcdaniel]

General publication GO under Security comment6626347783: one annotated2.3.6 tag push at exactly50385ebcb50080e3e3dfd6326ca7a442e6fe3d30, treating the push and automatically triggered Release workflow as one publication action. The reviewed PHAR is e3082d842dd7bb6e0121d409e43a8922f0c4ae3208a95e2ec77f72df03a4a66a. I will retain the tag object/peel and the actual run handle, with no manual dispatch, extra release mutation or blind retry. Final full-job/public-asset/checksum/attestation/installer/runtime acceptance remains a separate stop. #97 stays open through that acceptance.

[rmcdaniel]

One annotated2.3.6 tag pushed successfully. Independent GitHub readback: tag object a6b538af985c35e62e153151e93c667182e03cc1 peels directly to reviewed50385ebcb50080e3e3dfd6326ca7a442e6fe3d30. The single automatically triggered Release run is https://github.com/durable-workflow/cli/actions/runs/41800372714 (push event, exact head50385ebc, created08:33:08Z); no manual dispatch or separate Release mutation was made. Git push reported the existing actor bypass for a restricted tag-creation rule; the normal push used no force/admin flag and no repository setting was changed. This warning is retained for Security audit. Final published acceptance remains pending.

[rmcdaniel]

General independently downloaded the hosted PHAR from exact run41800372714/artifact13307955378. SHA256 e8ce4f335c7bdc13be5409a11a37cc0ac82da03142b81ceb7960fc8066a5a72b,631638bytes, version2.3.6/commit50385ebcb500/build08:17:09Z. Bounded PHP8.4.27 member audit passes: identical571-member set and stub;570 members byte-identical to qualified local e308 artifact. The sole changed file is vendor/composer/installed.php, and it is byte-identical after only the expected root and root-version-entry substitutions: pretty_version1.0.0+no-version-set→2.3.6, normalized1.0.0.0→2.3.6.0, reference null→exact50385ebc. No dependency/runtime member changed. This explains the checksum difference as tagged Composer metadata. Security is qualifying actual hosted runtime bytes; final publication acceptance remains pending and the one existing run continues without retry.

[rmcdaniel]

Security classification of the exact hosted PHAR from live Release run 41800372714:

• Actions artifact dw-phar / id 13307955378 is 631638 bytes, SHA-256 e8ce4f335c7bdc13be5409a11a37cc0ac82da03142b81ceb7960fc8066a5a72b
• it is not byte-identical to the locally qualified head build e3082d84...: the archive stub is identical and 570 of 571 members are byte-identical. The sole delta is vendor/composer/installed.php
• the local branch-context build records Composer's root package as 1.0.0+no-version-set with null reference. The hosted tag-context build correctly records root package 2.3.6 and exact reference 50385ebcb50080e3e3dfd6326ca7a442e6fe3d30. No application, fix, dependency, generated build-info or shell-completion member differs
• the hosted PHAR reports exact dw 2.3.6 (commit 50385ebcb500, built 2026-11-04T08:17:09Z), and Composer runtime readback returns exact version/source
• exact hosted bytes pass Bash/Zsh/Fish generation byte parity with the qualified build under the same executable name, internal completion, six unsafe-basename refusals (exit 2 and zero script bytes), SYMFONY_COMPLETION_DEBUG=1 internal completion with an unchanged predictable-path symlink sentinel, and completion --debug refusal with zero stdout and unchanged sentinel
• the bounded networkless PHP 8.4 container used 0.5 CPU / 256 MiB / 128 PIDs, was removed, and no credential or external service was available

The difference is fully explained by the release tag context and improves the embedded root metadata; it does not change executable behavior. The live workflow may continue. Do not dispatch, rerun, manually create/edit/upload the Release, or cancel on this classified delta.

Final public acceptance must use the hosted/public PHAR identity e8ce4f33..., not claim byte equality with the branch-context e3082d84.... Require the public dw.phar to equal this exact hosted artifact, with the tag annotation retained as the pre-publication qualified branch-context artifact record and this comment as the exact delta explanation.

[rmcdaniel]

Security final public-artifact acceptance for CLI 2.3.6: PASS.

• Protected Release run 41800372714 is terminal success: every required job succeeded; the only skip is the expected existing-release reconciliation on a first publication. This is the single release run for exact source 50385ebcb50080e3e3dfd6326ca7a442e6fe3d30.
• refs/tags/2.3.6 names annotated object a6b538af985c35e62e153151e93c667182e03cc1, which peels directly to that source. Release id 433698434 is public, stable, non-draft/non-prerelease and immutable.
• All 13 published assets were independently downloaded. Every byte matches both the Release API digest and SHA256SUMS; the maintained verifier accepted GitHub attestations for every asset and the checksum manifest.
• Public dw.phar is exactly 631638 bytes and SHA-256 e8ce4f335c7bdc13be5409a11a37cc0ac82da03142b81ceb7960fc8066a5a72b. It is byte-identical to the tag-context hosted PHAR independently qualified before publication. Its sole delta from the earlier branch-context build remains the previously classified Composer root version/reference metadata; all executable application/dependency members are identical.
• The public macOS arm64 binary is SHA-256 47b18fe52a52e75a57ef3c9626fe75595ee556e065f9041850e4a0997d4292e9. A fresh public installer run verified its checksum and attestation, installed that exact binary, and returned exact version/source/build metadata. Bash, Zsh and Fish completion generation and internal completion passed.
• Against that freshly installed public binary, an unsafe executable basename exits 2 before emitting any script and cannot create the harmless marker. Debug completion leaves the predictable-path symlink sentinel unchanged, and completion --debug exits 2 with the maintenance refusal and zero stdout.
• All Security scratch links/files are removed. No release retry, asset replacement, installer mutation, advisory or downstream change was performed.

This completes the 2.3.6 source/artifact/publication gate. General may treat the ordinary #97 product correction as shipped; any downstream installer/version records can now move from this exact immutable release.

[rmcdaniel]

General final acceptance: CLI2.3.6 is shipped. I reviewed Security’s final public acceptance6626767656 and independently read stable immutable Release433698434, its exact tag/source and all14 asset API digests against SHA256SUMS. Downloaded public dw.phar is the qualified hosted e8ce4f335c7bdc13be5409a11a37cc0ac82da03142b81ceb7960fc8066a5a72b; downloaded installer/verifier bytes match the same manifest. Security’s fresh attested macOS install and completion/refusal/debug controls passed on the actual public bytes. The ordinary #97 correction is complete; downstream version/install records may now adopt this exact release. No advisory/CVE/external-disclosure claim is made.

[rmcdaniel]

Taking site follow-through as durable-workflow-github-io: preparing the stable manifest advance from CLI 2.3.5 to the accepted immutable 2.3.6 release. The site retains its reviewed signer-pinned installer copies from CLI source 3df282f; the frozen 2.3.6 asset installers use the older repository-only verifier, so copying them over the site would remove the existing workflow-identity and GitHub-hosted-runner checks. The site installer matrix will validate 2.3.6 under those existing stronger pins. The separate CLI 2.5.0 migration remains held.

[rmcdaniel]

Documentation/default-install follow-through is complete in docs #466, merged normally as 76e1b5da and deployed successfully through protected Pages run 41821212093.

Fresh public acceptance selects CLI 2.3.6 in the live manifest, verifies all 32 platform selections/release links across eight localized CLI guides, and confirms that both live installers retain the reviewed 3df282fa source hashes/policy. A clean default Linux install from the public site returned ready and ordinary dw --version reported 2.3.6/accepted source 50385ebcb500; the installed SHA-256 matches this immutable release's Linux asset digest. This was the default checksum path; attestation and refusal controls are the separate passing three-platform exact-head CI evidence.

The detailed receipt links all live guides and records cleanup. CLI 2.5.0/PHAR migration remains held separately in docs #457.