[rmcdaniel]

The site still selects Waterline 2.13.2. Advance the Waterline value to the published 2.14.0 release so generated package identities and distribution references select the release with restored public image provenance. Set updated_at to 2026-11-04, the date of the current qualification, so the public qualificationDate and qualifiedOn metadata does not predate the selected artifacts' acceptance.

Release verification:

• Stable GitHub release 2.14.0 is latest, with no draft/prerelease flag. The annotated tag and fresh Packagist source agree at ff22ddf07723d4b4d4e07a5cc8ffd294901eb764.
• Fresh Docker Hub reads match the released index sha256:b00ba47220af6ce4dfd73cf85852b72ea7b6913149652637628b79701d0b1c98 and the accepted amd64 d0c0d039… / arm64 43e444de… digests.
• Protected publication and installed acceptance and subsequent published qualification succeeded, including both image architectures, Composer/browser, recovery, request budget and provenance checks. The latter's Composer consumer installed Waterline 2.14.0 with Workflow 2.20.1. Its service request-budget checks used SDK 3.4.1 and a legacy 2.4.0 control; this does not adopt the unreleased dependency/image work in waterline#272.
• The current-image scan follow-through is complete in waterline#273.

Validation: npm test passes under Node 24.22.1; diff review confirms only the Waterline version and qualification date change, with no credentials or private content added. Normal site qualification will validate rendering in all eight locales.

[rmcdaniel]

Ready for independent Security review and General’s merge decision at 1b28d62184a6b7624c3814b7c2a909bebe4b9877. All 14 current checks passed, including full eight-locale documentation qualification, all three installer platforms, CodeQL and Sonar. Local npm test passed under Node 24.22.1; the reviewed diff remains one Waterline version value. Publication, registry identity, installed-consumer and current-image scan evidence are linked in the description and in waterline#270. Merge remains held for review; after General merges the cleared SHA, the remaining site follow-through is deployment and live manifest/generated Waterline identity verification.

[rmcdaniel]

Security exact-head review: HOLD 1b28d62184a6b7624c3814b7c2a909bebe4b9877 for a public qualification-date mismatch.

The Waterline version change itself is correct, but static/stable-releases.json still has "updated_at": "2026-11-03". This head selects Waterline 2.14.0, whose publication and final acceptance occurred on 2026-11-04. scripts/public-artifact-versions.js exposes that manifest field as both ARTIFACT_PINS.qualificationDate and QUALIFIED_ARTIFACT_TUPLE_AUTHORITY.qualifiedOn; merging this head would therefore publicly state that the newly selected tuple was qualified a day before that artifact existed.

Current main also gained Workflow 2.20.2 and Python SDK 2.14.0 on November 4 without advancing the field, so this PR is the next clean manifest update that can restore the tuple's truthful date.

Required correction: change updated_at to 2026-11-04, keep the Waterline line otherwise unchanged, and return the replacement exact head after normal checks. A small contract check that refuses an artifact-version change without a corresponding qualification-date change would prevent recurrence, but it is not required to keep this release-manifest fix narrow.

[rmcdaniel]

Security’s date correction is implemented at 6ee349236af9a3de401857b6e7c362af13d09112: updated_at is now 2026-11-04. The only changes from current main remain Waterline 2.13.2 → 2.14.0 and that qualification date. Both public date fields resolve to November 4; npm test and diff inspection pass. Fresh normal checks are required at this exact head. General retains merge; if #463 merges first, this branch will receive that base before final qualification.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Refreshed normally onto merged #463/main 2c9a1ed1be41874cde61b37a5e93695cff70eca4 at 8a4660f42d50600df42013773e6da9b10e85cbd9. The review diff remains only Waterline 2.14.0 plus the corrected updated_at: 2026-11-04; approved docs from main are inherited unchanged. No force-push or installer-policy change. Fresh exact-head normal qualification is running; General retains merge after independent review.

[rmcdaniel]

Security exact-head review: MERGE GO for 8a4660f42d50600df42013773e6da9b10e85cbd9.

The complete delta against merged base 2c9a1ed1be41874cde61b37a5e93695cff70eca4 is confined to static/stable-releases.json: Waterline 2.13.2 -> accepted public 2.14.0, and updated_at 2026-11-03 -> 2026-11-04. All other artifact selections, installer bytes/pins, schema, and site content are unchanged. The branch is CLEAN and every exact-head check is terminal success, including executable documentation, installers, CodeQL, Sonar, boundary, and protocol catalog.

Normal exact-head merge is cleared. This disposition does not carry across any head/base/tree change. If another stable-release manifest candidate merges first, refresh normally and return the new head rather than resolving the shared lines manually.

[rmcdaniel]

General merged the Security-cleared exact head 8a4660f42d50600df42013773e6da9b10e85cbd9 through GitHub as 0be89919cb91f38b2820acbf43735c19cc8e70a3 after verifying the unchanged base and all 14 terminal-success checks. Public deployment/readback remains pending. Please verify the deployed stable manifest and generated Waterline references before calling this delivered. This merge advances main; #466 needs a normal base refresh, fresh whole-head checks and its own exact-head Security review before General merges it.

[rmcdaniel]

Live follow-through is complete after protected merge 0be89919cb91f38b2820acbf43735c19cc8e70a3 and successful Pages deployment 41809587317.

A fresh no-cache read of the live stable manifest selects Waterline 2.14.0 with qualification date 2026-11-04. The generated Composer package identities on compatibility/quickstart and the image identity on monitoring are correct on all 24 checked live pages across English, Ukrainian, Spanish, Brazilian Portuguese, Simplified Chinese, Japanese, French and German. Representative public pages: compatibility, quickstart, monitoring.

The remaining CLI and Python candidates were refreshed normally onto this main and are requalifying at their new exact heads. No installer bytes or source pin changed.