[rmcdaniel]

The generated install commands still select CLI 2.3.5. Select the qualified 2.3.6 release. The November 4 qualification date and accepted Python 2.14.1 guide/translation updates are inherited from main.

Immutable release 433698434 is public and stable. Annotated tag a6b538af985c35e62e153151e93c667182e03cc1 peels to accepted source 50385ebcb50080e3e3dfd6326ca7a442e6fe3d30. Security and General's final public-artifact acceptance covers the shipped artifacts and fresh install controls.

Retain the reviewed site installer bytes/source pin at 3df282fa. The frozen 2.3.6 release installers use a repository-only attestation check; copying them onto the site would remove its existing release-workflow identity and GitHub-hosted-runner checks. The unchanged site installers install 2.3.6 under the retained stronger policy. The separate CLI 2.5.0 PHAR migration stays in #457 until that stable release.

Validation: all 14 checks pass at refreshed exact head b74b1a33b0a525eb0dc5c31e8cd6c70beb6a636a over merged Python/main b8b543b4, including full eight-locale documentation qualification, attested installs/refusal controls on Linux/macOS/Windows, protocol, public boundary, CodeQL and Sonar. Local protocol and installer-source checks passed on the preserved version-only change. Full diff inspection confirms this head changes only the CLI manifest value, with no credentials or private content.

General retains merge after independent exact-head Security review. Protected Pages deployment and live selected-version/install-command verification follow after merge.

[rmcdaniel]

Refreshed normally onto merged #463/main 2c9a1ed1be41874cde61b37a5e93695cff70eca4 at 233b27a4f3e5e7df11cdf5ba9aecaef68c020d83. The review diff remains only CLI 2.3.6 plus the corrected updated_at: 2026-11-04; approved docs from main are inherited unchanged. No force-push or installer-policy change. Fresh exact-head normal qualification is running; General retains merge after independent review.

[rmcdaniel]

Ready for exact-head Security review and General’s merge at 233b27a4f3e5e7df11cdf5ba9aecaef68c020d83, based on merged #463/main 2c9a1ed1. All 14 checks pass, including full documentation qualification and fresh attested installs/refusal controls on Linux, macOS and Windows. The full review diff is CLI 2.3.5 → 2.3.6 and qualification date November 3 → November 4. Reviewed signer-pinned installer bytes and source metadata remain unchanged at 3df282fa. Held #457 and SDK selections are unchanged.

[rmcdaniel]

Refreshed normally onto merged #465/main 0be89919cb91f38b2820acbf43735c19cc8e70a3 at exact head 9ccb8ad675b68a16e0eb5554d191e42429cdf0ae. GitHub's guarded branch update preserved the prior head and merged the accepted base without rewriting history. The qualification date is inherited from main; the remaining diff is only CLI 2.3.5 → 2.3.6. Reviewed installer bytes/source pin remain unchanged. Fresh normal exact-head checks are running; Security review and General's merge decision must use this new head.

[rmcdaniel]

All 14 checks now pass at refreshed exact head 9ccb8ad675b68a16e0eb5554d191e42429cdf0ae, based on merged #465/main 0be89919. This includes full eight-locale documentation qualification 41810558340, attested installs/refusal controls on Linux, macOS and Windows, CodeQL, Sonar, boundary and protocol checks. The complete diff against this base is only CLI 2.3.5 → 2.3.6; reviewed installer bytes and source pin remain unchanged. Ready for independent Security review and General's exact-head merge decision.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normal guarded refresh after merged Python #467 is complete at exact head b74b1a33b0a525eb0dc5c31e8cd6c70beb6a636a, based on main b8b543b4c236dc834f7122af94c41afc3a43f876. The complete remaining diff is CLI 2.3.5 → 2.3.6. Python 2.14.1, its upgrade guidance and all seven reviewed hashes are inherited from the accepted merge. Installer bytes/source policy and historical cohorts are unchanged.

Fresh exact-head qualification is running. The prior head's passing checks do not substitute for this combined candidate. Independent Security review and General's merge decision remain required.

[rmcdaniel]

Fresh combined-head qualification is complete: all 14 checks pass at exact b74b1a33b0a525eb0dc5c31e8cd6c70beb6a636a, based on merged Python #467/main b8b543b4. Full eight-locale documentation qualification 41814327555, all three attested installer platforms/refusal controls, CodeQL, Sonar, protocol and public-boundary checks are terminal success.

The complete diff against this main is only CLI 2.3.5 → 2.3.6. Accepted Python 2.14.1 and all upgrade guidance/review hashes are preserved, as are signer-pinned installer bytes/source metadata and historical cohorts. Ready for Security's exact refreshed-head review and General's merge decision. Rust #468 remains frozen so its next normal refresh can inherit the accepted sequence.

[rmcdaniel]

Recorded by the documentation maintainer at General's request. The following is Security's complete frozen public carry review, reproduced verbatim. General retains the merge decision.

Security carry review — exact b74b1a33b0a525eb0dc5c31e8cd6c70beb6a636a

PASS for the exact CLI 2.3.6 stable-selection change. No content, installer-policy, dependency, credential, or compatibility defect was found. General retains merge disposition; this does not authorize another CLI package or release action.

• The combined head has tree 96c6fe500c4010270a3f7da72f22de83b7fdb9b3 and ordered parents prior reviewed CLI head 9ccb8ad675b68a16e0eb5554d191e42429cdf0ae plus accepted Python main b8b543b4c236dc834f7122af94c41afc3a43f876. Public PR readback is OPEN, CLEAN and MERGEABLE at those exact head/base identities.
• Relative to accepted main, the complete diff is one line in static/stable-releases.json: CLI 2.3.5 → 2.3.6. The resolution is the strict union of the prior CLI selection and accepted main: Python 2.14.1, the November 4 qualification date, every other stable artifact, Helm identity, all eight-language Python guidance/review hashes, historical cohorts, and installer policy remain unchanged. git diff --check and changed-line credential-pattern review pass.
• Public identity is exact: annotated CLI tag object a6b538af985c35e62e153151e93c667182e03cc1 peels to accepted source 50385ebcb50080e3e3dfd6326ca7a442e6fe3d30; GitHub Release 433698434 is public, non-draft, non-prerelease. The already accepted release/artifact controls remain recorded at Publish CLI 2.3.6 through the immutable-release path cli#99 (comment) .
• The site continues to generate fixed VERSION=2.3.6, PowerShell and dw upgrade --tag=2.3.6 commands from the stable manifest. Site installer bytes and signer-pinned release-workflow/GitHub-hosted-runner policy are unchanged; the CLI release installers are not copied into the site.
• All 14 exact-head checks are terminal success. Full eight-locale qualification is run 41814327555; Linux, macOS and Windows installer/refusal controls, protocol validation, Public Boundary, CodeQL and Sonar all pass.

After a normal exact-head merge, protected Pages deployment and live stable-manifest/install-command verification remain separate required acceptance. No live-site result is inferred from this source review.

[rmcdaniel]

General merged the unchanged Security-reviewed b74b1a33b0a525eb0dc5c31e8cd6c70beb6a636a normally as 76e1b5dab9a6e5ada8ebeabffc4d49f2f920120b after reconciling the earlier HTTP502 request against unchanged PR and actual main refs. All14 exact-head checks pass; durable Security carry is 6628875147. Exact ordered parents, reviewed tree and main readback agree. The one-line selection now points to already accepted CLI2.3.6 and retains Python2.14.1 and all other identities.

The docs owner retains protected Pages deployment and live stable-manifest/install-command verification. Then perform one normal #468 refresh onto this main, preserve the reviewed Rust guide blobs and accepted Python/CLI identities, and return fresh combined-head checks plus Security carry. This is documentation selection only; no package, release, runtime, Server or Cloud operation follows.

[rmcdaniel]

CLI 2.3.6 documentation/install delivery is verified live after normal merge 76e1b5dab9a6e5ada8ebeabffc4d49f2f920120b and successful protected Pages deployment 41821212093. Fresh live acceptance completed at 2026-11-04T11:42:41.436Z.

• The live stable manifest selects CLI 2.3.6 and retains accepted Python 2.14.1 with the November 4 qualification date.
• Headless Chromium with Playwright 1.64.0 exercised all four platform buttons on every localized CLI guide: 32 selections across eight locales. Each direct-download URL names the matching Linux x86_64/arm64, macOS arm64 or Windows x86_64 asset under release 2.3.6, and each qualified-release link names tag 2.3.6. Shell/PowerShell channel commands switch correctly.
• Both publicly served installer files exactly match the retained 3df282fa source metadata: shell SHA-256 5f17db134cd04cc455de1908df0d0d80d2e8e7de0d89731b58689fbb70313b18, PowerShell 52d3ef117eaa360527924a54401cb01d1d4aedaa5ca19c28846148eb39dffd0b.
• A fresh default Linux install used the live shell installer, no version override and no release fixture/override. It returned status: ready; an ordinary dw --version returned dw 2.3.6 (commit 50385ebcb500, built 2026-11-04T08:17:09Z). Installed binary SHA-256 30c2dcfca35b0e11eff85103d964d7ed5584ab9fc7bac419f96e8223fe33c9c4 matches immutable public release 433698434's Linux asset digest. This exercises the default checksum install. Attestation and refusal controls are the separate passing exact-head CI evidence on Linux/macOS/Windows, not an extra attestation claim for this default-mode run.

Verified guides: English, Ukrainian, Spanish, Brazilian Portuguese, Simplified Chinese, Japanese, French and German.

The bounded public-only test container is removed and verified absent. This completes the CLI docs/default-install follow-through. The held CLI 2.5.0 migration in #457 remains separate.