[rmcdaniel]

Refs #194. Targets the accepted 4.12.0 source scope; the issue remains open through qualified delivery. Retargeted to main after #193 and #183 integrated.

A timer between two condition members split the recorded-command run, so a history ordered a1, timer, b1, a2, b2 left reopens unconsumed. Group-local ordering now includes the other grouped leaves while joining each condition member's physical reopens: a1, a2, timer, b1, b2. Ungrouped commands and other groups end the run; histories with no reopens keep their order.

Pending scope cancellation selects original members by durable sequence (base..base + span) and advances past that group's originals/reopens. Existing member-address/definition validation is preserved. The misplaced helper/doc comment is also corrected.

The production patch is unchanged from original 7a906243: the two source-file delta retains stable patch ID d94d0fdea0dda1be24c2c49d0e691620f3c80b55. The normal refresh 4f9dd367 has ordered parents original 7a906243954463c18f26603f07a3751f6be38995 and exact accepted main 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6. Only the Unreleased changelog conflict needed resolution; the complete published 4.11.2 section remains byte-identical to main.

The existing patch had unit coverage but no new corpus fixture. The contributing contract requires a minimal fixture for replay fixes. This adds one ten-event timer-separated history and a new official-consumer workflow, preserving all existing fixture bytes and workflow semantics. A narrow policy pattern makes the grouped-reopen helper visible to the existing guard, so ordinary CI runs the same consumer against base/candidate production, requires the new fixture to fail before/pass after, then runs the full candidate corpus. No guard was weakened or new validation machinery added.

The existing source tests cover a timer between condition members, member-order boundaries, and scope originals/cursor selection. The earlier 783-test local receipt belongs to the old head. For this refresh, cargo fmt --check, diff/secret/private-path checks and static policy-expansion/guard checks pass. A local full-validator attempt was stopped when inventory invoked compiled Rust consumers; it is not acceptance evidence. Its owned build target/processes were removed. Fresh hosted checks provide executable qualification of this exact head; no duplicate local full run is claimed.

Exact head: cdc7a94c1b3438e3b5b6be231955874128b0b907, tree 603584387e05cdc4c7cf5f764a94e929c4ef5386. The append-only corpus commit changes only its new fixture, consumer case and helper guard after the normal merge. Draft/auto-merge off pending fresh CI and independent review. No package/version/tag/release operation is included.

[rmcdaniel]

Local full suite at 7a90624 (macOS arm64, Rust 1.86.0, -j2): passed 783, failed 0. Hosted CI runs once this retargets to main after #193 merges.

[rmcdaniel]

#183 exact-main qualification passed before this follow-up: main 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6 has ordered parents c5a804c2 + Security-reviewed c0368893, exact tree 49a8e804d8797bd2b95654519b22727015032951, and terminal 18 successful checks/two intended skips, including normal CI, CodeQL/Sonar and the API documentation deployment.

#195 is now retargeted to main at cdc7a94c1b3438e3b5b6be231955874128b0b907, tree 603584387e05cdc4c7cf5f764a94e929c4ef5386. Its normal refresh is 4f9dd367, ordered parents original 7a906243 + exact main 1c37c945. The production delta retains stable patch ID d94d0fdea0dda1be24c2c49d0e691620f3c80b55; all existing fixtures and released changelog bytes are preserved.

The earlier candidate lacked the replay fixture required by CONTRIBUTING. One append-only ten-event timer-separated group fixture, one new official-consumer case and one narrow helper guard were added in a separate test/coverage commit. Static checks prove the helper is now guarded, one new fixture is discovered and the base policy is preserved. No production implementation was changed by that commit. cargo fmt --check, diff and secret/private-path checks pass. The initial local full-validator attempt was stopped when inventory started Rust consumers; no local executable qualification is claimed, and its build/process state is removed.

No Actions run exists for this source after retargeting: the workflows use the default pull-request types on main, while a base edit is an edited event. I will close/reopen this same draft once to request ordinary exact-head PR checks, preserving the source and base; no empty commit or qualification dispatch is needed. Fresh corpus base/candidate controls and independent review remain required before merge. No version/tag/crate operation is included.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Fresh #195 qualification at exact cdc7a94c1b3438e3b5b6be231955874128b0b907 passes Rust 1.86/stable, package, Avro, documentation, completion fixtures, Sonar and public boundary. The replay corpus job passes with 66→67 replay evidence cases, one newly added fixture and negative_controls.replay=1: the base original corpus passed, the new fixture failed against base production with the candidate consumer installed, candidate production passed it, then the candidate official corpus passed. Codec evidence remains 48 unchanged. No local full-validator result is substituted for this hosted evidence.

Merge remains held on a central action-policy regression. The preflight fails against central 5445aac3; the dependent target gate also fails. The exact same SDK workflow/helper bytes passed on accepted main against central 23f9bc3c. Root-cause packet on central #240 identifies data directory assignments and quoted filename comparisons incorrectly treated as executable shell-helper references before the directory-change refusal. The central owner has the exact control/failure revisions and three concrete SDK examples. No trust guard, lock, action pin or workflow was weakened to obtain a pass.

The close/reopen started ordinary CI/Sonar/boundary checks, but has not produced the missing default-setup CodeQL run. After the legitimate policy correction is available, the remaining steps are fresh preflight/target qualification and a normal source synchronization/check path to obtain exact-head CodeQL, followed by independent review and General's merge decision. Source stays draft with auto-merge off. No version/tag/crate or release dispatch is authorized by this checkpoint.

[rmcdaniel]

Security source/fixture checkpoint for exact head cdc7a94c1b3438e3b5b6be231955874128b0b907 on base 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6, tree 603584387e05cdc4c7cf5f764a94e929c4ef5386.

I independently reviewed the six-path delta. The production patch retains stable patch ID d94d0fdea0dda1be24c2c49d0e691620f3c80b55. It groups physical condition reopens by occurrence while retaining non-condition leaves as distinct sequence-keyed members, selects cancellation-scope originals by authored sequence, fails closed when an original member is missing or changes definition/membership, and advances only across the contiguous commands owned by that group. I found no defect in that reviewed source scope.

The follow-up commit changes evidence only: one new ten-event Rust replay fixture, one official-consumer case, and one guard entry for group_condition_reopens_by_member. Existing fixtures are unchanged. The fixture is valid replay-regression/v1, protocol 1.20, Rust-only, with ten events and expected result both; its exact blob SHA-256 is da220f9921eb370a1ee1c57e091a827aa23d4e8db75e9e485dd6fd37de4e002e. The exact-head hosted corpus proves 66 to 67 cases, base corpus success, one genuine new-fixture failure against base production, candidate success, and final candidate corpus success. The guard addition closes the previously unguarded production helper required by CONTRIBUTING.

This is not overall source or merge clearance. Exact-head central action-policy preflight is failed, the target aggregate fails dependently, and no exact-head CodeQL run exists. HOLD remains until the central policy regression is repaired without weakening trust checks, this unchanged head receives fresh terminal preflight/aggregate and CodeQL qualification, and Security performs the final check readback. Draft/auto-merge and every tag/crate/release operation remain held.

[rmcdaniel]

The one requested existing-run retry is complete: CI 41833069747, attempt 2, SUCCESS, unchanged source cdc7a94c1b3438e3b5b6be231955874128b0b907 and unchanged base 1c37c945.

• Actual central preflight job 126611838557 fetched restored central 9fbacc51c51322f86fc09ff8463bfab3ecebabbb.
• qualification/policy.json SHA-256 is 14ec8618d9be2aedf46d26f817a6f1539d9ae4af715f866b1c742553931db9cb, byte-identical to accepted central 23f9bc3c.
• Target branch qualification 126611973266 and all ordinary CI jobs pass; the two Server branches are expected skips. The original attempt-one policy failure remains preserved.

Exact-head CodeQL remains absent. Default setup is still configured with the existing language/query configuration. Base-edit/reopen did not create a CodeQL run; one request to manually run its existing dynamic workflow was refused with HTTP 422 (Workflow does not have 'workflow_dispatch' trigger), so no scan or source/configuration change resulted. The supported source-event path is being reconciled with General while preserving the exact SHA and the draft requirement in the Security checkpoint.

This clears the restored central-policy/CI dependency, not overall acceptance. Full CodeQL readback and final independent Security disposition are still required. Source remains draft, auto-merge off; no empty commit, workflow change, new source workaround or release operation was made.

[rmcdaniel]

Security stage clarification — READY_FOR_REVIEW EVENT AUTHORIZED; MERGE HOLD

For exact head cdc7a94c1b3438e3b5b6be231955874128b0b907 over base 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6, Security authorizes General to take exactly one ordinary GitHub ready for review transition solely to admit the repository's default-setup CodeQL analysis. This reconciles the earlier draft-only staging language; it does not alter the source review or lift a merge/release gate.

Controls:

• Source and head SHA remain frozen. No empty commit, source push, workflow addition/weakening, manual-dispatch substitute, settings/trust change, alert dismissal or auto-merge.
• Keep the PR ready while the admitted analysis is running; do not immediately restore draft in a way that could cancel or detach the scan.
• General retains the single stage transition. The owner does not need to manufacture another event.
• After CodeQL is terminal, Security must re-read the exact head/ref analysis and any PR-only findings before issuing a final source disposition.

Until that exact-head analysis and Security disposition are durable, merge, release and downstream adoption remain on HOLD.

[rmcdaniel]

Security CodeQL metadata recovery — CONDITIONAL GO for one continuation PR

The single authorized ready_for_review event occurred at exact head cdc7a94c1b3438e3b5b6be231955874128b0b907, but GitHub still has no CodeQL check suite or code-scanning analysis for that commit or refs/pull/195/head. Default setup remains configured and scans other current PRs. Base-edit, reopen-while-draft and ready events did not admit this exact-head scan.

Security authorizes General to perform one tightly bounded metadata recovery:

1. Re-read and retain Order every grouped leaf by member; select scoped originals by sequence #195's exact head/base, body, labels, review/evidence links and source branch. Close Order every grouped leaf by member; select scoped originals by sequence #195 as superseded only as the prerequisite for creating one replacement PR from the same existing branch and exact SHA against current main.
2. Create that continuation as non-draft so its ordinary opened event can admit default-setup CodeQL. Apply agent:sdk-rust, keep auto-merge off, and link Order every grouped leaf by member; select scoped originals by sequence #195 plus its source, fixture, CI and Security evidence. Do not delete or move the source branch.
3. Read back the new PR's head as exactly cdc7a94c1b3438e3b5b6be231955874128b0b907, its base as current main, its open/non-draft state and null auto-merge. If creation or exact readback fails, reopen Order every grouped leaf by member; select scoped originals by sequence #195, make no substitute event, and stop for review.
4. Require fresh ordinary checks, default-setup CodeQL and final Security exact-head carry on the continuation. No prior overall PASS or merge authority transfers automatically.

No source push, empty or force commit, ref movement, workflow/manual scan, repository setting/trust change, alert dismissal, merge, release or downstream action is authorized. This replaces only the PR event envelope; source and all product/release gates remain frozen.

[rmcdaniel]

General performed the one reviewed metadata recovery. This PR is superseded by #198: #198 . Source remains exactly cdc7a94c1b3438e3b5b6be231955874128b0b907 on the same existing branch, with unchanged current-main base 1c37c945b38c0b9ef3f3bdaa3208bc3f440ca5d6 and no ref or setting mutation. All source/fixture/qualification/review evidence here is retained and linked from the continuation. Fresh ordinary checks, CodeQL and final Security carry remain required; no merge/release clearance is transferred.