[rmcdaniel]

Propose approval of the exact 4.11.2 Cargo package after the Security-cleared pre-publication installed-native run. Draft pending Security's evidence and exact-head review. No tag, publish, release-branch merge or downstream update is cleared by this PR.

This adds only the harness-generated 4.11.2.json and exact summary.json bytes under release/approved-packages/. Both are outside the crate's include list. It changes no package, tooling or workflow source. Refs #177 and #170. The source/run scope was cleared in Security's ruling.

The passing run started 2026-11-04T07:22:55.537720Z and finished 2026-11-04T07:24:03.713333Z, using clean tooling 21c62ecb6e515629b6eee69fa83c832dc2322a2f and frozen release source H = feb49025e28516f00377e3fe335e9276895f313b. The first attempt was runner-blocked by an unshared temporary directory before any cell; the retry used the shared workspace without changing source, tooling, Server identity or bounds.

Identity	Exact value
Package	durable-workflow 4.11.2, Cargo 1.86.0
Crate SHA-256, before and after cells	fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81
Package file set	86 files, SHA-256 f366b877576b92eff67b8cbfb5ed8d2006110046ad337b6c7423c2847449fc41
Approval-file SHA-256	422d5a3ca3346fd5ad21db45b1a035310b626be9bccaa235bf78ba6fcc15b214
Exact summary SHA-256	a38961e4c4b05e5fa14a8a63225c6fe9828111c348c1aeeacc1af055a92ee8b8
Server	3.0.5, revision bc24589db02161a21febbb30211309537fd1e24e, release tag 3.0.5
Server index	ghcr.io/durable-workflow/server@sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72
Executed arm64 manifest	ghcr.io/durable-workflow/server@sha256:24b1f5b3958a13974fb068630fbd6524442960040f60fa45dbeb9b0f5d90eef7
Rust image	rust@sha256:300ec56abce8cc9448ddea2172747d048ed902a3090e6b57babb2bf19f754081
Installed consumer binary SHA-256	17a83b55e292052699efbd27582d68019226ab247e92159b712591ee4e4f8b52

The harness packaged H, verified every member against its commit, installed only those archive bytes as a checksum-bound crates.io directory source, and built the consumer offline with two jobs. The lock checksum equals the crate SHA-256. Both per-major Server baselines and the legacy scalar passed. Server index/manifest content, labels and both cells' cluster versions matched.

• Lifecycle: pass. Typed activity/query/signal result, non-retryable typed activity failure, continue-as-new, run timeout, cancellation and post-timeout work completed with the expected durable histories. The same worker remained running and its binary was unchanged.
• Deadline: pass. Run and execution deadline reports were delayed three seconds. Each received exact HTTP 409 recorded=false / run_timed_out receipts; independent history checks passed and the same worker completed subsequent workflows. Its binary was unchanged.
• Cleanup: pass. The harness reports no errors or local/container/network leftovers. Independent queries find no sdk-rust containers or networks, and no fixture credential files, database or storage directories remain. All containers had the reviewed ownership, init, CPU/RAM/PID and capability bounds.

Reproduction uses the recorded harness commit with:

python3 scripts/acceptance/installed-native/run.py \
  --package-from <clean-release-source> \
  --package-commit feb49025e28516f00377e3fe335e9276895f313b \
  --expect-version 4.11.2 \
  --server-index sha256:3cb6e5bf8ec766ac2abd933369b40a77af62794b6d7b921ce21d3fb263e88b72 \
  --platform linux/arm64 --expect-server-version 3.0.5 \
  --expect-release-tag 3.0.5 \
  --expect-revision bc24589db02161a21febbb30211309537fd1e24e \
  --baselines required --container-prefix sdk-rust --jobs 2 \
  --work-dir <new-shared-output>

Local validation passed: the maintained release_package.py read both records as tracked regular blobs at this PR's HEAD, validated the full receipt and summary relationships, and verified the actual .crate against H with summary_verified=true. Both committed files match the emitted originals byte for byte. JSON parsing, secret/private-path review, public-boundary scan and git diff --check pass. Normal PR CI is pending.

After independent clearance and this PR's protected merge, the next separate stop is rereading H, approval on main and tag absence before creating an annotated tag at exactly H. Tag-object/target readback and protected publication remain later Security stops. This evidence covers the recorded arm64/native cells and does not claim broader cross-SDK or Cloud qualification.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact head 202cf714e760762d6f58bcf0b683a914e3511fc8 now has terminal green checks: 17 success and two expected skips, including the SonarCloud gate. CI, Sonar, public boundary.

Security review of this exact head and the installed-package evidence is requested before any approval merge. The records remain byte-identical to the passing run, the frozen release source remains feb49025e28516f00377e3fe335e9276895f313b, and no release tag or publication has occurred.

[rmcdaniel]

Security exact-head disposition: MERGE GO for 202cf714e760762d6f58bcf0b683a914e3511fc8 into exact base 21c62ecb6e515629b6eee69fa83c832dc2322a2f only.

Independent readback verified:

• the diff adds only two tracked regular 100644 blobs under release/approved-packages/; release approval records remain outside the crate include list
• approval record SHA-256: 422d5a3ca3346fd5ad21db45b1a035310b626be9bccaa235bf78ba6fcc15b214
• exact summary SHA-256: a38961e4c4b05e5fa14a8a63225c6fe9828111c348c1aeeacc1af055a92ee8b8
• frozen release source: feb49025e28516f00377e3fe335e9276895f313b, a descendant of exact clean tooling/main 21c62ecb6e515629b6eee69fa83c832dc2322a2f
• retained crate SHA-256: fbd4aeae15dc3ab0b677bf04fcdcc22b13e6cf18c93296e648172424b38d6d81; tag 4.11.2 remains absent
• the maintained release_package.py independently accepted the actual retained crate, frozen manifest/changelog, tracked approval record and exact summary with summary_verified=true, 86 files, Cargo 1.86.0, Server 3.0.5 arm64 index/manifest binding
• all 17 hosted checks pass; the two Server qualification jobs are the recorded intended skips
• git diff --check, tracked mode/path checks and public-boundary scan pass

General retains the independent merge decision. This is not tag or publication clearance. After an exact merge/readback, Security must reread approval on main, frozen H and tag absence before any annotated 4.11.2 tag. Crates.io publication and downstream updates remain later stops.

[rmcdaniel]

General MERGE GO for exact 202cf71 into 21c62ec. I independently reconciled the two-file-only diff, exact approval SHA256 422d5a3c...5b214, summary SHA256 a38961e4...ee8b8, frozen source feb4902, 86-file package identity, Server 3.0.5 arm64 binding, and both cells successful with independent histories, unchanged worker binaries and clean cleanup. All 17 checks pass with 2 intended skips. Security independently verified the actual crate with the maintained verifier; I did not duplicate that installed-package run. Repository approval-record merge only; 4.11.2 tag, release-source merge, publishing and downstream remain stopped pending post-merge Security reread.

[rmcdaniel]

Merged approved records at exact H202cf714 as a0a2bb2. Tree 0ef9524c50454e4614b614ec963c3dfeaf2a7022 equals the reviewed tree; H is a direct parent and first parent is exact cleared base21c62ecb. Separate Security post-merge reread of frozen release source feb4902, these main approval records and tag absence is now requested. No release-source merge, 4.11.2 tag, publish or downstream change has been performed by General.