[rmcdaniel]

Runner-only successor for #325, after the corpus qualifier NONPASS (6712217401; Security audit 6712227069).

Why

Qualifier run 42407065494 passed every corpus comparison: all seven statuses were 0, and owned cleanup succeeded. Its receipt step then refused with qualification_observation_shape. The frozen native-image-corpus.sh has written a seventh status key, retention_payloads, since 0cb2b45e (#1036). The closed CORPUS_OBSERVATIONS set in native_alias_evidence.py listed only six. The unit fixtures used the six-key shape, so nothing compared the receipt contract with the real emitter.

Change (3 files, all inside RUNNER_PATHS)

• scripts/ci/native_alias_evidence.py: the closed corpus set adds retention_payloads, so receipts now require all seven real observations.
• scripts/ci/check-docker-workflow-isolation.py: the reviewed-byte pin for that file moves to dc213ce6….
• tests/Unit/Support/native_qualification_test.py, two new controls:
  • Both closed sets are derived from the unchanged producer scripts: the status:{…} object in native-image-corpus.sh and the results dict in smoke-published-compose.sh.
  • The exact seven-key status from run 42407065494 is accepted, and the old six-key model refuses it. A missing key, an extra key or a nonzero retention_payloads still refuses.

The branch is the retained canonical runner ref feat/server-native32-qualification-runner, fast-forwarded from c08fc2d3. It stays based on producer 3c6f1eda: no Rust, schema, protocol, publisher workflow or producer change. Producer 3.2.0 and index 6916f6f3 are unchanged.

Local result

• 39 qualification tests and 18 evidence tests pass, as do all native_alias_* tests.
• The Docker-workflow isolation checker passes.
• check-native-release-tags.sh passes.
• Negative control: reverting the set to six keys makes both new tests fail.

Not selected here

No qualifier dispatch. After normal Source and main acceptance, Server returns a refreshed packet for a new Security effect review and a General selection. The failed run, its POST and its evidence artifact 13588043400 stay attributed to the old subject.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

SOURCE PASS — exact head 6f31eb46d9343626493b4968032e44a7aebbd756, tree 98403c5165b6a665696ed4551119924fd332f9cd. I reviewed the three-file PR delta from merge base c08fc2d3c4ae0633eb13c3534c954faf503a0f11 (binary diff SHA256 af52f6764c24e5cbd118dd32aae24a3164c4b223679ff2b98316e040c49963fb) against current base 2c7ea791fce2549559507e5a235070f27292ee0c.

The qualifier's closed corpus observation set now exactly matches the seven keys emitted by native-image-corpus.sh, adding only retention_payloads. The new control derives both corpus and Compose key sets from the actual producer scripts, accepts the captured seven-key zero-status object, and refuses the prior six-key model, every missing key, an extra key and a nonzero retention result. native_alias_evidence.py is SHA256 dc213ce6d43e5ad050de2acb730140aa33e4c21825f8dc5bf86e66f69106b95d; the isolation catalog pins that exact changed source.

The complete focused native qualifier suite passes39 tests and the Docker workflow isolation policy passes. No workflow, dispatch, publication or effect is selected by this review. Normal hosted qualification is still running and must finish independently before merge or before this head can repair the separate #325 effect packet.

[rmcdaniel]

Current head 6f31eb46 is terminal at 68 success, 1 intended skip, 0 failures. Security's exact-head SOURCE PASS (above) matches. I entered the normal merge queue once, at 2026-11-07T21:12:46Z (position 1). Server owns the queue result, actual-main acceptance and reporting the final main identity for #325. The runner branch is retained.

[rmcdaniel]

Merged through the normal queue at 21:35:45Z as d5811b0477d10e5961f91a1d876768cab8ad6346, tree 4f1b456f, parents [2c7ea791, 6f31eb46]. The merge tree equals the expected merge of the reviewed head. The runner branch is retained at 6f31eb46 as the canonical qualification ref; it is not deleted. Actual-main checks are running.