[rmcdaniel]

Critical PHP image correction

Part of #591. Merged as 7a02bbcec4d0f2c470d7556632da9f4d5d15b522 / whole 4dc7989c1fc74aec064573c838243109588617d6, identical to the qualified candidate below. Immutable tag 2.10.1 points to that merge. Protected Release run 39637101549 is FAILED: the cold ARM source build hit its 45-minute step limit while still compiling. No exact manifest was published, and later runtime/TLS/alias/chart verification was skipped. Trusted publication-tooling recovery #605 is qualified and merged at fb62c62a7; fresh protected Release 39654639711 is queued against the same immutable source. Published digests and installed acceptance remain pending. The separate fresh-main checks are not carried from the candidate.

This combines the PHP image correction with #585's cancellation fix for Server 2.10.1 / Helm 0.2.3. Workflow remains pinned to Core 2.9.0. No native/shared/frozen sources, schemas or protocol changes are introduced by the PHP correction.

Current source: 0cb1a153a7e4b52cf840e7952528370ec0d01151 / whole 4dc7989c1fc74aec064573c838243109588617d6, incorporating main 447bdbc57 and #585's efa0b178. PHP/application/Composer/release/chart bytes are unchanged from the signed-source component 5d8735c5; native/shared/differential-runner/OpenAPI bytes match that main. The Dockerfile matches the fully source-qualified 6a1adf11 component. Fresh whole-head qualification remains required.

• Build fixed PHP 8.3.36 from the signed upstream tarball on the immutable existing Apache foundation. Fixed tarball and public-keyring SHA-256 values plus the detached signature are verified. Configure options follow exact docker-library/php source f6048b5f. Replace the CLI, Apache module, libraries, headers and extension source, and require the actual executable to report the fixed 8.3 runtime before application installation.
• Disable session upload-progress tracking before request startup and replace unlimited POST sizing with a finite default that preserves the documented 64 MiB binary transport. Automatic POST parsing remains disabled and API JSON/binary limits remain authoritative.
• Document operator rollout/version checks, incomplete configuration reductions and immutable historical image identities.
• Include Preserve select member cancellation through worker HTTP validation #585's PHP completion-field validation and focused HTTP regressions unchanged. Its efa0b178 PHPUnit suite passes; none of those earlier results qualify this new image/tree. Publication remains held for the patched runtime.

Required before merge and publication

The official php:8.3.36-apache tag was still absent at 14:43 UTC. The current source therefore builds the signed PHP release directly instead of waiting for that tag or treating a changed environment variable as a runtime update. Its foundation is pinned to immutable manifest sha256:c59c808172ee3672cd334f8f2a5d7b1480a9d7273a368f412b8ee9b4ef418184.

The actual local build verifies both source checksums and the upstream release signature, compiles the Apache SAPI, installs libphp.so, and checks the real CLI reports 8.3.36. Required extensions and the complete production image also build successfully. The first two local builder attempts stopped before compilation because Docker Hub IPv4 connections timed out; the unchanged third attempt uses working IPv6 connectivity. No TLS verification is disabled.

Actual local runtime qualification

The signed-source 5d8735c5 component produces local production image sha256:120be6143fa78eea2874d3ce59fb98b832df40a5acfecd1224185da3fabb60ac on amd64. Its PHP/application bytes also match current fde90277; this is component evidence, not a carried whole-tree CI pass or a published image identity.

• Both CLI and the real Apache HTTP handler report 8.3.36. The HTTP handler is apache2handler, with POST/upload limits 64M, automatic parsing and session upload-progress disabled, and the original 128M PHP memory limit. CLI extensions load and Apache's module has no missing dynamic libraries.
• Bootstrap, readiness, authentication, a finite scheduler invocation and an empty queue-worker invocation pass. Two isolated API containers explicitly stop with SIGTERM, exit 0, no OOM.
• An official Core Avro encoder produces exactly 67,108,864 bytes. Real authenticated Apache upload and subsequent HTTP fetch preserve SHA-256 af34359a1e77a159a86ab2c2db943ea24887692f5039553d76c8c0e815feb9e2. JSON above 2 MiB and a declared binary size above 64 MiB return their respective typed 413 refusals. The first upload original lacked a configured namespace storage policy and correctly returned unavailable; a fresh API/database with explicit local policy qualifies the successful control.
• Normally installed PHP SDK 3.1.0 / 222e27eddc0915957ad513dcc3b2b2418f5eb959 completes default and named selection-cancellation originals under their unchanged 30-second budgets. Both return [9007199254740993, null, "λ"]. Independent stopped-state SQL shows eight tasks: six completed at attempt one, two cancelled activities never claimed; eighteen events, with one selection resolution/cancellation and one workflow completion per run, no activity started/completed/failed. The exact binary registry row matches the HTTP bytes/hash.
• The stopped database is fully checkpointed with no sidecars. Its initial plain read-only observer could not open that WAL-mode database on the read-only mount; an immutable read-only URI over the stopped copy completes the audit without changing the database hash. This is an observer correction, not a Server defect or an inspector acceptance.

The temporary HTTP version probe is added only to the isolated container, not to source or image layers. Earlier setup-command mistakes remain unsuccessful setup attempts. No multipart, S3, native, whole #878, production exploit or published-image acceptance is claimed.

Required proof: actual build/source qualification, CLI and Apache HTTP handler version/configuration, normal health/auth/worker behavior, exact-size binary transport and documented refusals, immutable published digests and installed acceptance. Configuration reductions alone do not close either CVE. New patch releases preserve all existing immutable tags; do not rebuild an old version tag in place.

The earlier borrowed PHP 8.3.35 image loads the proposed 64M POST/upload settings with automatic parsing and upload-progress disabled. The real executable check refuses that old binary even when its PHP_VERSION environment variable says 8.3.36. These remain isolated CLI configuration/negative controls. Their single-use tools are removed. The current owned compiler/build state is bounded and will be retired after qualification; there is no Cloud/provider action.

#585 is already merged and its implementation is included here. #583 and #591 remain open for their actual published-image and installed acceptance, including the separate compatible 2.9 security patch. Rust SDK 4.2.0 publication is independent. No Cloud source/deployment or production exploit probe is performed by this PR.

Original 209b771a PHP feature run 39617490616 fails before tests because php:8.3.36-apache is not found; its actual build error was read. Early optional replay/query topology stops at "Build current server image"; both memo-rolling cells fail inside "Exercise interrupted migration and mixed revisions". Their exact errors remain unread, so no runtime/root-cause attribution follows. Chart validation also fails with exact error still unestablished. Those failures stay recorded. Redundant optional performance/memo/topology cohorts are cancelled separately; they are not required branch gates. No result transfers across heads.

Exact analyzer and hosted follow-through

On fde90277, Sonar correctly identifies two source-download commands that permit a redirect away from HTTPS. 404ac64d restricts both initial and redirected protocols to HTTPS. Its four maintainability findings are addressed with digest-only image references, an explicit list matching the pinned base's nine PHP build dependencies, and a readable multiline executable guard. Exact 404 workflow and app gate pass; all six issues are explicitly CLOSED/FIXED in the API. Its new package-sort finding is addressed by sorting the same dependency list in the current required main integration. Exact 6a1adf11 workflow 39629531272 and the app gate now pass; the public API returns zero OPEN/CONFIRMED PR issues at 16:03 UTC. No suppression, profile or quality threshold changes.

The same Dockerfile follow-through removes compiler source/object files after installation; the verified source archive remains available for final extension builds. The earlier local runtime results remain attributed to their exact component.

The actual fde PHP job 119307698615 / run 39624673622 exits 125 before PHP tests, after successfully building the patched base: the PostgreSQL mirror returns toomanyrequests / Artifact Registry quota exceeded while pulling the unchanged pinned digest. Its original failure is retained. It is not a PHP assertion, a proved runtime regression or a resolved observation. Fresh current-source normal PHP, Sonar, Helm and boundary checks are required before merge/publication; fixtures, package references and test budgets are unchanged.

Exact 6a1adf11 completes normal PHP, Helm, Sonar, repository and boundary qualification. Main then advances through #595 to 447bdbc57; the ancestry-only 0cb1a153 integration keeps all PHP/image/release bytes unchanged. Its required PHP feature suite, repository contracts, central policy, Sonar workflow/app, Helm lint/kind and boundaries pass. The queued Feature source qualification aggregate contains only checks that its two dependencies succeeded; both dependencies passed. The critical security publication started from this exact tested whole tree after protected merge. Own optional performance/memo/topology cancellations remain terminal, with the optional performance aggregate failure retained.

Fresh-main PHP 39636390645 passes independently. Release 39637101549 failed at the cold build limit; qualified and merged #605 starts fresh protected recovery 39654639711, currently queued. Actual published image versions, digests, source-free readiness, TLS and installed SDK acceptance must finish before delivery is claimed. Historical failures remain failed. The completed merge-order request creates no continuing hold.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The separate protected chart job 119474973708 now passes, and Release 39654639711 is SUCCESS in full. This supplements the already recorded image/SDK acceptance; it does not transfer those results to any later source.

An independent anonymous OCI pull verifies chart 0.2.3 / Server 2.10.1, with manifest digest sha256:ffdb9b8699fae5ffbc9a6723771b38f41dede2940340965605641948eb5e073e and content-layer SHA-256 8392a082c368c02ce2120f86ba08c42c2082cbfa8a3ef9b4dbb1e918df9dd45d. The published package is at oci://ghcr.io/durable-workflow/charts/durable-workflow.

Its source annotation d055dc55 is intentional: the documented chart contract and publisher select the last commit that changed packaged chart files. Those files match the immutable Server 2.10.1 tag exactly; git diff d055dc55 2.10.1 -- k8s/helm/durable-workflow is empty. The annotation records chart provenance. The image's independent source identity remains 7a02bbce and its qualified digest remains 4a1819ec.

Both release notes and #591's current description are updated. The earlier cold-build failure and historical queued-chart checkpoints remain their original observations. This concludes the separate chart publication; Server 2.11 / Helm 0.3 activity-lease delivery is still independently qualifying.