Replace PHP Server with a compatible Rust runtime and safe in-place upgrade

Current delivery — November 9, 2026

Native 3.3.2 is released and Latest. Final cross-repository delivery receipt.

Release source/tag: 660217dd1ac62701eb1fc26b08fbbaf825e777d1. Published index: sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912 in both registries. Exact3.3.2 and rolling3.3/3/latest resolve to that index; exact3.3.0/3.3.1 remain intact.
Native: write a run of local activity records with one statement per table #1068 and Native: read workflow descriptions from one bounded coherent snapshot #1075 are completed: bounded ordered local-record batching and one-connection coherent workflow descriptions, including MySQL/MariaDB READ COMMITTED controls. Source/backend/main checks and all CodeQL languages passed. Earlier source/download NONPASSs remain attributed; original WIP refs are preserved.
Publication42591612884/a1, both architectures'3backend smokes/provenance, protected corpus42602023810 and four-cell Compose42602031026, default-resolution42600498794 and published PHP42600504863 are accepted. No build, qualifier, cancel or report duty remains live.
Subject-only runner#1114 is retained at b7337c1f91c3bc2eea0baaa9d41930220051386f, contained in current signed main 5bde7ed3. The fixed runner branch must remain; it is exactly one subject-only commit ahead of the release source.
Sample App#334 has signed main 98e8b49d,36source/30main successful checks, all9published runtime surfaces and all9language combinations. Developer image42610919065 passed7/7; both public registries serve sha256:c6eceb459ad78391ce9b82a45daa62ed665f0ae6ca19f0255802a79a7308acfc, and both embedded tuples match Git. Its completed source topic is absent; local/WIP refs remain.
Alias42612524622/a1 and GitHub Release42613125047/a1 are accepted. Release439079426 has the reviewed full notes and correct Latest designation. Native GitHub Releases should include tagged notes and recognize the complete body #1111 remains the source fix for full-note generation/idempotence; this delivery used one guarded body-only note augmentation and did not rerun the old writer.
SDK3.11.0 is already published with Prepare Server 2.4.26 and Helm chart 0.1.122 #269 installed acceptance. These internal Server changes need no unchanged SDK release. Schema/protocol1.20/capabilities and documented rollback constraints remain unchanged. No benchmark speedup or Cloud adoption is claimed.

Six Native P0s remain open: #1063(partial), #1074 and #1076(isolated measurement reconciliation of code already present since3.2.0), #1077, #1078 and #1079. sdk-php#341 depends on the accepted #1078 producer contract and a later SDK release. No supported date covers that whole remaining backlog. General owns the next source/measurement slices; Cloud runtime/security work and #1111 retain their separate owning records.

Objective

Replace the PHP/Apache Durable Workflow Server with a faster Rust successor in
this repository. Existing published SDKs, CLI, Waterline and sample applications
must work unchanged. Operators experience a major version upgrade of the same
product, with the same API, behavior, data and operational surfaces.

The PHP Server remains working as a reference throughout development. The
embedded Laravel Workflow package remains a first-class product. This is accepted
implementation work assigned to a dedicated maintainer, not a new architecture
comparison or a claim that Rust is already faster.

Constraints

Repository and delivery

No new repositories. Rust lives in durable-workflow/server.
Land small, coherent PRs on main frequently. Do not accumulate the rewrite
on a long-lived branch or break the PHP Server while landing foundations.
Keep a running, contributor-readable log in this repository with the current
plan, significant design decisions, verified outcomes, filed issues, the
fixture cases they block and the next concrete action.
Choose the architecture and established Rust libraries with engineering
judgment. Explain significant choices briefly and link the proving fixtures.
Follow ordinary review, CI, release and branch-cleanup rules.

Contract, parity and embedded mode

Published specifications and shared fixtures define observable behavior.
Neither implementation wins by default. When they disagree, settle the
contract first, then correct whichever implementation is wrong.
Establish a shared fixture corpus, recorder and differential runner that can
target a server URL. Reuse existing protocol specifications, conformance
scenarios and benchmark tooling rather than creating a second software factory.
Run the shared fixtures against embedded Laravel, PHP Server and Rust Server.
Workflow package changes also remain tested against a real HTTP Server.
Default to parity for existing and new observable capabilities. Define the
contract and fixtures first, implement a feature in both servers (including
necessary Workflow package changes), and pass the same fixtures on both.
A simple, slower PHP implementation is acceptable.
Internal scheduling, sharding and pooling mechanics without an observable
contract need no PHP counterpart.
If an observable capability cannot reasonably exist in PHP, advertise an
explicit capability flag, mark its fixtures Rust-only and record why.
Do not disguise incomplete parity as an internal optimization.
Preserve the existing Avro payload protocol, errors, authentication and
authorization, namespaces, durable identities and history, worker leases and
fencing, retries, cancellation, timers, schedules, visibility and recovery.
Execute the required PHP/Python/Rust worker directions, rather than assuming
an HTTP schema comparison proves them.

Database isolation and one-way upgrade

Support SQLite, MariaDB/MySQL and PostgreSQL using the current database tables
and stored data. Rust owns its versioned forward migrations.
Ordinary development and differential runs use separate isolated databases
for PHP, Rust and embedded targets. Never run different implementations
concurrently against one database.
The only cross-implementation shared-database exception is the dedicated
sequential upgrade test: PHP writes and stops, then Rust takes over that
same database. Multi-node replicas are tested within their own isolated
deployment, not against another implementation's state.
Upgrade existing deployments in place. HTTP export/import remains a way to
move data between deployments, not the upgrade route.
Require a backup before mutation and stop the PHP fleet before takeover.
Make interruption resume safely or fail without corrupting state.
Record a schema marker. All affected PHP startup/worker/bootstrap paths must
refuse an upgraded database before migration or durable writes can occur.
There is no PHP rollback after upgrade and no mixed PHP/Rust fleet.
Rust migrations need not preserve post-upgrade PHP schema compatibility.
The PHP reference continues to work against its own non-upgraded database.
Inventory stored PHP-serialized values, class names and framework conventions.
Handle each with a read-compatibility path or documented one-time conversion.
Do not silently discard data that Rust cannot interpret.
Preserve acknowledged work, durable history, pending workflows, timers,
leases, credentials and external payload references/bytes across takeover.

Operations and performance

Preserve existing image names, supported image architectures, DW_*
configuration, health/readiness, bootstrap, Compose and Helm layouts, metrics,
diagnostics, graceful shutdown and recovery.
Document a migration path for anything that cannot carry over directly,
such as a PHP authentication-provider class.
Record a reproducible PHP baseline before judging Rust. Use exact published
artifacts, workloads, hardware, resource limits, commands and raw results.
Rust must meet or beat PHP throughput, memory and idle long-poll cost.
Verify timers and lease renewals remain healthy during CPU-heavy load.
Do not accept apparent gains from lost work, backlog, swapping or an
unmeasured drain. Repeat promising measurements and recheck baseline drift.
Do not change customer pricing, Cloud production or managed rollout as part
of the Server rewrite. Exact Rust artifacts need their own Cloud qualification.

Work order

Establish the safety net: current contract inventory, shared fixtures,
recorder, URL-targeted runner, meaningful embedded/HTTP coverage and
reproducible PHP baseline.
Land the Rust foundations and vertical slices in small reviewed merges,
keeping PHP operational.
Run the differential suite after every change. Record intentional contract
decisions and convert every defect into a focused shared regression.
Complete all capabilities and actual SDK/worker directions, database and
multi-node qualification, performance proof and operational compatibility.
Finish migration tooling, backup-first upgrade tests, operator documentation
and major-version cutover preparation. Release through the repository's
existing decision and publication process, then verify published artifacts.

Acceptance

Ownership

A dedicated Rust Server maintainer owns this issue and its scoped implementation,
tests and cutover preparation. Coordinate necessary cross-repository contract
and Workflow changes through linked owning records. Other maintainers should
avoid competing implementation of this rewrite while that assignment is active.

The first safety-net slice is in #326, with the public running log, capability inventory and frozen published tuple. The default PHP artifact remains unchanged; no Rust runtime or performance improvement is claimed.

At source 8182ad8b5df8a8266f52e0a368fb3abea53a19e9, three reviewed cases run through actual PHP SDK workers and real embedded Laravel database queue jobs on independent SQLite files: typed echo, an exact int64 beyond JSON number precision, and one external activity. The recorder checks completed work, the complete expected event inventory, history pagination, deadline budgets, registered types, decoded values/types and start/run/activity/attempt relationships. The differential comparison anchors to current fixture hashes and rechecks observations; matching partial recordings and saved pass labels cannot qualify a run. There are 25 focused comparator checks.

Hosted fixture qualification passed and retains both records and comparison for 90 days. Repository contracts and boundary checks passed; the full PHP feature suite is still running. This is bounded correctness evidence, not a full three-runtime/database or performance qualification.

Next action after the first merge: establish a current reproducible PHP baseline with the existing capacity workload and commands. The current standard launcher freezes older packages and a Linux 6.8 profile; a versioned current artifact tuple and matching qualification profile are needed before recording comparable measurements. Keep workload/admission/completion/drain rules intact. Also complete the representation audit: Laravel queue payloads serialize PHP job objects, and internal async payloads can contain signed serialized closures inside Avro binary values. Avro-only wire transport does not by itself make those representations Rust-readable. Upgrade fixtures must exercise explicit tested compatibility/conversion or safe preflight refusal, without discarding acknowledged work.

All unproven #325 acceptance items remain open, including full SDK/consumer directions, all database families, multi-node interruption, Rust throughput/memory/idle long polls, in-place takeover, schema-marker refusal, operator cutover, publication and downstream verification. Rust development will record target-directory size and clean/incremental compile time and use bounded task-owned build state.

The fixture foundation is merged in #326 at ed49098b3db6b43827c9d90ba9b38f0104f2342d. Three shared cases pass on the pinned published PHP image and embedded Workflow through real SDK worker and Laravel queue execution; all 25 comparator counterexamples pass. Fixture qualification and full feature/source qualification passed at the exact PR head. Merged branch deletion is verified.

Next is the PHP baseline: the existing capacity 1.9.0 tuple pins Server 2.1.1 and the standard local profile requires a different kernel. I will preserve those historical inputs and add a versioned current-artifact input/profile through the existing capacity commands, retaining their offered-load, completion, full-window and drain rules. Throughput, memory and idle mixed long-poll measurements remain unrecorded; Rust implementation and all remaining #325 gates stay open.

The pinned PHP measurement profile merged in #327 after all source checks passed. Three 120-second windows at 0.25 offered starts/s each completed and verified all 30 planned workflows with zero pending work or poll/result/history errors. Higher-rate repetitions and the following drift control are running; no maximum-capacity result or Rust improvement is claimed.

Three mixed-idle repetitions each at 6, 12 and 24 polls completed with clean worker deregistration, no claimed tasks and no runtime OOM/restarts. Outcomes were consistently 6 empty; 8 empty/4 explicit capacity rejections; and 8 empty/16 rejections, respectively. Query waits lasted about five seconds despite requesting ten. All 24-poll bursts produced at least one two-second health/readiness timeout; an Apache worker-limit warning was observed. The failed API headroom observations are retained, rather than treating admission correctness as a complete pass. Changed background workload also requires a matched-condition PHP/Rust resampling before any performance gain claim.

Draft #328 records these bounded results and a stored-representation audit checkpoint. Avro transport does not remove PHP-specific queue jobs, signed serialized closures, encrypted history cursors or local class execution. Their compatibility/conversion, backup-first migration, schema marker and PHP refusal tests remain explicit open gates.

Next: finish offered-rate/drift observations, retain their complete limits and failed evidence, remove the reference experiment resources, then implement the first Rust slice without changing the default PHP artifact.

The PHP development reference is complete, with bounded results in #328. Three 120-second windows at each of 0.25 and 0.5 offered starts/s completed and verified every workflow in-window. At 1/s, only 48–51 of 120 completed in-window before the remainder drained; this does not establish sustained 1/s throughput. The original second high-rate run's configured hourly worker exit invalidated its resource comparison. Its raw result remains retained, together with the replacement's one readiness 503.

All three 24-poll registration bursts produced ordinary API timeouts. Smaller mixed-poll runs passed admission and API checks; every registration was cleaned up. All 810 offered workflows, including the invalid resource sample and two following drift windows, completed and verified. Final synthetic counts were 846 completed runs including setup, 2530 completed tasks, zero failed jobs and zero idle registrations. Input identities, failures and sampling limits are retained; disposable experiment resources and dependencies are removed.

The result is diagnostic: changing background workload, admission sampling gaps, incomplete client resource costs and the development host's different capacity topology still require a matched PHP/Rust comparison and full qualification. Stored PHP jobs/closures, cursors and local execution also remain explicit conversion/compatibility gates in the audit. Next: merge the exact-head-qualified report, then add the first Rust slice with clean/incremental build-time and physical disk measurements. PHP remains the published default.

#329 merged the first unpublished Rust foundation at d684f2ff1a85c1aa49b7febd877139bf2db631ab. All final-head source checks passed, including the PHP feature suite, four Rust codec tests, 15 two-way PHP/Rust codec cases and the real PHP/embedded workflow fixtures. Fixture evidence is retained for 90 days. No Rust HTTP workflow, migration, runtime gain or cutover is qualified yet.

The build observations keep the tradeoff explicit: native clean builds around 22 seconds/182 MiB; native no-op/comment edits 0.063/0.374 seconds; Kache fresh-target reconstruction 3.462 seconds, with slower cold builds and added cache/target disk. It remains optional. Build/cache/download state, task tool images, Kache sandbox, clean worktree and merged local/remote branch are removed; thin receipts remain.

Next: add the HTTP/storage slice with honest readiness and safe upgraded-database boundaries. Full malformed-input/resource qualification precedes exposing payload decode at HTTP ingress. The complete capability/client/database/performance/one-way-upgrade gates remain under #325; PHP stays the published default.

PR #330 merged as d2feae2a54c3630271e1d4e5217740f09031d2d6. It adds an explicitly experimental Rust HTTP/SQLite runtime that starts real workflows, leases workflow/activity tasks, persists typed history and opaque Avro envelopes, fences stale attempts, and commits/replays completion through the unchanged published PHP SDK.

The three reviewed fixtures match across isolated published PHP, Rust and embedded Laravel targets. The final-head shared Action also passes four codec tests, seven transaction/HTTP tests, 15 two-way codec values and a real SIGKILL/replacement-container check: the persisted activity lease expires, the old attempt is refused, and a fresh SDK worker completes attempt two with one committed result and the original identities/history. The complete PHP feature/source qualification, repository contracts and public-boundary checks pass.

Bounded compile measurements at two CPUs/2 GiB: a clean test/binary build took 54.65 s, with 521.4 MiB of targets plus 202.6 MiB of downloads; binary-only no-op/comment edit took 0.16/1.51 s. Inputs, exclusions and cache growth are in rust/runtime-build-observations-2026-10-09.md. This is a development observation, not a full-runtime or performance acceptance claim. Disposable resources and the merged worktree/branch have been removed.

PHP remains the published default; native Rust development databases do not qualify for PHP takeover. Next: enforce PHP refusal before any upgraded-database mutation, then extend the native schema and backup-first sequential migration foundation. MySQL/PostgreSQL, the remaining API/client/capability surface, strict ingress/external payloads, full recovery/CPU-load/performance qualification and published artifacts remain open. #325 stays active.

General selects one fresh full native-release invocation for3.3.2 at unchanged M332660217dd1ac62701eb1fc26b08fbbaf825e777d1. Attempt1 is terminal NONPASS and index publication was skipped. Both version tags remain404; the Git tag, current main and release workflow blob97b4088a are unchanged. Exact failed-parent bytes are reverified and fresh mirror availability is positive.

Rebuild and smoke both architectures, then verify and attest the newly produced index through the same protected publisher. No selective receipt reuse, source/digest substitution or tag movement. One invocation, no automatic retry. Report within110minutes, with one exact cancel only if this run is still live then. Published corpus/Compose/default/PHP/affected-consumer acceptance and alias/Release effects remain subsequent gates.

Native3.3.2 publication custody accepted: 42591612884/a1, exact tag3.3.2/source660217dd1ac62701eb1fc26b08fbbaf825e777d1, all4jobs success. Report duty is closed; no cancellation or retry of this invocation.

Both registries independently return byte-identical647B OCI indexes: body SHA256 = Docker-Content-Digest = sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. Children: amd6475287c71…768c9a, arm64af908795…ed3218. The complete smoke artifact ZIPs match their API digests; each exact child passed SQLite/PostgreSQL/MySQL readiness and3.3.2identity, authentication refusal, nonroot config and clean SIGTERM exit.

GitHub CLI cryptographically verified both SLSAv1 attestations against the actual index bytes, exact repo/workflow, source+signer digest, refs/tags/3.3.2 and hosted-runner requirement. Both certificates bind invocation42591612884/attempts/1 and the expected GHCR/Hub subjects, with Rekor timestamps09:22:59/09:23:04UTC. Attempt1/42590134500 remains NONPASS; no tag/source/pin moved.

This is accepted version-image publication, not final stable acceptance. Next: one subject-only runner refresh on M332, normal PR/queue/main custody, then exact-index corpus/Compose plus default/PHP/affected-consumer follow-through. Aliases and GitHub Release remain3.3.1. No SDK or Cloud adoption is implied.

General reviewed the3.3.2 subject-only runner refresh: b7337c1f91c3bc2eea0baaa9d41930220051386f/treee10968b996fccbd745051fc685f816580a4b4b96, sole parent M332660217dd1ac62701eb1fc26b08fbbaf825e777d1. Diff2,057B/SHA256be6abf62ca87c95a956779ef535cfafa435b208c0e4313f888fe9bcc047e6756. Subject902B/SHA256adb680049076844aafaee941815e722864a9fa564f2ad72081ea23c004304ad1. Only release.tag/source/run/attempt/index change to the accepted42591612884/a1 publication at4aeceb42; MySQL, QEMU, schema and the other12runner-path blobs are unchanged. Canonical JSON and exact file/parent checks pass.

Advance the fixed runner ref once by fast-forward, leased on4c5ec8ad, and open one ordinary draft source train. After green source checks, queue a merge so this tip becomes an ancestor of main; retain the runner branch. Qualification dispatch and alias/Release effects remain subsequent. The initial local static reader refused an AST named constant before any commit/push; explicit constant resolution completed the same source check, with no product code change.

Bind qualification runner to the Native 3.3.2 publication

General selects one no-input Published Compose dispatch at immutable3.3.2/M332660217dd. The exact index4aeceb42…debf912 is publication/provenance accepted; M332 actual-main custody already passed before publication. Runner-refresh main checks are separate and still owed before promotion-eligible qualification.

Run published-compose.yml on ref3.3.2 with no server_image input. Require all4amd64/arm64 ×local/production cells to log "Smoking the Compose default durableworkflow/server:3.3.2.", resolve the published3.3.2 digest and pass smoke/cleanup with no fallback. This deliberately nonpromotion ref proves default resolution, not an eligible receipt. Workflow-pinned MySQL/QEMU and35min job bounds unchanged. One dispatch/attempt; report byT0+45min. Any missing cell/404/identity/cleanup failure is NONPASS. No retry, input change, alias, GitHub Release or Cloud effect. Hosted evidence14days, localbulk through acceptance/20:30review.

General selects one published PHP acceptance run for Native3.3.2 on immutable ref3.3.2/M332660217dd, image durableworkflow/server@sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. Publication/provenance and original M332 actual-main custody accepted. Runner-refresh main checks remain a separate gate for protected qualification.

published-workflow-lifecycle.yml experimentphp-replay-conditions. All non-Server inputs remain byte-equal to accepted3.3.1 acceptance: normal Packagist SDK3.11.0, tooling535e111a, Workflow2.22.0, Python2.14.1, Rust4.12.0, CLI2.3.3, Waterline2.13.2 and workflow-pinned MySQL679e7e92. This run executes PHP; other declared SDK inputs are not non-PHP coverage claims. No product source overlay.

Require all13original replay scenarios with0skips;7installed C1–C5reports/9fresh Native exports, original C2activity/signal ordering andCANlineage, read-only physical MySQL inventory/predicates0violations, package/image identities, exporter lint andcleanup=0. Keep the previously accepted3.3.0/#269 and3.3.1 evidence separate. Same60min job bound, report byT0+70min; one dispatch/attempt,no retry or input change. Setup/predicate/evidence/cleanup failure staysNONPASS. Hosted evidence30days; localraw until currentcomparison/20:30review. No alias/GitHubRelease/Cloud effect.

Native3.3.2 no-input Compose default resolution: PASS in all4amd64/arm64 ×local/production cells, run42600498794/attempt1 on exact tag3.3.2/M332. Each complete captured job log records "Smoking the Compose default durableworkflow/server:3.3.2." and smokePASS; no unpublished fallback. Selector/body/strict cleanup/finalize steps all succeed. Nonpromotion context is intentional; this supplies no eligible promotion receipt and does not replace the protected exact-digest dispatch after runner main checks. Complete logs/hashes retained, original attempt only; report duty resolved.

Native3.3.2 published PHP acceptance: PASS, run42600504863/attempt1 on immutable3.3.2/M332, SDK3.11.0 from normal published distribution (Qfbc64ef9), exact image4aeceb42…debf912. Complete artifact13664639392 ZIP194609B/SHA256c8848983f31122e863b14dc98bdc613c0f7ebeaace0a6d9de8840ecdf71780bf verified;77safe members/1921809expanded bytes captured as data.

All13original replay scenarios execute with0skips, unchanged SDK distribution/tooling and separate client/worker/restart processes.7C1–C5installed reports bind9fresh Native exports with contiguous unique event sequences, occurrence policy/budgets/anchor preservation, timer bijection, C2activity→noise→completion→open ordering andCANlineage. Exact read-only physical MySQL predicates match the prior qualified SQL after replacing only fresh namespace/run IDs;0rows/violations, exporter lintPASS,cleanup=0. Source/tag/run labels and full image identity match3.3.2 publication. No product-source overlay or non-PHP execution claim.

This is a new3.3.2 release cell, not a benchmark or production rollback result; #269 remains completed on its earlier accepted tuple. Report duty resolved. Protected exact-digest corpus/Compose acceptance and SampleApp follow-through remain owed before final delivery. No alias or GitHubRelease mutation.

General selects two original protected published-image qualification runs for Native3.3.2, following PR1114 actual-main custody acceptance.

Bound release: tag3.3.2/source660217dd1ac62701eb1fc26b08fbbaf825e777d1, native-release42591612884/attempt1, indexsha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. Bothregistry indexes/platformsmokes/SLSAprovenance accepted. First publication NONPASS stays attributed. Immutable-tag default4/4 and publishedPHP13scenarios/9exports/0SQLviolations pass.

Fixed runner feat/server-native32-qualification-runner=b7337c1f91c3bc2eea0baaa9d41930220051386f; subject04630e4d/902B/SHA256adb680049076844aafaee941815e722864a9fa564f2ad72081ea23c004304ad1. Signedmain5bde7ed3 contains it; exactly1commit/subject-only ahead ofreleaseM332. Other12runner blobs/MySQL62fb722c/QEMU465d3fdd unchanged. Main31checks=21success/10intendedskips,0statuses;8successful originalruns plus1source-condition controller skip, all4CodeQLlanguages pass. No separate mainaggregate is invented.

One native-image-parity.yml dispatch on the fixedrunner with native_image=ghcr.io/durable-workflow/server@sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. Require eligible admission, fullSQLite/amd64 corpus against frozen publishedPHP and embedded references, all declared exits0/comparisonsPASS, exact identity, eligible receipt and exactowned cleanup. Existing75min jobbound; reportbyT0+90min.

One published-compose.yml dispatch on that same runner with server_image equal to the same exactGHCRdigest. Require eligible admission and all4amd64/arm64×local/production cells, exact image/dependency/config identities, smoke/cleanup and4eligible receipts. Existing35min jobbounds; reportbyT0+45min.

Re-read this selection and fresh refs/tag/subject/main terminal custody before each effect; require no prior dispatch at thishead and no active prior fixed-ref role. Refuse drift. Independent normal hosted resources; one attempt each, no retry/cancellation/input change/source overlay. Failed/missing gates stay NONPASS. Hosted evidence14days; localraw through currentcomparison/20:30review. Combined read-only promotion verifier must pass before separately selected alias/GitHubRelease writers. SampleApp source/runtime/image follow-through remains separate; its local332tuple is still unpushed. No Cloud effect.

Native3.3.2 protected exact-digest Compose: PASS, run42602031026/attempt1 on fixedrunnerb7337c1f. All4amd64/arm64×local/production cells have eligiblev2receipts. Reviewed qualification_receipts verifier independently binds actual Action run/jobs/steps/artifact digests, source/subject/workflow blobs, exact published index4aeceb42 and platform config/manifest identities, pinnedMySQL/QEMU, observations and0owned-container/network/volume cleanup. Source-only/PR/default receipts are not substituted. Full4receipts/ZIPs retained and report duty resolved. Combined corpus/Compose verification remains owed while corpus42602023810 runs. No alias/GitHubRelease or SampleApp publication yet.

Native3.3.2 full published-artifact qualification accepted. Corpus42602023810/attempt1 on fixedrunnerb7337c1f is terminalSUCCESS, with all7declared observations exit0, all5three-reference comparisonsPASS and exactowned cleanup0containers/networks/volumes. Full report ZIP13666758916/5461067B/SHA2565045ab2e8c3632569de914d7633134c9dec7986ffa70983ce21bc4983a8fdd29 and eligible receipt13666374930/942B/SHA256caeee7ef04b241a26bf028d9b912814eb1dd732d3c80f68b62153d716cf03be2 are verified.

The exact released read-only native_alias_evidence.verify also accepts the combined manifest: source/tag/native-release42591612884a1/SLSA/registry subjects, runner/902Bsubject/main containment, immutableworkflow blobs, all5eligible receipt artifacts,4Compose cells and finalmutable artifact/run re-reads. Promotion evidenceSHA2560a7f12279b594c38b1d7de2848fbb9d5cc8827d72bcd386c2fbae2519fbedcd7. No alias/release/image mutation occurred in verification.

Independent immutable-tag Compose default4/4 and publishedPHP13scenarios/0skips,7C1–C5reports/9fresh Native exports/0SQLviolations/cleanup0 are already accepted. The sameSDK3.11.0 distribution is used. Source-only and PR results are not substituted. This clears the exact-image prerequisite for SampleApp’s separate332tuple source/runtime/image train. Aliases/GitHubRelease and deliveredissueclosure remain after affected-consumer follow-through. Original publication failure and all earlier NONPASSs stay attributed; no benchmark speedup claimed.

General accepts the prepared SampleApp332tuple source and selects one must-be-absent push/draftPR normalCI train. Head2f4894854d211b2e01dd6c8a76692eee9655643b, tree89d3a8db, soleparentcurrentmain49e96367;859Bdelta/SHA256787d5c0c16e276b8ff8ea9e6b2c4896f6b91c2e9a460fa648e1e66507b70e720. One file changes only Server version3.3.1→3.3.2 and image775e83d5→4aeceb42. SDKs/Workflow/CLI/Waterline unchanged.

Native332 publication/provenance, immutabledefault4/4, installedPHP13scenarios/9exports/SQL0, protectedcorpus and4eligibleCompose receipts, combinedreadonly verifier allPASS. This is the affectedconsumer follow-through. Fresh guards: exactcleanworktree/base/head/tree/diff, remoteabsent,0duplicatePRs and0secretscanhits. Push with must-be-absent lease, draftPR, normalCI originalattempt. No mainmerge, runtime dispatch or image publication selected now. Devcontainer publication is workflow_dispatch-only and remains separate. Preserve operatorWIPs; no SDKtoolchain/hostpackage installs. Return terminalsourcechecks before ready/integration.

Required Native3.3.2 consumer follow-through is complete: Sample App#334 has accepted signed main custody, all9published runtime surfaces, and the rebuilt/published developer image. Both architectures' embedded tuples match Git. Publication/provenance, published PHP replay/condition waits, no-input default Compose and the eligible exact-digest corpus/four-cell Compose receipts are accepted. These are compatibility and contract checks, not a reproduced workload benchmark.

General selects one Native3.3.2 alias promotion through native-alias-promotion.yml, ref 3.3.2, source 660217dd1ac62701eb1fc26b08fbbaf825e777d1. The fresh read-only combined verifier passed; exact1,676-byte v2 evidence SHA256 is 0a7f12279b594c38b1d7de2848fbb9d5cc8827d72bcd386c2fbae2519fbedcd7.

Only applicable 3.3, 3 and latest aliases in GHCR/Docker Hub may move toward qualified index sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. Exact version tags and Git source stay unchanged; newer aliases must not move backward. The protected workflow repeats publication, current-attempt artifact, provenance, subject/runner ancestry and cleanup verification under its normal environment/rolling-alias lock. No check or policy waiver.

Guards: current main 5bde7ed3d428cfa5eaf2038bb8cf4a12079f848c contains M, runner b7337c1f91c3bc2eea0baaa9d41930220051386f, no active alias publisher, no prior invocation on M and no GitHub Release3.3.2. The five selected qualification artifacts are current and unexpired. One dispatch, no retry/rollback. Cross-registry writes are not atomic; partial/unknown is NONPASS. Report byT0+40minutes, keep any live state explicit and do not cancel. GitHub Release creation remains a later effect after independent alias readback. No build, image acquisition or Cloud production effect.

{"compose":{"cells":[{"artifact_digest":"sha256:f2a82bbd24ca141d951d8c78b0c4dd5c9ac44d6a4f4cda3ea196bdca970ea59c","artifact_id":13666785683,"job_id":129108598809,"platform":"linux/arm64","profile":"local"},{"artifact_digest":"sha256:23d12f16bb3b1da917250eb57cbe31b4f7c9306ca963c412f6fbba39575fb98e","artifact_id":13666406544,"job_id":129108598832,"platform":"linux/arm64","profile":"production"},{"artifact_digest":"sha256:85269c6acebbbaab46d0d0752fd6fb06bcc9c2955314c0ddd752d2f82f712bd4","artifact_id":13666182152,"job_id":129108598620,"platform":"linux/amd64","profile":"local"},{"artifact_digest":"sha256:edc61d4fdcbf506c102016f21330a231c485c4442894b767f3463bcd2fe156da","artifact_id":13665549808,"job_id":129108599019,"platform":"linux/amd64","profile":"production"}],"run_attempt":1,"run_id":42602031026,"runner_commit":"b7337c1f91c3bc2eea0baaa9d41930220051386f","workflow_blob":"09082357d57e7c95746d2f815715bb91414cf112"},"corpus":{"artifact_digest":"sha256:caeee7ef04b241a26bf028d9b912814eb1dd732d3c80f68b62153d716cf03be2","artifact_id":13666374930,"run_attempt":1,"run_id":42602023810,"runner_commit":"b7337c1f91c3bc2eea0baaa9d41930220051386f","workflow_blob":"6d20b7a52ffd7c4330499008d9192054074f6ee7"},"release":{"index_digest":"sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912","run_attempt":1,"run_id":42591612884,"source_commit":"660217dd1ac62701eb1fc26b08fbbaf825e777d1","tag":"3.3.2"},"runner":{"ref":"refs/heads/feat/server-native32-qualification-runner","source_commit":"b7337c1f91c3bc2eea0baaa9d41930220051386f","subject_blob":"04630e4d7ce4cb3c36d58aae87789446a02f823e"},"schema":"durable-workflow.native-alias-promotion-evidence.v2"}

Native3.3.2 alias custody is accepted: 42612524622/a1, all3jobs successful. Independent anonymous readback verifies 3.3.2, 3.3, 3 and latest in both registries at sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912. Both647-byte indexes match exactly, including header/body digests. Exact3.3.0 and3.3.1 tags retain their prior indexes. No retry/rollback. Sample App source/main/full runtime/developer-image follow-through is accepted. The alias report duty is resolved.

General selects one Native GitHub Release writer dispatch on protected main 5bde7ed3d428cfa5eaf2038bb8cf4a12079f848c, tag3.3.2/source660217dd1ac62701eb1fc26b08fbbaf825e777d1, publication42591612884/a1 and the same accepted v2 promotion evidence (0a7f1227…bedcd7). The existing main-only environment and rolling-alias lock repeat publication, provenance, qualification and live latest-alias verification before creating the plain3.3.2 final Release/Latest. No asset upload, new build/tag or alias effect.

Guards: exact main, immutable tag and reviewed workflow blob38a355ab; publication/alias runs terminal success; no3.3.2 Release and no prior writer on this main; no other live writer. One dispatch, no retry/cancel. Report byT0+20minutes and keep any live outcome explicit.

Known #1111 is unchanged: this writer emits only the identity table. After its successful creation and independent readback, General also selects one guarded body-only PATCH appending the reviewed full3.3.2 notes. Source notes2454B/SHA2567ee79d6999132f247c2c17638e3e6337d66368b0b274b618caba55f08416dbb2; rendered2590B/SHA25621dc248ecd9c94a54190fb04a981f89255d9d2ff3fd2ec1f34af240a10d244fe, changing only the two relative upgrade/limitations links to the immutable3.3.2 tag. Require the untouched expected identity table before that patch, retain title/tag/target/draft/prerelease identity, and verify full body and Latest afterward. Do not rerun the writer after augmentation.

All earlier NONPASS attributions and six other Native P0s remain open. No benchmark speedup or Cloud adoption is claimed. The automatic noon-backup observation remains independently due after12:02UTC.

Native 3.3.2 is delivered and Latest: full release notes, release439079426, source 660217dd1ac62701eb1fc26b08fbbaf825e777d1, published index sha256:4aeceb423ee4c8931f00ec2936149ac6b2a75479243b3930f9c6336ccdebf912.

The complete source/main, publication/provenance, both architectures' three-backend smoke, protected corpus, four exact Compose cells, default resolution and published PHP replay/condition-wait checks are accepted. Sample App#334 has signed main custody, all9published runtime surfaces and language combinations, and the rebuilt developer image in both registries. Its embedded tuple matches Git on amd64/arm64.

Alias42612524622/a1 passed3/3; independent readback binds exact3.3.2 plus3.3/3/latest in both registries to the qualified index. Exact3.3.0/3.3.1 remain intact. GitHub Release42613125047/a1 passed, then one selected body-only augmentation attached the reviewed notes with immutable-source links. Final title/tag/source/flags/Latest and full2956-byte body match; body SHA256 001cd0ce24f0024e2619398e0e276f3401551f26e8527fced68e24345e1fc9a2. The known #1111 source follow-up remains open; the writer was not rerun.

This closes delivery of #1068 bounded local-record batching and #1075 coherent workflow descriptions. Existing clients require no new SDK release for these internal changes; SDK3.11.0 is already published. Schema/protocol/capabilities and documented rollback constraints are unchanged. No reproduced benchmark speedup is claimed. Earlier NONPASSs remain attributed; no release/promotion/report duty remains live.

Six Native P0s remain open: #1063(partial), #1074 and #1076(measurement reconciliation of already-released code), #1077, #1078 and #1079. sdk-php#341 depends on #1078's accepted producer contract and a later SDK release. Cloud adoption and security/runtime gates remain separate. Next: drive those actual remaining slices and the #1111 writer fix without changing released tags.

Navigation Menu

Repository navigation

Replace PHP Server with a compatible Rust runtime and safe in-place upgrade #325

Current delivery — November 9, 2026

Objective

Constraints

Repository and delivery

Contract, parity and embedded mode

Database isolation and one-way upgrade

Operations and performance

Work order

Acceptance

Ownership

820 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Replace PHP Server with a compatible Rust runtime and safe in-place upgrade #325

Description

Current delivery — November 9, 2026

Objective

Constraints

Repository and delivery

Contract, parity and embedded mode

Database isolation and one-way upgrade

Operations and performance

Work order

Acceptance

Ownership

Activity

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

rmcdaniel commented on Oct 9, 2026

820 remaining items

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

rmcdaniel commented on Nov 9, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions