sfmskywalker · Oct 6, 2026 · Sep 11, 2026 · Sep 11, 2026 · Sep 12, 2026 · Sep 12, 2026
diff --git a/doc/integration-program/extensions-catchup-dispositions.json b/doc/integration-program/extensions-catchup-dispositions.json
diff --git a/doc/integration-program/extensions-catchup.md b/doc/integration-program/extensions-catchup.md
@@ -0,0 +1,43 @@
+# Extensions release reconciliation and Core catchup
+
+Tracker: Elsa Core #8623. The reconciled Extensions source preserves both original parents through a normal merge of release/3.9 into main. The subsequent cleanup removes one duplicate Dapper friend-assembly item introduced by the automatic project merge.
+
+Source main: `98a185a303b6c96347d25c780528ce37f2f864a3`.
+Release/3.9: `89d4eb9b739ae135604aac2a1de18653a289bdb0`.
+Reconciled source: `b76f8fd216fdc529d41fbf39fd712d3fcd4e80fd`.
+Previous imported source: `3cf502955791cbd20375022ef4597f0e195faf8a`.
+Core mapping base: `91a1c0723`.
+
+All stable 3.8 tags (3.8.0, 3.8.1, 3.8.2, 3.8.4), their release branch tips, and release/3.9 are ancestors of the reconciled source. No 3.8.3 tag exists in the inspected source repository. Main's package workflow and Directory.Build.props are unchanged, retaining base_version 3.10.0 and Elsa dependencies 3.10.0-preview.5760 / Studio 3.10.0-preview.1799.
+
+## Source conflict dispositions
+
+| Conflict path | Resolution |
+| --- | --- |
+| .github/workflows/packages.yml | Keep main publication settings and 3.10 base version. |
+| Directory.Build.props | Keep main 3.10 preview dependency pins. |
+| Dapper Modules/Runtime/Stores/KeyValueStore.cs | Keep main atomic delete method and preview-compatible documentation. |
+| MongoDb Modules/Runtime/KeyValueStore.cs | Keep main scoped atomic delete method and preview-compatible documentation. |
+| MongoDb Modules/Management/WorkflowInstanceStore.cs | Apply release scoped interruption through MongoDbStore.UpdateOneAsync while retaining finished-row refusal. |
+| Elsa.Dapper.UnitTests/DapperWorkflowInstanceStoreTests.cs | Combine release cutoff/filter cases with main stronger cross-tenant regression and parameterized tenant seed helper. |
+| Elsa.MongoDb.UnitTests/MongoKeyValueStoreTryDeleteTests.cs | Keep main concrete-store calls and deterministic historical race baseline compatible with source preview dependency. |
+| Elsa.MongoDb.UnitTests/MongoWorkflowInstanceStoreTests.cs | Keep main exact recursive Id-filter assertions. |
+| Elsa.Persistence.Dapper.UnitTests/DapperKeyValueStoreTryDeletePostgreSqlTests.cs | Keep main concrete-store coverage against migration-built PostgreSQL. |
+| Elsa.Persistence.Dapper.UnitTests/DapperKeyValueStoreTryDeleteTests.cs | Keep main concrete-store and SQLite race baseline coverage. |
+| Elsa.Persistence.Dapper.UnitTests/DapperPostgreSqlMigrationTests.cs | Include release BeforeLastUpdated coverage. |
+| Elsa.Persistence.Dapper.UnitTests/NonPgQuerySqlSnapshotTests.cs | Include release exclusive less-than snapshots. |
+| Elsa.Persistence.Dapper.UnitTests/PostgreSqlDialectTests.cs | Include release quoted less-than assertions. |
+
+## Core mapping
+
+`extensions-catchup-dispositions.json` accounts for every changed source path using the established destination mapping in `scripts/integration-program/rehearse-import.py`. Root-level settings, workflows, solution metadata, and instructions are refreshed only as inert `.source` snapshots. Current Core build/publication configuration remains authoritative.
+
+The live slice adds the existence-guarded Dapper runtime migration 20008 (KeyValues and BookmarkQueueItems.SerializedOptions), atomic tenant-scoped TryDelete implementations, default-tenant NULL/empty compatibility, corrected prefix parameter binding, BeforeLastUpdated filtering, Mongo interruption/summary tenant scoping, DI-backed variable serialization, and JsonNode subtype/legacy compatibility. Imported regression coverage exercises migration-built SQLite/PostgreSQL and MongoDB containers. Core atomic-delete tests dispatch through IKeyValueStore because Core already supplies that API.
+
+Existing Core project-reference/SSH.NET compatibility adjustments and MigrationDatabases.QuotedIdentifiers/UnquotedIdentifiers are preserved. Identity V3_10 remains untouched. Files already equal to the reconciled source are recorded without rewriting them.
+
+Verification is recorded by the integrating lead after source and mapped Core test execution. No publication or cutover is performed by this local slice.
+
+## Persistence review follow-up
+
+[Extensions #286](https://github.com/elsa-workflows/elsa-extensions/pull/286) at `8626e81f4a780be7d5fde87a1ae8b15cc6915934` adds reviewed ownership-safe saves, literal prefix semantics, SQLite instant comparison, and legacy Mongo envelope-collision handling. The refreshed receipt includes all 48 paths from the previous imported source through this follow-up. Core keeps its documented API/layout adaptations. Full source and mapped persistence suite evidence is recorded in [the catch-up verification report](release-catchup-verification.md).
diff --git a/doc/integration-program/legacy/extensions/.github/reviewers.md.source b/doc/integration-program/legacy/extensions/.github/reviewers.md.source
@@ -0,0 +1,24 @@
+# Advisory PR reviewers
+
+Live list of automated reviewers for this repository (elsa-extensions). Agents read it before opening a PR.
+
+Last verified: 2026-10-04
+
+| Reviewer | Status | How to request | Notes |
+| --- | --- | --- | --- |
+| GitHub Copilot code review (`copilot-pull-request-reviewer[bot]`) | live | Add reviewer `@copilot`: `gh pr edit <n> --add-reviewer @copilot` (GitHub CLI 2.88 or later) | Advisory. A `@copilot review` comment does not trigger it. Bot-authored PRs need the org policy that lets Copilot review them. |
+| Greptile (`greptile-apps[bot]`) | not live | Comment `@greptileai` (once enabled here) | Advisory; not part of the merge gate (see Rules). Installed, but does not review PRs here. |
+| CodeRabbit (`coderabbitai[bot]`) | not live | Comment `@coderabbitai review` (once enabled here) | Not enabled for this repository. |
+| Cursor Bugbot | not live | Top-level PR comment `cursor review` (once enabled) | Must first be enabled in the Cursor dashboard. `cursor[bot]` comments on PRs come from Cursor cloud agents, not Bugbot. |
+| GitHub Code Quality (`github-code-quality[bot]`) | informational | Automatic; cannot be requested | CodeQL code-quality comments. Not an advisory pick and not part of the merge gate. |
+
+## Rules
+
+- Greptile does not review PRs on this repository. Do not wait for or request a Greptile score.
+- Pick exactly one live advisory reviewer from the table (currently Copilot) and request it once the PR is open. Do not request a second reviewer.
+- If the picked reviewer declines or skips the PR, request another live reviewer if there is one; otherwise continue without one.
+- The PR author (human or agent) never reviews or approves its own PR.
+- Merge gate: the only merge gate is an Elsa 3 Code Review on the PR whose body starts with the line `Elsa 3 Code Review: APPROVE + HIGH @ <head sha>` (the full 40-character SHA of the PR's current head commit), plus green CI on that head. The Code Review is posted as `sfmskywalker` with review event COMMENT, so its GitHub review state is COMMENTED, not APPROVED. A `REQUEST_CHANGES` verdict, a confidence below `HIGH`, or a SHA other than the current head does not pass. The Code Review is a separate reviewer from the PR author, even when both post from the same account.
+- Pin the merge to the approved SHA: `gh pr merge <n> --match-head-commit <sha>`, or the merge API (`PUT /repos/{owner}/{repo}/pulls/{n}/merge`) with `sha=<sha>`. Any push after the approval voids it; Code Review must re-confirm with `Elsa 3 Code Review: APPROVE + HIGH @ <new head sha>` before merging.
+- Greptile, CodeRabbit, Copilot and Bugbot are advisory only. Their findings feed into the Code Review, but none of them is required for merge: there is no Greptile score gate (no 5/5 requirement) and no waive process.
+- Update this file whenever a reviewer is added, removed, or changes how it is requested.
diff --git a/doc/integration-program/legacy/extensions/.github/workflows/packages.yml.source b/doc/integration-program/legacy/extensions/.github/workflows/packages.yml.source
@@ -1,6 +1,16 @@
 name: Packages
 on:
   workflow_dispatch:
+    inputs:
+      # Does nothing on main while base_version is 3.10.x. Dispatch VERSION is
+      # always ${base_version}-${prefix}.${run_number}, so the nuget.org job's
+      # !startsWith(..., '3.10.') gate never opens. Publishing 3.10 publicly
+      # later means deliberately removing that check and deciding how a dispatch
+      # run sets VERSION.
+      publish_nuget:
+        description: 'Publish packages to nuget.org (never for 3.10.x)'
+        type: boolean
+        default: false
   push:
     branches:
       - 'main'
@@ -26,6 +36,8 @@ jobs:
     name: Build packages
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    outputs:
+      version: ${{ steps.set_version.outputs.version }}
     steps:
       - name: Extract branch name
         run: |
@@ -56,13 +68,17 @@ jobs:
             git branch --remote --contains | grep origin/${BRANCH_NAME}
           fi
       - name: Set VERSION variable
+        id: set_version
         run: |
           if [[ "${{ github.ref }}" == refs/tags/* && "${{ github.event_name }}" == "release" && ("${{ github.event.action }}" == "published" || "${{ github.event.action }}" == "prereleased") ]]; then
             TAG_NAME=${{ github.ref }} # e.g., refs/tags/3.0.0
             TAG_NAME=${TAG_NAME#refs/tags/} # remove the refs/tags/ prefix
             echo "VERSION=${TAG_NAME}" >> $GITHUB_ENV
+            echo "version=${TAG_NAME}" >> $GITHUB_OUTPUT
           else
-            echo "VERSION=${{env.base_version}}-${PACKAGE_PREFIX}.${{github.run_number}}" >> $GITHUB_ENV
+            VERSION="${{env.base_version}}-${PACKAGE_PREFIX}.${{github.run_number}}"
+            echo "VERSION=${VERSION}" >> $GITHUB_ENV
+            echo "version=${VERSION}" >> $GITHUB_OUTPUT
           fi
       - uses: actions/setup-dotnet@v5
         with:
@@ -77,7 +93,7 @@ jobs:
         with:
           name: elsa-nuget-packages
           path: packages/*nupkg
-        if: ${{ github.event_name == 'release' || github.event_name == 'push'}}
+        if: ${{ github.event_name == 'release' || github.event_name == 'push' || github.event_name == 'workflow_dispatch'}}
 
   publish_preview_feedz:
     name: Publish to feedz.io
@@ -91,15 +107,30 @@ jobs:
         with:
           name: elsa-nuget-packages
 
+      - name: Check API key (feedz.io)
+        env:
+          API_KEY: ${{ secrets.FEEDZ_API_KEY }}
+        run: |
+          if [ -z "$API_KEY" ]; then
+            echo "::error::API key for feedz.io is empty. Check the FEEDZ_API_KEY repository secret; nothing was pushed."
+            exit 1
+          fi
+
       - name: Publish to feedz.io
-        run: dotnet nuget push *.nupkg -k ${{ secrets.FEEDZ_API_KEY }} -s ${{ env.feedz_feed_source }} --skip-duplicate
+        env:
+          API_KEY: ${{ secrets.FEEDZ_API_KEY }}
+        run: dotnet nuget push *.nupkg -k "$API_KEY" -s ${{ env.feedz_feed_source }} --skip-duplicate
 
   publish_nuget:
     name: Publish release to nuget.org
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 20
-    if: ${{ github.event_name == 'release' && github.event.action == 'published' }}
+    # Dispatch-only. 3.10.x (including 3.10.0-preview.*) must never reach nuget.org.
+    # publish_nuget does nothing on main while base_version is 3.10.x. Publishing
+    # 3.10 publicly later means deliberately removing the 3.10. check and deciding
+    # how a dispatch run sets VERSION (always base_version-prefix.run_number).
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_nuget && !startsWith(needs.build.outputs.version, '3.10.') }}
     permissions:
       # Required to request the OIDC token that nuget.org exchanges for a short-lived API key (Trusted Publishing).
       id-token: write
@@ -116,5 +147,16 @@ jobs:
         with:
           user: ${{ env.nuget_user }}
 
+      - name: Check API key (nuget.org)
+        env:
+          API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}
+        run: |
+          if [ -z "$API_KEY" ]; then
+            echo "::error::API key for nuget.org is empty. Check the NuGet login (OIDC) step output and the Trusted Publishing policy on nuget.org; nothing was pushed."
+            exit 1
+          fi
+
       - name: Publish to nuget.org
-        run: dotnet nuget push *.nupkg -k ${{ steps.nuget_login.outputs.NUGET_API_KEY }} -s ${{ env.nuget_feed_source }} --skip-duplicate
+        env:
+          API_KEY: ${{ steps.nuget_login.outputs.NUGET_API_KEY }}
+        run: dotnet nuget push *.nupkg -k "$API_KEY" -s ${{ env.nuget_feed_source }} --skip-duplicate
diff --git a/doc/integration-program/legacy/extensions/AGENTS.md.source b/doc/integration-program/legacy/extensions/AGENTS.md.source
@@ -0,0 +1,3 @@
+# AGENTS.md
+
+Before opening a PR, read `.github/reviewers.md` and request exactly one live advisory reviewer from it once the PR is open. Greptile does not review PRs here, and all automated reviewers are advisory; merge only on the gate described there (Elsa 3 Code Review `APPROVE + HIGH @ <head sha>` plus green CI, merge pinned to that SHA).
diff --git a/doc/integration-program/legacy/extensions/Directory.Build.props.source b/doc/integration-program/legacy/extensions/Directory.Build.props.source
@@ -37,8 +37,8 @@
 	</PropertyGroup>
 
     <PropertyGroup Label="PackageVersions">
-        <ElsaVersion>3.10.0-preview.5705</ElsaVersion>
-        <ElsaStudioVersion>3.10.0-preview.1749</ElsaStudioVersion>
+        <ElsaVersion>3.10.0-preview.5760</ElsaVersion>
+        <ElsaStudioVersion>3.10.0-preview.1799</ElsaStudioVersion>
     </PropertyGroup>
 
 </Project>
diff --git a/doc/integration-program/legacy/extensions/Directory.Packages.props.source b/doc/integration-program/legacy/extensions/Directory.Packages.props.source
@@ -165,6 +165,9 @@
         <PackageVersion Include="FluentMigrator" Version="7.2.0"/>
         <PackageVersion Include="FluentMigrator.Runner" Version="7.2.0"/>
         <PackageVersion Include="FluentMigrator.Runner.Core" Version="7.2.0"/>
+        <PackageVersion Include="FluentMigrator.Runner.MySql" Version="7.2.0"/>
+        <PackageVersion Include="FluentMigrator.Runner.Oracle" Version="7.2.0"/>
+        <PackageVersion Include="FluentMigrator.Runner.Postgres" Version="7.2.0"/>
         <PackageVersion Include="FluentMigrator.Runner.SqlServer" Version="7.2.0"/>
         <PackageVersion Include="FluentMigrator.Runner.SQLite" Version="7.2.0"/>
         <PackageVersion Include="FluentStorage" Version="6.0.0"/>

diff --git a/doc/integration-program/legacy/extensions/Elsa.Extensions.sln.source b/doc/integration-program/legacy/extensions/Elsa.Extensions.sln.source
@@ -336,6 +336,10 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "runtimes", "runtimes", "{74
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.Workflows.Runtime.ProtoActor.UnitTests", "test\modules\runtimes\Elsa.Workflows.Runtime.ProtoActor.UnitTests\Elsa.Workflows.Runtime.ProtoActor.UnitTests.csproj", "{209765CA-207B-44F0-94E4-0711235E7F99}"
 EndProject
+Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "secrets", "secrets", "{A1526B50-A5D1-398B-3070-5440A8E5BDFE}"
+EndProject
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Elsa.Secrets.Management.UnitTests", "test\modules\secrets\Elsa.Secrets.Management.UnitTests\Elsa.Secrets.Management.UnitTests.csproj", "{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}"
+EndProject
 Global
 	GlobalSection(SolutionConfigurationPlatforms) = preSolution
 		Debug|Any CPU = Debug|Any CPU
@@ -1610,6 +1614,18 @@ Global
 		{C115D266-ED50-4584-B059-B4BB48B54C77}.Release|x64.Build.0 = Release|Any CPU
 		{C115D266-ED50-4584-B059-B4BB48B54C77}.Release|x86.ActiveCfg = Release|Any CPU
 		{C115D266-ED50-4584-B059-B4BB48B54C77}.Release|x86.Build.0 = Release|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Debug|x64.ActiveCfg = Debug|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Debug|x64.Build.0 = Debug|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Debug|x86.ActiveCfg = Debug|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Debug|x86.Build.0 = Debug|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Release|Any CPU.Build.0 = Release|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Release|x64.ActiveCfg = Release|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Release|x64.Build.0 = Release|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Release|x86.ActiveCfg = Release|Any CPU
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F}.Release|x86.Build.0 = Release|Any CPU
 	EndGlobalSection
 	GlobalSection(SolutionProperties) = preSolution
 		HideSolutionNode = FALSE
@@ -1758,6 +1774,8 @@ Global
 		{799D5262-2BB1-C4D2-CB3D-522B0B7186CF} = {3DDE6F89-531C-47F8-9CD7-7A4E6984FA48}
 		{1994376D-9775-4709-88E5-BE44618546AD} = {799D5262-2BB1-C4D2-CB3D-522B0B7186CF}
 		{C115D266-ED50-4584-B059-B4BB48B54C77} = {273F8587-516E-41F3-93B9-D2F8FDC188A4}
+		{A1526B50-A5D1-398B-3070-5440A8E5BDFE} = {3DDE6F89-531C-47F8-9CD7-7A4E6984FA48}
+		{02CB40E6-1DC0-4AC8-B9F1-D268CA26654F} = {A1526B50-A5D1-398B-3070-5440A8E5BDFE}
 	EndGlobalSection
 	GlobalSection(ExtensibilityGlobals) = postSolution
 		SolutionGuid = {11A771DA-B728-445E-8A88-AE1C84C3B3A6}

diff --git a/doc/integration-program/legacy/studio/.github/reviewers.md.source b/doc/integration-program/legacy/studio/.github/reviewers.md.source
@@ -0,0 +1,23 @@
+# Advisory PR reviewers
+
+Live list of automated reviewers for this repository (elsa-studio). Agents read it before opening a PR.
+
+Last verified: 2026-10-04
+
+| Reviewer | Status | How to request | Notes |
+| --- | --- | --- | --- |
+| Greptile (`greptile-apps[bot]`) | live | Automatic when a PR is opened; comment `@greptileai` to review a new head after a push | Advisory; not part of the merge gate (see Rules). Posts a "Confidence Score: N/5" summary and a "Greptile Review" check. Reviews only allow-listed authors; others get "PR author is not in the allowed authors list". |
+| CodeRabbit (`coderabbitai[bot]`) | live | Automatic on PRs into `main`; comment `@coderabbitai review` for other base branches or a re-review after a push | Advisory. Skips PRs into other base branches unless requested. Reviews draw on an hourly allowance, so do not request it while its automatic review is pending. |
+| GitHub Copilot code review (`copilot-pull-request-reviewer[bot]`) | live | Add reviewer `@copilot`: `gh pr edit <n> --add-reviewer @copilot` (GitHub CLI 2.88 or later) | Advisory. A `@copilot review` comment does not trigger it. Bot-authored PRs need the org policy that lets Copilot review them. |
+| Cursor Bugbot | not live | Top-level PR comment `cursor review` (once enabled) | Must first be enabled in the Cursor dashboard. `cursor[bot]` comments on PRs come from Cursor cloud agents, not Bugbot. |
+
+## Rules
+
+- Greptile reviews automatically when a PR is opened. It is advisory: after a push you may comment `@greptileai` for a fresh review of the new head, but nobody waits for a Greptile score.
+- Besides Greptile, request at most one additional advisory reviewer (CodeRabbit or Copilot) once the PR is open. If your pick reviews automatically on this PR (CodeRabbit does on PRs into `main`), wait for that run instead of requesting it; request it manually only if no run appears, the PR targets another base branch, or you need a re-review after a push.
+- If the additional reviewer declines or skips the PR, you may request the other one instead.
+- The PR author (human or agent) never reviews or approves its own PR.
+- Merge gate: the only merge gate is an Elsa 3 Code Review on the PR whose body starts with the line `Elsa 3 Code Review: APPROVE + HIGH @ <head sha>` (the full 40-character SHA of the PR's current head commit), plus green CI on that head. The Code Review is posted as `sfmskywalker` with review event COMMENT, so its GitHub review state is COMMENTED, not APPROVED. A `REQUEST_CHANGES` verdict, a confidence below `HIGH`, or a SHA other than the current head does not pass. The Code Review is a separate reviewer from the PR author, even when both post from the same account.
+- Pin the merge to the approved SHA: `gh pr merge <n> --match-head-commit <sha>`, or the merge API (`PUT /repos/{owner}/{repo}/pulls/{n}/merge`) with `sha=<sha>`. Any push after the approval voids it; Code Review must re-confirm with `Elsa 3 Code Review: APPROVE + HIGH @ <new head sha>` before merging.
+- Greptile, CodeRabbit, Copilot and Bugbot are advisory only. Their findings feed into the Code Review, but none of them is required for merge: there is no Greptile score gate (no 5/5 requirement) and no waive process.
+- Update this file whenever a reviewer is added, removed, or changes how it is requested.
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,3 @@
		# AGENTS.md

		Before opening a PR, read `.github/reviewers.md` and request exactly one live advisory reviewer from it once the PR is open. Greptile does not review PRs here, and all automated reviewers are advisory; merge only on the gate described there (Elsa 3 Code Review `APPROVE + HIGH @ <head sha>` plus green CI, merge pinned to that SHA).