[Feature] F3.4: Artifact provenance, release notes, and recovery procedures

Additional owner requirement — individual product releases, 2026-10-08

The owner explicitly requested the ability to release Core, Studio and Extensions individually. Include product-selective release entrypoints and verification that releasing one product does not automatically republish the other products. Preserve existing package identities; check required dependency availability and compatibility for each selected product. The paired Studio npm distributions remain an internally coordinated unit where their exact dependency requires it.

Preserve the approved aligned baseline for the first consolidated 3.10 release. Track and verify independent product release capability as its own bounded deliverable rather than reopening the completed structural milestone or expanding the immediate maintenance-build slice into a generic release-engine redesign. Maintenance preparation already needs explicit product/line selection; reuse that where appropriate. This requirement does not authorize a package upload, deployment or archival by itself.

Owner decision — archival sequence, 2026-10-08

The owner selected option 1 in the delivery chat: archive Studio and Extensions after the Core maintenance and publisher handoff is verified, without waiting for the first full consolidated 3.10 release. The archive readiness boundary includes working Core maintenance and publisher capability, completed contributor routing, retired competing source authority and recovery instructions. The full 3.10 release follows as a separate deliverable with its existing applicable acceptance gates preserved.

This selects sequencing. Prepare and verify the concrete archival packet before requesting final operational approval; no repository is archived by this decision record. The earlier choices remain: preserve Studio/Extensions 3.8/3.9 release layouts/history on separate Core maintenance branches, and move both existing Studio npm distributions into Core publishing while preserving package names.

The full 3.10 browser/profile certification in #8643 is no longer a prerequisite to this archive-first sequence; its incomplete evidence and Hosted routing decision remain explicit for the later release. Dependency-update ownership is resolved in #8636: coordinated Core/Studio/Extensions PRs are permitted with applicable CI and review for every affected product. Its corrective implementation and operational inventory/version/feed proof remain incomplete. Refine bounded implementation Tasks against these selected outcomes, preserving the completed structural milestone and deferred Slack/React boundaries.

Current executor acceptance: #8650 merged at 702376b501439e5244a0db8728d12b9da86eb5d9; #8649 is closed and accepted. Retained evidence binds the reviewed head, exact merge-tree equality, hosted original-byte rehearsal/read-only verification, independent APPROVE + HIGH and Greptile 5/5. No package or symbol was uploaded. This feature remains open for actual publication, recovery and publisher transition.

Program: #8194
Parent: #8198
Planning ID: F3.4

Outcome and scope

Verify artifact commit provenance and hashes; document partial-publication recovery, release notes, and immutable-package constraints.

Acceptance criteria

Deliver the specified capability and demonstrate each behavior above with targeted checks or documented research evidence.
Preserve existing package/activity identities and supported contracts, or provide an explicit migration.
Document setup, limitations, dependencies and verification results.

Readiness

Feature in progress. The active delivery queue is maintained on #8194; #8651 is accepted through #8652, with final integration tracked by #8655. #8649 is accepted for the immutable original-byte package/symbol executor with every candidate PDB association and a fail-closed native protected-environment admission boundary. #8647 is accepted through #8648 at program merge 8876428f472f3cf22957bec35302ee2470644dc9; lead acceptance binds exact-head CI/review and explicit live observation gaps. #8645 remains accepted for complete original-candidate recovery preparation. Original candidate #8631 and bounded persisted compatibility #8639 remain accepted. The owner resolved #8643's routing policy to root / by default with explicitly configured prefixes; the product correction and full browser/profile certification remain incomplete for the later 3.10 deliverable. The owner also resolved #8636's update policy to coordinated dependency PRs with affected-product gates; correction and actual inventory/version/feed/update proof remain incomplete, with failed operational evidence retained. Full immutable publication/recovery, candidate symbol verification and live publisher handoff remain open.

Follow AGENTS.md, existing test/ conventions and dated ADRs under doc/adr/. Scope is Elsa 3 unless explicitly a portability assessment. Repository consolidation includes Core, all Extensions, and Studio; release boundaries remain explicit and independent.

Hierarchy: native parent/sub-issue relationships verified on 2026-09-23. Explicit blocking dependencies are configured separately; Markdown links remain references. See #8194.

Current delivery evidence — 2026-10-06

Release-preparation audit identifies stable candidate creation, immutable publish-only recovery and publisher handoff as separate remaining outcomes.
[Task] Prepare a nonpublishing consolidated 3.10.0 candidate #8631 / Prepare a nonpublishing consolidated 3.10.0 candidate #8635 is accepted at reviewed source ba5b348aa2414fdf7c19d9d8806e87b7c91a4205, merged into the program branch as fc967930ac2b47895a4231e4f12352ec6dd955b7. Lead acceptance binds original artifact 11412848210 and SHA-256 ace85260c3389916fe3dcd7ee9cd5b766e4030dd6cee13c7f89285ada79c944f, available through 2026-11-05T12:13:30Z. Hosted preparation/retrieval and all three representative consumers passed; no publication occurred. [Task] Prove persisted SQLite upgrades against the accepted stable 3.10.0 candidate #8639 accepted the stable-byte persisted matrix through Prove persisted workflow upgrades against stable 3.10.0 packages #8644; paired browser acceptance remains [Task] Verify stable server and Studio packages across supported browser hosts #8643.
Public Feedz presence preflight found no listed 3.10.0 version among the 225 candidate IDs at 12:04 UTC. This unauthenticated point-in-time observation is not version reservation, authenticated publisher proof or publication approval.
Actual post-merge Dependabot verification failed despite successful Actions status: only immediate directories were selected, no usable imported project inventory was evaluated, and proposals concerned only root dotnet-ef. At this 2026-10-06 checkpoint, [Task] Restore Dependabot discovery for imported Extensions and Studio projects #8636 was blocked on ownership. The later 2026-10-08 owner decision resolved that policy; historical runtime verification still failed and remains recorded. Discovery, central-version and real registry/update evidence require correction and another verified run.
This feature remains open for its full outcomes, including immutable partial-publication recovery and the separately authorized publisher transition. Earlier proof-version packages are preserved unchanged. Publication approval must bind the exact new candidate bytes and their applicable compatibility evidence. No package publication, live publisher cutover, deployment or archival is authorized by candidate preparation.

Current preparation — 2026-10-07

#8647 delivered the read-only consolidated publisher handoff/quiescence preflight and ordered cutover packet through #8648. #8649 delivered the artifact-only executor and complete PDB readback contract through merged #8650. Its complete second hosted attempt verified all 225 missing packages and 668 missing symbols without uploads; attempt 1 retains three read timeouts. Rehearsal uploads were simulated only. #8645 acceptance records the complete original-byte recovery proof and exact-head review/CI. The current authority audit identifies old credential access and missing reviewer-protected package environments. This preparation changes no live authority and does not claim intended-reader rights, symbol delivery, complete compatibility or publication approval. The executor implementation is accepted; provisioning and inspecting its actual protected environment and credentials, approved cutover/publication, and post-publication readback remain explicit later outcomes.

Candidate freshness before publication

The original stable artifact 11412848210 remains immutable, with its original compatibility and recovery evidence preserved. It predates the execution-cycle, Mongo and Studio source corrections now being integrated through #8652, #8654 and #8656. Its prior preparation acceptance therefore does not prove that it contains the final source selected for the consolidated release. After final-main integration and any required #8643 product correction, prepare a fresh candidate from the explicitly selected release commit and verify its own package/symbol bytes and applicable compatibility matrix. Do not silently replace the original artifact or reuse its byte-specific receipts as evidence for a newly built candidate. Publication approval must identify the selected source, exact new artifact/digests, applicable compatibility evidence and operational authority. No original or refreshed candidate is authorized for publication by this planning update.

Release preparation audit — refreshed 2026-10-06

The complete nonpublishing package proof is now accepted: #8626 is closed and #8627 merged into the program branch at 5b6b75fdd64a22d99ac4258311a29258b559055b. Run 37410240989 produced 225 package/symbol pairs at proof version 3.10.0-proof.37410240989.1, from exact source 44083dc4f47d56aa2d5c215b0c7479c0b7290cb0. Artifact 11390805430 has archive SHA256 8317e5766591f9da2d1f83cd6a85274bd41efbfbd0039d6a1bcfaf0c9bf81636, size 92,756,892 bytes and expiry 2026-10-13 04:26:20 UTC. The lead independently verified package identities, hashes, source provenance and representative clean-consumer evidence. These proof bytes cannot be relabeled as stable 3.10.0.

Current production and source-publisher inspection confirms the following remaining preparation work:

Retain a production-version candidate without publishing. The Core packages.yml manual dispatch with publisher inputs false currently omits its artifact upload. Imported packability lifts only under the proof flag, which correctly rejects stable versions. Introduce a distinct guarded candidate path with explicit Release, consistent restore/compile/pack version inputs, Studio ClientLib preparation, independently evaluated inventory/exclusions, full package/symbol/source/browser-asset verification and clean consumers. Preserve default import guards and legacy Secrets exclusions. Keep Elsa.SamplePackage at the common candidate version; the old profile's fixed 1.0.1 exception must not shrink the accepted set. Record active guard changes in the retained-asset disposition ledger.
Publish and recover from the original immutable candidate. Bind source SHA/version, original run, artifact ID/name/digest/size, inventory/evidence hashes, reviewed publisher source and the exact Feedz target. Download and verify those bytes without restore/build/pack. Classify each remote ID/version as missing, matching or conflicting/unverifiable; push only missing artifacts, inspect uncertain outcomes before retries, stop on conflicts and verify the complete remote set. --skip-duplicate alone is not content comparison. Retain per-package receipts. Current release helpers still assume separate Core/Studio/Extensions stages, public NuGet and release-event NuGet.org recovery; reconcile a consolidated Feedz-only mode while preserving 3.8/3.9 maintenance and the explicit Templates boundary.
Prepare source publisher guards and handoff. At Extensions e189390b3ea10b730c4d66bf40e357f7621374ab and Studio 3d028a4e9a3267b291f3d43d8064b5c81a6f2759, automatic Feedz publication remains active; public dispatch guards exclude only literal 3.10.. The reviewed handoff must cover 3.10 and all later NuGet versions while preserving 3.8/3.9 stable/prerelease publishers and unrelated builds. Inspect all publish-capable refs and prove queued/running old publishers have quiesced before enabling Core. Extensions Add Azure Blob Storage distributed lock provider #227 and Studio Unable to Trigger suspended workflow by activity name in Entity framework core. #1072 are closed, unmerged and superseded, not matching implementations to reopen.

Sources: Core production workflow, version propagation, release profile, Extensions workflow, Studio workflow.

#8629 is the ready persisted-upgrade matrix; #8628 remains the sole active delivery Task. Refine the candidate, immutable recovery and handoff slices after that boundary. The Dependabot discovery correction remains a separate operational gate. The owner decision for both Studio npm IDs remains pending under #8216, and no npm ownership change is assumed.

Publication and live cutover still require concrete reviewed approval packets: production candidate/CI/upgrade evidence, exact artifact identity and expiry, remote-content preflight, immutable recovery, one publisher per ID/version line, maintenance preservation and run quiescence. No publication, deployment, credential change, package deprecation or archival occurred. #8220 remains open / Not Ready / Verification Pending at full scope.

Imported Dependabot operational evidence — 2026-10-06

The configured daily product jobs have executed after import: Extensions 37263679866, Studio 36503465892 and Studio 36511031809 completed successfully. Their updater payloads name /src/extensions and /src/studio; the run event is Dependabot's dynamic, while daily scheduling is established by the committed configuration.

The logs show Feedz registry discovery and bearer-auth proxy configuration without a surfaced Feedz authentication error, but no explicit Feedz HTTP response status. This does not establish credential scope or independent authenticated-feed success. Repository secret metadata alone is inconclusive because organization-scoped credentials may apply.

Follow-up inspection confirms a manifest-discovery gap: all three retained discovery payloads report IsSuccess=true but Projects=[], GlobalJson=null and No project files found. They discover only ../../.config/dotnet-tools.json and its dotnet-ef dependency. No imported project or Directory.Packages.props is evaluated, despite 77 Extensions and 72 Studio project files and both central-package files being present in the imported worktree. The weekly root NuGet job excludes these product subtrees. Product dependency discovery therefore needs a corrective slice and verified post-fix updater evidence; successful job status alone does not close it. The logs do not establish why discovery was empty. Feed-access proof remains separately limited as above. No secret values were inspected or changed; no new update job or publication was triggered.

This operational limit is separate from architecture documentation task #8628 and the active full-package proof #8626. The frozen import ledger is not a current completion claim.

The current upstream NuGetUpdater entry-point discovery enumerates direct workspace files before expanding discovered solution/project entry points. Neither imported subtree has a root-level solution/project, which is consistent with the observed empty discovery; the exact historical updater binary was not identified. GitHub documents recursive directories glob patterns. A minimal corrective candidate is the two product-specific recursive directory selectors, preserving the root exclusions, registries, schedules, limits and existing group rules. Verify grouping from the proposed update diff rather than assuming cross-directory behavior. No configuration change has been made.

Post-fix acceptance must show actual discovered product projects, their imported central-package props and evaluated versions, followed by a correctly scoped update proposal or explicit current-version result and usable registry access. A green job that only updates an ancestor tool manifest is insufficient. This belongs to the existing release/operational gate and will be scheduled after the current active task.

Current delivery reconciliation: #8198 and #8217–#8220 are In Progress, reflecting existing manifest/dependency foundations and merged #8627, rather than Todo. The 225-package consolidated proof passed at exact head 44083dc4f47d56aa2d5c215b0c7479c0b7290cb0 and landed on the shared program branch at 5b6b75fdd64a22d99ac4258311a29258b559055b. Its hashes, source provenance and representative consumers are prepublication evidence.

All five issues remain open / Not Ready / Verification Pending at their complete feature/epic scope. #8629 is the ready persisted-upgrade matrix under #8219, behind sole active Task #8628. Production release instructions, partial-publication recovery, immutable artifact reuse, publisher handoff and the confirmed Dependabot discovery correction remain under #8220 and related cutover work. The accepted first-3.10 lockstep decision does not complete later independent version streams or selective publication. No first release, live publisher cutover, npm artifact proof or provider certification has occurred.

Read-only release preflight, 2026-10-06 12:04 UTC: the public Feedz service index advertised PackageBaseAddress/3.0.0 at https://f.feedz.io/elsa-workflows/elsa-3/nuget/v3/packages. All 225 unique evaluated candidate package IDs returned HTTP 200 from their version indexes, and none listed exact stable 3.10.0. There were zero transport/authorization failures or unverifiable responses. The lead checked complete ID coverage against the hashed evaluated inventory and independently re-read Elsa, Elsa.SamplePackage, Elsa.Slack and Elsa.Studio.Core.

This is a point-in-time observation of unauthenticated public listings. It does not reserve versions, prove private feed visibility or publisher credentials, compare remote package bytes, accept the still-running candidate, or authorize publication. The eventual approved publish-only path must freshly classify its full package set using the intended publisher access and compare any existing versions against the exact original candidate bytes; conflicts or unverifiable content must stop publication. No packages were downloaded or pushed by this presence preflight, and no feed or workflow was changed.

#8631 remains the sole active Task; #8636 remains next ready. Immutable publication/recovery, stable-byte compatibility, source publisher quiescence/cutover and the outstanding npm ownership decision remain separate gates.

Source publisher preparation: ref-specific gaps

Read-only follow-up for #8220 / #8216. No workflow, ref, publisher credential, external registry or live publication was changed. The lead reviewed the actual Studio workflow version/branch checks as well as the worker's bounded inventory.

Studio main 3d028a4e9a3267b291f3d43d8064b5c81a6f2759 (packages workflow blob 169022ee5831fad2b61714807ef4498342b36074) and Extensions main e189390b3ea10b730c4d66bf40e357f7621374ab (blob 4763f3a806985edb0f5e690b048094fb77e192a9) still calculate 3.10.0-based packages and allow automatic Feedz publication on push/release. Their public NuGet dispatch guards reject literal 3.10.*, not the entire consolidated 3.10-and-later range. Neither current-main workflow provides an arbitrary version override; the broader range gap matters when evaluating all refs and future version changes.
Mutable Studio maintenance branches release/3.8.1, release/3.8.2, release/3.8.4 and release/3.9.0 contain a separate arbitrary version override plus publish input, with semver-shape validation but no release-line restriction. The first three share workflow blob 336d1f0ccda1152645331adb30940bf80f3c2d1a. The 3.9.0 branch workflow is blob 24bc4df9c60c0a750b97383fcbddbc4b9c810e9c. These source paths permit dispatching a chosen 3.10+ version through their publication gates, subject to their ordinary build and external authority succeeding. This is source-confirmed reachability, not an executed publication test.
Matching immutable tags retain those input definitions, but manual tag publication is not proven: the remote-branch precheck strips only refs/heads, and special-cases tags only for release events. Tag dispatch therefore appears to fail its branch precheck. Existing tag release events use the tag's own version. Preserve these distinctions; do not rewrite release tags or count the presence of an input as proof that a pipeline can reach publishing.
At 2026-10-06T15:43:37Z, first-page queued/in-progress Actions queries returned zero runs in both source repositories. Other states and pagination completeness were not audited. This is a bounded observation, not a cutover quiescence receipt.

The cutover packet must cover mutable maintenance refs, tag/event behavior, effective publisher authority and all in-flight states while preserving 3.8/3.9 maintenance. Main-only guards are insufficient. Closed, unmerged source PRs elsa-workflows/elsa-studio#1072, elsa-workflows/elsa-extensions#238 and elsa-workflows/elsa-extensions#227 do not establish a live guard. Studio npm ownership remains the existing unresolved decision; this audit makes no ownership change.

Preparation only. #8636 remains the sole active delivery Task while its actual updater verification runs; #8639 remains next-ready. No new implementation leaf was activated, and no publication or publisher cutover is approved by this checkpoint.

Publisher preparation audit, 2026-10-07. Read-only metadata; no credentials read and no environment/secret configuration changed.

The three repositories have no reviewer-protected package publication environment. Core has copilot and github-pages (the latter has a branch policy only); Studio and Extensions have only copilot. Core retains a repository-level Feedz credential name. Both source repositories have no repository-level secrets, but organization-level Feedz credential names are available to all three. This corrects any inference that empty repository secret lists mean historical publisher workflows lack credentials.

A new main-branch workflow guard or environment: declaration alone cannot contain historical tag/maintenance workflows that continue using repository/organization credentials. The next preparation must include the reviewed Core artifact-only executor, an enforceable environment credential boundary, an explicit maintenance path for source 3.8/3.9 releases, and the exact later credential relocation/rotation and source-ref handoff procedure. Encoded Feedz credentials remain in this audit until their actual authority is proven; an npm-related name or use does not prove NuGet isolation. npm ownership itself remains #8216.

GitHub environment documentation explains environment-secret approval boundaries and branch/tag restrictions. Feedz permission documentation documents repository-scoped package management, including upload/replace/delete; it does not establish version-line isolation. Actual configured Feedz authority and immutability remain unverified.

#8645 remains the sole active delivery Task. This is readiness work, not live publisher cutover or acceptance. The next task will preserve full compatibility, symbol readback, fresh fully paginated publisher quiescence and concrete publication approval as separate gates. No publication, secret rotation, environment creation, source-publisher activation/deactivation or archival occurred.

Read-only symbol delivery research for #8647 / #8220

The existing public Elsa.Workflows.Core 3.9.0 package yielded anonymous Portable PDB readback for net8.0, net9.0 and net10.0. The Sol worker verified CodeView GUID, stamp and the normalized PE checksum; the lead independently checked retained package/PDB hashes, metadata identity and normalized checksum bytes against each DLL. A wrong-GUID negative control returned HTTP 404.

This supplies a concrete reader contract for the future immutable artifact executor. After separately approved publication, verify every candidate PDB against the corresponding unchanged original .snupkg member, in addition to identity/checksum, association and SourceLink checks. Original .snupkg archive round-trip, candidate 3.10 symbol acceptance, private-reader rights and actual publication remain unproven. No credential or publication action occurred. The original candidate and all 225 package/symbol pairs remain in scope.

Receipt SHA-256: 3c01540055ef72945ba26c0d0d59ddc589a676a90780ce53fb58c020c047ad1a (exact local JSON bytes). The portable evidence below includes pinned official .NET algorithm sources, exact public lookup URLs and hashes:

{
  "kind": "existing-release-anonymous-feedz-portable-pdb-research",
  "package": {
    "http_status": 200,
    "content_type": "application/octet-stream",
    "content_disposition": "attachment; filename=\"Elsa.Workflows.Core.3.9.0.nupkg\"",
    "package_url": "https://f.feedz.io/elsa-workflows/elsa-3/nuget/v3/packages/elsa.workflows.core/3.9.0/elsa.workflows.core.3.9.0.nupkg",
    "sha256": "5e820a16283c26768dbc5fa22ca4bf459f23b2c43f63bfff9c510589230d5729",
    "bytes": 1177036,
    "dll_members": [
      "lib/net10.0/Elsa.Workflows.Core.dll",
      "lib/net8.0/Elsa.Workflows.Core.dll",
      "lib/net9.0/Elsa.Workflows.Core.dll"
    ],
    "pdb_members": []
  },
  "symbols": [
    {
      "observed_at": "2026-10-07T10:34:59.305783+00:00",
      "url": "https://f.feedz.io/elsa-workflows/elsa-3/symbols/elsa.workflows.core.pdb/38431eb6be30159e7350f3fb64ef7594FFFFFFFF/elsa.workflows.core.pdb",
      "authentication": "anonymous-no-auth-header",
      "framework": "net10.0",
      "dll_sha256": "4993ea5342fb3a0f779ab45d7641d943646671d0f41a78ea769ee17a0f585ae8",
      "publication_performed": false,
      "credentials_used": false,
      "http_status": 200,
      "content_type": "application/octet-stream",
      "bytes": 271884,
      "raw_pdb_sha256": "db63606b1affa1795ec8bdc3a394a8a674ddf097795ed96d9cb43ad84e0bb939",
      "portable_pdb_magic": true,
      "pdb_guid": "38431eb6-be30-159e-7350-f3fb64ef7594",
      "pdb_stamp": 2919124998,
      "assembly_codeview_guid": "38431eb6-be30-159e-7350-f3fb64ef7594",
      "assembly_codeview_stamp": 2919124998,
      "guid_matches_assembly": true,
      "stamp_matches_assembly": true,
      "expected_pe_pdb_checksum": "b61e433830be9e157350f3fb64ef75940650feadd2b8a56a75145233e922ab76",
      "observed_normalized_pdb_checksum": "b61e433830be9e157350f3fb64ef75940650feadd2b8a56a75145233e922ab76",
      "normalized_checksum_matches_assembly": true,
      "metadata_streams": [
        "#Blob",
        "#GUID",
        "#Pdb",
        "#Strings",
        "#~"
      ]
    },
    {
      "observed_at": "2026-10-07T10:35:00.451023+00:00",
      "url": "https://f.feedz.io/elsa-workflows/elsa-3/symbols/elsa.workflows.core.pdb/a333d4788351bd2b5393ff6ca11d6c14FFFFFFFF/elsa.workflows.core.pdb",
      "authentication": "anonymous-no-auth-header",
      "framework": "net8.0",
      "dll_sha256": "be36d04aa432c4cae84247667f8cd2fdd015f8713e14ebdf090c9c8c0f544be0",
      "publication_performed": false,
      "credentials_used": false,
      "http_status": 200,
      "retrieved_in_prior_probe": true,
      "bytes": 271844,
      "raw_pdb_sha256": "09833e14e56a393f357ea6658abf7e1aab385d2110ac9fc5cd5eb5724e9c018b",
      "portable_pdb_magic": true,
      "pdb_guid": "a333d478-8351-bd2b-5393-ff6ca11d6c14",
      "pdb_stamp": 650828388,
      "assembly_codeview_guid": "a333d478-8351-bd2b-5393-ff6ca11d6c14",
      "assembly_codeview_stamp": 650828388,
      "guid_matches_assembly": true,
      "stamp_matches_assembly": true,
      "expected_pe_pdb_checksum": "78d433a351832bbd5393ff6ca11d6c1464daca26f77c07392b1371446052defe",
      "observed_normalized_pdb_checksum": "78d433a351832bbd5393ff6ca11d6c1464daca26f77c07392b1371446052defe",
      "normalized_checksum_matches_assembly": true,
      "metadata_streams": [
        "#Blob",
        "#GUID",
        "#Pdb",
        "#Strings",
        "#~"
      ]
    },
    {
      "observed_at": "2026-10-07T10:35:00.451846+00:00",
      "url": "https://f.feedz.io/elsa-workflows/elsa-3/symbols/elsa.workflows.core.pdb/e9b8af748d07289fe073c57910bbdf75FFFFFFFF/elsa.workflows.core.pdb",
      "authentication": "anonymous-no-auth-header",
      "framework": "net9.0",
      "dll_sha256": "7fe303533f7eeab0c3daacf72ed78f592c7a5ac3c972aa859121936ad990c35d",
      "publication_performed": false,
      "credentials_used": false,
      "http_status": 200,
      "content_type": "application/octet-stream",
      "bytes": 271864,
      "raw_pdb_sha256": "b38c5ac544fc3999aadd3b1a628e18d16e4ca6e4e5b9eee595c6906835bc2999",
      "portable_pdb_magic": true,
      "pdb_guid": "e9b8af74-8d07-289f-e073-c57910bbdf75",
      "pdb_stamp": 3333278319,
      "assembly_codeview_guid": "e9b8af74-8d07-289f-e073-c57910bbdf75",
      "assembly_codeview_stamp": 3333278319,
      "guid_matches_assembly": true,
      "stamp_matches_assembly": true,
      "expected_pe_pdb_checksum": "74afb8e9078d9f28e073c57910bbdf756fcaadc6080c8a75c2eedba5de7cbcba",
      "observed_normalized_pdb_checksum": "74afb8e9078d9f28e073c57910bbdf756fcaadc6080c8a75c2eedba5de7cbcba",
      "normalized_checksum_matches_assembly": true,
      "metadata_streams": [
        "#Blob",
        "#GUID",
        "#Pdb",
        "#Strings",
        "#~"
      ]
    }
  ],
  "actual_package_publication_performed": false,
  "original_snupkg_archive_readback_proven": false,
  "new_candidate_publication_or_symbols_proven": false,
  "credentials_used": false,
  "sources": {
    "feedz_symbols": "https://feedz.io/docs/package-formats/symbols",
    "portable_key_generator": "https://raw.githubusercontent.com/dotnet/symstore/main/src/Microsoft.SymbolStore/KeyGenerators/PortablePDBFileKeyGenerator.cs",
    "key_builder": "https://raw.githubusercontent.com/dotnet/symstore/main/src/Microsoft.SymbolStore/KeyGenerators/KeyGenerator.cs",
    "checksum_validation": "https://raw.githubusercontent.com/dotnet/symstore/main/src/Microsoft.SymbolStore/ChecksumValidator.cs",
    "pdb_metadata_format": "https://raw.githubusercontent.com/dotnet/runtime/main/docs/design/specs/PortablePdb-Metadata.md"
  },
  "official_algorithm_sources": [
    {
      "repository": "dotnet/symstore",
      "source_commit": "d66992e7c2f32288fbf1acf08cdea43098025c7c",
      "path": "src/Microsoft.SymbolStore/KeyGenerators/PortablePDBFileKeyGenerator.cs",
      "url": "https://raw.githubusercontent.com/dotnet/symstore/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/KeyGenerators/PortablePDBFileKeyGenerator.cs",
      "source_sha256": "c9674986fa3e8f28a6efc2527e2f581c9227774a4552c466798596a1030253e9"
    },
    {
      "repository": "dotnet/symstore",
      "source_commit": "d66992e7c2f32288fbf1acf08cdea43098025c7c",
      "path": "src/Microsoft.SymbolStore/KeyGenerators/KeyGenerator.cs",
      "url": "https://raw.githubusercontent.com/dotnet/symstore/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/KeyGenerators/KeyGenerator.cs",
      "source_sha256": "b9c67caa34f947562dba4cfaed35bc18c23d86c3500476750600426af46574a9"
    },
    {
      "repository": "dotnet/symstore",
      "source_commit": "d66992e7c2f32288fbf1acf08cdea43098025c7c",
      "path": "src/Microsoft.SymbolStore/KeyGenerators/PEFileKeyGenerator.cs",
      "url": "https://raw.githubusercontent.com/dotnet/symstore/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/KeyGenerators/PEFileKeyGenerator.cs",
      "source_sha256": "c625ec80087b98e1930647bed59b99b418c4344cca6aba251d131bd56e3f45fb"
    },
    {
      "repository": "dotnet/symstore",
      "source_commit": "d66992e7c2f32288fbf1acf08cdea43098025c7c",
      "path": "src/Microsoft.SymbolStore/ChecksumValidator.cs",
      "url": "https://raw.githubusercontent.com/dotnet/symstore/d66992e7c2f32288fbf1acf08cdea43098025c7c/src/Microsoft.SymbolStore/ChecksumValidator.cs",
      "source_sha256": "b88b95fba11988b380ae441a67752d29a489cbf81d90e24cb5bd7a24fb5c8e6e"
    },
    {
      "repository": "dotnet/runtime",
      "source_commit": "ea01cd94f644df0c4247f3a1bd995d4edbaf9245",
      "path": "docs/design/specs/PE-COFF.md",
      "url": "https://raw.githubusercontent.com/dotnet/runtime/ea01cd94f644df0c4247f3a1bd995d4edbaf9245/docs/design/specs/PE-COFF.md",
      "source_sha256": "c31bde121508a14e42338ff2fd9b4b46dd3b9400d2abfeead347273e7d0a3543"
    },
    {
      "repository": "dotnet/runtime",
      "source_commit": "ea01cd94f644df0c4247f3a1bd995d4edbaf9245",
      "path": "docs/design/specs/PortablePdb-Metadata.md",
      "url": "https://raw.githubusercontent.com/dotnet/runtime/ea01cd94f644df0c4247f3a1bd995d4edbaf9245/docs/design/specs/PortablePdb-Metadata.md",
      "source_sha256": "9a665fa69840b1e8f20f2f2cb2fd308a990ea3f10e01186cf8302c8d91432ee2"
    }
  ],
  "wrong_guid_negative_control": {
    "kind": "wrong-guid-negative-control",
    "url": "https://f.feedz.io/elsa-workflows/elsa-3/symbols/elsa.workflows.core.pdb/a333d4788351bd2b5393ff6ca11d6c15FFFFFFFF/elsa.workflows.core.pdb",
    "credentials_used": false,
    "observed_at": "2026-10-07T10:35:26.466167+00:00",
    "http_status": 404
  },
  "released_snupkg_archive_check": {
    "url": "https://api.github.com/repos/elsa-workflows/elsa-core/releases/tags/3.9.0",
    "http_status": 200,
    "tag_name": "3.9.0",
    "assets": []
  },
  "algorithm": {
    "derive_key": "lowercase_pdb_filename / GUID.ToString(N) + FFFFFFFF / lowercase_pdb_filename",
    "portable_pdb_identity": "first16bytes GUID plus following4byte stamp in #Pdb; compare DLL portable CodeView GUID and debug-directory timestamp",
    "normalized_checksum": "SHA256(entire PDB with first20bytes of #Pdb stream zeroed); match DLL type19 PdbChecksum record",
    "raw_pdb_digest": "SHA256 of unchanged fetched PDB bytes; separate from normalized PE checksum"
  },
  "limits": [
    "Only existing Elsa.Workflows.Core 3.9.0 from elsa-workflows/elsa-3 was tested, using one public anonymous reader class across three target frameworks.",
    "No 3.10 candidate upload or readback occurred, and no private reader credential rights were tested.",
    "PDB retrieval is proven; original .snupkg archive byte readback is not proven.",
    "The inspected official Feedz symbol/API/CLI docs and service index do not advertise an original .snupkg download route; the public Core 3.9.0 GitHub release had no assets. This bounded search does not establish that no authenticated or provider archive route exists.",
    "No local .NET verifier was executed; binary identity and checksums were verified with cheap Python following the pinned official format and algorithm."
  ],
  "next_approved_executor_contract": [
    "Retain immutable candidate nupkg/snupkg hashes and the raw SHA-256 of each original candidate PDB before approval and upload.",
    "After separately approved symbol upload, derive each lookup key from candidate DLL CodeView metadata, fetch from the exact intended feed using the intended reader class, verify Portable PDB identity and normalized DLL checksum, then compare the raw fetched PDB SHA-256 with the corresponding PDB bytes inside the candidate snupkg.",
    "Keep original snupkg archive readback as a separate explicit contract if required; do not substitute PDB retrieval for whole-archive retrieval.",
    "Preserve the existing associated-PDB and SourceLink checks. Full candidate 3.10 acceptance remains separate."
  ],
  "completed_at": "2026-10-07T10:37:03.912239+00:00"
}

[skip ci] Add immutable consolidated package executor (#8650)

Release preparation dependency: preserve merged #8662

Core main is now e150e837da2c89e1798c5370417091c47085b6bb through #8662. The release skill/profile/helper now require verified Apps containers after package verification and before release completion. This policy must survive the program's final main integration. It does not require interrupting #8664's current package proof: its five changed release-skill files do not overlap the package PR, are outside the package proof input closure, and are not executed by that proof. Final combined/main verification must include the new release-helper tests; the existing cb52 tooling receipt covers the older helper only.

For actual consolidated release preparation:

Retain the configured six canonical Apps images and two exact-version aliases, applicable product selection, both linux/amd64 and linux/arm64, exact reviewed Apps commit/run/attempt, original artifact digest, resolved package-family versions, required feed checks, live registry/platform digests and smoke evidence. Preserve explicit legacy-checkpoint adoption and evidence freshness rules. Build-only or stale receipts are not release acceptance.
Reconcile the generic four-repository/two-feed release route with the accepted first-consolidated-3.10 ADR: Core is the sole package publisher and 3.10 is Feedz-only. Do not republish Studio/Extensions 3.10 or enable NuGet.org merely to satisfy the generic profile. A single publisher repository must not accidentally collapse the intended Core/Studio/Extensions product scope into server-only container selection.
Freshly inspect the adopted Apps producer, protected environments and real publisher authority when preparing the concrete release. Package/PDB compatibility, original-artifact recovery, legacy-publisher containment and cutover remain separately required.

The lead reviewed the read-only integration assessment (SHA256 bfc75108f6a738b6071c2c7c2b9c1ca980c24a464f361392d1ea75019b415d79). No release helper, checkpoint, source PR, registry or deployment was changed; no container dispatch, package publication, announcement or new authorization is implied. #8661 remains the sole active delivery Task. This records required release integration work under the existing #8220 scope, not a second active implementation.

Main integration requirement refreshed after merged Core #8665, commit bf4020b49fb724f439cb9384b99adaa63c2e5a91, on top of #8662.

Final program integration must preserve the strengthened container release policy. Every backend image platform (server, server-studio-server and server-studio-wasm, plus backend aliases) needs successful authenticated identity login, protected workflow-definition JSON and dashboard JSON proving an AcceptingWork runtime, literal acceptance/valid-metrics flags and a nonnegative integer running-workflow count. Studio-only images retain their separate client checks. The profile recognizes Elsa.Workflows.Runtime.Dashboard; an HTTP200 or syntactically valid Dashboard JSON alone is insufficient.

The lead read the four-file change and its regression cases. Those files are disjoint from #8664 and outside its package-proof inputs. Read-only merge-tree of current program candidate e67 plus new main succeeds with tree caa2602543dd3b89b4a9c64d4c8e53bff19ab191; this establishes conflict-free composition only, not combined-head CI or container acceptance. Current #8664 proof remains intact, and final integration must run the updated release-helper checks on its actual combined head.

The prior #8662 provenance, platform-digest, alias, feed-availability, freshness and genuine Apps-producer gates still apply. Reconcile the generic release profile with the accepted first3.10 lockstep/single-Core-publisher/Feedz-only policy without losing the complete Core/Studio/Extensions product image scope. Do not re-enable legacy source publishers or NuGet publication solely to satisfy generic probes. A fresh concrete Apps build/smoke and original release evidence remain required; no publication/deployment or version-tag replacement authorization is inferred from these merged policies.

Read-only operational readiness checkpoint at reviewed controller 78423f7fa1b39ad20c344265e5950d3c58526249. The October7 publisher inventory expired October8 and must be reconciled rather than extended. Current provider workflow-record counts are Core45, Studio9, Extensions10; these are Actions records, not a claim that all64 are publishers. Historical workflow IDs, branch/tag dispatch and rerun authority remain part of the cutover scope.

The lead independently rechecked two old Core Packages runs: 34748690771 (September13 codex-branch push) and 25907099045 (May15 main push) still report QUEUED, each with zero returned jobs. That does not prove credential exhaustion or harmlessness. Their exact immutable source/workflow and eventual disposition must be accounted for before claiming quiescence; no cancellation was performed. The current #8683 CI build/proof runs are separate, with publication selection/deployment skipped.

Current environment inventories contain only Core copilot/github-pages and source-repository copilot environments; no dedicated protected publisher environment is configured. Organization credential-name reachability, provider scopes and revocation/rotation remain unverified. No credential values were read. Current branch/workflow observations and earlier byte/recovery rehearsals are useful preparation, but do not establish operational publisher admission or live authority retirement.

The concrete approval packet still needs exact product/line/source/version and artifact identities; reviewed executor/source guards; intended-reader/feed conflict and byte reconciliation; actual environment/ref/reviewer/credential policy; fresh fully paginated run/job observations and post-containment recheck; and original-byte recovery/stop conditions. Keep capability activation, any first production upload, and archival execution distinct. A production upload is not added merely to demonstrate publisher capability unless the scoped criterion requires it. #8683 remains the sole active Task; #8688 is queued for product-selection/prerequisite implementation. No settings, permanent refs, credential authority, publication or archive state changed.

Follow-up immutable-source check resolves the two queued-run publisher paths. At exact heads c521ac9227b3f447469c0ae5fd2dd8286386fc11 (run34748690771) and d343b30f76b37e8f295253c675c63b8ed18820f3 (run25907099045), their retained Packages workflows enable Feedz publishing for push events after successful build; public NuGet publishing is release-only. Current main's explicit dispatch opt-in does not retroactively guard those definitions. The lead verified the exact workflow Git blob identities and publisher guards. Whether either run can schedule, its build succeeds, or its current FEEDZ_API_KEY resolves remains unknown. Current queued/zero-jobs metadata does not establish prior execution, artifact history or credential exhaustion.

The separate active workflow48109397 is an Elsa2.x publisher retained on branch2.x, with different line/feed scope and historical successful publisher jobs. It must be accounted for and isolated by scope; Elsa3 consolidation does not authorize retiring legitimate Elsa2.x delivery. Do not disable it or revoke shared credentials indiscriminately. Current organization credential-name selection/provider scopes still need authorized read-only verification and a concrete isolation/revocation plan.

These findings refine the operational packet; no run was cancelled or resumed and no source, settings, credentials, refs, package or archive state changed.

Read-only cutover inventory refreshed at 2026-10-09T13:53:42Z while #8683 remains the sole active delivery Task. Studio has 15 open PRs and Extensions has 16; both GitHub pagination walks completed (one page each, below 100 records). All 31 target main, none targets the supported 3.8/3.9 release branches, and none was updated after the 11:56:20Z source-intake snapshot. Core/Studio/Extensions main OIDs remain unchanged. This adds no newly arrived source change to the current release catch-up.

The frozen inventory records exact title/URL/draft/updatedAt/head ref+SHA/base ref+SHA for every PR. JSON SHA-256 12582a44dbcb3edc7ea4781d7968b494b3fc98b3125f185dc35ed026f0a4d642; memo SHA-256 54fb09015ca7eadc0ac2a1f1e6324fd73efa6713a65e1e5c38eb0ee3427c15b6. The lead read the complete memo including all 31 rows. PR API base SHA is a target-side snapshot, not necessarily today's main tip. Review/check/merge eligibility and patch equivalence were not audited in this inventory.

Before archival, reconcile each open source PR with its existing routing/disposition record and any adopted Core PR, preserve contributor work, and refresh this inventory. Open PRs are not automatically approved or required implementations; no PR was merged, closed, transferred or messaged by this audit. This is preparation for the required retirement/archive packet, not archive readiness or operational activation.

Read-only publisher/cutover refresh, observed 2026-10-09 15:31–15:44 UTC. The lead reviewed the bounded inventory and independently fetched all 19 selected workflow files at their exact source commits, matching their Git blob IDs, SHA-256 and UTF-8 byte sizes. Candidate 06605714827989ab991c6385fd1f794aec1b8338 remains under final CI in #8689; actual Core main is still b286a49a25f3a85db9bdd640700118986a771023.

The expired October 7 inventory is superseded for these observations. GitHub currently lists 64 workflow identities (Core 45, Studio 9, Extensions 10), covering 39 current-main YAML files. Dynamic and retained identities are included; these totals are not a publisher count or proof that every historical body remains executable.
Studio and Extensions still contain 3.8/3.9 maintenance and main Feedz publication paths. Current-main Core package publication requires explicit dispatch, while its older maintenance YAML has different triggers. Preserve the separate Core 2.x Feedz/npm/NuGet/Docker delivery line when retiring superseded Elsa 3 authority.
Core's original-candidate executor references elsa-3-10-feedz, but that environment is absent. No current environment provides the required reviewer-protected package boundary. Repository secret names alone do not settle organization scope: organization metadata reads returned 403. External Feedz grants and NuGet/npm trusted-publisher mappings remain unverified.
Two old Core Packages runs remain queued: 34748690771 at c521ac9227b3f447469c0ae5fd2dd8286386fc11 and 25907099045 at d343b30f76b37e8f295253c675c63b8ed18820f3. Their fresh jobs endpoints returned zero jobs. This does not prove absence of earlier artifacts, loaded credentials, or safe resumption. Neither run was canceled or restarted.

Before operational approval, bind the selected product/line and exact source/artifact/version/digests; verify the replacement publisher, protected environment and provider permissions; refresh queued/running jobs and contributor PR dispositions; then prepare the precise authority-retirement, recovery and archive actions. Historical successful publish-job statuses are not current package-byte or permission proof. #8216/#8220 stay open. #8683 is still the sole active delivery Task; #8688 starts only after its acceptance on main.

No publication, credential/settings/ref change, source-authority retirement, or archival occurred. This checkpoint is preparation evidence, not operational acceptance.

Evidence: refreshed memo SHA-256 70b079dd8d72bb019c45a636490d69b5f9046698bbb8acc9bd6f6051856ce145; JSON 38a660fef665ec9e96267861b9da0b8eaa0cd1e1c2a5234f0398d4b7a9436b49; lead independent readback e5f4e9d70b46b0e0ab7d762cc1bb78e1b9a7230fa0db08964acb8f9caf4215e8.

Next hosted custody slice is now native Task #8736, under #8220 and explicitly blocked by #8734 completion. It is Todo / Not Ready / Verification Pending and unassigned; #8734 remains the sole active Task. Scope is a manual main-only checkout-free original reader plus separate verifier for the fixed reviewed A221 packet/ZIP, reusing the existing executor. No publisher job/input, environment/OIDC, credential lookup, producer/build/repack or publication is introduced. Native parent and blocker were independently read back; no existing owner/workflow was duplicated.

Current PR #8735 remains frozen at50e8beb03f04b249969bdf9d783653ad32a20a4a. Exact independent APPROVE/HIGH, Greptile5/5, advisory review and all integration/package-impact checks pass. Only ordinary .NET run38160446477/job114532104083 remains live. No merge, authority activation, publication or archival. The new custody slice prepares the actual hosted input stage; it does not replace maintenance #8693, intended-reader/dist-tag/grant/provenance acceptance or approved publisher handoff.

Publisher and archival action packet — preparation checkpoint 2026-10-11T19:31:52.080470+00:00

This records concrete selected destinations, verified npm preparation and the remaining execution gates. It is not an approval request or permission to activate a publisher/archive. #8734 is the sole active Task; #8736 is queued until8734 acceptance on actualmain.

Current code: main integration #8737 at0240e8aa7f828fec57a1af1929288e5b327199c3/tree64e27ff44d311ef8af9a01b738371465b91b3028 is under fresh cumulative review/CI. Shared correction #8739 passed all exact644 gates and merged normally. Actualmain remains6d9c58045dfaa197ad8f53d03db773900551acbe. Publication policy is unset, and no native npm publisher exists yet.

Original custody action: #8736 will retrieve original provider artifact11607565131 from producer37911724081 attempt1/sourcea221888910e96711d07e66f86f6e698edde6524b/tree0407d373f981c9b29e491b739051e200214682ea. OriginalZIP94,760,475bytes/SHA2563f05853f6fad6fbac7389d9cf12825bc0914e457feb5dd79f57db7914a1d96fe; retained receiptSHA2562957ac31ccedf69e702becd6b714d1a076970dbafd0aa4aebf4bbe6fd1a83280; literal reviewedpacketSHA2560af4dd27274201e2cb6d13d8d4709304cd4e0da2c0603260d3e3355e4c3703f4. Its version0.0.0-proof.37911724081.1 is permanently unpublishable. The checkout-free reader transfers the unchanged original file to a separate clean exact-source, credential-free verifier. The lead's reviewed nonpublishing native proof is already authorized; workers cannot dispatch. Original expiration is revalidated, never bypassed or extended by transfer. Actual644 local verification already passed for both allowlisted registries anonymously without uploads; original consumer replay remains actualc358, not hosted proof.

Selected maintenance destinations: Core maintenance/studio/3.8.4 from9bff3f785fd13bd80a3a7ecf88fec4aec8eef7ae; maintenance/studio/3.9.0 froma30ed7c997dfb3cff1d5d095a4ee19ff03c7fe42; maintenance/extensions/3.8.4 from154ba15fb4da85b4bebecfbe43639579cbda1d0d; maintenance/extensions/3.9.0 from89d4eb9b739ae135604aac2a1de18653a289bdb0. These raw pins are provenance starting points, not safe invocable workflow tips. Reviewed containment descendants, ref-scoped protection and complete #8693 maintenance proof must precede permanent activation. Existing Core release refs stay intact. #8693's MySQL/.NET10 owner choice and all seven criteria remain open; no narrower support is selected.

Future operational sequence: finish the actual maintenance and hosted original-custody proof; review exact contained maintenance descendants/protection and permanent refs; bind both existing npm IDs to the reviewed Core workflow/environment/ref/reviewer and original release-candidate packet/action; verify provider identity/grants, intended-reader visibility, dist-tags, serialization and immutable partial-pair recovery; prepare provider/admin authority changes and old-publisher retirement/revocation; account for all in-flight/unknown outcomes; refresh contributor registers at freeze and verify recovery; then request final approval for archiving exactly elsa-workflows/elsa-studio and elsa-workflows/elsa-extensions. Actual registry uploads need a separately identified reviewed release candidate and per-candidate authorization. Proof bytes are never relabeled/repacked into releases.

The latest dated authority readback18:10UTC found all four proposed Coremaintenance refs absent, no required-reviewer publisher environment, source package workflows active, and two old Corepush runs queued/jobs0; queue presence is not quiescence. Organization secret metadata was permission-unavailable, and names never prove actual registry grants or revocation. Recheck live state before any concrete approval request; do not treat this dated observation as present activation proof. The16:27 contributor snapshot contains205issues and31PRs, requiring final freeze reconciliation.

The selected archive-first sequence does not wait for full3.10/browser #8643, but independent product releases, full3.10 and remaining required program outcomes remain open afterward. #8636 updater correctness is required program work, not an archival prerequisite. No publication, credential/trust/protection/ref activation, source-authority retirement, deployment or archival occurred through this preparation.

#8736 bounded custody closeout

Task #8736 is accepted and closed: all seven criteria and independent evidence. PR #8766 normally merged at fd98ccf807b24f88d1e847948ea2c1fb6ee6feb5 after fresh exact-head independent APPROVE/HIGH, Greptile 5/5, zero unresolved threads and applicable CI. The single native custody run 38308812342, attempt 1, succeeded; original/transfer/evidence artifacts, exact original ZIP/packet/receipt, clean executor and actual job permissions were independently read back. Both registry observations were anonymous-public missing-pair results with zero uploads.

This closes hosted nonpublishing original custody only. The fixed proof version remains permanently unpublishable. Actual maintenance artifacts/consumers, publisher trust/grants/intended-reader access/serialization/dist-tags/source-retirement, controlled publication/recovery, full release certification and archival remain open under #8741 and the relevant existing owners. No credential/trust, maintenance-policy, deployment or archival action was taken.

Project #52 #8736 is Done / Accepted / Verification Passed. The lead stops at this verified closeout; no next Task is activated. Recommend resolving #8693's MySQL/.NET10 support decision before resuming its existing #8694 maintenance artifact/consumer work. Feature #8220 and Program #8741 remain open, with their criteria unchanged.

Navigation Menu

Repository navigation

[Feature] F3.4: Artifact provenance, release notes, and recovery procedures #8220

Additional owner requirement — individual product releases, 2026-10-08

Owner decision — archival sequence, 2026-10-08

Outcome and scope

Acceptance criteria

Readiness

Current delivery evidence — 2026-10-06

Current preparation — 2026-10-07

Candidate freshness before publication

Release preparation audit — refreshed 2026-10-06

Imported Dependabot operational evidence — 2026-10-06

Source publisher preparation: ref-specific gaps

1 remaining item

Release preparation dependency: preserve merged #8662

Publisher and archival action packet — preparation checkpoint 2026-10-11T19:31:52.080470+00:00

#8736 bounded custody closeout

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

[Feature] F3.4: Artifact provenance, release notes, and recovery procedures #8220

Description

Additional owner requirement — individual product releases, 2026-10-08

Owner decision — archival sequence, 2026-10-08

Outcome and scope

Acceptance criteria

Readiness

Current delivery evidence — 2026-10-06

Current preparation — 2026-10-07

Candidate freshness before publication

Activity

sfmskywalker commented on Oct 6, 2026

Release preparation audit — refreshed 2026-10-06

sfmskywalker commented on Oct 6, 2026

Imported Dependabot operational evidence — 2026-10-06

sfmskywalker commented on Oct 6, 2026

sfmskywalker commented on Oct 6, 2026

sfmskywalker commented on Oct 6, 2026

Source publisher preparation: ref-specific gaps

sfmskywalker commented on Oct 7, 2026

1 remaining item

sfmskywalker commented on Oct 7, 2026

sfmskywalker commented on Oct 8, 2026

Release preparation dependency: preserve merged #8662

sfmskywalker commented on Oct 8, 2026

sfmskywalker commented on Oct 9, 2026

sfmskywalker commented on Oct 9, 2026

sfmskywalker commented on Oct 9, 2026

sfmskywalker commented on Oct 9, 2026

sfmskywalker commented on Oct 11, 2026

sfmskywalker commented on Oct 11, 2026

Publisher and archival action packet — preparation checkpoint 2026-10-11T19:31:52.080470+00:00

sfmskywalker commented on Oct 12, 2026

#8736 bounded custody closeout

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions