[Task] Restore Dependabot discovery for imported Extensions and Studio projects #8636

Current delivery — 2026-10-11 16:36 UTC

Task #8734 is now the sole active delivery Task: In Progress / Assigned / Verification Pending, implementing immutable Core Studio npm publication/recovery preparation. Task #8636 remains OPEN, now Todo / Not Ready / Pending for a tested upstream correctness candidate; all failed operational receipts and unchecked acceptance criteria remain preserved. Its resume gate includes correct conditional declaration selection, complete native operations/byte reconciliation, full inventory/version/feed/proposal coverage and the managed runtime bound. No unchanged updater retry or acceptance waiver is implied. Structural consolidation is accepted: sibling core/, studio/, and extensions/ on Core main are the development source of truth. Actual main is now 6d9c58045dfaa197ad8f53d03db773900551acbe, tree a842d713cb6157f80e819aee6c04842ca116e215. Post-merge Packages 38154054586 is now terminal SUCCESS at exact6d9: unit/integration, component, coverage and package build passed; publication selection, Pages, NuGet and Feedz publication were skipped. Prior main Packages38138452395 remains historical passed evidence.

New bounded correctness evidence: local upstream test-only commit7f09fcce8a779a546ebce8936c6e02d9b5a53558/tree3b3eab58b4caccd4fc7f07643b0698ad261a1804 reproduces the conditional CPM wrong-row write through the real XmlFileWriter. SDK10.0.400 focused suite completed32.010s:94existing tests pass,1new regression intentionally fails,0skipped. Requesting unique original9.0.13→10.0.12 changes firstnet8row8.0.24 instead. Lead source/TRX audit and fresh independent exact-head APPROVE/HIGH accept this failing regression only. Production helper unchanged; no upstream submission, native rerun or fullTask acceptance. The concrete upstream case is retained locally. No more logger-only work or identical55minute reruns.

Archive-first scheduling correction: live parent/dependency/acceptance audit confirms finish8636first was queue order, not an archival dependency; full8643browser certification is explicitly post-handoff/archive. NewTask8734 is nativechild8220, references8216 and the existing8725 npmcheckbox, preserving all8725othercriteria. Closed8679 is its native prerequisite. Full163item readback verifies8734 the only active Task;8643 remains the shallow ready buffer and8693 remains NotReady for the unanswered MySQL/.NET10 choice. WorkerSol6.1High owns a clean isolated6d9-based branch, root integration/QA. Implementing a publisher does not activate it: no upload, credential/OIDC request, sourceauthority retirement, environment/ref provisioning or archival is performed. All operational approval gates remain.

Contributor freshness: complete paginated source inventories at16:27UTC still contain205issues (137Studio/68Extensions) and31PRs (15/16), with no added/removed identities and unchanged PRheads/bases/contributor metadata. OnlyStudio1127 updatedAt/labels/milestone differ from the accepted register; its bug/triaged labels and3.10milestone are recorded in the private comparison. This is a dated observation, not an atomic freeze or permission to close/transfer anything. Reconcile this metadata before final freeze.

Forward integration #8730 merged normally at13:45:06Z as f080341e4820eeccdac260129809c8ddecca48d5. Lead verified ordered parents090a70e + reviewed7064381 and exact reviewed tree7879ff2. Exact-head independent APPROVE/HIGH, Greptile5/5, advisory review, resolved threads and applicable CI passed. Original package proof 38139974536 and artifact11704121492 were audited directly by the lead and an independent reviewer:232 packages +232 symbols,9,898 source-input hashes, one representative consumer across three TFMs and six admission cells. This accepts that proof's stated scope, not every consumer or publisher cutover. The inherited Bugbot wording nit is prepared for following reviewed main integration.

Retained-helper repair #8731 merged normally at14:30:51Z as 8007fb6aba40dbc109f62c2b75189180166b6bf6. Lead verified ordered parentsf080 + reviewed67 and exact reviewed treef3ba6d. Exact-head source review APPROVE/HIGH, Greptile5/5, CodeRabbit, all three resolved threads and19 terminal checks (16 successful, three expected skips) passed. Original package proof38143468862 passed; artifact11704687919 SHA256831dd75986c0fc0276ca551bccc6cddda52dbb41fba0e3e726598356e918294a passed lead and independent original-ZIP audit (APPROVE/HIGH):232 packages +232 symbols,9,898 exact source-input hashes,689 framework provenance records, six browser assets and195 loaded assembly/package-byte bindings across the representative consumer and six admission cells. Raw per-cell process logs are not archived and fixture UTC start identity remains self-reported. All19 module-test consumers retain net10/MVC10.0.9. Lead admission.

Main integration #8733 merged normally at16:06:13Z as 6d9c58045dfaa197ad8f53d03db773900551acbe. Lead verified ordered parentscb34 + exact reviewedf5 and exact reviewed treea842; accepted8730/8731 actual history is retained. Exact-head independent Elsa3 APPROVE/HIGH, two clean lead passes, Greptile5/5 atf5, CodeRabbit reviewed coverage/noactionablecomments, both resolvedthreads and25 successfulchecks/threeexpectedskips passed. Normal/C-locale discovery tests13/7431, guidance10 andactionlint/diffcheck passed. Original package proof38150111158 artifact11707805623 (96,968,336bytes; SHA2561ce2200d0dfbe5c0fcd03848ab9b1054b776bfc241b69bbdf53299e73152cedd) passed lead and independent original-ZIP audits APPROVE/HIGH:232packages+232symbols,9,898source-inputhashes,689frameworkprovenance records,195loadedassembly/packagebytebindings, one representative consumer/threeTFMs and six admissioncells/354true scenarioassertions.17,178 tracked provenance document records matched;2,134externaldocuments notrefetched/1,999generateddocuments notregenerated. Independent audit's initial parser holds (symbol archive, runtime/enriched row projection, provenance categories) were corrected and retained; noartifactfinding remains. Rawper-cellprocesslogs absent and fixtureUTCidentity selfreported. Lead admission. PR row Done/Accepted/Passed atcode/CI/boundedartifactscope only. NativeclosingIssuesReferences unexpectedly auto-closedTask8636 atmerge despiteRefsbody; leadcaughtthisinpostmergecompletionaudit, reopened16:09:34Z withtransparentcomment and restoredInProgress/Assigned/Failed. Full162itemreadback confirmsTask8636soleactive andProgram8194open. Futuremergepreflight explicitlychecks nativeclosinglinks alongsidebody/commitkeywords. Shared target codex/elsa-integration-program normally fast-forwarded to accepted actualmain6d9, noforce/historyrewrite. Task8636 and fullprogram remainopen. No publication, deployment, maintenance activation or archival performed.

Fresh diagnostic-only native probe 38144025419, helper heade5a2d23 targeting exact67/f3, completed successfully. Original artifact11703559257 passed ZIP/provider-digest/CRC and independent audit; lead verified all10,949 tracked source hashes and the379 tracked /355 solution /356 selected /173 imported-project census. The one requested retained workspace returned four records, including the helper and three referenced Core projects, where the earlier retained probe returned none. The other352 selected paths were unrequested, not failed. The aggregate retained row reports three TFMs and50 dependencies;32 lack native version reporting and one literal central mismatch requires per-TFM attribution. This is presence evidence only: full native/managed acceptance, per-TFM versions, configured Feedz resolution, proposal/current-version results and hosted helper binary equivalence remain unproven. The diagnostic helper is not production code.

The four original managed product runs38138459021/38138459953/38138460548/38138462077 ended at the provider's explicit55-minute limit; tooling38138463197 succeeded. Independently reproduced discovery intervals account for85–93% of updater-step elapsed time. Pinned source shows initial closure overlap plus per-project/per-TFM writer rediscovery; grouping all dependencies does not remove that loop. A17-shard cost partition is accounting only, with no proven full-job runtime bound. Lead independently reproduced both cost and stricter marker-bound native JSON extraction:29 successful nonempty workspace payloads contain54 project rows covering30 unique selected paths. Rejected/malformed payloads retain unknown success. The same Core-tests partial bytes yield the same three strict successful payloads as terminal bytes; the earlier one-object result came from a different outer-transport parser. Historical evidence is preserved. These counts do not establish356-project coverage, per-TFM versions or proposal acceptance. No unchanged managed rerun or new configuration is authorized by this checkpoint. Dependency PRs #8543/#8729 remain outside this Task's merge scope.

Bounded native writer diagnostic 38148578231, helper04141/treee8fd92, FAILED at14:49:32Z, native job114497029147. SDK10.0.400/pins/inventory and upstream CLI build passed; caller_build exited1 after44.891s, before native producer or writer execution. Original artifact11706510460 SHA256372d2eeff48acf450fdca8170c79e0775e469ee05286987518ae4f93c9c5f51a passed lead and author-independent integrity/pin/stage audit as an accepted FAILURE receipt only. Raw original compiler error is unavailable. A separately labelled local build on checksum-verified official SDK10.0.400 and exact d3bc/submodules reproduced IDE0055; a formatting-only two-projection correction compiles with0 warnings/errors and matches committed Program.cs hash. This does not prove the unavailable hosted cause.

The corrected helper is pushed at c0a31c92ccc55a828b7a65a763de17d161aceb6f, tree 75b452d176ce3fbbc19cf956631e2c9c418407de.55 normal/optimized tests pass; root two clean formatting-only passes, compile-log/source hash replay and independent exact-head APPROVE/HIGH completed before dispatch. Exactly one new diagnostic 38149800279 ran15:05:03Z–15:09:40Z, native job114500692668, and FAILED verification; ordinary tests were expected skipped. Upstream build57.085s, caller43.415s, producer14.997s and actual native writer97.687s all returned0. The receipt has43 events,13 ordered discovery pairs, nine attempts and six missing-dependency warning observations. The central file changed transiently then returned to its original hash; observed operations are empty. A different Core API-client project changed unexpectedly, so changes remain unaccounted and per-TFM after readback is empty; all completion/update/full-acceptance flags remain false. Original artifact11706083431 SHA25627c1a6f7cc2621c6e90ea9701afeadc872af6322346c3a392cd07cd0e22570d5 passed lead provider-size/digest/CRC/single-summary/source/caller/pin checks; independent audit APPROVE/HIGH confirms an intact failure receipt, not runtime acceptance. Original checkout and upstream tracked files stayed unchanged. Investigation confirmed an early-return reporting defect that drops the central hash before after observations can bind. The two-file correction is now pushed at exact7dc3b1b72d6824d23ad46fd5d93791825186ea53/tree d3583de148742bf3d7930c88c1c00ef8599d8ef4, after58 normal/optimized tests, two clean lead passes and author-independent APPROVE/HIGH. It retains independent after observations while every unexpected write still fails all acceptance gates. A capped hash-only classifier diagnoses the single unexpected project without emitting source content or waiving the change. Exactly one new writer-smoke diagnostic38151477064 ran15:29:25Z–15:33:47Z and FAILED verification at that exact helper head. Official/caller/producer/native stages49.605/40.508/14.095/98.627seconds all returned0; all six framework evaluations returned0. Final readback now binds all three unchanged versions8.0.24/9.0.13/10.0.3 to the final inputs. The Core APIclient changed only by UTF8BOM removal: baseline719bytes→716, and the lead reproduced both before/after hashes from exact target Git bytes. This change remains unaccounted, observed operations remain empty, requested target was not reached and every completion/update/fullacceptance flag remains false. Original artifact11706727240 SHA2560b0504cbfb1c1557d93a007c9cc6ae1054f5f5f7c734935b18e1daff3601efb4 passed lead provider-size/digest/CRC/closed-summary/pins/SDK/caller/targetarchive/event and baseline-byte checks. Author-independent audit is ACCEPTED_FAILURE_RECEIPT/HIGH, not runtime or Task acceptance. The lead reconstructed the exact target Git archive and matched its reported hash; hosted raw archive/evaluation payloads are not retained in this summary-only ZIP. SDK/runner filesystem rechecks remain receipt-reported; supplied local upstream has a known untracked diagnostic scratch directory, not a tracked source change. Originalcheckout/upstream trackedfiles remain unchanged. The closed-reason correction was committed/pushed as1ac87bdae7d694b68476c968d6e0e9548ad2bfbc/tree89f79c4b052af601c1da7457ce4c8b54e147293a after60normal/optimized focusedtests, exactcallercompile/syntheticloggercases, two cleanleadpasses and independent APPROVE/HIGH. Exactlyone new diagnostic38153465432 ran15:57:51Z–16:02:36Z and FAILED. Official55.793/caller44.439/producer19.506/native101.604seconds returned0; sixevaluations0. The intact originalartifact11707721949 (12,657bytes SHA256d84fd413a9f1b594a10314d976ead4f0b5a8aebb387dc1b7de7d9e8dd440d018; summary805871b1693c877bb0a3285d7a6b05ff670f1ccc389c7dfb4531ca05cf6d9b22) passedlead originalZIP/provider/CRC/duplicatekey/caller/Gitbaseline/eventchainchecks; author-independent failureaudit ACCEPTED_FAILURE_RECEIPT/HIGH, complete reports read and admitted bylead asfailureonly.46events/13orderedpairs/9attempts now include THREE observed final version_mismatch causes, bound to attempts3/6/9 and discoveryordinals5/9/13. This identifies the actual final-version validation rollback branch for thisfreshreceipt; conditionalrow and writerloopTFM remainunexposed, notinferred. Finalversions8.0.24/9.0.13/10.0.3 unchanged; emptyoperations; BOM-onlyAPIClientwrite stillunaccounted and everyupdate/completion/fullacceptance flagfalse. Priorhistoricalcause remainsunknown. No unchangedrerun. Solread-only assessment and lead independent reconstruction now show: replacingonlythe exacttargetcentral SignalRnet8 row8.0.24→10.0.12 yields transientSHA25612bd5d5ce01bed6080fbbaf31420831e8425ce02ef9ee8cfb54c05d555bd3ce2 observedbefore allthree rollbacks; singletonnet9/net10variants do notmatch. This is bounded byte-reconstruction evidence, not retainedhosttransientbytes or writerTFM observation. Checked officialdependabotv0.399.0/currentmain4725d253 retain identical relevantwriter/XML/discovery/experimentlogic; no supportedconfiguration-only fix wasestablished. nuget_find_root_directory addresses aseparate unproven discovery-cost route. A concrete upstreamdefectcase is preparedlocally, notfiled; nextfunctionalretryrequires a testedcorrectnesscandidate or explicitowner-approvedversionpolicychange. No morelogger-only orunchanged55minruns planned; allfullinventory/feed/proposal/managedgates remainopen. Historical c0 BOM attribution remains unknown; the new receipt does not retroactively characterize old bytes. No unchanged diagnostic rerun is planned. Workflow remains explicit opt-in/off default, read-only, disabled checkout credentials, SDK10.0.400, closed summary-only7-day artifact. It invokes public pinned UpdaterWorker for one producer-derived public SignalR request in a disposable snapshot. Python840-second scope includes clone/build/producer/writer/readback/cleanup, excluding hosted checkout/SDK; no strict whole-job840-second claim. No accepted native result. Writer-loop TFM/native rerun survivors remain unexposed/unknown; Feedz not supplied; full356/173, proposals and managed equivalence remain unaccepted.

Read-only projection of the actual six-cell run38070354211 headd91 confirms both Core lines failed at package-verification/source-producer-unverified after planning/source preflight succeeded. Original log digests and safe JSON projection were independently reproduced by the lead. Exact package/framework/check identity was not retained publicly and no Core artifact exists, so product-source fix status remains unknown. PR #8694 contains a plausible verifier correction and safe diagnostics, but source CI/review is not native acceptance. #8693 still awaits the explicit MySQL/.NET10 compatibility decision; its seven criteria remain open. A fresh49-project source/reference audit shows an EF9 remedy must align every co-installed EF component/provider, including shared Core and direct AI/UserTasks references, not only Extensions MySQL. Separate DbContexts/shells do not isolate EF major versions. EF9 remains an unverified coherent application baseline, not a safe global downgrade. A fresh official support-policy check changes the lead recommendation: Microsoft lists EF9 support ending November10,2026 and EF10 support ending November10,2028. Pomelo9 requires EFRelational9. Preserve EF10 on.NET10 and investigate a supported compatible MySQL/MariaDB route by default; EF9 would be an explicit short-lived bridge choice requiring coherent co-installed-package validation. The owner has not made this choice. No provider replacement, support narrowing or publication is assumed. Fresh primary provider audit found released EF10 candidates claiming bothMySQL/MariaDB: Microting10.0.12 (MITfork, renamedassembly/namespaces, net10-onlywithnet8routeunresolved) and Devart10.2.223.10 (commercialprovider/clientchange). Both requireRelational>=10.0.12 againstauditedElsa10.0.9. Neither is avalidateddrop-in remedy; PomeloEF10PR2047 remainsunreleased andOracle doesnotestablishMariaDBsupport. Microting package / Devart package. Ownerchoice remainspending; preserveallengines/TFMs/49projectcoinstalledclosure and originalsevencriteria. No fork/commercial/providerreplacement isselected. Staged Core prerequisite publication remains a separate concrete authorization gate. Task8734 was activated only after8636 moved to its explicit external waiting gate; no second active leaf remains.

Full board readback confirms163 items, #8734 the only active Task and #8636 Todo / Not Ready / Pending with its failed receipts preserved; #8730 Done / Accepted / Passed at code-and-CI scope; #8731 Done / Accepted / Passed at code-and-CI scope; #8733 Done / Accepted / Passed at code/CI/bounded artifact scope; #8643 Todo / Agent Ready / Pending; #8693 Todo / Not Ready / Pending for the existing MySQL/.NET10 decision, all seven criteria open. Fresh16:00 release audit reverified39raw3.8/3.9refs unchanged and all35logicalreleasecommits as exactf5ancestors, nowretainedbyactualmain6d9; sourceheads unchanged and lateststable3.9.0 inallthree repositories. Donors remain unarchived. Independent releases, maintenance containment, publisher cutover, recovery, approved archival and all remaining E1–E9 outcomes remain required. No Task/Program closeout or publication follows from this checkpoint.

Current corrective delivery — 2026-10-11

This Task is now the sole active delivery Task, In Progress / In Review / Verification Failed after bounded probes; operational acceptance remains incomplete. #8693 is Todo / Not Ready / Pending while its native proof awaits the unresolved MySQL/.NET10 support decision; its exact291 controller CI/review remains owned in the separate verification lane. No acceptance criteria are waived. #8688 remains closed and accepted.

The October 8 owner decision permits coordinated Core/Studio/Extensions dependency proposals with applicable checks for every affected product. It supersedes the historical requirement below to preserve strict product-only proposals or separate updater entries where that prevents a working correction. The old product paths and inventory counts below describe earlier runs, not the current target.

Earlier source snapshot 570aaa95b09a7043273df2bcd4f533f216804694 (tree cfc65f4e6db94b06eb6794a67acec4f3143531ec) had root core/, studio/, extensions/ and one root Elsa.sln. The tracked tree contains 100 Extensions and 73 Studio projects. Root Elsa.sln lists 355 projects and covers 172 of those 173 product projects; the retained extensions/src/Elsa.Testing.Extensions project remains outside the solution and requires explicit native disposition. The former src-only coverage contract checked 149 product projects and omitted 24 test/sample paths (23 Extensions, one Studio). Reconcile all 173 product paths with actual eligible updater discovery and evaluated central imports. Core has 183 tracked projects for reference-graph context; this does not infer native discovery from tracked or solution counts.

Fresh activation verified the native parent #8220 and zero blocking dependencies. None of the62 open PRs matches this discovery/configuration correction; generated dependency-update PRs remain separate. The clean isolated worktree is /Users/sipke/.codex/worktrees/dependabot-solution-discovery-8636/elsa-core-main, branch codex/dependabot-solution-discovery-8636, starting from actual main 3cc81c652906fc0e18a2ec0c6732308440f8c720. Refresh the recorded inventory/configuration and recent native updater results before editing; the historical 570aaa counts below remain attributed to that snapshot. Current generated PR8673 is evidence to inspect, not authority to merge dependency updates. Adopt a matching PR if one appears. Use an isolated worktree, preserve user changes and retain the recorded narrow default-branch verification sequence.

Bounded correction

• Correct the current updater entrypoints/configuration to avoid the repeated project discovery that caused both 55-minute timeouts. Reuse the existing solution/native updater behavior where suitable. Coordinated proposals may include referenced Core and product central files; account for every affected product. Do not redesign the upstream updater or introduce an unrelated automation platform.
• Keep change scope to updater configuration, directly required discovery/coverage contracts and CI wiring, and its documentation/ledger. Preserve registry identities, secret-name boundaries and intended update coverage. Explain any necessary schedule/group/entrypoint adjustment. Do not change package versions or credentials, publish artifacts, activate publishers or merge generated update PRs.
• Verify against the actual pinned native updater behavior before another hosted run. Reconcile the complete tracked product inventory and actual central versions, and preserve the separate disposition of retained Elsa.Testing.Extensions; do not drop it merely because restore fails or it is outside the solution.
• After the reviewed correction reaches default main, inspect actual completed hosted discovery/resolution and update/current-version results. Prove configured Feedz package resolution where exercised; retain an explicit gap otherwise. Status-only success, root-tool-only discovery and the old synthetic timing fixture do not satisfy operational acceptance.
• Require the repository's exact-head independent Elsa 3 APPROVE + HIGH, applicable green CI and Greptile gate before the authorized ordinary merge. Forward-integrate that accepted configuration into the program branch without landing unrelated work.

The coherent correction is now draft PR #8719, pushed at c0f470853bfa8fbf9c3266df75da48cb859f9799, tree 51aa6e0938cd24732d8a285f701dc6b614b63a69, based on actual main3cc81c. The lead integration worktree is /Users/sipke/.codex/worktrees/dependabot-solution-integration-8636/elsa-core-main, branch codex/dependabot-solution-integration-8636; the author checkout remains frozen at b822. Six files change: one coordinated NuGet job selects root solution and the retained testing project; all379 tracked projects/356 selected/all173 Extensions+Studio paths and literal central imports are reconciled; three functional/configuration blobs are unchanged from b822. Both review findings were corrected and the active ledger now records this real PR while preserving #8495/#8640 provenance. Core adopts daily06:00 Europe/Amsterdam; one-PR cap and Elsa grouping apply across the coordinated job. No versions, project files, credentials or publishers changed.

Independent Luna6 Extra High source review is APPROVE + HIGH at c48cdb4, based on full b822 review plus the complete three-file correction delta and verified unchanged functional pins. Author and lead Ruby each passed seven tests/1,538 assertions on b822-identical functional blobs. The original normal Python run remains recorded as17/18: a staging-window active-blob mismatch; complete committed ledger/receipt rechecks passed normal/optimized and complete product_layout passed six/mode at b822. Lead final-c48 production ledger CLI passed normal and optimized with163assets/receipt comparison. No full optimized mutation-heavy ledger-suite pass is claimed locally. Greptile's c48 score4/5 identified a valid missing discovery-document trigger. That one-line correction is now pushed at c0f, and independent source review re-confirms APPROVE + HIGH at c0f4708. Root before/after path matching and actionlint pass; the other five changed blobs are unchanged. Fresh exact-head CI/Greptile/CodeRabbit are requested; older-head evidence does not transfer. A separate manual-only hosted native preflight is being prepared in an isolated worktree under this Task, with no push/execution yet. Native output can omit failed project records; all356 selected rows require explicit reconciliation, with omissions/failures left unaccepted.

The pinned native discovery plan uses the actual upstream DiscoveryWorker rather than treating the Ruby model or graph API as full evaluation. Its original private helper binaries are absent; reconstructing the pinned helper requires compatible SDK10.0.400, while this host has10.0.300. The current overloaded host does not supply a trustworthy production timing bound. No heavy helper build, native restore/discovery or new hosted updater run was launched. Retained-project NU1008/NU1010/empty-result disposition, evaluated central versions, full native/hosted inventory and applicable configured-feed proof remain open. Original preparation reports retain their earlier scope; generated Studio PR8673 narrows but does not close the operational gap.

The previously checked acceptance boxes below retain their original code/configuration snapshot scope. They do not approve the new correction or waive the remaining operational criteria. #8636 remains open until current inventory, central-version, result and applicable feed evidence satisfy its acceptance. This queued correction is part of the full program; it is not newly asserted as a prerequisite to archival.

Historical scope and evidence (preserved)

Owner decision — coordinated dependency updates, 2026-10-08

The owner selected option 1 in the delivery chat: dependency-update PRs may change Core, Studio and Extensions together where their shared/reference graph requires it. Every affected product must receive applicable CI and review. Strict product-only changed-file isolation is not required. This resolves the ownership choice raised by the native updater diagnostic.

#8636 is eligible for corrective planning against the current root core/extensions/studio layout. Preserve the original failed/time-limited operational evidence and complete inventory/version/feed acceptance; the policy choice does not make those checks pass. Refresh current configuration and adopt any matching PR before implementation. Do not rerun the old configuration unchanged or merge generated dependency updates without their ordinary gates. This record does not claim a successful updater run or alter package versions, feeds or credentials.

The remaining Hosted Studio routing choice in #8643 will be presented next. The selected archive-first sequence keeps its full release-certification work in the later 3.10 deliverable.

Program: #8194
Parent: #8220
Related: #8216, #8219

Readiness and dependencies

Previously active as the program's sole delivery Task after #8631 was accepted through merged PR #8635 (fc967930ac2b47895a4231e4f12352ec6dd955b7). Activation checks confirmed native parent #8220 and no blocking dependencies. The correction merged through PR #8640 on main and PR #8642 on the program branch; operational acceptance remains incomplete. Queue order is not a technical dependency.

Target main directly for this operational configuration correction so Dependabot can exercise its default-branch configuration, then forward-integrate the same accepted config commit into codex/elsa-integration-program. This narrow default-branch requirement is part of the Task's verification; it does not land pending product/release changes or wait for full program completion.

Outcome

Dependabot version updates discover the imported NuGet projects under src/extensions and src/studio, evaluate each product's central package versions, and produce correctly scoped update proposals or explicit current-version results. Green runs that discover only the root dotnet-tools manifest do not satisfy this Task.

Scope

• In .github/dependabot.yml, change the separate Extensions and Studio NuGet update entries from singular directory paths to plural directories with recursive product-specific selectors, using /src/extensions/**/Elsa.* and /src/studio/**/Elsa.* to select every tracked project directory without also selecting 1,000 empty directories. Terminal /** proved insufficient in the first actual runs. Validate against the native NuGet updater PathHelper directory matcher, corroborate with Ruby glob expansion, and reconcile all tracked manifests, including future deeper paths. Python recursive path enumeration is not an equivalent check.
• Preserve the separate product entries and their current target branch, schedules, registries, PR limits, group rules and commit-message settings. Preserve the root weekly NuGet entry and its exclusions for both product subtrees.
• Keep correction, regression, CI wiring and migration-ledger evidence in the adopted focused PR Fix recursive Dependabot project discovery and validate coverage #8640. Do not include dependency version changes, publication changes, publisher cutover, secrets work, or changes to the candidate/package workflow in [Task] Prepare a nonpublishing consolidated 3.10.0 candidate #8631.

Acceptance

• Dependabot configuration validation passes. Static inspection confirms each recursive selector covers the intended eligible product projects, the Extensions and Studio entries remain separate, and the existing root exclusions and per-entry settings are preserved.

• After the configuration is on default branch main, completed Extensions and Studio Dependabot runs each report discovered projects under the corresponding product subtree. Neither result is Projects=[], No project files found, or discovery of only .config/dotnet-tools.json / dotnet-ef.

• Sanitized run evidence shows discovered projects evaluate the corresponding src/extensions/Directory.Packages.props or src/studio/Directory.Packages.props and records their resolved central-package versions. Reconcile discovered projects with the intended eligible project inventory and explain exclusions.

• For each product, an updater result demonstrates either a scoped update proposal with versions consistent with the evaluated inputs or an explicit current-version result for the discovered projects. A green workflow status alone is insufficient.

• Where discovered projects use a package from elsa-feedz-preview, updater evidence shows successful configured-feed resolution/version access. Do not inspect or expose credentials. If the run does not exercise that registry, leave Feedz access unverified and record the gap explicitly under [Feature] F3.4: Artifact provenance, release notes, and recovery procedures #8220. Publicly accessible package metadata alone does not prove authentication; do not infer missing credentials from an empty discovery run or a registry response without a package-resolution trace.

• Any generated dependency-update PR remains subject to ordinary review and merge gates; this Task does not merge dependency updates.

• Exact-head repository review and CI gates pass before merge; forward integration of the same accepted configuration into the program branch is recorded.

Verification sequence

1. Validate the YAML and check the selector match set against the product projects. Review that the two product entries remain disjoint and the weekly root exclusions are intact.
2. When activated, target main directly and merge the config correction there; target-branch for both product entries is main.
3. Capture the first completed updater run for each product after that merge, including its run ID, head SHA, and sanitized discovery/resolution output.
4. Check nonempty project discovery, central props evaluation, scoped proposal or explicit current-version result, and Feedz access where exercised. Do not close this Task on status-only green evidence.
5. Forward-integrate the same config commit to codex/elsa-integration-program and record both refs.

Boundaries

This Task closes only the imported product manifest-discovery gap. It does not complete #8216, #8219, #8220, the release candidate in #8631, or any publication/cutover gate.

Sources

• Operational evidence: #8220 comment 6008843772
• Recursive selectors: GitHub Dependabot configuration docs
• directories glob support: Dependabot options reference
• Default-branch behavior: About dependabot.yml

Active delivery — 2026-10-06

#8638 merged into main as a307bd9bdff3b81f55715e23b748fc77457c1f65 after all exact-head checks and reviews passed. Actual updater evidence then failed this Task's acceptance: terminal /** selected 27 immediate Extensions directories and six Studio directories, leaving the nested projects undiscovered. Only Extensions' directly nested Elsa.Testing.Extensions entry point was found, and its restore failed with NU1008/NU1010. All discovery receipts had empty project lists; updates concerned only root dotnet-ef.

PR #8640 merged into main as b38e7523f79297076e51701fd951c426145aa99c at 2026-10-06T14:54:46Z after all exact-head gates passed on reviewed head 9ef95cf1dc8c2f4b36102364a357bd6d51a5126d. The native-matcher-backed selectors cover all 77 Extensions and 72 Studio projects. The ledger pins the current configuration while retaining original history and strict guards; Ruby normal/C locale and full local/hosted tooling checks passed.

GitHub automatically started Extensions run 37482946954 and Studio run 37482947275 on that main commit. Both corrected runs ended cancelled at the 55-minute execution limit; timeout evidence and diagnosis are recorded. Operational acceptance remains failed/pending correction; complete logs have been reconciled and no identical rerun has been requested. That execution ended In Progress / Assigned / verification Failed; the merged PR is Done / Accepted / Passed at its code-and-CI scope. Historical runtime failure is preserved above. PR #8642 merged the same accepted correction into codex/elsa-integration-program as 93d9135deacafa60c94e0e39b624cf738e1d16dd after all exact-head gates passed on 488122d37164e8de77ef68c52f7467bf8e4f85ae. The lead verified the merged tree equals the reviewed tree. Integration gate evidence preserves the original candidate and ledger records. #8639 was the next-ready buffer at that checkpoint.

Corrective scope clarification

Upstream updater source 9c06d60057ba9e7e79210e6618f932a28cf6a158 uses native NuGet Job.GetAllDirectories / PathHelper.GetMatchingDirectoriesUnder in the observed run, then scans each selected directory nonrecursively. Ruby Dir.glob is separate corroboration, not the observed native execution path. Preserve coverage of all 77 Extensions and 72 Studio project paths, including future deeper manifest locations. Of those, 76 Extensions and all 72 Studio projects are in the current root solution. The retained Elsa.Testing.Extensions project is outside that solution and reported NU1008/NU1010 restore errors in the original run (with Error=null, continued execution and empty project discovery); no inspected disposition establishes retirement, so do not exclude, delete or silently rewrite it merely to obtain a passing run. Record its exact status separately and assess actual eligible-project/central-version coverage before acceptance.

Current scheduling — native diagnostic complete

The owner has resolved the coordinated Core/product dependency proposal policy; see the current decision above. Corrective planning and operational verification remain incomplete. Diagnostic and exact resume condition. Both hosted timeouts remain failed operational evidence. The board maps this external decision gate to Todo / Not Ready / verification Pending because it has no Blocked status. No acceptance criterion is waived. #8639 is accepted through merged #8644; #8645 and the later executor preparation are also accepted within their recorded scopes. #8643 is separately blocked on Hosted routing. The sole active delivery Task is tracked in the current #8194 checkpoint (#8655 main promotion at this refresh); queue order is not a technical dependency of this ownership decision.