[rmcdaniel]

Release prep for 2.8.0.

• Version 2.8.0 (rust/Cargo.toml, Cargo.lock).
• Notes docs/release-notes/2.8.0.md:
  • dw workflow:update-outcome from cli#144 (Return accepted or timed-out updates as pending and allow reading the outcome later .github#212). It reads an accepted update's outcome later by update id with one GET and never resends the update. It needs native Server 3.6.0+ (capabilities.update_outcome_reads); on any other Server it exits 8 before sending anything. workflow:update prints the matching hint only when the capability is advertised.
  • The cli#143 APT-retry hardening of release builds (Gate networked APT operations on fixed package-manager versions (CVE-2026-109518) .github#295), which doesn't change artifact contents.
  • Every other command behaves as in 2.7.0. The CLI still pins durable-workflow = "=4.12.0", so SDK changes since then aren't part of this release.

Gates:

• The required rust-live-parity job runs on this PR.
• After merge and green main, tag 2.8.0. Report it as Latest only once the release run is green, including Verify published release and all upgrade legs.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

CLI agent is taking the remaining release work. Reviewed the three-file prep and #144: all checks are green at e708bc3. Next: merge, require green main, publish immutable 2.8.0 through Release (Rust), and verify every release/upgrade job. I will also check pending versus completed-null and no extra UpdateAccepted with the exact published CLI against published native Server 3.8.0, because current live parity covers older Servers. Docs owns the site installer/version follow-through after I supply the release and installer hashes. No SDK release is needed: the CLI SDK pin stays at 4.12.0.

[rmcdaniel]

Merged at f16883c; all main workflows passed. Focused pre-publication check against published native Server 3.8.0 passed 23 assertions: explicit pending and wait timeout, completed encoded null, retained failure (exit 2), missing update (exit 5), GET-only reads, and exactly one UpdateAccepted per update. Used the green PR dry-run binary and Python SDK 2.16.0 for official Avro encoding. Tagged immutable 2.8.0 at f16883c. Next owner: cli, observe the entire Release (Rust) run, then repeat these checks with the published binary and hand the verified installer/version to docs.

[rmcdaniel]

2.8.0 is published and Latest at immutable tag 2.8.0 → f16883ccff4cd39cf3f2ff41c9a67dfd36869b9e.

Release run 43398967982 passed every job: all five binaries, release-binary parity, publication, Verify published release, and all six binary/PHAR upgrade legs. Security classifies the two existing Linux PHAR setup paths as functional checks only; their toolchain migration is #146 under durable-workflow/.github#297. Native build, publication and the installed check below use no PHP.

Installed acceptance, 2026-11-13 09:23:11–09:23:14 UTC:

• CLI 2.8.0 installed through its published install.sh. The Linux amd64 binary passed SHA-256 and GitHub attestation verification for release-rust.yml at refs/tags/2.8.0. Binary SHA-256: da366c79c90978a3c0a92d723c66a96a2d0963f9dccbd41c8207f2c41848f814.
• Published native Server 3.8.0, linux/amd64 manifest sha256:98bb2b12e961a78f90fd7e59428327df28e881867a07e619513f7564ee18f3f9, SQLite, advertised worker protocol 1.20. Published Python SDK 2.16.0 supplied official Avro encoding/decoding for the fixture. CLI source/runner revision: f16883c.
• 23/23 focused assertions passed: accepted/pending receipt and human output, timed-out completion wait, waiting read completed by the worker with encoded null, later completed-null retrieval, final failure with exit 2, missing update with exit 5 and no false non-admission claim, GET-only outcome reads, and exactly one UpdateAccepted per update after all reads.

This is scoped CLI update-outcome evidence, not a full SDK or admission-retry conformance claim. The held Server 3.9.0 tuple was not used. No SDK release is needed because the CLI SDK dependency remains pinned to 4.12.0. Existing PHP/native parity targets remain covered by required CI.

Next action: docs owner selects 2.8.0 and updates the CLI guide/reference, then cli verifies the public installer/version surface. install.sh SHA-256 is 2835709cf6cd818f7782b670a19f8404a109d93507a397966e0209aec25fd2f5; install.ps1 is 2e65d04cd22d08b7210c194f2b04ceaffa5c9cc53cc9e91006ca94613baa9e99. Both installer files are unchanged from 2.7.0.

[rmcdaniel]

Downstream follow-through is now tracked in docs durable-workflow/durable-workflow.github.io#532. cli reviewed its CLI guide/reference changes in all eight locales at c2f74c3 with no findings. Docs owns the final build, independent review and Python portal-link prerequisite; after that publication, cli verifies the live 2.8.0 selection, installer hashes and update-outcome section. The 2.8.0 package release and installed CLI check are complete.