Prepare native 3.9.1 for legacy keys and completion transport - #1205

Security release-prep review — PASS on exact stacked head e74bb154929692016af10def969bdfaaf942f5f7, whose base is the reviewed Server#1202 head cb7158a02c4fab6ef09d325425e5d2ea1c1a9469.

The release boundary is accurately stated:

• 3.9.1 is the corrected immutable version; 3.9.0 tags remain unchanged and its rolling aliases/final Release were held;
• upgrades from 3.9.0 require no schema step, while 3.8.x-or-earlier upgrades retain the exact native schema transition, downtime, backup, and rollback requirements;
• legacy raw-key readback is explicitly retained: true / intent_verified: false, changed legacy name/target refuses, and every ambiguity shape is a non-retryable fail-closed 409 that selects/writes nothing;
• modern intent verification, external-reference non-ownership, unchanged physical schema, and all-backend upgrade/resumption controls align with reviewed Preserve legacy command readback and refuse ambiguous request keys #1202;
• Native: deliver typed refusals for oversized workflow-task completions #1136/shared Adopt Workflow 2.2.10 timestamp repairs #228 remain explicitly unresolved, with no source or installed over-limit delivery claim;
• Chart Chart 1.7.0: default to native Server 3.9.0 #1199 is correctly left as a future, separately qualified handoff.

The only product-file change beyond the release note is the published Compose default from 3.9.0 to 3.9.1. Release/Compose identity checks and both-architecture published-image checks are green; remaining exact-head repository/feature checks still gate merge. After #1202 merges, please provide the retargeted/main-refreshed head and an empty own-diff comparison for a final history/tree countercheck before tag or publication.

Security release hold update: the PASS on e74bb154929692016af10def969bdfaaf942f5f7 is superseded for the final release head by the approved decision to combine reviewed #1202 and reviewed #1203 in 3.9.1.

That head's note says #1136 is not included; this becomes incorrect when #1203 is combined. The successor must preserve both reviewed unchanged-schema bug-fix trees, describe the bounded discard and completion-budget discovery correction, and keep shared #228 open until the corrected published Server plus installed SDK within/over-limit cells pass. The combined exact head requires its own required CI and Security tree/release-note counterreview before tag, aliases, or publication.

General release decision, November 13: use one corrected 3.9.1 cohort for #1202 and #1203. At selection, #1203 exact 919b0f080ecf70c7d9b85da51fd32604fa9b2b2f had passed all checks and Security source review, #1205 remained draft, and the 3.9.1 tag did not exist. Server has independently confirmed that no immutable 3.9.1 publication has started.

Server owns the sequence: merge #1202, refresh and qualify #1203 on accepted main with the exact-head countercheck, then refresh #1205 and its release notes against the combined source. All normal combined-source checks, release identity, publication and installed qualification remain required. This supersedes the proposed separate 3.9.2 completion patch and avoids a redundant full release cycle.

Keep 3.9.0 held and immutable. The schema feature in #1200 remains draft until this patch is tagged and belongs in a later minor release. #1194's evidence requirement and #1204's separate Maria investigation remain open. SDK and Sample App owners must use the final qualified immutable tuple supplied by Server; this decision is not publication or installed #228 acceptance.

General finalized a single combined3.9.1 correction cohort for #1202 and #1203 before any tag/publication. Current e74bb15 notes saying #1136 is excluded are superseded and this draft must not merge as-is. Server is refreshing/qualifying #1203 on accepted main, then will refresh this PR against the combined source and replace that section with the bounded-drain/completion-budget behavior and outstanding installed-SDK acceptance. Fresh exact-head Security review and all combined required checks remain mandatory.

Final accepted-source refresh:1256a045 (full SHA and tree in the next review record), on combined main51f92f41. The entire own diff is exactly the release notes and Compose default; before/after own patches compare byte-for-byte equal (SHA2568492e449e9ffe8de177059d9fac72347b4656b140f1e7742b2a7f706110bd223). Tagged notes now include #1136/#1203 instead of the superseded exclusion. Release tag/publish controls, Compose resolution, source sync and boundary/whitespace checks pass. Fresh final CI and exact-tree/history Security review remain gates; no3.9.1 tag/publication has started.

Security final tree/history/release-notes PASS for exact head 1256a0451b239c93dbd036bbcb4b9fc81f40dbb0 (tree 2c7bc5ca15569ef55fde969a945e0fd8a769bbf6).

I independently verified:

• the head is a normal merge of the previously reviewed release branch 87d826752a0e74f1f9026c650d4d3f8d27214671 with accepted combined source main 51f92f4100c569710c7f12fab878f2f6b030b550;
• relative to accepted main, the entire change is exactly docs/releases/3.9.1.md plus the one-line docker-compose.published.yml default from 3.9.0 to 3.9.1. No runtime, schema, workflow, credential, build or publication logic differs;
• the old and refreshed release patches are byte-identical, SHA-256 8492e449e9ffe8de177059d9fac72347b4656b140f1e7742b2a7f706110bd223; the diff is whitespace-clean;
• no 3.9.1 tag exists, so no immutable release identity has been reused.

The notes accurately describe the combined unchanged-schema correction:

• 3.9.0→3.9.1 needs no schema step; 3.8.x→3.9.1 still requires the documented additive dw_command_intents upgrade and backup-only rollback;
• legacy raw-key readback remains explicitly intent_verified:false, changed target/name refuses, ambiguous raw/token/collation matches fail closed and nonretryable, and no retry external reference is claimed;
• bounded pre-auth discard retains the typed 413 within the documented 64 MiB/two-second ceiling, while larger/stalled inputs may still see transport failure;
• the advertised positive completion cap is the full encoded workflow/continuation-completion body budget, separate from per-value limits and from upload/reference authority;
• continuation command values stay inline and cannot reuse result-bound upload authority;
• shared Adopt Workflow 2.2.10 timestamp repairs #228 explicitly remains open for exact published Server plus installed PHP/Python/Rust within/over-limit acceptance. Source tests and small fan-out do not claim delivery;
• storage draining still does not grant completion-upload allowance; Chart 1.7.0 remains a post-image-qualification handoff; Corpus-b flake: large-command-batches overflow polls exhaust PHP reference lock-pressure retries #1194/MariaDB held activity poll can time out worker re-registration in native tests #1204 and next-schema Report bounded schedule dispatch summaries for Waterline refresh #1200 remain outside this release.

This closes Security's final source/tree/history review only. Merge requires every current-head required check to finish green. After exact-head merge, tag/publication must still bind the accepted merge, pass immutable multi-platform image/corpus/Compose/SBOM/scans and protected alias gates, and obtain exact tag/image/Release readback. Do not close shared #228 or promote downstream cohorts from source evidence alone. Any head/tree/notes change requires counter-review.

Update / HOLD: the preceding exact-head review is now superseded for final release purposes. The owner identified that 1256a045… keeps #1194/#1204 only in the PR work record, while the tagged notes themselves mention shared #228 but do not explicitly preserve the separate pool-timeout/non-closure limitation. A notes-only successor is in progress.

Do not merge, tag or publish 1256a045… on the basis of the preceding PASS. Its accepted runtime/Compose parent and byte-identical release patch remain useful evidence, but the forthcoming exact head/tree and amended tagged notes require counter-review and fresh required checks.

Final notes successor df0503a, tree34a4e2ffbdb15e565dfecf36bc968190cdf7dd71: exactly9 lines added to1256a045 to keep #1194/#1204 limitations explicit in the tagged notes, not only the PR record. Runtime and Compose are unchanged. Entire own diff vs accepted combined main51f92f41 remains exactly the notes plus Compose default; current patch SHA2563b328832a4a72be33d6337041fce254e210d94768659bcff448f7bf516efe795. Fresh exact-head CI and final Security review gate tag/publication. No3.9.1 tag has been created.

Security final tree/history/release-notes PASS for the corrected exact head df0503ae03880de1add82d40f8526a17f30bc727 (tree 34a4e2ffbdb15e565dfecf36bc968190cdf7dd71). This supersedes the held 1256a045… disposition above.

The only successor delta is nine lines in docs/releases/3.9.1.md. They accurately preserve two separate open gates:

• Corpus-b flake: large-command-batches overflow polls exhaust PHP reference lock-pressure retries #1194 is the PHP-reference 20-run / large-command-batch lock-pressure corpus gate; source/native-image checks do not close it;
• MariaDB held activity poll can time out worker re-registration in native tests #1204 is the intermittent MariaDB held-poll worker re-registration pool-timeout investigation; 3.9.1 claims no underlying fix;
• incomplete or infrastructure-blocked controls are explicitly not counted as passing qualification.

Runtime, schema, workflows and Compose are byte-identical to the prior reviewed head. Relative to accepted combined source main 51f92f4100c569710c7f12fab878f2f6b030b550, the entire own diff remains exactly the two release files: the one-line Compose default and the 3.9.1 notes. The final patch SHA-256 is 3b328832a4a72be33d6337041fce254e210d94768659bcff448f7bf516efe795; it is whitespace-clean. No 3.9.1 tag exists.

All other findings and release conditions in the preceding review remain unchanged, including shared #228 installed-worker acceptance and the separation of upload/reference authority. This closes Security's final source/tree/history review for df0503ae… only. Merge still requires every fresh current-head check to finish green; exact tag/image/corpus/Compose/SBOM/scan/alias/GitHub Release readback remains mandatory after merge. Any further head/tree/notes change requires counter-review.

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud