[sfmskywalker]

Published hosts can return Dashboard JSON while omitting the workflow runtime contributor and UI widgets, leaving an empty page with an unavailable runtime. Register the released runtime contributor in all backend hosts and workflow Dashboard widgets in each Studio host/client. Require an accepting runtime and valid workflow counters in authenticated smoke evidence.

The correction publisher also fails on classic Docker when label verification pulls one multi-platform index digest for both architectures. Resolve the verified index and pull each architecture by its own immutable manifest digest before inspecting labels. Preserve the platform, provenance and destination checks, and remove the unused validator assignment reported by CodeQL.

Validation: 50 focused Python tests pass normally and under -O; actionlint and diff checks pass. Local combined WebAssembly 3.8.4 passes strict browser/API checks with all workflow Dashboard widgets and no browser errors. Root independently verified combined Studio Server 3.9.0 browser/API login, accepting runtime and workflow Dashboard widgets with no errors after waiting for the Blazor circuit to become interactive. Both rebuilt versions embed exact-version packages. The actual failed-run candidate passes label verification for both platform child manifests. The Apps/Core receipt contract passes for all eight references and the Core-only scope using actual restored package assets with mocked external services. Final public-image browser checks are required after publication.

[sfmskywalker]

Independent review: APPROVE + HIGH @ a547653. The sole change removes an unused local variable while invoking the same validator at the same point. Validation and failure behavior remain unchanged. Root ran all 44 focused tests successfully; diff checks pass. No blocking findings.

[greptile-apps]

Confidence Score: 5/5

[High risk] Adds new dashboard packages and updates build configuration.

No blocking issue is reported, and the supplied review evidence supports merging. Final public-image browser checks remain required after publication.

What we checked:

• Older receipts remain usable: No. The new checks read image evidence from the current run. Older receipts go through a separate check that does not require Dashboard smoke fields.

Summary

This PR registers workflow runtime data in backend Dashboard responses and workflow widgets in Studio hosts and clients.

• Authenticated smoke checks now require an accepting runtime and six valid workflow counters.
• Image label checks pull each architecture by its own manifest digest.
• The unused assignment is removed without removing the check.
• Older publication receipts remain usable because their validation does not require the new Dashboard smoke fields.
• No blocking issue is reported. Final public-image browser checks remain required after publication.

_{Reviews (3) · Last reviewed commit: "Register workflow dashboard hosts and wi..." · Reviewed by Greptile}

[sfmskywalker]

@greptileai

[sfmskywalker]

Independent review: APPROVE + HIGH @ 66cf5ce. The publisher resolves the verified root index to exactly AMD64 and ARM64 child digests, then pulls and inspects each immutable child reference. Repository parsing preserves registry ports; missing or extra platforms fail before pulls. All expected label checks and correction destination checks remain intact. All 48 tests pass normally and under -O; actionlint passes. The actual failed-run candidate passed live label verification on both architectures. No blocking findings.

[sfmskywalker]

@greptileai

[sfmskywalker]

Independent review: APPROVE + HIGH @ 10841d6. All three backend hosts register the exact-version workflow runtime Dashboard contributor; all four Studio entry points register workflow Dashboard widgets with their existing feature settings. Producer semantic proof matches Core receipt requirements, and the reviewed correction/child-digest safeguards remain intact. All 50 tests pass normally and under -O; actionlint passes. The author subsequently confirmed strict local combined-SSR 3.9.0 browser success after waiting for the Blazor circuit to become interactive; final public-image checks remain required.

[sfmskywalker]

Root independently verified the repaired combined-SSR 3.9.0 Docker image with the corrected browser harness: login, Accepting work runtime, Operational health metrics, Execution trend and Recent workflow activity all pass with zero browser errors or failed requests. The browser test now waits for the Blazor Server circuit before submitting the prerendered form. This closes the earlier browser-validation caveat; final public-tag checks remain pending publication.

[sfmskywalker]

Final delivery verification: both corrected releases succeeded from merged commit f1b0d4b. Runs: 3.8.4 https://github.com/elsa-workflows/elsa-apps/actions/runs/37747159965 and 3.9.0 https://github.com/elsa-workflows/elsa-apps/actions/runs/37747164447. Each publishes six canonical images plus the exact-version server/studio aliases for linux/amd64 and linux/arm64. Both GitHub receipt archive hashes and all live registry/package checks pass with the strengthened Core verifier. Fresh pulls of all twelve canonical versioned images pass API and browser QA for Server, Studio SSR, Studio hosted WASM, Studio standalone WASM, combined SSR and combined WASM. Every Studio mode displays Accepting work, workflow counters, execution trend and recent activity with zero browser errors or failed requests. Generic server/studio latest digests match the pre-release snapshot.