[sfmskywalker]

Purpose

In-place re-pin of #9102 onto release/3.10.0. Replaces run 40202201744 / artifact 12603436856 with the green post-#9108 candidate from release/3.10.0 @ 5cff67228e550b353b3483eb3b37dfdb73a41c74.

Main PR: #9102

Scope

• Bug fix (behavior change)

Description

Same identity as the main PR:

Field	Value
Artifact id	12664519771
Name	consolidated-candidate-5cff67228e550b353b3483eb3b37dfdb73a41c74-40347931480-1
Producer run	40347931480, attempt 1
Head SHA	5cff67228e550b353b3483eb3b37dfdb73a41c74
Digest / archive SHA-256	sha256:2dd253e1f2946ddcb2b8e75ef397596001757ddbcb0a91f717e9505bbf28b4f6
Size	96096205
Expires	2026-11-25T16:05:50Z
Manifest SHA-256	b6a1750f1f796f68a441bef93f67386b4a862dbca94d498ecf64536b102c2994
Envelope SHA-256	93fdcbd271fe712ab9c96d0ee868528c608e6bd13517c17d319eecd2c2f0be48 (565-byte producer transport envelope.json, trailing LF, retrieved_at 2026-10-26T16:06:11Z)
Consumers artifact	12664734747 (not a pin constant)

Package ID set is unchanged: 231 packages, 135 exclusions (134 IDs).

Folded the same comment nits as #9102. Also dropped the stale elsa-studio-v3 publish claim from the docker-publish.yml header and core/docs/wiki/build-run-operate.md (3.10 does not publish that image; the matrix row is already gone on release/3.10.0).

Verification

ID-set, stage, recovery, executor, approval-summary, upgrade-fixture, candidate-clock, and elsa-release tests passed on this branch.

Refs #9016

  

[cursor]

@elsa-workflows-bot review

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Essentials
• Run ID: 93062267-c0c6-41c5-a288-988e4702df3c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[sfmskywalker]

Same CodeRabbit count fix as #9102: rehearsal and full-acceptance instructions in docs/integration-program/consolidated-package-recovery.md now say 231. Cherry-picked -x from eef85f909366e75912eca30c7dc89fcdf60742fd.

Head is 7f93869df3fc3aeb42817734f6d186f0b00ace49.

@greptileai
@elsa-workflows-bot review

[greptile-apps]

Confidence Score: 5/5

[Medium impact] No blocking issues were identified. There are no reported issues requiring changes before merging.

Summary

Re-pins the 3.10.0 candidate to run 40347931480, artifact 12664519771, with 231 packages and 135 exclusions.

• Stable 3.10.0 release checks use the pinned 231-package candidate.
• The 3.10 Docker publish workflow no longer builds the standalone Studio image.

No actionable new issues were found in the changes since the previous review. No previous review threads were supplied.

_{Reviews (3) · Last reviewed commit: "Keep the producer envelope including its..." · Reviewed by Greptile}

[elsa-workflows-review-bot]

Elsa 3 Code Review: APPROVE + HIGH @ 7f93869

Code Review, Round 1/6

This re-pins the 3.10.0 stable candidate from the Oct 6 placeholder (artifact 11412848210, 225 packages, which fails the guard) to run 40202201744 / artifact 12603436856 (231 packages from release/3.10.0 @ f60c00766b10). It also replaces hard-coded counts with values derived from the pin.

Release-branch patch safety: only CI workflows, Python release tooling, tests, the pin JSON and docs change. No product source, package metadata or build inputs are touched, so the shipped bytes are the pinned artifact and are not rebuilt. I compared this patch with #9102 (cherry-pick -x of eef85f90). It is identical apart from hunk offsets and two lines that already differed between the branches (the per-branch baseline sentence in package-publisher-gates.md, and the 6-vs-8 Studio content entries on the release branch). Both are correct for this branch.

CI: all checks green at this head (ubuntu-latest, import-rehearsal-tests, mapped-source-artifact-proof, selector-and-plan, select-tests, validate-gates, retained-testing-helper, toc, GitGuardian). CLA passes. Greptile scored it 5/5 with no findings. CodeRabbit skipped it because the base is not the default branch.

Not merging: release-candidate pin PRs stay approve-then-Lead-merges.

What I checked

• Pin is real and matches the guard. I downloaded artifact 12603436856 and checked it end to end. Archive sha256 13241bc1…a0d and size 96,125,850 match. The sealed preupload-manifest.json hashes to ac881065…24e6 (= MANIFEST_SHA256). The checked-in envelope hashes to 417f73ad…5af8 (= ENVELOPE_SHA256). inventory_identity hashes to 56852c6a…3f73c (= baseline evidence.inventory_sha256). The archive contains 231 .nupkg + 231 .snupkg. Its ID set equals validate_packages_id_set.txt exactly, and its 135 exclusions equal the new pin baseline. inventory-diff.json in the artifact is empty.
• Guard passes on the real bytes, on both branches. PACKAGES_DIR=<extracted> python3 scripts/validate_packages_id_set.py gives 231 IDs; Studio content passes with 8 entries using main's guard and 6 using the release/3.10.0 guard.
• Producer identity. Run 40202201744 attempt 1 is workflow_dispatch, success, prepare-consolidated-release-candidate.yml, head f60c00766b10… on release/3.10.0. That commit is the current tip of release/3.10.0. Artifact name, digest, size, expiry and workflow_run match the jq checks in both workflows.
• Consistency. Every identity value now comes from consolidated_candidate_input.py plus the envelope (ARCHIVE_SIZE, EXPIRES_AT, executor EXPIRY, recovery SOURCE/run/artifact). The new import-time envelope-identity check and the workflow pin test bind the two hard-coded workflow copies to those constants. In the scripts, tests and workflows I found no 224/225/450/668 counts or old pin values left, apart from the intended historical STALE_OCT6_MISSING regression test.
• Guards are tighter, not looser. The pin-to-guard test is now an exact pin_ids == guard_ids (231). Dropping the elsa.samplepackage sentinel in _local_inventory is correct: that ID is not in the 231 set, and the ID set stays bound through inventory_sha256 → pin baseline in consolidated_recovery_inputs.
• Tests. I ran python3 -m unittest for the touched integration-program tests plus executor-workflow and prepare-candidate (136 OK), and for scripts/test_validate_packages_id_set + test_stage_consolidated_candidate_nupkgs (29 OK, also OK under -O). Results were the same on both PR heads.
• Bot findings. CodeRabbit's single outside-diff item (91–93 rehearsal/full-acceptance counts still at 225) is fixed in the docs commit. I verified the cursor[bot] threads and resolved them.

Blockers

None.

Non-blocking follow-ups (could fold into this PR, or into #9016 close-out)

1. .github/workflows/packages.yml:12 (the publish_nuget dispatch description operators see) and the comments at :377, :459 and :481 still say stable 3.10.x nuget.org is "blocked until re-pin (#9016)" / "fails the 231-ID guard until #9016". After this merges, that's no longer true. It's harmless in direction, but the dispatch description is what an operator reads before approving.
2. docs/integration-program/consolidated-publisher-handoff.md:63 still tells the operator to retain artifact 11412848210 (sha ace85260…, expiry 2026-11-05, 225 pairs). It should point at the current pin, or say "the current pin in consolidated_candidate_input.py" so it can't go stale again.
3. scripts/integration-program/persisted-workflow-upgrade/README.md:41/43 still describes the envelope as the "accepted historical envelope" "accepted through #8635". It's a fresh Oct 25 envelope now, so that wording should be updated.
4. Readability: test_consolidated_executor_approval_summary.py:83 (packages + 7 + (packages - 7) * 2) and test_consolidated_package_executor.py:176 (2 * PIN_COUNT - PIN_COUNT // 3) encode fixture shape as unexplained numbers. A named constant or a one-line comment (what the 7 are, what the third is) would save the next re-pin some archaeology.
5. Minor: scripts/test_validate_packages_id_set.py imports consolidated_candidate_input again inside the new test (:290) when it is already imported at :262. It works, but it's redundant.
6. Operational: the pinned artifact expires 2026-11-24T15:03:46Z. Bytes are frozen at f60c00766b10, so any product-code pick that lands on release/3.10.0 after that commit is not in what 3.10.0 publishes unless it is re-pinned again. stage_consolidated_candidate_nupkgs.py checks only the tag name, not that the tag commit carries the same product sources. That is pre-existing and by design, but worth stating in the release checklist.

— Code Review (Elsa 3), via Elsa Review

[cursor]

@elsa-workflows-bot review

[cursor]

@greptileai

[elsa-workflows-review-bot]

Elsa 3 Code Review: REQUEST_CHANGES + HIGH @ cf9202c

Code Review, Round 2/6

[3.10] pick of the #9102 re-pin to run 40347931480 / artifact 12664519771 / source 5cff67228e550b353b3483eb3b37dfdb73a41c74, plus "Stop listing elsa-studio-v3 as a 3.10 published image". It carries the same envelope blocker as #9102.

Pick fidelity

• The re-pin commit 5119f038 has exactly the same added and removed lines as eef85f90..3b867c72 on #9102.
• The branch is based on f60c0076 and is not rebased onto the current release/3.10.0 (5cff6722, which adds #9107 and #9110). A trial merge is clean, and the merged tree's only docker-publish.yml change is the header comment, because #9107 already removed the elsa-studio matrix entry. After merge, release/3.10.0 is 5cff6722 plus this pin, so the pinned source is the base the branch merges into.

Studio image wording

Consistent with #9107: in the merged tree no elsa-studio-v3 reference remains except the new docker-publish.yml:7 note that 3.10 does not publish it, and core/docs/wiki/build-run-operate.md:90 now lists only elsa-server-v3 next to elsa-server-and-studio-v3. main still publishes elsa-studio-v3, which is intended, because #9107 was a 3.10-only fallback.

Pin verification

Identical to #9102 and verified against the API and the downloaded bytes: digest sha256:2dd253e1f2946ddcb2b8e75ef397596001757ddbcb0a91f717e9505bbf28b4f6, size 96096205, expiry 2026-11-25T16:05:50Z, run 40347931480 attempt 1 success from release/3.10.0 @ 5cff6722, manifest b6a1750f...2994 matches the archive. The archive holds 231 packages and 135 exclusions, matching the pin baseline exactly; inventory_sha256 recomputes. validate_packages_id_set.py passes on the pinned bytes with this branch's guard (231 IDs, 6 Studio entries). No stale references to the f60c0076 candidate remain.

Blocking

1. scripts/integration-program/persisted-workflow-upgrade/stable-original-envelope.json:1: same as #9102. retrieved_at is 2026-10-27T06:37:49Z instead of the producer's 2026-10-26T16:06:11Z, so ENVELOPE_SHA256 (consolidated_candidate_input.py:17) and the README "verbatim" claim (persisted-workflow-upgrade/README.md:43) bind a regenerated envelope. Restore the producer's bytes (SHA-256 2369a297877ec51b5fc5da4f4f90df65f33dbf03036485109d994b7cae678328) and update both references, the same way as on #9102.

R1 notes

The same notes as #9102, with the same results: the magic 7 is fixed, the runbook now says 231/135 (134 IDs), and packages.yml and the handoff point at the current pin. The duplicate import is only partly fixed (test_validate_packages_id_set.py:288-289 still repeats :260-261), which is non-blocking. build/ConsolidatedPackageProof.targets:9 still has the stale #9016 wording.

Tests (run locally on this head)

test_validate_packages_id_set.py 21 passed. Candidate clock, approval summary, executor, recovery, recovery inputs and stable upgrade fixture: 114 passed.

Advisory bots

• Greptile (5/5 on this head): no findings. Agreed apart from the envelope, which it did not compare against the producer.
• CodeRabbit skips this base branch. The R1 author-note thread on consolidated-package-recovery.md:93 stays resolved.

Verdict: REQUEST_CHANGES, HIGH. Once the envelope matches the producer's bytes, as on #9102, this is an approve.

— Code Review (Elsa 3), via Elsa Review

[elsa-workflows-review-bot]

Addendum to the Round 2 review at cf9202ce917428f65172b7fbb70b8ee9820ce1a2: CodeRabbit found a wording issue on #9102 that applies here too, because this branch carries the same text. packages.yml:12, :377, :467 and :489 now say "Stable 3.10.x" stages or publishes the pinned 231-ID candidate, but stage_consolidated_candidate_nupkgs.py:49 only accepts refs/tags/3.10.0, so 3.10.1 fails closed. Please say 3.10.0 in those four places along with the envelope fix. This is non-blocking on its own.

— Code Review (Elsa 3), via Elsa Review

[sfmskywalker]

@elsa-workflows-bot review
@greptileai

[elsa-workflows-review-bot]

Elsa 3 Code Review: APPROVE + HIGH @ 067f952

Code Review, Round 3/6

Delta cf9202ce...067f9529 (a5a252d4 restores the producer envelope, 067f9529 keeps its trailing LF) fixes the R2 blocker and the R2 notes. I found nothing actionable.

R2 blocker: fixed

• stable-original-envelope.json is byte-identical (cmp) to envelope.json in producer artifact 12663849532 (candidate-transport-40347931480-1, run 40347931480, source 5cff6722): 565 bytes ending in LF, SHA-256 93fdcbd271fe712ab9c96d0ee868528c608e6bd13517c17d319eecd2c2f0be48, retrieved_at 2026-10-26T16:06:11Z.
• Correction to R2: the 2369a297... value I quoted is the same bytes without the final LF. The file the previous pin committed at f60c0076 was also 565 bytes ending in LF, so the committed bytes here follow the existing convention and are the producer's bytes as written.
• ENVELOPE_SHA256 (consolidated_candidate_input.py:17) and README:43 (hash and retrieved_at) match. There are no other references to the old 9c1840b8... hash. test_stable_persisted_workflow_upgrade_fixture.py:292 binds the constant to the file bytes, and the executor, recovery inputs and the approval summary all hash-check the file at runtime.
• The archive pin was verified in R2 and is unchanged: artifact 12664519771, sha256:2dd253e1...b4f6, 96,096,205 bytes, expiring 2026-11-25T16:05:50Z. It is still not expired.

Rest of the delta

• packages.yml (comments and the publish_nuget description only, no condition changed): "Stable 3.10.0" is now correct, because stage_consolidated_candidate_nupkgs.py:49 accepts only refs/tags/3.10.0, so other stable 3.10.x tags fail closed. This resolves the R2 addendum.
• ConsolidatedPackageProof.targets:9: the stale #9016 wording is replaced. This is a comment-only change.
• test_validate_packages_id_set.py: the duplicate sys.path insert and import are now at module level once. Behaviour is unchanged.
• Patch safety: no runtime or product code is touched, and the release-branch workflow logic is unchanged. A trial merge onto release/3.10.0 (5cff6722) is clean.

Tests (run locally on this head)

test_validate_packages_id_set.py: 21 passed. Candidate clock, approval summary, executor, recovery, recovery inputs and stable upgrade fixture: 114 passed. verify-pin against the API and the artifact bytes is clean, including the envelope compared byte for byte with the producer transport (231 IDs, 6 Studio entries on this branch's guard).

Nits (optional, non-blocking)

• packages.yml:459: "other tags push this run's pack" is loose for stable 3.10.x tags other than 3.10.0, which fail closed in the stage step. It is fine as is.

Advisory bots

• Greptile: 5/5 with no findings, re-run on 067f9529. CodeRabbit skips this base branch. All review threads are resolved.

CI

Every check run on 067f9529 is complete and green: ubuntu-latest, import-rehearsal-tests, selector-and-plan, prove, mapped-source-artifact-proof, validate-gates, retained-testing-helper, select-tests, docs TOC, CLA, GitGuardian and Greptile. pinned-source-tests, released-artifact-proof and run-affected-tests were skipped by their path filters, and CodeRabbit skips this base branch.

Verdict: APPROVE, HIGH. This targets a release branch, so it is approve-only and the bot does not merge it.

— Code Review (Elsa 3), via Elsa Review