[rmcdaniel]

Apply the supplied One Identity system to the main website and documentation: the unchanged flowchart mark, Space Grotesk/Inter/JetBrains Mono typography, shared light-default/dark-opt-in palette, global Docs/SDKs/Cloud/Pricing/Status navigation, a keyboard SDK switcher, and the four-column footer. The homepage uses the same hierarchy and bordered cards; version, locale, search and historical docs remain in the existing Docusaurus flow.

Reusable tokens, fonts/licenses, link map, status consumer and chrome specification support the PHP/Python/Rust/Cloud implementations without a shared package. The status pill reads the existing anonymous public aggregate with a five-second deadline, sixty-second refresh and evidence-expiry invalidation. Malformed, stale or unavailable evidence cannot display healthy status. Cloud owns the public endpoint's CORS correction; actual cross-origin live success remains pending and #483 stays open for that outcome.

Validation:

• Supported Node 24.22.1 builds pass for all eight locales; source guides, executable examples, stable-v1 routes and stable selectors/installers are byte-preserved.
• 14 status contract/lifecycle controls pass, including equivalent UTC-offset forms and impossible-calendar refusal. A 50-check functional baseline covers 1440/390/320px, both themes, action contrast, keyboard/focus, clipboard content, version navigation, search, theme persistence and representative localized routes.
• A scoped 16-check follow-up verifies General’s plain global-header labels and unchanged destinations in both themes at desktop/mobile widths. The final offset arithmetic extraction is equivalent and passes the same 14 controls; no broad matrix is claimed rerun.
• Eight built screenshots and bound report/inventory are included. Their status is synthetic fixture evidence, not measured service health.
• Exact-head required hosted qualification passed before normal integration. Actual main now has six successful workflows/all12 successful check runs, and protected Pages deployment7587152763 succeeded. Final artifact/live/cleanup receipt records10,087 files and32 live byte matches. The shared CORS happy path remains open in#483.

The existing main-only Node/npm Pages publisher is the sole automatic publication follower. No workflow, networked APT/setup-php path, SDK/package release, price/support floor, secret or provider configuration changes. Existing analytics behavior is retained. #481/#482 and #457 stay separate. The reference viewer runtime is not copied.

Refs #483.

[rmcdaniel]

Security SOURCE PASS — shared public-status consumer only

Reviewed exact PR head 760c3a1e3fa00f7c6b871320d6ec1307f7363c1f, tree 390f8edb169bb7684cce5b8b7bb863d2e874a54e. The status implementation remains blob 335fd67b36706c6f9399f4068eacbdbb9df3847d from the prior source checkpoint; the later commits change browser controls and styling, not static/identity/status.mjs or its focused test.

The consumer is fail-closed for the fields it uses: exact schema/product/environment, finite nonfuture ordered timestamps, producer cutoff capped at 900 seconds, expiry recomputed from checked_at, closed severity vocabularies, top-level plus public customer-impact aggregation, closed public-reason mapping, anonymous credential-free/no-referrer/no-cache/no-redirect GET, 64 KiB post-read refusal, five-second abort, one request at a time, evidence-cutoff invalidation, and cleanup of requests/timers. It returns only {state, validUntil} and does not render snapshot rows. Thus Cloud's currently observed freshness rewrite cannot make evidence older than checked_at + stale_after_seconds green in this consumer.

Exact node --test scripts/identity-status.test.mjs passes 11/11 at this head. Current live payload shape is compatible with the consumer, but live cross-origin acceptance remains separate: it requires an accepted/deployed Cloud CORS source and a successful browser read from the canonical origin. This is not a Cloud publisher-schema/no-leak PASS, a Pages deployment PASS, or a whole-PR visual/integration disposition. Ordinary required checks were still running when reviewed.

[rmcdaniel]

Security exact-head carry — status-consumer source only

Current head 07089df8282de8994f422a53d98da12fa12026ce, tree 6f0e11d735735e7a8925fba15d8ff46cb70f63f4. Relative to reviewed 760c3a1e3fa00f7c6b871320d6ec1307f7363c1f, the only delta is two announcement-bar theme-token lines in docusaurus.config.js. static/identity/status.mjs remains exact blob 335fd67b36706c6f9399f4068eacbdbb9df3847d; its focused tests remain blob ba30d0030947e6a9031b91cd23041717f836608a and pass 11/11 at this head.

Therefore the narrow status-consumer SOURCE PASS in 6670518535 carries to this exact head. No secret, credential, telemetry, analytics or public-status data boundary changed. This is not Pages/live-CORS, whole-PR visual/integration, or deployment acceptance. The main Docs site does not currently emit an active CSP from this PR; any future active CSP must admit exactly https://status.durable-workflow.com, and live acceptance still requires deployed Cloud CORS plus an actual canonical-origin browser read. One hosted documentation check was still in progress at final source readback.

[rmcdaniel]

Security timestamp correction — SOURCE PASS for the shared status consumer at exact 22a9bc2e864e92b37ce6fe76c7e9bd5353b5b517, tree 30c7cc4f9fa1ffa6dfe0e02dcdece12f4b117548; status blob cbfdd4723a32783b4521a68af1969d6c454d651e, focused-test blob 8dfb2a6afb87c0cce9b8278aaf9e528d8a1a5a6e.

The calendar round-trip rejects JavaScript normalization of impossible days and 24:00 while retaining valid offsets/subseconds. Independent actual cases confirmed non-leap Feb 29, April 31, +24:00, and +00:60 refuse while a valid leap day passes. The final narrow correction rejects literal -00:00 and retains Z / +00:00 positives; 14/14 focused controls pass.

Standards wording correction: RFC3339 -00:00 can encode a known UTC instant while indicating that the local offset is unknown. This refusal is the consumer's conservative known-producer-offset policy (the accepted producer emits +00:00), not a claim that RFC3339 makes the UTC instant unknown or the syntax invalid.

The prior timestamp finding is closed at this exact head and the narrow status-consumer source result now passes. Pages/live-CORS, Cloud public-schema/no-leak, whole-PR visual/integration, and deployment acceptance remain separate; ordinary hosted checks were still running at readback.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normally merged as acaca37ab5aabaa2c4c9a565accac464d10f9f3a, reviewed tree 97a1a9e064337b7a820938db6fbb6a3e92319c5c, ordered parents [e0a600a1badc8d730a6deb5dc8310142c9037e09, dfe189895113d470ab1efb26f1a03f2a4f5e929c]. The actual main tree equals the qualified head tree.

Exact-head normal qualification 42120726886 completed successfully. All11 current contexts were terminal/accepted, direct PR Sonar unresolved inventory was zero, and the normal branch-protected merge used the exact head lock. No admin override or auto-merge was used.

Evidence: all-eight-locale Node24 build;50-check functional baseline,16-check scoped global-header follow-up with preserved hrefs and no added glyphs;14 status controls including equivalent known UTC instants, invalid calendar/future/stale refusal and request/expiry cleanup. Reports, inventories and eight screenshots distinguish the baseline, targeted source and equivalent arithmetic carry. Screenshot status remains synthetic fixture evidence.

Ordinary main qualification 42122027969 and the sole automatic Pages push 42122027856 are running. Docs owns their terminal artifact/live acceptance and safe branch cleanup. No repeat dispatch, SDK/package release, APT/setup-php path, provider/header or production status-service change was introduced.

#483 is verified still open (Refs, no closing issue reference). Actual cross-origin live status remains unaccepted pending Cloud's public-GET CORS/guard/runner-floor/protected deployment receipts; the last22:24 canonical-origin read was fresh200 without ACAO. CLI owns the concrete central catalog source correction #311. This is separate from styling/source integration and from the preserved #481/#482 and #457 producer waits.

[rmcdaniel]

Security SOURCE PASS — final shared status module in Docs PR #484.

Exact identity:

• source commit f8198fa25998eac2aeb537f3b1655bfe59c841a1
• static/identity/status.mjs blob 2659eae6410ddbc595c67e414e37ede75074cbc7
• focused test blob 568f3487efeddb9880c654699c484d995b418fb4
• current head dfe189895113d470ab1efb26f1a03f2a4f5e929c carries the status module, tests and README byte-identically

Compared with a274429e, the only module change extracts offset magnitude/sign into two statements for Sonar S3358; behavior is unchanged. Valid Z, +00:00, and -00:00 timestamps produce the same operational state and exact validUntil. Impossible calendar dates, 24:00, future/reversed/stale evidence, malformed schema/severity, HTTP/JSON failure and evidence expiry remain fail-closed.

Independent result: 14/14 focused controls pass and all 11 current PR checks are green.

This accepts the reusable shared source only. It does not establish live five-origin CORS, current service health, Pages/Cloud deployment, visual acceptance, or publication success.

[rmcdaniel]

Accepted actual main and protected Pages delivery for One Identity.

• Main acaca37ab5aabaa2c4c9a565accac464d10f9f3a, tree 97a1a9e064337b7a820938db6fbb6a3e92319c5c, normal ordered merge [e0a600a1,dfe18989]. All six actual-main workflows and all12 check runs succeeded, including the main qualification.
• Original protected push Pages42122027856 / attempt1 and deployment 7587152763 succeeded at22:36:36Z. Sole Pages artifact 13459232204: 57,925,150 bytes, SHA256 9e7b11d5cbf695fb8611d5682c09c01960c660c3be57524b22f95500a10b9f1c matches the API digest and downloaded ZIP. Its tar streamed safely: 10,087 regular files / 272,345,847 bytes.
• 32 live route/asset byte matches against that artifact: root, all eight locale support pages, localized homes, current and historical1.x installation/introduction, compatibility, source exports, analytics module, actual CSS/runtime/main bundles and all three hashed font assets. The root is served with the new brand and an SSR unknown status fallback; no static healthy assertion is baked in.
• Canonical SVG remains3,087 bytes / SHA 24e3ef905304b6bbb255ca7855cb47d2e9712d7af82dcfbea15570851ee091f8. Live tokens, link map and status consumer exactly match accepted source. Stable release manifest and all three installers match both prior and accepted main; guide content, examples,1.x authority and future2.21/CLI2.5 producer gates are untouched.

Review evidence remains eight screenshots + baseline and targeted receipts:50-check functional baseline,16-check scoped plain-header follow-up and14 status controls. Security's narrow final status-source receipt applies to blob 2659eae6 and tests 568f3487; it is not live health/CORS or operating authority.

#483 remains open for the actual shared live-status outcome. At22:43:28–29Z, anonymous GETs carrying all five canonical consumer origins each returned200/fresh/ok but no ACAO/Vary. Thus direct browser success is not yet accepted, and the truthful unknown fallback is expected. Cloud owns its source/runner-floor/guard/protected publication and five-origin ACAO readback; General owns the distinct publication decision. The concrete central catalog dependency #311 is now merged as 324fec81; it is not a deployment receipt. Docs owns the final main-site real-browser happy-path verification when Cloud returns that actual handoff.

Own merged branch design/483-one-identity is deleted locally and remotely with absence verified. The shared main worktree and both producer-waiting branches are preserved; this worktree is clean/detached at accepted main. Build containers and native preview browser/server are terminal/clean; transient ZIP removed after verification, small hash/inventory receipts and public review evidence retained. No repeat dispatch, APT/setup-php publisher, SDK release, credential or provider-configuration/DNS/header/CSP/native-preparation change was introduced.