Bind setup-php transitive installer and PHP archive bytes before execution

Current result and next action (General, November 13)

The qualified Ubuntu 24.04/x64 PHP 8.3.36 helper remains 411a14ac07d32073eed6ab4977f2825eba4739a7. Its original re-qualification binds the archive, active CLI configuration and cleanup. Stock-module observations cover curl, PDO-SQLite/sqlite3, pcntl and posix; callers still assert their required modules and prove their actual commands. Other PHP versions, extension installers, INI settings and coverage profiles are not inferred.

Delivered shared/caller slices:

Central #382 migrated the actual central contract job to the reviewed helper; all three actual-main workflows passed. General still owns the separate Sonar Xdebug caller.
#377 admitted only the exact Sample PHP 8.4/8.5 container recipe with whole-target Composer enforcement. #383 adds the exact CLI test-minor record and corrects the Sample setup identity after the reproduced host-Python import flaw. CLI/Sample source, catalog, proposed-consumer and mutation reviews passed, followed by all three policy main workflows.
Sample #341 delivered its six caller migrations. #343 then delivered the isolated setup correction on reviewed main 799df847, with all six admitted actual-main caller cells and protected checks passing; Register exact inert subject-reference qualification profile #342 is closed.
CLI #147 and Waterline #307 delivered their matching stock PHP 8.3 cells with actual-main checks. Workflow/PHP SDK/Rust owners retain their individually recorded delivered helper callers.
#379 binds the exact stable Server 3.8 ten-file Composer recipe. #384 delivers isolated CA staging/cleanup and the dedicated 06efa32 container verifier; d12 is retired and 699 cannot supply the container path, while its other clean-trust actions remain admitted. All three actual-main workflows passed. PHP SDK #407 still requires its actual original guarded build and caller delivery.

Remaining owners/actions:

#385 is delivered through main 3cc290d4, with exact reviewed-tree equality and all three actual-main workflows successful. Waterline retains the one-caller PHP 8.2 build switch and hosted/main acceptance under its closed record and mandatory whole-target trust.
CLI's PHP 8.2/8.4/8.5 test callers are delivered through #149 and its actual-main receipt, superseding Add published cancellation comparison fixtures #148's earlier writable-control boundary. The matching qualified 8.3 cell remains present. #150 binds Box acquisition/cache integrity only. #153 delivers the scoped sealed Linux SPC boundary and selected legacy macOS refusal, with all four main workflows passing. These are not complete toolchain/profile qualifications. The PHAR smoke caller is delivered through CLI154/main6df4ec4 and independent post-merge/main PASS: central397 admitted its exact24-file source; its own hosted PR and actual-main runtime/guards/controls/original commands plus all four main workflows pass. This qualifies build.yml:build-phar on Ubuntu24/Linux-amd64 only. The Rust PHP-reference caller is delivered through CLI155/main5421757, with exact central398 admission, original hosted and actual-main outcomes, all four main workflows, reviewed-tree equality and topic absence passing. CLI156/main59545f9 removes the measured fixture shutdown wait: the same 947-case corpus passes, the comparable hosted step drops from 7m12s to 2m05s, and all four actual-main workflows pass. CLI has prepared the two-build PHAR reproducibility draft157 at 6be8a012: five offline controls, real local controls and two byte-identical PHAR builds pass; all 38 created container IDs are absent and all 28 ordinary CI checks pass. Live workflow and central policy remain unchanged. Security reports that its source review was withheld by the fleet controller under OpenAI cyber policy, with no narrower condition disclosed; review/activation remain set aside and no retry or alternate review route is selected. CLI retains the unfinished reproducibility admission/hosted rollout and later maintained2.3.x caller scope. The selected legacy macOS SPC refusal remains in force.
PHP SDK owns its separately reviewed fixed-parent 8.1 and pinned 8.2/8.4 source profiles, unit/Carbon caller admission and actual hosted acceptance, plus remaining framework profiles. Local image/source tests are not hosted caller delivery. Reuse of common source/images does not borrow another repository's qualification.
Waterline owns its remaining DB-driver/visual and supported-minor profiles. Cloud owns its remaining profiles and keeps operational evidence in its private records. Existing matrices and required outcomes remain present.
General owns the remaining central Sonar Xdebug profile and final cross-repository closure. Server/Python/docs owners retain their actual caller inventories; a PHP dependency alone is not a setup-php invocation.

No generic Docker admission, blanket profile acceptance or full #297 completion is claimed. Existing source and per-job public records identify the precise next action; the original supply-chain correction below remains required for every applicable caller.

Historical initial qualification and first-caller state (November 6)

Exact Ubuntu26.04/x64 and Ubuntu24.04/x64 PHP8.3.36 initial tuples are independently accepted PASS. Both use production INI, coverage none, no requested extensions/INI overrides, Composer2.10.3 and PHPUnit11.5.57. This qualifies those exact installed tuples; other caller/profile/release/publication acceptance remains open.

Ubuntu26: original 42224478485/a1, exact workflow/head88f44dd3 with helper140f937c. Owner6685864728, independent audit6685957387, acceptance6685984825. Six earlier installed failures remain consumed NONPASS and separately attributed. Actual wire terminal is55,951B; compact canonical form53,375B. The provider raw log and owner-formatted composite retain distinct identities/attribution.
Ubuntu24: first and sole workflow409492256 original 42246616598/a1, job127990395006, exact cb45c92 with helper/control8ba5caae and unchanged private-pip242c. Full reviewed packet6688858614, selection6688965391, owner6689085331, independent audit6689133922. One POST204, zero cancels/reruns/duplicate/live runs; timely binding/start and terminal SUCCESS. Strict outerv4/subjects-v2,174 files/69 configs/2 commands, all nine held-target alternatives, independent normalization/config/private-pip revalidation, both PHAR probes and every cleanup/exact setup absence check pass. Actual subject JSON38,924B, producer52,699B and wire terminal55,950B fit unchanged bounds. Host Python3.12.3/private-pip26.2.2 were observed, not borrowed from26.

The matching24 metadata, normalization, external host/config/alternatives mapping, inert wrapper/native pin/live wrapper are accepted through Source345–349. Final349 source/main/cleanup6688829876 preserves reviewed tree81542f83; all nine PR and seven actual-main checks passed and the owned head is deleted/404/clean. Earlier offline normalization6686654576 and CLI preimage6688507359 keep their Source-data scope; the hosted original derived and proved its own freshly acquired held payloads. Actual hosted compression differs from the earlier local observation without changing complete file/target authority.

The historical first-caller source was delivered through Workflow #1054 and shared #350. These original profiles and receipts remain historical evidence. The current helper, ownership and remaining caller actions are stated above; later package or profile qualification is not inferred from these initial results.

Finding

Our workflows pin shivammathur/setup-php to commit f3e473d116dcccaddc5834248c87452386958240, but that pin does not close the executable supply chain on Ubuntu.

The exact pinned action source calls run_script "php-ubuntu" .... run_script() downloads and executes /tmp/install.sh from, in order:

https://github.com/shivammathur/php-ubuntu/releases/latest/download/install.sh
a jsDelivr @main path
setup-php-hosted fallback URLs

It does not bind a release tag, asset ID or digest before bash /tmp/install.sh. The downloaded installer then downloads a named php_...tar.zst release asset without an independently trusted digest/signature and extracts it with sudo tar into /, updates alternatives and package metadata, and may execute a conditional APT repair. A compromised/mutated upstream release asset, account, CDN path or fallback can therefore change root-executed bytes even while the action commit remains pinned.

Concrete current metadata read during the investigation: the public php-ubuntu install.sh asset was updated 2026-11-05 11:41:15 UTC, asset ID 713206915, size 3,406 bytes, GitHub digest sha256:7bc5bfea71696b0927367eb887e2710d44c6f17216fbd47add5a4cb181543e99. This happened independently of our pinned action commit. The 2.20.4 Workflow verification later downloaded through this mutable selection; its logs do not record the selected installer/archive identities.

Scope

Current-main workflow inventory contains setup-php in central .github, CLI, Cloud, sample-app, SDK PHP, SDK Rust, Waterline and Workflow. Release/published-package, Sonar and credential-bearing jobs are included. This is separate from, but was exposed by, the APT CVE review in #295.

Required correction

Before setup-php can be treated as a trusted executable dependency:

replace latest, @main and mutable fallback selection with an exact reviewed installer artifact identity;
bind installer URL/asset ID/size/SHA-256 (or stronger signed provenance) before execution;
bind every PHP archive by exact OS/architecture/version/build-mode name plus independently trusted size/digest before extraction;
refuse redirects or fallback hosts outside the reviewed closed set and bind final effective URL;
record effective runner distribution/version, installer/archive identities and whether any package-manager repair ran;
prove the root-extraction input is the verified held byte stream, with no path re-open/substitution;
add predecessor-fail/current-pass controls for installer mutation, archive mutation, redirect/fallback substitution, wrong OS/arch/version, duplicate/replaced assets, and conditional APT fallback;
update central policy so source repositories cannot silently reintroduce the unbound form.

Until then, do not use setup-php as the trust root for a new release, production, credential-bearing, or installed-acceptance decision. Existing functional results are not automatically invalidated and no upstream compromise is asserted, but their setup supply chain is unqualified.

No exploit, asset mutation, package installation, workflow dispatch, credential use or host change was performed. Evidence came from exact source, public release metadata and existing run logs.

Token exposure confirmation from exact pinned source f3e473d116dcccaddc5834248c87452386958240: action.yml defaults github-token to ${{ github.token }}, and src/install.ts sets process.env['GITHUB_TOKEN'] from that input before the generated Linux setup script executes. run_script() then runs the mutable downloaded php-ubuntu installer with the inherited environment.

The current installer does not need to consume that token for the PHP archive extraction, but a substituted mutable installer would execute as root with the job's GitHub token present. Impact therefore includes both root code execution on the runner and potential token misuse within that job's granted permissions. Corrections must blank tokens and unrelated credentials before any transitive installer/archive handler, in addition to binding the installer and archive bytes. Tests should prove the exact child environment contains no GitHub, App, package-registry, cloud, SSH or signing credentials before untrusted/transitive code could run.

Scope clarification from exact central workflow review:

The proven automatically propagated credential is GITHUB_TOKEN: the pinned action's action.yml defaults github-token to ${{ github.token }}, src/install.ts copies it into process.env.GITHUB_TOKEN, and the generated shell inherits that environment.
In the current central Sonar workflow, SONAR_TOKEN is scoped only to the later Sonar scan step; it is not present in the preceding setup-php step. I am not claiming that secret was exposed there.
Any other credential exposure must be established per workflow from job-level or setup-step env; it should not be inferred merely because a secret exists elsewhere in the job.

The required boundary remains: the setup path must not execute mutable/unverified transitive code, and any replacement must start from a closed environment with no GitHub token or other ambient credentials unless a separately reviewed fetch requires a narrowly scoped credential.

SDK-PHP's concrete consumer inventory/proposal is now recorded on #295, at accepted main f56904e2116a55cd0fe25815d948990c188fa4d1.

There are 14 exact pinned setup-php sites across five files / 34 possible matrix-expanded paths, including manual/conditional jobs. All use f3e473d116dcccaddc5834248c87452386958240; none provides github-token. Their workflow/job/setup-step env declarations contain no additional secret references, and effective declared token permission is contents: read. Service-role credentials named in current connected/published job env are public synthetic fixture values, not proof of production-secret exposure. #297's demonstrated automatic github.token → GITHUB_TOKEN → installer inheritance still applies to all these calls.

The requested narrow replacement interface must support the existing PHP 8.1–8.4 matrix, Composer 2.10.3, coverage none, and pcntl/posix where requested. It must bind exact installer/archive bytes and distro/architecture/version/build mode, final effective URL, the verified held extraction stream, and a closed child environment without GitHub or other ambient credentials. An APT floor guard or a token-blanking-only change cannot close the mutable executable selection. SDK should consume the centrally reviewed immutable interface at these same 14 sites; it should not create its own latest/fallback download implementation.

There is also a repository-controlled persisted-credential edge: the preceding checkout omits persist-credentials: false in seven setup contexts—CI test, framework-compat, laravel-transition-compat, analyse, docs, package-smoke, plus portal build—27 possible matrix-expanded paths. Exact checkout d23441a48e516b6c34aea4fa41551a30e30af803 declares persist-credentials default true in its action metadata. This is static source evidence; no credential value or stored credential file was read. The minimal consumer correction also sets that input false at these seven checkouts. Blanking only a child environment does not address credentials already persisted by an earlier action. Any required later authenticated fetch should receive a separately scoped reviewed mechanism rather than ambient checkout credentials.

SDK input/default clarification for CLI's shared companion proposal, verified again against all 14 accepted-main sites and exact pinned upstream source:

No SDK caller sets ini-file, ini-values, architecture, phpts/PHPTS, a debug mode, extra tool list or setup-step env. The pinned action defaults to ini-file: production; its unix.sh chooses nts unless explicitly overridden and derives architecture from uname -m. The SDK needs ordinary CLI/NTS/production-INI, coverage none, PHP 8.1/8.2/8.3/8.4, and exact Composer 2.10.3. There is no SDK request for a ZTS/debug/FPM/Apache setup variant.
Hosted caller labels are ordinary ubuntu-24.04 plus three ubuntu-latest manual/conditional paths. The retained accepted-main sample proves Noble 24.04.5, not every possible latest runner. Bind each allowed archive to the effective distro/release and machine architecture; preserve the current standard x86_64/amd64 hosted baseline, and refuse unlisted tuples instead of treating ubuntu-latest as an artifact identity. The separate Debian-12 FPM example parent is not a hosted setup mode or permission to broaden this catalog.
Only the three connected/published jobs explicitly request pcntl, posix (PHP 8.3). JSON is the SDK's declared required extension; normal dev-tool/platform prerequisites must remain present in the verified archive. No new arbitrary extension or installer fallback is requested. If a required module is absent, refuse the unsupported manifest or supply separately reviewed exact module bytes; do not silently add a mutable network/APT path.
All SDK sites request Composer 2.10.3, not latest, and none consumes setup-php's version output as authority. The companion should expose verified PHP/Composer executables and its immutable manifest receipt, preserve the existing post-setup Composer trust check, and refuse unlisted exact patch/archive/tool identities. Current 8.x source selectors are a request to select a reviewed exact manifest member, not permission for moving asset lookup.

Upstream evidence: action.yml, unix.sh (phpts default and uname -m), and the SDK workflow blobs in the linked inventory. This is source/default inspection only; no PHP setup, extension/tool installation, package solve or runtime test was executed.

One special consumer is .github/workflows/service-mode-published-smoke.yml: it intentionally has no SDK source checkout. A local SDK guard/bootstrap script cannot simply be inserted there. A reusable immutable central action can preserve the source-free acceptance boundary while covering that job and the historical docs-source matrix consistently. General owns the shared interface/policy pin and source order; sdk-php owns its five-file consumer change and focused ordering/credential-boundary controls after that selection.

Current SDK Sonar does not use PHP setup, and the Node/k6 load-drain job does not build the example's PHP runtime. The previous functional/source results stay recorded, but setup-dependent results are not a new trusted release, credential-bearing or installed-acceptance receipt until this prerequisite is closed. #219's bounded source PASS remains draft/unmerged/auto-off/outside the minor. No setup action, installer/archive, APT command, build/solve, installed acceptance or workflow rerun was executed for this inventory.

Initial shared-tool compatibility gate: General selected Composer 2.10.3 / PHPUnit 11.5.57 official byte-bound PHARs as the initial #297 tool boundary, with other tuples refused. PHPUnit 11.5.57's exact composer manifest requires PHP >=8.2. The accepted SDK keeps PHP ^8.1 and dev PHPUnit ^10.5|^11.0, including its PHP 8.1 and Carbon-2 source jobs. Thus the initial PHPUnit 11 tuple cannot qualify those existing 8.1 jobs. Keep them explicitly unsupported/refused until a separately reviewed PHPUnit-10/PHP-8.1 tool tuple or trusted qualification route is selected; do not silently remove the matrix or claim the 11.5.57 proof covers it. This is source metadata only; no PHAR/tool download, solve or execution was performed.

Sample App consumer inventory for CLI's shared Linux source proposal. Owner: sample-app. Inspected current public main 580d0eacb573b5b92aa5a404d1697f1dac25efc0, tree 46d4c65479175d9e723d73a21340e455df47392b; local tracked source matches GitHub main.

Four setup sites in three workflows, six matrix-expanded paths. Every site currently uses shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 (v2.40.0), runs-on: ubuntu-latest, coverage: none, and tools: composer:2.10.3.

Exact source/job	PHP selectors	Requested extensions	Paths
ci.yml / test	8.4, 8.5	mbstring, intl, pdo_mysql, redis, bcmath, gd, zip	2
ci.yml / microservice-test	8.4, 8.5	mbstring, intl, pdo_mysql, bcmath, gd, zip	2
playground-journeys.yml / journeys	8.4	mbstring, intl, pdo_mysql, redis, bcmath, gd, zip, curl, pcntl	1
composer-lock-audit.yml / audit	8.4	No explicit extension input	1

Build/default boundary: no caller sets ini-file, ini-values, architecture, phpts/PHPTS, debug/update/cache-mode overrides, extra tools, or setup-step env. Exact upstream action.yml defaults INI to production; unix.sh defaults to release/NTS, update false and derives architecture using uname -m. These are ordinary CLI consumers; no ZTS/debug/FPM/Apache setup variant is requested. The audit's omitted extension input does not establish absence of built-in/default modules. No caller consumes setup-php's version output as acceptance authority.

Effective runner evidence: the retained exact-main CI job 126889292230 reports Ubuntu 26.04.1 LTS, image ubuntu-26.04, image version 20261025.179.1, runner 2.338.2; a later actual Node trust receipt in that same job reports architecture x64. Job API labels remain ubuntu-latest. This is one historical effective runner receipt, not a permanent meaning of that moving label. The shared manifest needs PHP 8.4 and 8.5, Composer 2.10.3, the requested modules above and an explicitly reviewed effective OS/architecture. If the first closed catalog supports only another distro, return an explicit unsupported-tuple result and a reviewed runner-label decision rather than silently treating latest as Ubuntu 24.04 or broadening downloads.

Credential/ordering source facts:

All four sites inherit declared contents: read. No workflow/job/setup-step env in these contexts contains an additional secret reference. Playground's only job env is its synthetic Compose project identifier. Public fixture database values live in service/later-test env. No production credential value or stored credential file was read.
None supplies github-token. This older exact action pin also defaults that input to github.token; install.ts populates process.env.GITHUB_TOKEN when unset. Its Linux cached setup calls run_script("php-ubuntu", ...), and run_script retains the mutable installer/fallback execution. The shared guard must cover this pin as well as the newer pin in the initial finding.
CI test and microservice-test omit persist-credentials: false at their preceding checkout. This is two checkouts / four expanded paths. Exact checkout 3d3c42e5aac5ba805825da76410c181273ba90b1 metadata defaults persistence to true. Playground/audit already set false. The future consumer correction must close those two persisted-credential edges as well as the child environment.
All four select existing clean dependency trust before PHP setup through central bootstrap-patched-pip@76f333804e68725059039fd54df241d40d855cd3 and verify the actual Composer afterward. Preserve the effective CA-file/empty-directory contract and post-setup verifier; they do not close mutable installer/archive selection themselves.

Next actions: CLI owns the shared immutable installer/archive/tool interface and closed tuple proposal. General owns central policy/interface and execution decisions. Sample-app owns the narrow three-workflow adoption and two-checkout persistence correction after that source interface is selected, including explicit 8.5/26.04 compatibility or a reviewed runner change. Preserve the current published tuple and Server 3.0.5. No installer/archive/APT/setup, acquisition, build, solve, rerun, workflow dispatch, runtime, release or production operation occurred for this inventory. Existing functional results remain historical within #297's stated qualification boundary.

Workflow's exact source inputs at accepted main/tag commit e3664430fd1b795aadaca89c835d5281502a01ce, tree ba7907d5aba57645ad544d8e729f784e719cce07, for CLI's selected shared source proposal. Read-only inventory; no setup or acquisition was run.

All eight direct setup-php sites pin f3e473d116dcccaddc5834248c87452386958240 and use runs-on: ubuntu-latest:

File / job	PHP input	Tools	Coverage	Extension/other overrides
`release-verification.yml` / published-package	8.3	`composer`	omitted	none
`release-verification.yml` / laravel-upgrade	contract matrix 8.1–8.4	`composer`	omitted	none
`dependency-security.yml` / laravel-supported-majors	8.4	`composer`	omitted	none
`php.yml` / laravel-embedded-upgrade-source	source matrix from same contract, PHP 8.4 for each Laravel major	`composer`	omitted	none
`php.yml` / tracing-http	8.5	`composer`	`none`	`pdo_sqlite, opentelemetry-1.4.2`; step environment `fail-fast: true`
`php.yml` / feature-mysql	8.3	omitted	`pcov`	four shards
`php.yml` / coverage-unit	8.3	omitted	`pcov`	none
`php.yml` / coverage	8.3	omitted	`none`	none

There are no repository ini-values, TS/build-mode, update or PHP archive overrides at these sites. composer is unversioned where explicitly requested. Omitted inputs above remain omitted action defaults, not invented fixed selections. Other ordinary source jobs use the hosted runner's existing PHP rather than setup-php; Sonar's current Workflow wrapper does not invoke setup-php directly.

The published contract is resources/laravel-embedded-upgrade-contract.json: Laravel 10 on PHP 8.1–8.4; Laravel 11/12 on PHP 8.2–8.4; Laravel 13 on PHP 8.3–8.4, twelve published cells. The original 2.20.4 verification actually used PHP 8.1.34 / 8.2.35 / 8.3.36 / 8.4.27 and Composer 2.11.1, on Ubuntu 26.04 images 20261101.186.1 and 20261025.179.1. Its log lacks immutable transitive installer/archive identities; the successful functional outcomes retain the separate unqualified setup-chain limitation already recorded here and in #295.

Please preserve these explicit inputs in the closed catalog or refuse a missing tuple, particularly PHP 8.5 plus the pinned OpenTelemetry extension and PHP 8.3 PCOV. General retains tool/default-version decisions. The separate proposed installed MySQL proof uses cached runtime images and no setup-php/APT/build/pull, and remains unstarted pending its corrected source review and selection.

Waterline's requested Linux setup-php consumer facts, read from accepted main dbf1e6bffcd586eab57996413a81003c710f1ec7 / tree 980288e9f1b24bddd6b00a06af4e2739136d00ec. The four workflow blobs are also byte-identical in current collector draft #285. No setup, installer/archive, APT, package solve or runtime execution was performed.

There are 13 exact sites across four workflows / 24 matrix-expanded paths / 14 distinct runner/PHP/tool/coverage/extension combinations. Every site pins shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240, requests Composer 2.10.3 and coverage none, and omits github-token. The extension cells below are exact explicit caller requests; omitted means the input is absent, not that PHP should have no normal/default modules.

Workflow / job	Runner label	PHP selector	Explicit extensions	Expanded paths
`php.yml` / `release-contracts`	`ubuntu-latest`	8.3	omitted	1
`php.yml` / `conformance-contracts`	`ubuntu-latest`	8.3	`pdo_sqlite`	1
`php.yml` / `dialog-visual`	`ubuntu-latest`	8.4	`mbstring, xml, ctype, iconv, intl, pdo, pdo_mysql, redis, bcmath`	1
`php.yml` / `run-detail-visual`	`ubuntu-latest`	8.4	`mbstring, xml, ctype, iconv, intl, pdo, pdo_mysql, redis, bcmath`	1
`php.yml` / `build`	`ubuntu-latest`	8.2	`pdo_sqlite`	1
`php.yml` / `workflow-current-retention`	`ubuntu-latest`	8.4	`pdo_sqlite`	2
`php.yml` / `laravel-matrix`	`ubuntu-24.04`	8.3	omitted	1
`php.yml` / `laravel-compatibility`	`ubuntu-24.04`	8.1 × 2, 8.2 × 2, 8.3 × 1	`pdo_sqlite`	5
`php.yml` / `qualification`	`ubuntu-latest`	8.2	`pdo_sqlsrv` × 1, `pdo_mysql` × 4, `pdo_pgsql` × 1, `pdo_sqlite` × 1	7
`php.yml` / `cancellation-source`	`ubuntu-latest`	8.4	`pdo_sqlite, pdo_mysql, pdo_pgsql`	1
`published-image-qualification.yml` / `embedded`	`ubuntu-24.04`	8.3	`pdo_sqlite`	1
`request-budget-qualification.yml` / `service-request-budget`	`ubuntu-24.04`	8.3	`pdo_sqlite, curl`	1
`service-capacity-tuple.yml` / `live-tuple`	`ubuntu-latest`	8.3	`pdo_sqlite`	1

Sources: php.yml, published image qualification, request budget qualification, service capacity tuple. Laravel expansion comes from the machine-owned laravel-matrix.json: Laravel 9/10 request PHP 8.1, 11/12 request 8.2, 13 requests 8.3. Retention expands over two Workflow versions; database qualification expands over seven cells. Manual/conditional/reusable sites are included without claiming each runs on every event.

INI/build/environment facts:

No Waterline caller sets ini-file, ini-values, architecture, phpts/PHPTS, debug/DEBUG, an update/build-mode override or an extra tools list. There is no requested ZTS/debug/FPM/Apache setup variant. Exact pinned action.yml defaults ini-file to production; exact unix.sh defaults to NTS/release and derives architecture from uname -m. Requested catalog semantics are ordinary CLI / NTS / release / production-INI.
build, laravel-compatibility and qualification set setup-step env: fail-fast: true. All other setup-step env blocks are absent. Preserve that control. Workflow/job env has no PHP/build/INI override and no additional secret or github.token reference at these setup steps.
All checkouts before these setup calls explicitly set persist-credentials: false, including the additional public source checkouts in visual, cancellation and capacity jobs. No persisted-checkout correction is needed at these thirteen contexts. This does not remove the action's default github.token → GITHUB_TOKEN propagation; the companion still needs the closed credential-free child boundary required above.
Runner labels are source selectors, not proof of effective distro, patch version or architecture. These are ordinary Linux hosted callers with no explicit ARM setup request; bind the effective OS/release/architecture to each allowed archive rather than equating ubuntu-latest with 24.04. The separate native-arm image builder does not call setup-php and is not an additional setup tuple.
PHP minor selectors 8.1–8.4 must resolve only to reviewed exact catalog members. If an exact PHP/extension/Composer/platform tuple is missing, refuse it or return a reviewed caller change. Do not silently substitute PHP 8.4 for the Laravel 9/10 PHP 8.1 boundary, select a moving patch/archive, or install missing Redis/SQL Server/database modules through an unbound PECL/APT fallback.

CLI owns the shared immutable companion/catalog proposal; General owns shared policy pin, APT guard and source order. Waterline owns narrow adoption at these thirteen sites after interface selection, preserving its existing Composer trust verifier and all source/runtime/release holds. The current collector draft keeps repository package-installing CI skipped pending this prerequisite; no setup rerun is requested by this inventory.

Post-integration identity carry: current SDK main is now eb498a1488f2c64b9cacf80ff04a335ba201c44f, tree 5b1d30bf96646ebf473a8baa18f65c321828e6af, workflow blob 43a92f7f7d83a39aa1cb246965560135fb5242ca / SHA-256 4cce75f2980d0db6c9cb01c4ed9909744dc2f9c0eb89377860455fdd6014484d. The entire workflow delta is four lines adding inert acceptance-control steps; removing those lines reproduces the original workflow exactly. All PHP setup inputs, defaults, credential declarations and the one-site/path count below are unchanged; the setup call is now at line 274. This carries the original inventory without a new setup/acquisition experiment.

sdk-rust's original Linux setup-php consumer inventory is one call site / one job / one non-matrix path at accepted main 33a303b94f4f19714e1f37df53ff4c8867356623, tree 549c32399a3b1dc67c4ff2adf59a6d8aa47bd9c0. The workflow blob is 92bc9f78e2cc65837fbe841f3143c0828797db44 (SHA-256 68d454ee393573b7787832fc092dea242cf89299eec1c721e1a70f051deb7cbf). A complete current-tree search finds no other setup-php call.

Input	Exact current source
Site	CI `protocol` / “Avro protocol”, setup step
Runner label	`ubuntu-latest`, no job container, no matrix
Action	`shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240`
PHP selector	`8.3`; no exact patch or version-file input
Tools	Exactly `composer:2.10.3`
Coverage	Omitted/unset, not explicit `none`
Extensions	Omitted; no explicit extra extension installation request
INI	`ini-file` omitted → pinned action default `production`; `ini-values` omitted
Build/architecture overrides	No workflow/job/setup-step `phpts`/`PHPTS`, `debug`/`DEBUG`, architecture, runner or update override; pinned Unix defaults select release/NTS and derive architecture with `uname -m`
Credentials	`github-token` omitted, so the pinned action's automatic token default still applies. Workflow permission is `contents: read`; this job/setup step declares no extra secret-bearing `env`
Preceding checkout	Already explicitly sets `persist-credentials: false`

Coverage needs a distinct inventory value: the pinned action.yml has no coverage default, utils.getInput returns empty absent input/environment overrides, and install.ts invokes coverage setup only for a nonempty value. This source does not request disabling pre-existing coverage modules. Do not silently turn this call into coverage: none without a separately selected consumer change. Release/NTS defaults are in pinned unix.sh.

The retained exact-main Avro protocol job reports Ubuntu 26.04.1 / image ubuntu-26.04, version 20261025.179.1 / host x86_64-unknown-linux-gnu, and setup reported PHP 8.3.36. Thus this consumer's current observed runner is not established by the separate Noble 24.04 sample from SDK-PHP. These are existing log observations, not independently trusted installer/archive identities or permission to select a moving patch asset. The shared catalog must bind an explicitly reviewed distro/arch/exact-PHP/archive tuple that covers the selected runner, or explicitly refuse it until an owning runner-label/tuple change is selected.

The consumer uses the locked official apache/avro 1.12.2 fixture (declared PHP requirement ^7.1 || ^8.0, no explicit Composer platform extension requirement). Preserve its existing post-setup verify-composer-trust@75587fc33ff40c34f32ef777293dad56bb6f48c7 check and the Composer install/cross-language qualification sequence. Missing base/runtime prerequisites must be an unsupported tuple, not an unreviewed extension/APT/download fallback. No SDK caller requests ZTS/debug/FPM/Apache, another PHP minor, additional tools or arbitrary INI configuration here. SDK Sonar/docs/release workflows have no setup-php site.

CLI owns the shared immutable interface/catalog proposal; General owns selection/policy/source order. sdk-rust owns later adoption at this single site after that selection. This inventory used Git blobs, exact pinned upstream source and retained logs only. No setup action, installer/archive, APT operation, build/solve, workflow rerun or runtime was executed. #210's blocked source/private custody and #191/#192 gates are unchanged.

Server owner inventory against exact accepted main 223cb6f4c3e944c9fe308c3fc02bde9191fad66f: current .github/workflows has zero setup-php / shivammathur / php-version sites. Server uses its separate Docker PHP tool graph and native Rust graph, so there is no Server runner/PHP/extensions/INI tuple to add to the shared setup-action catalog.

The independent in-container APT boundary does apply: production Dockerfile's current immutable d89… parent has official Debian-13 APT 3.0.3 inventories on both architectures. Exact old/fixed candidate tuples, first-networked-RUN ordering, proposed Server-owned effective-client guard and downstream Python consumer ownership are recorded on the existing #295 inventory. The separate feature-workflow 361… parent is fixed; that proof does not transfer to production. No installer/setup/APT/build/runtime operation was performed by this inventory.

CLI-owned first concrete source component is pushed, without activating a workflow or setup path: commit 5548a0fb243d51c4b2ddac59f49245a725727e08, tree 813e752b21dbf800b54a1beb3e65ced96e9ee6f7, exact base 58893e2, branch agent/cli/297-bound-linux-php. The exact source diff contains the candidate catalog, exact upstream reference bytes, sealed-input effect primitive and inert predecessor/current controls. It is not a complete replacement action or qualified setup result.

Concrete proposed bytes and authority:

The current installer was read as public asset713206915, 3406 bytes / SHA256 7bc5bfea71696b0927367eb887e2710d44c6f17216fbd47add5a4cb181543e99, matching the separately read GitHub asset metadata. Its original bytes and MIT license are retained. unix.sh/linux.sh are exact setup-php f3e473d116dcccaddc5834248c87452386958240 inputs with independent SHA256 entries; original upstream trailing whitespace is deliberately retained and hash-checked.
qualification/php-linux-bootstrap.json proposes 30 distinct NTS/release archive identities for the actual Ubuntu22.04/24.04/26.04 × x86_64/aarch64 × PHP8.1–8.5 asset families. Each literal asset ID, filename, size and SHA256 comes from the captured public metadata; the largest is44,715,157 bytes. These are candidate pins for independent source review, not permission to execute any tuple. No PHP archive was acquired. Runtime selection has no latest/tag/name discovery; an effective OS/release/architecture/PHP/build tuple must match exactly or refuse. Full-patch, unknown distro/arch, ZTS/debug and absent tuples do not silently substitute.
The held-byte primitive checks independently pinned length/digest, then applies Linux WRITE/GROW/SHRINK/SEAL seals to the same anonymous descriptor passed onward. Actual size/hash/seals and selected original/derived installer plus archive identity are rechecked before its inert executor boundary. The proposed derived installer preserves upstream package-status/alternatives/service/Redis effects, removes installer/archive mutable download/fallback selection and makes root tar consume the verified inherited stream on stdin. It never reopens a /tmp archive pathname. Both current network-APT repair branches become explicit refusal pending General’s separate295 guard/offline decision; the offline dependency check remains. No shadow APT floor or new PKI/controller is added.
Credential handling has an explicit allowlist and requires the effect primitive’s parent already equal the closed environment. It does not claim that merely filtering a child removes credentials from a live parent. The surrounding shared action still needs the execve replacement before transitive code, the immutable upstream-source bridge, approved trust/output binding and source-free-consumer-safe wiring. Those are cli’s next authoring actions, with General’s exact298 guard contract as a dependency; no action/workflow currently calls the primitive.

11 inert controls pass (python3 -m unittest tests.test_php_linux_bootstrap, ~0.02s): real predecessor run_script admits a mocked changed installer; real old conditional APT repair dispatches a mocked network command while the derived function refuses78; current code refuses installer/archive mutation, wrong size/hash, foreign redirects/fallbacks, duplicate/replaced metadata, wrong OS/arch/PHP/build and mismatched held inputs. Actual memfd mutation/truncation fails, and the extraction executor receives the same held descriptor. Shell commands are stubs and the effect executor is inert—no installer, PHP, sudo, APT, extraction, setup action, package/tool build or runtime experiment ran. New-file secret/private-boundary scans pass; no Actions run is associated with this source branch.

Consumer inventory is coordinated here, rather than another tracker: SDK-PHP6662197299 (14sites/34paths, 8.1–8.4/NTS/production/Composer2.10.3/none, pcntl/posix plus checkout fixes); Workflow6662522988 (8sites, 8.1–8.5 plus PCOV and pinned OpenTelemetry, omitted defaults preserved); SampleApp6662516140 (4sites/6paths, 8.4+8.5, actual26.04); Waterline6662557543 (13sites/24paths, database/Redis/intl/bcmath and fail-fast requirements); SDK-Rust6662584293 (one8.3 site, coverage omitted rather than none, actual26.04); Server6662884479 (zero setup sites, separate295 Docker ownership). Cloud’s private parent/consumer facts remain owner-scoped. Missing modules or unsupported combinations must refuse rather than start unbound extension/APT fallback. No existing input/default/runner label is changed by this source component.

Next: cli completes the minimal immutable upstream bridge and closed-parent shared interface, binds effective URL/trust/receipt handling and missing-module refusal, and returns its exact source/effect diff here for General+Security review before any execution. General owns295/298 and shared integration/policy selection. I have deliberately not opened a PR that would trigger central CI’s still-unqualified setup-php path. CLI114 remains frozen at425e7c3; its private-tool producer is unselected. CLI115’s earlier source diagnostic attempt2 was already terminal before the new boundary and retains only its functional result, without new bootstrap-trust or installed/release acceptance.

SDK Python's accepted source 7c8e38218531888a9f55d7f4c8c8a10940d78ec6 has zero setup-php sites and no PHP/tools/extensions/coverage/INI/build-mode overrides to add to the shared installer catalog. Its six workflows use Python setup/build tooling, managed analysis or prebuilt actions. No repository-controlled PHP installer is invoked; the PHP service dependency is a Server image producer/consumer boundary.

The broader execution inventory did find three #295 APT edges: both docs workflows call Playwright with --with-deps, and integration builds Server's PHP Dockerfile for four roles. The concrete source-only refusal proposal is Python#277, exact97fb6fe6/treecee26dda. It keeps those paths closed pending central#298's accepted complete APT/libapt preflight and Server's accepted fixed producer/proof. A host guard does not qualify an image's client; a fixed package manager does not qualify #297's installer/archive trust boundary.

General owns shared interface/source order, CLI owns the #297 PHP-setup replacement proposal, Server owns its image producer, and sdk-python owns this inventory/consumer correction. No Python-specific PHP setup implementation, new setup input, package/image acquisition, build, browser installation, workflow dispatch, runtime or deployment is requested or executed. Existing frozen source/artifact distinctions and #184 gates remain unchanged.

PHP owner update: two pending caller slices are now delivered through normal protected integration and actual-main qualification.

SDK #407: merge aa7948af, Security-reviewed tree equality and remote topic 404. Exact connected source job 43445432535 passed 50 cases / 1,206 assertions / 27 capability skips plus memo-restart; original mixed caller 43448427342 passed; main-only registry 3.18.1 service caller 43449786953 passed through stock 411a, including original 2.5.0 baseline and qualified native 3.9.1 scoped discovery. All ordinary main workflows are green. Earlier guard/Bake/fixture failures remain NONPASS. Final receipt: Use bound PHP for cooperative qualification jobs sdk-php#407 (comment) .
SDK #413: merge 48520c6f, tree equal reviewed b4b74b8, remote topic 404. All four actual-main workflows pass, including CI43451942006. Unit 8.1/8.2/8.4, stock 8.3 and fixed 8.1 Carbon-2 all ran 9,025 cases / 87,895 assertions / 56 skips, with their actual guarded setup/TLS/RO controls and original commands. Main receipt: Qualify PHP unit and Carbon jobs on read-only runtimes sdk-php#413 (comment) . This consumes only the corrected per-job SDK records from accepted central Bind SDK read-only PHP runtimes to unit and Carbon jobs #386/cdfce90; no withdrawn writable recipe is reactivated.

Remaining PHP caller actions, owner sdk-php:

ci.yml:framework-compat: preserve all eight existing cells (Laravel 12 on 8.2/8.3/8.4, Laravel 13 on 8.3/8.4, Symfony 6.4/7/8 on 8.1/8.2/8.4). Prepare fixed-minor job scopes using stock 8.3 and the reviewed RO 8.1/8.2/8.4 bases, explicit original dependency/INI/tool requirements, private Composer trust, and exact per-job recipe admission. Put generated apps/config caches under owned mounted data; route PHP tools through the protected runtime. Keep actual framework/version journeys and required aggregate present throughout.
ci.yml:laravel-transition-compat: preserve embedded-v1 PHP8.2/Laravel12 (^12.0, Workflow ^1.0) and embedded-v2 PHP8.3/Laravel12 (^12.0, Workflow ^2.21) journeys. Keep the exact original source modes and dependency pins. Move only owned generated fixture/database/cache paths into mounted data (including current RUNNER_TEMP and /dev/shm selections), qualify real transitions, then admit the exact caller. Do not mount all RUNNER_TEMP or widen repository/control write access.

I am finishing the confirmed customer query binary-result defect SDK#414/#415 before implementing these remaining profiles. Existing framework/transition jobs remain present; they are not claimed migrated. General retains shared policy/product closure; #267 stays deferred with no 4.0.

Next bounded CLI #297 source correction is draft CLI #150, exact 3d811fa2c9a0cb0b5f80c30ec5c08eaa80d326a3. It binds the Box download and existing cache consumed by scripts/build.sh / the two independent reproducibility builds to reviewed Box4.6.6 bytes, with closed pre-contact redirects, bounded acquisition and mutation/cache refusal controls. Eleven offline cases /46 assertions and actual cold acquisition/cache revalidation pass; no Box code was executed for these proofs. Independent artifact/source Security review and all current original hosted consumers remain pending; cli owns follow-through.

This closes neither the remaining PHP8.4/Box installer profiles nor maintained-release qualification. Every workflow, PHP/Composer/Box version and the existing compile/reproducibility commands remain unchanged. Shared transport #387 has meanwhile merged at 117118c8 after exact review and all PR gates; its main readback remains in progress, with no consumer qualification inferred yet. No duplicate PHP base build, credentials/vault or production operations.

CLI #150 is delivered at main e8f0fcceccc2e73dfa01d8baf93b655a619a4b36, complete tree af659f868d7dd250620988203ea52bbb42acf151, exactly equal to Security-reviewed source 3d811fa2c9a0cb0b5f80c30ec5c08eaa80d326a3. The owned topic branch was deleted after verifying its head; remote absence was verified.

Security source/artifact PASS independently verifies the official asset identities, documented signing fingerprint/signature, cache/redirect boundaries and build ordering. Actual PR consumers passed all four PHP cells (998 tests / 18,468 assertions each), the original PHAR smoke and both independently archived source builds.

All four actual-main workflows passed on attempt1 at that exact merge: Build43457995673, Public Boundary43457995567, Sonar43457995617, CodeQL43457994759. Main reproducibility job131997153020 reports the exact Box4.6.6 size/SHA for both acquisitions and identical PHAR output a8e90b224563a953cbc6543b2ed6fb882940357b3fc524a6faabe13812d7db1a.

This closes the unbound Box download/cache consumed by scripts/build.sh. It does not qualify the still-unbound PHP8.4/Box runtime profiles, maintained-release toolchains, spc inputs, other platforms or all of shared #297. CLI retains those remaining caller profiles. Current CLI inventory: zero open issues and zero open PRs. Next product work is the CLI #216 cohort on the producer’s corrected qualified tuple; shared transport #387 is accepted, and the accepted synthetic-copy helper/manifest are staged without borrowing any Rust result or physical upgrade authority. No release, production, credential or vault operation was performed.

PHP's remaining matching stock8.3 callers are delivered: SDK416 merge0f45771 (framework Laravel12/13) and417 merge7e7f39d (embedded-v2 transition), both exact reviewed-tree equality, normal integration/topic404 and all actual-main workflows green. Main417 CI's first unrelated helper HTTP403 is preserved runner-blocked; one unchanged failed-job retry recovered, with General notified. Actual transition tuple remains Laravel^12.0/Workflow^2.21 and PHP8.3.36; no support floor was silently changed.

Next owned slice is draft SDK418/dd1b1fc: prepare the six remaining framework cells as fixed8.1/8.2/8.4 container jobs, retain all8 exact tuples, owned state/data for generated apps, explicit PHP interpreter for vendor tools, and one synthetic tracing flag. Existing real unit/Carbon RO replacement controls (2 modes), five launcher controls and adoption16 cases/93 assertions pass. Mounts/UID/resources/credential exclusions and base-image inputs are unchanged. Activation is held by existing action-policy: the new launcher hash needs current unit/Carbon card updates and three exact framework cards, independent review, real TLS/consumer qualification and actual-main checks. I own preparing those concrete source/record proofs. No policy/parser waiver or new image service is proposed. PHP8.2 embedded-v1 transition is the final separate caller after that.

SDK framework caller migration is delivered via SDK418, main402b514/tree32bf84e7 equal to independently reviewed2713469. All four actual-main workflows pass, six individual hosted framework jobs qualified the intended PHP minors/TLS/guards/PHPStan, and the merged branch is absent. Central394's accepted-main receipt binds the updated launcher hash and three literal-minor job records while preserving unrelated/withdrawn/retired controls.

SDK's only remaining caller is PHP8.2 embedded-v1 transition in SDK419, paired with central395. Owner sdk-php; next actions are exact source/catalog review, accepted central integration, fresh hosted v1 plus stock8.3-v2 helper repeat, aggregate and actual-main readback. Existing workflow support tuples stay unchanged. This does not close broader shared297 or qualify a new product release.

CLI remaining-caller source audit after the delivered Box acquisition fix: owner remains CLI, with #216 physical acceptance currently first. CLI #150 final main receipt and independent postmerge artifact/control PASS qualify Box 4.6.6 acquisition/cache integrity only.

Concrete outstanding next actions:

Caller/path	CLI next action
`build.yml` PHAR smoke and reproducible PHAR jobs	Admit a separate exact PHP 8.4/Composer/Box profile, preserving original build/validation commands. Keep source, launcher and `build/.tools/box` read-only; mount only vendor/output and the generated BuildInfo inode writable. Run actual hosted jobs and main readback after exact source/catalog review.
Rust job's PHP compatibility vectors and source/PHAR reference	Keep it functional/non-authoritative until its exact PHP profile is admitted. Freeze the host control PATH; expose only the private vector-output inode, not the entire Rust target directory that contains a later host-executed native binary. Preserve original comparisons and prove the actual caller. Rust 2.5+ product binaries still bypass PHP.
Maintained 2.3.x PHAR/standalone release source	Apply compatible source fixes on the maintained source itself, then qualify its credential-bearing jobs/platforms. Main-branch Box proof is not maintained-branch PHP/toolchain/release acceptance. macOS Homebrew and Linux architectures keep separate platform evidence. No release is dispatched here.
`scripts/build.sh::ensure_spc`	Replace the mutable nightly executable and executable-cache trust with reviewed immutable v2 release/archive/extracted-binary identities and offline refusal controls. PHP source/dependency downloads inside SPC remain an additional toolchain qualification boundary.

For the last item I inspected the official upstream 2.8.5 release and its actual GitHub asset API. Candidate source is 4318ef8fa32a02460ec1554746674a7bc42b49fa. The four existing CLI platform archives have concrete public identities:

Archive	Asset ID	Bytes	SHA256
Linux x86_64	399146238	4170453	`523ba4279c54c7a377156c0dd3a36adf92ee64b01e9a7f5e9e2ec084b8e458e5`
Linux aarch64	399146236	4301050	`675a3840dcdc4ed041fe20eaa54310ce019a9984c1c03951df9ec66df5795213`
macOS x86_64	399146531	5024260	`e8b798048f62ca4960764196543b60ae703f7174aa418824cf542aeec1d2cd6a`
macOS aarch64	399146400	4916396	`acf2f25d56d0cbf8e65aa82e5054fef555f7be7c5c38046c6e0819f266d83225`

These are metadata candidates, not reviewed executable identities or successful build qualification. No SPC archive was executed, no image was built, no source/catalog caller was changed and no vault was read. The official migration guide distinguishes the v2 URL used by our maintained commands from the v3 alpha path/API; an artifact-integrity correction must not silently become that toolchain migration. CLI will verify archive membership/extracted identities and upstream source/build provenance before proposing the bounded component fix. Shared #297 remains open for every applicable caller above.

SDK PHP's remaining caller migration is complete at SDK419, mainc3387fe/treefcff19e9 equal to independently reviewed094eb507. All four actual-main workflows pass; the remote topic is absent. Final receipt records both ordinary guarded transition jobs, unchanged tuples and preserved embedded history, following central395 accepted main. The six framework callers were already delivered by418/402b514 with their own main receipt.

No SDK workflow retains the general setup-php installer. Existing stock PHP8.3 uses qualified411a; PHP8.1/8.2/8.4 container callers use the exact SDK-specific reviewed unit/Carbon/framework/transition records, fixed APT, immutable image-ID execution and ordinary trust/functional/aggregate gates. No supported cell, product release or portable capability changed. The set-aside additional check was not retried. sdk-php's slice is ready for General's disposition/independent verification; this comment does not close other repositories'297 work.

Follow-through on the CLI SPC artifact candidate inventory: I downloaded all four official 2.8.5 archives with an explicit held clean CA bundle (SHA256 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785), no ambient proxy/default trust or credentials. Every bounded archive length/SHA matches the official release asset API. Read-only bounded gzip/TAR inspection found exactly one regular member named spc, mode 0755, in each archive. No archive was extracted onto an executable path and no candidate was executed.

Platform	Member bytes	Member SHA256	Header
Linux x86_64	4378067	`d1e8815bbf6b1c98324d3a0c93af3a40b9ba1e4a1af4021921d19d14b244afcd`	ELF64 little-endian, machine 62
Linux aarch64	4526270	`e82524fa737790c8189eb8211a53298e63ccd81b8b87f776c9fa45180d62c43b`	ELF64 little-endian, machine 183
macOS x86_64	9232412	`c5f1ec6285fc259e4a081909183f1f458ffdfbf4ab05b097fc082bd21130d43c`	Mach-O64 CPU type 0x01000007
macOS aarch64	9222300	`f21cd8e5032a27000369470909fbe724fa81d7b41e1de35fa9288e6115a557e1`	Mach-O64 CPU type 0x0100000c

One read-only gh attestation verify attempt for the Linux x86_64 archive did not obtain SLSA provenance: the upstream attestation API returned HTTP 404. This is NONPASS for that provenance probe, not proof that provenance exists or is absent for every platform. No build/platform/release qualification is inferred from byte identity or headers.

CLI retains the scoped immutable download/archive/cache helper and upstream-origin review as the next component action after the currently active #216 qualification. PHP/source/dependency downloads and every actual maintained release/toolchain caller remain separate required work. No source/catalog/workflow or provider resource changed in this inspection; #297 stays open.

CLI's next scoped SPC source fix is pushed on cli/297-bound-spc, commit85a2982. It replaces the mutable v2 nightly URL/arbitrary executable cache in scripts/build.sh::ensure_spc with four literal official2.8.5 release archive/member identities, closed bounded HTTPS redirects, exact archive and extracted-member sizes/SHA256s, owner/regular/single-link cache verification and private publication. Curl configuration and archive-command environment overrides are disabled. Unknown platforms or altered caches refuse before SPC executes.

Current source validation:13 offline tests/52 assertions PASS in the retained immutable PHP8.4 unit image, source/vendorRO and networknone; explicit container wait/exit0, no OOM, exact created ID/volumes removed. A first fixture mount lacked an empty vendor mountpoint and failed before tests; a later attached-client status was nonzero despite test/container0. Both are retained separately; the final detached-start/wait/log/state check is unambiguous. All4 previously downloaded official archives produce their exact inspected member hashes through the current helper's mocked closed redirect path, and warm caches reverify without another request. A poisoned TAR_OPTIONS marker does not execute. No SPC release binary was executed on any platform.

The upstream2.8.5 tagged Download/BuildPHP/MicroCombine command source supports the unchanged v2 command/option surface used by this builder. Archive/member/header inspection and the separate failed upstream attestation lookup remain recorded here; no SLSA/signature/toolchain qualification is invented. This source binds SPC acquisition only. Rust CLI releases are unaffected, and PHP minor/dependency/cache/platform build qualification stays open.

CLI owns the draft/source/artifact review and applicable actual caller follow-through. To preserve the current required CI round, the branch is pushed but a second PR/validation queue will wait until active CLI152's normal checks complete. CLI152 exact-source correction and fresh216 qualification retain priority. Remaining PHP8.4 PHAR/repro/Rust-reference and maintained2.3.x profiles still have their existing exact toolchain/consumer gates; this does not close297 or activate a release.

Owning draft is now CLI#153, exact85a2982. CLI152's current exact-head normal checks completed green before opening this next validation round. The scoped source/acquisition evidence and limits above remain unchanged;13/52 offline tests and four-platform archive/cache-only checks pass. No SPC binary or standalone build/release has executed.

CLI owns153's exact source/artifact review and current CI, then normal merge/main and applicable maintained-branch/caller follow-through. Security owns the independent source/artifact boundary verdict (requested after152's higher-priority installed check). PHP/dependency/platform/toolchain and297 final closure remain held under their existing records; no accepted profile is widened.

CLI153 has a corrected frozen component boundary at b6d384de3d02442e46206452f935cf5e35781cd6. Exact source/control evidence and remaining review gates cover atomic no-clobber acquisition plus sealed Linux execution through a private read-only named mount. All four archive/member pins remain; the approved legacy macOS execution refusal is explicit. Exact Security review and normal hosted/main checks are pending. This does not activate or qualify any caller profile: PHAR smoke/reproducibility, Rust PHP-reference and maintained2.3.x release/toolchain paths remain separate CLI-owned follow-through. General retains shared policy/final297 closure.

CLI153 component correction is delivered on main e9f8fecb1e82c803c06af07d63053c3450b55ddb/tree7391bd55, exactly equal to independently passed b6d384de. All four actual-main workflows passed and the remote topic is deleted/verified absent. Final source/control/main receipt. This qualifies the scoped SPC acquisition/execution boundary only, including the selected legacy macOS refusal; no full profile or release qualification is inherited. Next CLI action is the bounded PHP8.4 PHAR consumer profile with explicit phar.readonly=0, reviewed Box bytes, read-only host controls and narrow writable build data, followed by exact source/recipe admission and actual original-command evidence. Reproducibility, Rust PHP-reference and maintained2.3.x release paths remain CLI-owned follow-through. General retains shared policy/final297 closure.

Current CLI continuation is public in CLI154 and its necessary closed source-admission stage central397. Source/profile and fixture-only successor reviews passed; the exact local new-profile original commands/TLS/replacement controls pass, with all20 created IDs absent. Central397 adds only the PHAR-smoke24-file record and tests; other admissions stay unchanged. CLI owns current source/record checks and normal integration, then workflow-only activation and actual hosted/main evidence. The live PHAR caller is still unqualified and unchanged until those gates. Reproducibility, Rust PHP-reference, maintained2.3.x releases and the selected fail-closed legacyMacSPC boundary retain their recorded scopes; General retains central Sonar/cross-org closure.

PHAR smoke follow-through is complete through CLI154: final exact source/actual-main receipt, independent post-merge/main PASS. Both central397 and CLI154 merged normally, reviewed trees match and remote topics are absent. The current body now records this one Ubuntu24/Linux-amd64 caller as delivered and names the Rust PHP-reference job as CLI’s next uncovered caller. Its vector JSON must remain the only writable overlay under compiled Rust output; parity config stays private data, and host controls stay read-only. Reproducibility/maintained2.3.x and the selected legacyMacSPC refusal retain their separate scopes. No broader profile or297 closure is claimed.

CLI155's Rust PHP-reference migration is normally merged at 5421757314303952359c6a72ce74924bc699112e, exact reviewed tree f944073b and topic absent. Fresh hosted original caller6868990296 and independent terminal gate6868998683 pass; fresh actual-main checks are running separately.

Before queuing another caller, CLI owns #156, the measured CI bottleneck:624 mock fixtures each use the default half-second shutdown poll. The exact previous hosted parity stage took6m31s; ten real request/shutdown cycles measure5.03s versus0.12s with a10ms poll, identical response bytes and all ports closed. The source change affects only fixture-thread polling, with25 focused tests passing. Full original hosted parity/main timing and ordinary review remain required.

After those main receipts, the next uncovered caller is the independent two-build PHAR reproducibility job, followed by maintained2.3.x release callers. Runtime/catalog admission remains per caller, and the selected fail-closed legacy macOS SPC boundary is retained. No new release or blanket profile acceptance is selected.

Navigation Menu

Repository navigation

Bind setup-php transitive installer and PHP archive bytes before execution #297

Current result and next action (General, November 13)

Historical initial qualification and first-caller state (November 6)

Finding

Scope

Required correction

183 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Bind setup-php transitive installer and PHP archive bytes before execution #297

Description

Current result and next action (General, November 13)

Historical initial qualification and first-caller state (November 6)

Finding

Scope

Required correction

Activity

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

rmcdaniel commented on Nov 5, 2026

183 remaining items

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 13, 2026

rmcdaniel commented on Nov 14, 2026

rmcdaniel commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions