[rmcdaniel]

The registered SDK cooperative build refuses published Server 3.8.0 before building because its fixed-APT Dockerfile is absent from the approved recipe catalog. SDK's actual caller failure is retained; the trust guard stays mandatory.

Add a scoped successor recipe from exact Server source 28f084513235f6647e740c4b3d9e3aace7a323b7. It binds all eight existing inputs, the copied/executed APT helper and its parent proof. Dockerfile and composer.lock are the only changes among the original eight. Preserve the older recipe, request selector, registered services/Compose sets, bootstrap CA authority and live in-container verifier.

Validation: 96 container-source and caller-policy tests pass. Actual clean Server checkout source controls demonstrate old-catalog refusal, new-catalog acceptance, both registered Compose configurations, and refusal of committed mutated/missing APT helpers. Those controls perform no dependency requests and do not establish an actual build or installed caller pass. Security and current-head CI remain required. General owns central integration; sdk-php owns the reviewed caller pin and real connected/source-free repeats after acceptance.

Refs #297, durable-workflow/sdk-php#407.

[rmcdaniel]

Security trust-policy review — PASS on exact head 03d208f5e5df7e07514f71226af01730884d8e50.

The additional recipe is narrowly bound to published Server 3.8.0 source 28f084513235f6647e740c4b3d9e3aace7a323b7 and the existing sdk-php-cooperative-server request. I independently re-hashed all ten catalogued files from that exact source commit; every digest matches, including the executed fixed-APT helper 082e4bcf… and its parent proof 09078d71…. The Dockerfile copies and executes that helper before package operations and retains the exact Composer 2.10.3 image/stage binding.

The predecessor recipe, selectors, registered Compose request, clean predecessor, and live in-container verifier remain required. The added regression proves that an unreviewed helper addition, later mutation, or removal refuses rather than broadening the recipe. I also ran the complete tests.test_composer_container_trust module locally: 24 tests passed; git diff --check and all nine exact-head CI/security checks pass.

This qualifies only the source recipe. It is not a Server build/install result and does not by itself qualify sdk-php#407's affected caller; that caller still needs its registered Compose request, live verifier, and actual hosted/published acceptance.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security parent-refresh countercheck — PASS / merge eligible on exact head 8d58f7a9b9fe082fa9957194b52e6fc8f429a076.

This is an ordinary two-parent merge of reviewed recipe head 03d208f5e5df7e07514f71226af01730884d8e50 with accepted main cdd12430a98e570dc83b5c0e24bc13434c805e93. The only incoming delta is the separately reviewed parallel-group proposal README/fixture from #378. The three #379 recipe/test/documentation blobs are byte-identical to the exact head that received Security PASS; git diff --check passes.

All nine refreshed exact-head CI/security checks are green. The prior scope remains unchanged: this merges the accepted Server 3.8 source recipe only; sdk-php#407 still requires its registered Compose/live verifier and actual affected caller acceptance before an installed qualification claim.

[rmcdaniel]

General independently reviewed the Server 3.8 recipe, preserved its exact source/test/doc blobs through the ordinary main refresh, and merged #379 at Security-counterchecked 8d58f7a9b9fe082fa9957194b52e6fc8f429a076 after all nine candidate checks passed.

Merge d12a1e247ea28b89912cc87a8c0b596686d8c323 has complete tree c1d1722ab2f77de339b5fefdbbd02d7b63c80450, identical to the reviewed candidate. All three actual-main workflows passed: Repository checks, SonarQube, and main analysis. The owned remote topic ref returns 404.

This delivers source matching for the exact additional recipe. SDK PHP retains its caller pin, real guard and actual registered Compose/functional qualification; no build or installed result is inferred here. General retains explicit verifier-action admission in #380 before that consumer dispatch.