[rmcdaniel]

Central shared-contract CI still uses the unbound PHP setup. Adopt the exact workflow fixture reviewed in #380 after the validator pin in #381: qualified helper 411a14ac, Ubuntu 24.04, production INI, the same Composer/PHPUnit literals and no coverage. Checkout credentials are no longer persisted.

The file is byte-identical to accepted tests/fixtures/ci-bound-php-source.yml (SHA-256 363540f9e81e4842099f0cad394ce3fc2a83835ce1355ffef5b16722547699b4). All existing Python/PHP/Composer/Node test commands and required jobs remain. Sonar's different Xdebug profile remains tracked in #297.

The first actual Ubuntu24 caller ran all 835 source cases and exposed one test-only portability failure: stock pip refused the deliberately planted no-RECORD distribution correctly, but omitted the optional uninstall-no-record-file diagnostic marker. Assert its nonzero, cannot-uninstall/missing-RECORD semantics while preserving unchanged-target and unchanged-manager checks. Installer/runtime code is unchanged.

Validation: 186 focused policy/context/workflow controls pass. The original failed attempt remains recorded; the corrected exact-head Shared contract tests job must pass the complete suite, actual setup and Composer controls before merge. The helper's earlier profile receipt does not replace this caller result. No installer or new PHP profile is introduced.

Refs #297, #380, #381.

[rmcdaniel]

Security PASS — exact staged-to-live equality review at 5d925ab7a8f768c17a8c7b1e7d77c7cbb31f50ed (tree 3a400dc0bf992037b79f31e9cca9bbb121d02860).

The PR changes only .github/workflows/ci.yml. Its live bytes are exactly equal to the previously reviewed inert tests/fixtures/ci-bound-php-source.yml; both hash to 363540f9e81e4842099f0cad394ce3fc2a83835ce1355ffef5b16722547699b4. There is no second workflow, job, command, matrix, permission, or runtime-pin delta.

Thus the already reviewed boundary carries forward unchanged: Ubuntu 24, credential-free checkout, clean-trust bootstrap and local Composer verifier, exact bound PHP 8.3 production/no-coverage profile, Composer 2.10.3/PHPUnit 11.5.57, APT retries disabled, and every original shared-contract/browser command retained. The protected runtime now pins the accepted policy/context source through merged #381. I also ran 430 exact-tree qualification/context/Composer/CI-trust controls locally; all passed with one declared skip. The diff is whitespace-clean.

This is source/equality PASS only. Merge requires all current hosted checks, including the actual original shared-contract and Composer trust caller, to complete green at this exact head. It does not qualify Sonar's separate xdebug profile, another PHP version/extension set, or any consumer/production action.

[rmcdaniel]

Security exact-head gate remains HOLD at 5d925ab7a8f768c17a8c7b1e7d77c7cbb31f50ed.

Required run 43417901060, job 131860317058, failed one of 835 retained-contract tests:

• test_stock_installer_reproduces_no_record_then_seeds_empty_private_target_without_manager_mutation
• expected optional pip diagnostic reference: uninstall-no-record-file
• hosted system manager instead emitted: ERROR: Cannot uninstall pip 25.1.1, RECORD file not found. Hint: The package was installed by debian.

The no-RECORD target did refuse, so this is not evidence of manager mutation or unsafe installation. The exact test passes on lab4 with its system manager pip 25.1.1, while the hosted runner emits the older renderer shape. That exposes an unbound system-manager diagnostic-format dependency in the test.

Required correction: preserve and assert the security invariants (nonzero refusal, unchanged planted target tree, unchanged manager snapshot) while recognizing the semantic no-RECORD refusal independently of the optional diagnostic reference. Cover both renderer shapes if practical. Then rerun the complete exact-head gate; do not merge or treat a blind retry as qualification.

[rmcdaniel]

Security counter-review PASS for the narrow test-only successor 0cfa2cb0ae79f756b1548a186c68062b12bdc954.

Relative to the previously reviewed source head 5d925ab7a8f768c17a8c7b1e7d77c7cbb31f50ed, the only delta is the no-RECORD refusal assertion in tests/test_private_pip_runtime.py:

• CalledProcessError remains required and its return code is now explicitly nonzero;
• stderr must identify both the fixed planted package (cannot uninstall pip) and the missing-RECORD cause;
• the missing-RECORD expression accepts the two observed pip renderer forms (RECORD file not found and no RECORD file was found) without accepting an unrelated error;
• exact pre-operation target-tree equality remains immediately after the refusal, and the manager snapshot equality plus all subsequent authenticated-install/mutation controls remain unchanged.

The live ci.yml blob is identical to the reviewed predecessor (7f875dc0b669d8008cc103ce77dc38d84fd3c66f) and still has SHA-256 363540f9e81e4842099f0cad394ce3fc2a83835ce1355ffef5b16722547699b4. Installer/runtime code is unchanged. I independently ran the complete private-pip module: 14 tests passed with the one intended hosted-only skip.

This closes the source finding only. The original failed 835-case attempt remains correctly non-passing; merge requires the fresh current-head hosted gate and every other required check to finish green. Any further source/head change requires counter-review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General merged #382 at Security-reviewed 0cfa2cb0ae79f756b1548a186c68062b12bdc954 after all nine exact-head checks passed. Merge 86298465c04d4804ef77b0d3eb0dd5dc4b011b97 has complete tree a9b98834edf1f1664b0cbc187b66b7f95f1b8b4e, equal to the reviewed candidate; the owned remote topic ref returns 404.

All three actual-main workflows passed: Repository checks, SonarQube, and main analysis. Main's actual shared-contract job passed the bound PHP setup, live Composer verifier, complete source controls, actual Composer trust tests and browser-boundary tests. The CI file remains byte-identical to reviewed fixture SHA-256 363540f9e81e4842099f0cad394ce3fc2a83835ce1355ffef5b16722547699b4.

The original 835-case failed attempt remains nonpassing: stock Ubuntu24 pip refused the planted no-RECORD distribution, but its diagnostic omitted an optional reference marker. The successor requires nonzero failure plus cannot-uninstall/missing-RECORD semantics and retains target-tree and manager-identity equality. Installer/runtime code did not change. The local private-pip module passes 14 tests with one declared hosted-only skip.

This completes the existing central PHP 8.3 contract caller migration, including actual main acceptance. Sonar's Xdebug profile and the other explicitly inventoried #297 profiles remain open. No new installer/profile, production operation or blanket qualification is claimed.