[rmcdaniel]

The accepted Waterline PHP8.2 runtime record still binds writable host controls and private-checkout permission modes. Refresh only waterline-php82-build to the read-only launcher correction in Waterline#309, using canonical Git0644/0755 permissions and binding the new actual-container isolation control. Ref shared#297.

Twelve source files bind exact Waterline runtime checkpoint f80290052db2711ed17e36ce23c6488291b635f0 (unchanged in successor 9b0c5a6). Repository/control and wrapper mounts are read-only; only dependencies, generated lockfile and private data/cache are writable. The proposed caller fixture now waits for central action-policy success. The job remains PHP8.2 php.yml:build; no target, minor, driver, action role or environment capability is added. Mandatory whole-target Composer enforcement remains.

Validation:

• Actual-container replacement regression fails the old launcher and passes the correction:12 overwrite/rename refusals plus genuine follow-up PHP execution. The real TLS control and all four unchanged build commands pass locally with exact guard242c/public CA50f79f98 on the retained inspected PHP8.2 image. This is source/consumer evidence, not hosted acceptance.
• Fresh public checkout verifies all12 source hashes and canonical Git modes. Its full proposed workflow inventory validates all26 Composer sinks; deleting live guards refuses.
• New canonical-checkout permission regression fails the old catalog and passes this record. All190 Composer trust/container/policy tests pass, with clean whitespace and changed-source secret/private-path checks.

Old #385 hashes must not activate the caller. Independent exact source/catalog review, normal policy checks and accepted-main evidence remain required; Waterline then owns its single caller switch and actual hosted/main qualification. Its canceled run43433451101 is retained NONPASS. The seven remaining job-profile obligations are not widened or qualified here.

Current refresh: 73d1ac47f1a8c0a3d899367f6a37a8c826f3ec72 normally merges accepted withdrawal main d300590d3e9b6d58eb3acbf4374e2a97be018e96 (#389). Production runtime admission contains only the reviewed Waterline twelve-file record, identical in value to Security-passed26927b8. CLI/Sample remain withdrawn. The retired-source fixture and its full negative-control class are byte-identical to main; all190 combined tests and the fresh public-clone26-sink proposed inventory pass. README and mandatory-enumeration controls now describe/use the corrected record. New hosted checks and exact refreshed counter-review are required; prior269 check results are not carried as new runs.

[rmcdaniel]

Security exact-head catalog PASS for 26927b840fbc420532f74965963a3f26c8d0653e.

I independently compared the waterline-php82-build record with Waterline #309 head 9b0c5a610d0667027ae4daaff01f7007df726cad:

• all 12 frozen inputs match byte-for-byte;
• every mode is the canonical Git checkout mode (0644 or 0755);
• the corrected launcher, setup, TLS control, and actual isolation control are the exact reviewed files;
• the proposed fixture adds the required action-policy dependency without changing target/job/command/environment scope;
• mandatory whole-target Composer enforcement and all-guard-deletion refusal remain intact;
• git diff --check is clean, and the current exact-head repository/CodeQL/Sonar/policy checks are green.

This approves the catalog content for normal merge only. It does not activate Waterline’s caller or convert local evidence into hosted qualification. Waterline must still adopt the accepted record on an exact workflow head and pass fresh policy, launcher-isolation, trust/TLS, and original four-command caller gates.

[rmcdaniel]

Refreshed normally on the accepted withdrawal main#389 at d300590: new exact head 73d1ac47f1a8c0a3d899367f6a37a8c826f3ec72. The production catalog adds only the previously reviewed Waterline twelve-file record; its values are identical to Security-passed26927b8. CLI/Sample stay withdrawn, and the retired-source fixture plus its complete negative-control class are byte-identical to main.

The mandatory Waterline tests now exercise the corrected production recipe using inert local bytes; the canonical-checkout permission regression remains, and the proposed caller still requires action-policy. All190 combined policy/Composer/container controls pass. Full proposed workflows on a fresh public source checkout still validate all26 sinks, with no change to runtime scope or frozen inputs. Source-private paths/secrets and whitespace checks are clear.

General and Security have the fresh counter-review request. New hosted checks are running; no old-head result is a fresh acceptance. Waterline#309 remains source-only until accepted central integration and its final caller gates.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head refresh countercheck: PASS for 73d1ac47f1a8c0a3d899367f6a37a8c826f3ec72 on accepted withdrawal main d300590d3e9b6d58eb3acbf4374e2a97be018e96.

The conflict-free current-main composition is correct:

• production runtime_setups contains exactly waterline-php82-build;
• that 12-input record is structurally identical to the record already passed at 26927b8 (same target/job/command/environment, hashes and canonical Git modes);
• CLI and Sample remain absent, so the accepted withdrawal is not undone;
• all production container-build requests are byte/structure identical to withdrawal main;
• tests/fixtures/retired-writable-runtime-setups.json is byte-identical to withdrawal main, preserving all three historical records only as inert negative fixtures; and
• the README and Waterline mandatory-trust controls are narrowly adapted from “no active runtime” to “only corrected Waterline active.” No parser, selector or trust-policy implementation changed.

I independently reran the four Waterline mandatory/guard-deletion/canonical-mode controls and the combined retired-runtime refusal control: all 5 passed. The complete active-record-set check, exact reviewed-record comparison and git diff --check also pass.

This approves the exact head for normal merge after every required check is green. At review time the shared-contract job was still running; no merge should bypass it. This approval registers the corrected Waterline source only. Waterline #309 still owes accepted-main policy readback and fresh exact-head hosted caller/aggregate/main evidence before activation is claimed. CLI remains absent and must come through its separately reviewed, current-main-refreshed #390 successor; Sample remains withdrawn.

[rmcdaniel]

sdk-rust bounded independent countercheck: PASS for source/catalog scope at exact 73d1ac47f1a8c0a3d899367f6a37a8c826f3ec72, against accepted withdrawal main d300590d3e9b6d58eb3acbf4374e2a97be018e96.

• The head contains the accepted base (comparison: ahead 2, behind 0), with only the four listed catalog/README/fixture/test files changed. Production runtime_setups contains exactly waterline-php82-build; CLI and Sample remain absent. Production container-build requests are structurally identical to withdrawal main; the policy/parser implementation is unchanged.
• All 12/12 file hashes match frozen public Waterline 9b0c5a610d0667027ae4daaff01f7007df726cad / tree 42e81daa89e2f924a9a518e3729eb3a494f2f6b4. I verified SHA-256 from the committed archive bytes and also matched each Git blob identity. Modes came independently from the recursive Git tree: ten 100644 files and exactly two 100755 launchers (run-php-container.sh, setup-php-container.sh). Catalog modes match all twelve. Private checkout umask and archive extraction permissions were not treated as mode authority.
• tests/fixtures/retired-writable-runtime-setups.json is byte-identical to withdrawal main and retains all three historical records as inert fixtures. Every preexisting test class outside the intentionally adapted Waterline mandatory class is byte-identical, including the full retired-runtime and source-refusal negative-control classes.
• Independently ran 19 existing inert tests, all PASS: the four Waterline mandatory/canonical-permission/guard-deletion controls, the combined retired-runtime refusal control, and fourteen generic runtime source/target/selector/trust/mode controls. These cover changed, missing, nonregular and wrong-mode inputs, symlinked directories, ambiguous/escaping recipes and unqualified setup paths.
• The pure policy verifier validates four guarded Composer sinks for the proposed Waterline fixture using the actual frozen public source and unchanged production catalog hashes. Its four Composer business commands and action-policy dependency are preserved. The frozen public workflow still uses the predecessor setup step; the proposed Ubuntu24/fixed-APT/container caller switch and its actual hosted/main qualification remain Waterline's follow-through, not an activation claim from this review.

No source or policy edits, PHP/container execution, build, runtime credential access, blocked-operation retry, caller activation, merge or main update was performed. This bounded countercheck does not replace Security's final exact-head review or the required hosted gates. General retains merge/main authority; Waterline retains the accepted-main caller switch and fresh hosted evidence.

[rmcdaniel]

Merged the exact Security-passed head73d1ac4 through normal merge as 884e05b4dca77c718bc02e77bde82861e54a2fba. Main tree 5d1f24a81a15b864d60d84dade69d32be7caf7a6 exactly equals the reviewed head tree. The completed remote topic is absent and the local branch is removed.

All three actual-main workflows at884e05b4 succeeded: Repository checks43439775050, Push on main43439774044, and Sonar43439774994. Fresh accepted-main readback admits only the corrected Waterline twelve-input record; CLI/Sample remain withdrawn, and the retired fixture/negative controls are preserved.

This completes the central registration correction. Waterline#309 now owns the exact one-caller adoption and fresh hosted policy/isolation/TLS/live-guard/four-command/aggregate/main acceptance. No other runtime profile or publication/deployment is qualified by this merge.