From 26927b840fbc420532f74965963a3f26c8d0653e Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Fri, 13 Nov 2026 13:36:49 +0000
Subject: [PATCH] Bind Waterline read-only PHP controls and canonical Git modes

---
 qualification/composer-container-trust.json | 32 ++++++++++++---------
 tests/fixtures/waterline-php82-build.yml    |  1 +
 tests/test_composer_trust_contract.py       |  6 ++++
 3 files changed, 25 insertions(+), 14 deletions(-)

diff --git a/qualification/composer-container-trust.json b/qualification/composer-container-trust.json
index befd79a..fa6765b 100644
--- a/qualification/composer-container-trust.json
+++ b/qualification/composer-container-trust.json
@@ -147,47 +147,51 @@
       "files": {
         "docker/php-ci/Dockerfile": {
           "sha256": "81d23fbbee7e4ee97ca14df9d17982aa664335b94499c5019662259fe0387eaa",
-          "mode": 384
+          "mode": 420
         },
         "docker/php-ci/Dockerfile.dockerignore": {
           "sha256": "a26d7f1f5ae2cac900e5e32bfaa0f08bd7a8435847095990c9bfe09d0edbf264",
-          "mode": 384
+          "mode": 420
         },
         "docker/php-ci/verify-php-trust.php": {
           "sha256": "529c282e7422202bf25565431a6391de388f86dfe5bfd6c75cf21daa56ffa75e",
-          "mode": 384
+          "mode": 420
         },
         "docker/brotli/install-vendor.sh": {
           "sha256": "d7eb8b2a3e0af1c3072a56bcb81632b22f061f211d8fe5e57ee901c8bf94c92f",
-          "mode": 384
+          "mode": 420
         },
         "docker/brotli/verify-runtime.php": {
           "sha256": "580cc465e349f3872eca592355294e7320fe7f1a4560ff5d4c83d5900921c00e",
-          "mode": 384
+          "mode": 420
         },
         "docker/brotli/verify-system-brotli.c": {
           "sha256": "3353927d206aaf5e63157e46be715c6cbee46bac777e29f8f9e25c4c1f656667",
-          "mode": 384
+          "mode": 420
         },
         "docker/brotli/version": {
           "sha256": "e064953e075ddb99fb7b48ad29e215f2dfa075812c127eb1d6ab680e9920fba2",
-          "mode": 384
+          "mode": 420
         },
         "scripts/ci/php-container-images.json": {
           "sha256": "3314ecfd6c32641af1d5475f8e57f4421979f67e05db1f98c79ef7b08d41b944",
-          "mode": 384
+          "mode": 420
         },
         "scripts/ci/run-php-container.sh": {
-          "sha256": "456f9716edbfaa8429edba92f958c4e1b3551bcbfd849a722764ae47daffb8fd",
-          "mode": 448
+          "sha256": "27b2601a4907737efa9ce157524e36ef0932df97d2d23b515cf65997e4f3725b",
+          "mode": 493
         },
         "scripts/ci/setup-php-container.sh": {
-          "sha256": "5064d48df69940cdf609be7bccd82ee71624d1017a8486a29028c765bb311f13",
-          "mode": 448
+          "sha256": "db0a276dea94aef70c3873ffc14e0ebf88e5baf4a6145e1a61a281d5835f59e4",
+          "mode": 493
         },
         "tests/ci/test_php_container_tls.py": {
-          "sha256": "7e365ff0f27c4efea0f7cf8ec3778f48fb1fe03e80a5b5b0c9500a6935f3d767",
-          "mode": 384
+          "sha256": "9b229ac8400a047bfc6cf60ede16db899298e01b3543b840ab692656c2ef28fb",
+          "mode": 420
+        },
+        "tests/ci/test_php_container_isolation.py": {
+          "sha256": "821e1c8db3da47ec502efd704044bffb55b744ce7fe1d42c71c367ba0c9e9924",
+          "mode": 420
         }
       }
     },
diff --git a/tests/fixtures/waterline-php82-build.yml b/tests/fixtures/waterline-php82-build.yml
index 04f0d03..d1ab354 100644
--- a/tests/fixtures/waterline-php82-build.yml
+++ b/tests/fixtures/waterline-php82-build.yml
@@ -2,6 +2,7 @@
 jobs:
   build:
     needs:
+    - action-policy
     - classify
     - frontend
     if: ${{ needs.classify.outputs.qualification-class == 'complete' }}
diff --git a/tests/test_composer_trust_contract.py b/tests/test_composer_trust_contract.py
index 280e65c..8ca22c6 100644
--- a/tests/test_composer_trust_contract.py
+++ b/tests/test_composer_trust_contract.py
@@ -399,6 +399,12 @@ def check(self, document):
     def test_proposed_build_enumerates_all_guarded_requests(self):
         self.assertEqual(4, len(self.check(self.document)))
 
+    def test_proposed_build_accepts_canonical_git_checkout_permissions(self):
+        recipe = self.catalog["runtime_setups"]["waterline-php82-build"]
+        for name, expected in recipe["files"].items():
+            (self.root / name).chmod(0o755 if expected["mode"] & 0o100 else 0o644)
+        self.assertEqual(4, len(self.check(self.document)))
+
     def test_deleting_every_live_verifier_cannot_disable_enumeration(self):
         document = deepcopy(self.document)
         steps = document["jobs"]["build"]["steps"]