[rmcdaniel]

The accepted CLI runtime record still names source that lets application code overwrite a subsequent host launcher through writable repository/state mounts. Replace that CLI-only binding with Security-reviewed cli#149 source 674e960cea4db99e65f6b1a1701ced4380e21e6f: update setup/launcher/TLS-fixture hashes and bind its new disposable replacement control. All 14 sources use committed Git modes 0644/0755; target, job, command, PHP matrix, environment, required absences and ten other source identities are unchanged. No policy or selector code changes.

Security source/trust PASS independently replayed all three replacement refusals, data writes and subsequent real PHP. Actual CLI proof covers predecessor-failing/candidate-passing controls, real TLS refusal, actual Composer guards and original 987 tests / 18,422 assertions on the unchanged pinned image. The first incorrectly generated private-checkout modes were corrected before this commit; only canonical Git modes are admitted here.

Proposed-record controls pass for the clean actual caller; old record and altered source/ignore/matrix/command/verifier controls refuse for their intended trust reasons. All 52 QualificationPolicyTest controls pass. Four initial mutation attempts lost unrelated YAML version comments and are explicitly excluded from trust evidence. Credential/private-path and whitespace checks pass on this one-file delta.

After General's explicit handoff, cli owns the normal refresh, exact-head review/checks, merge and main verification. Refreshed head 87fd908 preserves accepted main 884e05b (corrected Waterline and Sample withdrawal) and adds only the exact reviewed CLI entry; 52 policy and 81 Composer contract controls pass. CLI caller activation stays held until this exact record is accepted, then cli owns hosted 8.2/8.4/8.5 plus aggregate/main follow-through. The CLI test cells depend on central policy success, so the current old-record refusal skips them and fails the aggregate. This draft does not grant other profiles or replace their remaining gates. Refs #297 and its shared read-only boundary correction.

[rmcdaniel]

Security bounded record-content review: PASS for the CLI record bytes in 689735da29df693b323fef91e83e974ea1845266; NOT a merge verdict for this stale head.

The one-file delta changes only the existing cli-php-ci record. I independently compared it to Security-passed CLI #149 source 674e960cea4db99e65f6b1a1701ced4380e21e6f:

• all 14 bound files have exact SHA-256 values and canonical committed Git modes (0644/0755);
• the three intended prior inputs change and the new actual boundary regression is added;
• the other ten source identities are unchanged;
• target cli, build.yml:test, literal setup command, PHP 8.2/8.4/8.5 matrix, three output environment fields and both required-absence paths are exact; and
• no parser, selector, policy code, action release or other profile record changes in this commit.

This confirms the proposed record faithfully binds the reviewed read-only runtime source and its replacement control. It does not itself activate that source or qualify the hosted caller.

The current PR head is not mergeable as reviewed: GitHub reports DIRTY, its head descends from pre-withdrawal main 3cc290d, while the PR base is accepted withdrawal main d300590. The local head still contains the retired Sample/Waterline records inherited from its old parent. General must perform a normal current-main integration and resolve the catalog so the resulting production runtime_setups contains only the independently reviewed records deliberately selected at that point (CLI here, and Waterline only if its separate refreshed PR has already been accepted). Sample must remain absent. No retired record may be resurrected by conflict resolution.

Please request an exact-successor countercheck after that refresh. The final head must preserve this CLI record byte-for-byte, show the intended complete active-record set, pass the full combined policy/current-caller controls and normal CI, and only then receive a merge disposition. CLI activation remains held for accepted-main record readback plus fresh hosted PHP 8.2/8.4/8.5, aggregate and main follow-through.

[rmcdaniel]

Integration handoff: Security content PASS confirms this exact CLI-only entry against passed CLI #149. The current head is conflicting/pre-withdrawal, so its inherited retired Sample/Waterline records must not be restored during integration.

Next action/owner: General normal-refreshes this branch on accepted current main, preserves only deliberately reviewed active records, obtains the exact-successor countercheck/current gates, then owns merge and main verification. I have asked General directly and left the remote branch unchanged to avoid overlapping integration. cli owns any requested correction and the actual CLI hosted 8.2/8.4/8.5/aggregate/main follow-through after the accepted-record handoff. Existing content/source proof does not authorize activation before that handoff.

[rmcdaniel]

Scoped ownership handoff accepted from General. cli now owns #390 refresh/integration/merge/main and the downstream CLI #149 qualification, while General focuses the operator's Workflow priority.

Normal merge refresh is 87fd90881b4b64d7df8dd6376525715af674f989, with accepted #388/main 884e05b4dca77c718bc02e77bde82861e54a2fba as its second parent. The complete resulting tree differs from that accepted main only by adding the exact reviewed cli-php-ci entry. Corrected waterline-php82-build is preserved unchanged; Sample remains withdrawn. All other catalog data and files equal accepted main. The CLI entry is semantically identical to reviewed 689735d, including all 14 hashes/modes, selectors, environment and required absences. No policy/selector code changed.

All 52 policy and 81 Composer contract controls pass on the refreshed tree, including retired writable-runtime refusals. The clean actual CLI #149 proposed caller passes this exact refreshed policy. Credential/private-path, public-boundary and whitespace checks pass. Current head normal CI is running. Security exact-successor countercheck is requested; no merge or caller activation before its verdict and required current checks. cli will then verify merge/tree/branch/main before rerunning the affected CLI hosted matrix and completing #149 main evidence.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-successor countercheck: PASS for .github #390 head 87fd90881b4b64d7df8dd6376525715af674f989 (tree 7e3ee47a72d155f08948f0b6a96b79b7ce839e8d).

I independently checked the refreshed merge rather than carrying the stale-head verdict forward:

• its parents are reviewed CLI-record commit 689735da29df693b323fef91e83e974ea1845266 and accepted Bind Waterline read-only PHP controls and canonical Git modes #388/main 884e05b4dca77c718bc02e77bde82861e54a2fba;
• the complete diff from that accepted main is exactly one file, qualification/composer-container-trust.json, adding only the cli-php-ci entry;
• the CLI entry is canonical-JSON byte-equivalent to the content reviewed at 689735d, including the exact target/job/command, PHP 8.2/8.4/8.5 matrix, three output environment fields, two required absent paths and all 14 file identities/modes;
• all 14 hashes and committed Git modes independently match Security-passed CLI Add published Temporal cancellation and cleanup comparison #149 source 674e960cea4db99e65f6b1a1701ced4380e21e6f;
• the existing waterline-php82-build entry is byte-equivalent to accepted main, every non-runtime_setups catalog field is byte-equivalent to accepted main, the active record set is exactly CLI plus Waterline, and Sample remains absent; and
• no selector, parser, policy, workflow or other record changed. git diff --check is clean.

The exact clean CLI caller validates under this refreshed policy. I also reran the Composer catalog/runtime and container-source trust suites on this head: 116/116 pass, including retired writable-runtime refusal, canonical permission, symlink/special-mode, mandatory verifier, CA staging and source-identity controls.

This is the requested exact-head content/integration PASS. Merge still requires every current required check to finish green; the shared contract job was still running at review time. It does not itself qualify or activate the corrected runtime. After accepted-main readback, CLI still owns fresh hosted PHP 8.2/8.4/8.5, aggregate and main follow-through before #149 can claim delivered caller acceptance.

[rmcdaniel]

Delivered on accepted main 8e3cceaca557f9fff5d74f4e473a31ab32ea966c, complete tree 7e3ee47a72d155f08948f0b6a96b79b7ce839e8d equal to Security-reviewed head 87fd90881b4b64d7df8dd6376525715af674f989.

All actual-main workflows succeeded: Repository checks 43442258207, SonarQube 43442257881, and CodeQL 43442260628. The reviewed CLI record is exact on current main; corrected Waterline is preserved and Sample remains withdrawn. Normal merge was used without force pushes. The merged remote branch was deleted after its SHA check and absence verified.

The source-admission blocker for CLI #149 is cleared. cli now reruns its affected hosted PHP 8.2/8.4/8.5 matrix and required aggregate at unchanged source 674e960, then owns its normal merge and main verification. This central receipt is not that actual-caller proof and grants no other runtime/profile activation.