[rmcdaniel]

CLI #155 prepares a pinned PHP profile for Rust compatibility vectors and PHP source parity. This adds only its exact 22-file runtime record and inert proposed caller under build.yml:rust; all existing catalog values and the policy implementation remain unchanged.

The runtime keeps compiled Rust binaries and host controls read-only, permits only the vector JSON plus declared private data, and binds the selected PHP wrapper. Existing whole-target Composer verification remains required. The original Cargo, native reference and parity commands remain present.

Validation: 128 focused tests pass, the complete current and proposed CLI workflows each enumerate eight guarded dependency requests, and ten actual source/caller mutations refuse. Independent exact source/catalog review, normal current checks and accepted-main readback precede CLI workflow activation. Runtime evidence and hosted caller qualification remain on CLI #155; this does not close shared #297 or qualify other callers.

[rmcdaniel]

Security exact catalog review: PASS for 22aff73 / tree d3d1d059abf5f5d6a42e98ac13b560b6840548a7.

The complete change from accepted 7ffdb96 is one closed cli-php-reference runtime record, one byte-identical proposed caller fixture and four focused tests. Existing catalog entries and qualification policy code are unchanged. I independently matched every one of the 22 registered file digests and Git modes against CLI 032400bf1a4ed3457b138f4ccb11d5afcf5c4855, confirmed both registered absent Docker ignore files are absent, and compared the two fixture byte streams as equal.

The record selects only build.yml job rust and the single unconditional setup command, limits its runtime fields to the four declared values, and binds the inherited base plus the new reference profile and controls. The tests refuse moved jobs/workflows, an extra unguarded request job, any bound-file or absence mutation, setup skip/ignore/environment overrides, and deletion of the live Composer verifier.

This is catalog/source approval only. Normal exact-head CI and accepted-main tree equality remain required before CLI activates the caller; CLI 032 currently also retains its independent failed PHP 8.3 check pending classification.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Accepted-main verification is complete. Normal merge 57c23b63c77284371bfc83f2ba562bdf4230ddaf has tree d3d1d059abf5f5d6a42e98ac13b560b6840548a7, exactly equal to independently reviewed 22aff73. The remote topic branch is deleted and its absence verified.

All three actual-main workflows are terminal SUCCESS: Repository checks43536295803, CodeQL43536295549, and Sonar43536295760.

All22 registered CLI file hashes/Git modes and both absences were rechecked before adoption. Existing catalog values and qualification policy are unchanged. Security's exact catalog PASS is 6868707993. CLI155 now owns only the workflow adoption and fresh original hosted caller/main proof. Other shared297 callers and release paths remain open.

[rmcdaniel]

Security independent post-merge readback: PASS.

PR #398 merged normally as 57c23b6 with parents 7ffdb96 and reviewed 22aff73. Its tree is exactly d3d1d059abf5f5d6a42e98ac13b560b6840548a7, equal to the reviewed topic tree. Main currently resolves to that merge, and the remote topic ref is absent.

All three exact-main workflows are terminal green: Repository checks 43536295803, CodeQL 43536295549 and SonarQube 43536295760. The cli-php-reference catalog admission is therefore accepted on main. This does not activate the CLI caller or qualify its first hosted run; CLI #155 retains those independent gates and its exact-head PHP 8.3 runner block.