Restore bound PHP setup after upstream archive replacement

.github/workflows/ci.yml

@@ -35,7 +35,7 @@ jobs:
       - name: Disable APT download retries (CVE-2026-109518)
         run: echo 'Acquire::Retries "0";' | sudo tee /etc/apt/apt.conf.d/99-no-retries >/dev/null
 
-      - uses: durable-workflow/.github/.github/actions/setup-php-linux@411a14ac07d32073eed6ab4977f2825eba4739a7 # bound-linux-php
+      - uses: durable-workflow/.github/.github/actions/setup-php-linux@5c1ddbff59bcfad8a686a72a9b09804b359c382a # bound-linux-php
         with:
           php-version: '8.3'
           ini-file: production

.github/workflows/native-policy.yml

@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: durable-workflow/.github
-          ref: d4770e6555fdb59b044f2e5919e95a24c0a25073
+          ref: 2f6445df3c10ed10599001ff7bee6ecc25bac2f4
           path: .native-policy-control
           persist-credentials: false
       - name: Set up the policy interpreter

.github/workflows/qualify-linux-php-initial.yml

@@ -48,21 +48,21 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: durable-workflow/.github
-          ref: 140f937cf245f39a495467fe6bab2bd30f93a17a
+          ref: 5c1ddbff59bcfad8a686a72a9b09804b359c382a
           persist-credentials: false
       - name: Check out the accepted private-pip and terminal control source
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: durable-workflow/.github
-          ref: 140f937cf245f39a495467fe6bab2bd30f93a17a
+          ref: 5c1ddbff59bcfad8a686a72a9b09804b359c382a
           path: .qualification-control
           persist-credentials: false
       - name: Bind source and require the existing host prerequisites
         shell: bash
         run: |
           set -euo pipefail
-          test "$(/usr/bin/git rev-parse HEAD)" = 140f937cf245f39a495467fe6bab2bd30f93a17a
-          test "$(/usr/bin/git -C .qualification-control rev-parse HEAD)" = 140f937cf245f39a495467fe6bab2bd30f93a17a
+          test "$(/usr/bin/git rev-parse HEAD)" = 5c1ddbff59bcfad8a686a72a9b09804b359c382a
+          test "$(/usr/bin/git -C .qualification-control rev-parse HEAD)" = 5c1ddbff59bcfad8a686a72a9b09804b359c382a
           /usr/bin/python3 -I -S -B - <<'PY'
           import hashlib,json,os,pathlib,shutil,sys
           sys.path.insert(0,str(pathlib.Path.cwd()))
@@ -123,8 +123,8 @@ jobs:
               os.environ.clear()
               os.environ.update(closed)
               def publish(evidence):
-                  evidence['source']='140f937cf245f39a495467fe6bab2bd30f93a17a'
-                  evidence['php_helper_source']='140f937cf245f39a495467fe6bab2bd30f93a17a'
+                  evidence['source']='5c1ddbff59bcfad8a686a72a9b09804b359c382a'
+                  evidence['php_helper_source']='5c1ddbff59bcfad8a686a72a9b09804b359c382a'
                   evidence['pip_predecessor_source']='242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5'
                   evidence['control']=control
                   text=json.dumps(evidence,sort_keys=True)

.github/workflows/qualify-linux-php-ubuntu24.yml

@@ -48,21 +48,21 @@ jobs:
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: durable-workflow/.github
-          ref: 411a14ac07d32073eed6ab4977f2825eba4739a7
+          ref: 5c1ddbff59bcfad8a686a72a9b09804b359c382a
           persist-credentials: false
       - name: Check out the accepted private-pip and terminal control source
         uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: durable-workflow/.github
-          ref: 411a14ac07d32073eed6ab4977f2825eba4739a7
+          ref: 5c1ddbff59bcfad8a686a72a9b09804b359c382a
           path: .qualification-control
           persist-credentials: false
       - name: Bind source and require the existing host prerequisites
         shell: bash
         run: |
           set -euo pipefail
-          test "$(/usr/bin/git rev-parse HEAD)" = 411a14ac07d32073eed6ab4977f2825eba4739a7
-          test "$(/usr/bin/git -C .qualification-control rev-parse HEAD)" = 411a14ac07d32073eed6ab4977f2825eba4739a7
+          test "$(/usr/bin/git rev-parse HEAD)" = 5c1ddbff59bcfad8a686a72a9b09804b359c382a
+          test "$(/usr/bin/git -C .qualification-control rev-parse HEAD)" = 5c1ddbff59bcfad8a686a72a9b09804b359c382a
           /usr/bin/python3 -I -S -B - <<'PY'
           import hashlib,json,os,pathlib,shutil,sys
           sys.path.insert(0,str(pathlib.Path.cwd()))
@@ -123,8 +123,8 @@ jobs:
               os.environ.clear()
               os.environ.update(closed)
               def publish(evidence):
-                  evidence['source']='411a14ac07d32073eed6ab4977f2825eba4739a7'
-                  evidence['php_helper_source']='411a14ac07d32073eed6ab4977f2825eba4739a7'
+                  evidence['source']='5c1ddbff59bcfad8a686a72a9b09804b359c382a'
+                  evidence['php_helper_source']='5c1ddbff59bcfad8a686a72a9b09804b359c382a'
                   evidence['pip_predecessor_source']='242c2a7fb23459db2e1ada5f84dbee6d61d9b1e5'
                   evidence['control']=control
                   text=json.dumps(evidence,sort_keys=True)

qualification/NATIVE-PILOT.md

@@ -25,6 +25,20 @@ a reviewed runtime-pin update; do not assume the pin follows a moving branch.
 The rule selects the central workflow from protected main. Protect changes to
 that source and record the actual workflow/runtime commits in pilot evidence.
 
+An upstream input disappearing can prevent the policy repository's own required
+CI from admitting its repair. The old runtime also cannot admit new workflow
+bytes or action pins. Do not disable the rule or add bypass actors to break
+that cycle. Prepare and independently review the complete source successor,
+including its exact workflow/action registries. The successor workflow must pin
+an earlier reviewed runtime commit in the same ancestry. An authorized
+organization administrator can then select that frozen workflow with the
+ruleset's `sha` field while keeping enforcement Active and every other rule
+unchanged. This administrative selection is separate from source review and
+requires existing authorized access; never silently expand credential scopes.
+Trigger fresh accepted and refused PR events to verify the new enforcer before
+merging the repair through the protected path. Restore a moving main ref only
+after verifying that it selects the same accepted workflow and runtime.
+
 After source acceptance, the bounded live rollout is:
 
 1. An authorized organization admin imports the disabled rule and verifies its

qualification/php-linux-bootstrap.json

@@ -23,10 +23,10 @@
       "thread_safety": "nts",
       "build": "release",
       "asset": {
-        "id": 739209532,
+        "id": 747287433,
         "name": "php_8.3-nts+ubuntu24.04.tar.zst",
-        "size": 42500132,
-        "digest": "sha256:b81626ab8a7d91c23f3b8dee7fc0860fbd3ef99c9f4b22c5321b0e0545771768"
+        "size": 43826053,
+        "digest": "sha256:c60a4af4c7806c8c123268305b35ba1f7250a8356b195997bd0860359b101784"
       }
     },
     {
@@ -37,10 +37,10 @@
       "thread_safety": "nts",
       "build": "release",
       "asset": {
-        "id": 739711545,
+        "id": 747290740,
         "name": "php_8.3-nts+ubuntu26.04.tar.zst",
-        "size": 40568012,
-        "digest": "sha256:11c1a56755ec5d90567265719b21bc08e7c5ac4a539866a56f55c0fe5b6d196a"
+        "size": 40600860,
+        "digest": "sha256:d4959f02ae28e3936ad2ae3bcaca25aff8c2eca38ae11ab53a72a76a3711a7ab"
       }
     }
   ]

qualification/php-linux-initial-alternatives.json

@@ -1,7 +1,7 @@
 {
   "schema": "durable-workflow.php-linux-initial-alternatives/v1",
   "installer_sha256": "7bc5bfea71696b0927367eb887e2710d44c6f17216fbd47add5a4cb181543e99",
-  "archive_metadata_sha256": "6cecceedccc27b553c16fd94fb2f52c4621652ef4e41fc2d73c5d2f6b9efeebe",
+  "archive_metadata_sha256": "af6ff884ab6a626f5628457730dcb7e135fd76226eb945ada68697693ac2381f",
   "order": [
     "install",
     "fix_alternatives",