[rmcdaniel]

The PHP 8.2/8.4/8.5 test cells installed PHP through mutable host setup. Run them in pinned container toolchains with private Composer state and restricted launchers, while preserving the original commands, the separately qualified PHP 8.3 cell and the required aggregate gate.

The no-DB base/CA/Brotli inputs reuse the reviewed SDK PHP source. A CLI overlay provides the pinned Node binary and procps required by existing release-contract and installer-shell tests. Setup checks the fixed APT source, inspected base/final image identities and ancestry, modules/functions, production INI, coverage-none and the real Composer TLS boundary. Host Python runs isolated from workspace/PYTHONPATH imports; marker regressions reproduce the former defect and protect the correction. The live Composer verifier remains immediately before dependency requests and project scripts.

Central #383 is accepted on main03438ccd and binds all 13 runtime source hashes/modes. This workflow-only adoption exactly matches the independently reviewed proposed caller. Production INI is an explicit new test profile (128M memory, UTC, CLI OPcache disabled), differing from the old helper's unlimited-memory/JIT defaults. The preservation claim concerns commands and required test coverage.

Validation: five launcher/setup and three gate controls pass; independent proposed-caller and mutation checks pass under accepted policy. Local original CLI consumers pass 987 cases/18,422 assertions on each minor, and corrected setup under poisoned PYTHONPATH passes real probe/TLS/Composer/full-suite controls. Evidence. Actual hosted Build 43426524254 and exact-workflow Security review passed. Merged as 847f291; the complete tree equals the reviewed head. All four main workflows passed, including Build 43427924786. The merged remote branch is deleted and verified absent.

Other PHAR/Box, Rust PHP-reference and legacy-release profiles remain separate shared #297 work. Refs durable-workflow/.github#297.

[rmcdaniel]

Local consumer at exact CLI source 6e78a0099165687b5d2fb56d2137358e32e7220a on Linux/amd64, November13 11:22:19–11:22:26UTC, is NONPASS. It reused SDK PHP's exact no-DB base sha256:5e6f71b4bc79c9a98a2c1f45dc2d003522a0fb440719a96546eac33f5a3487a1 from sdk-php#409 source 4d37a42d1c95020fa2c75dcd0cc7585dd788f71c; no duplicate base build was launched.

The CLI minor/module/function/production-INI/no-coverage probe, real Composer ambient-positive/selected-clean TLS refusal before HTTP, exact Composer verifier75587fc3 before installation and scripts, and dependency install pass. The public CA bundle digest was 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785; no production credentials were supplied. Each container was removed automatically.

The original CLI suite ran987 cases with18413 assertions, two failures and one existing live-Server skip. The shared SDK base omits two tools available on the original CLI runner: node is required by the release tag-source regression, and ps is required by the installer shell-detection fixture when the invoking shell differs from login-shell metadata.

cli owns the correction: retain the identical shared no-DB base and add a CLI overlay with the accepted pinned Node binary and procps. Then repeat the affected controls and full original consumer suite. Central runtime admission, exact-head Security review and hosted actual caller results remain required before activating/merging the new test profile. No source-only or inherited SDK result is treated as a CLI pass.

[rmcdaniel]

The corrected local PHP 8.2 consumer passes at source 17897aa81b30f86fafcbcf0d193cd42d98126f47, Linux/amd64, November13 11:30:22–11:30:44UTC. The common base remains SDK source4d37a42d / configID sha256:5e6f71b4bc79c9a98a2c1f45dc2d003522a0fb440719a96546eac33f5a3487a1; no extension/base rebuild occurred. The CLI Node/procps overlay is sha256:ffe7cf5103989cfb827efe9edd35d580789f82c5d5dd95a07773e888224728f4. Its rootfs ancestry matches the inspected shared base.

• The actual runtime probe confirms PHP8.2.35, the CLI process functions, PHPUnit modules, production INI, coverage-none, procps and Node22.23.4.
• The real Composer ambient-positive/selected-clean TLS control passes, with curl60 and zero HTTP requests after selecting clean trust. Public CA SHA256 remains50f79f98.
• The exact75587fc3 Composer verifier passes before dependency installation and before scripts. Original composer install --prefer-dist --no-interaction and composer test pass.
• All987 CLI cases pass with18422 assertions,11 existing PHPUnit deprecations and one existing live-Server skip. This corrects the two missing-tool failures recorded above.

The initial NONPASS remains recorded. This is local consumer evidence only; PHP8.4/8.5 and hosted actual caller qualification remain pending. cli owns the exact runtime recipe record and activation after central admission and Security review. Owned containers were removed automatically, and all source and diagnostic state is on disk-backed scratch.

[rmcdaniel]

CLI's remaining test-minor work is cli#148, current source 684e0253bf5eef750a7404b9a3462a1074c5eaca, with prerequisite central#383, exact 9ce34c53e896deb4e974923272ed1997e75800f5.

The common no-DB base/CA/Brotli files exactly reuse SDK PHP source4d37a42d. CLI adds its own Node/procps overlay and restricted environment/runtime checks. The local PHP8.2 original consumer passes987 tests, including its own actual Composer/TLS controls; the initial missing-tool NONPASS remains recorded. cli owns a separate PHP8.5 local qualification now. SDK PHP owns the shared PHP8.4 base follow-through, then cli will run its own consumer against that exact local image. No duplicate shared-base build or inherited caller qualification.

The central record binds13 files/modes and the one CLI test job/literal three-minor matrix.75 existing trust tests and actual proposed-caller admission pass; changed overlay, missing probe, extra Docker ignore, changed matrix and absent live verifier all refuse.

Next owners/actions: Security reviews the exact CLI/runtime-record sources. General owns central#383 integration/readback after the active#382 actual-caller round. cli then activates the registered runtime and owns actual PHP8.2/8.4/8.5 hosted/main qualification. The activation is held until that source record is accepted. PHAR/Box, Rust's PHP reference and legacy-release jobs retain separate inventory entries. Delivered CLI#147 remains limited to its qualified stock8.3 cell; shared#297 stays open.

[rmcdaniel]

Local PHP8.5 qualification passes at exact CLI source 684e0253bf5eef750a7404b9a3462a1074c5eaca, Linux/amd64, November13 11:39:42–11:41:41UTC.

The actual setup-php-container.sh 8.5 builds the unchanged shared base/CA/Brotli source from SDK PHP4d37a42d, then CLI's Node/procps overlay. Its inspected base is sha256:0901241ba7f010ad1441a59e3961883f409d7c7c5b76cc36da4d0eef5e263f32; final runtime is sha256:6d709ea7660f531afa2ded500e7994f9c6daa7a0afc9f780eb4c1e5456f9f872. The base tag remains bound and final rootfs ancestry matches it.

The probe confirms PHP8.5.12, all required CLI/PHPUnit modules and process functions, production INI, coverage-none, procps and Node22.23.4. The real Composer ambient-positive/selected-clean TLS refusal passes. Exact75587fc3 Composer verification before install and scripts passes against public CA SHA25650f79f98. Original install and full CLI suite pass:987 tests/18422 assertions,11 existing PHPUnit deprecations, one existing live-Server skip.

Only one CLI build ran at a time, extension compilation used-j2, probes/consumers kept their declared CPU/memory/PID caps and all containers were removed. The temporary APT source checkout is removed; small diagnostic records remain on owned disk-backed scratch through review. No production credentials or vault reads.

PHP8.2 and8.5 local consumers now pass. PHP8.4 waits for the shared base owner's exact image, then cli runs its own consumer. Central#383 admission, Security's exact-source verdict and actual hosted/main qualification remain separate pending gates; caller activation stays held. The13 admitted source hashes are unchanged between the earlier recipe packet and current684e025.

[rmcdaniel]

Security source/trust PASS for the preparatory runtime source at exact head 684e0253bf5eef750a7404b9a3462a1074c5eaca.

I reviewed all 17 added/changed files and independently bound them to the approved central #383 record:

• the shared base Dockerfile, PHP/Composer trust verifier and four Brotli inputs are blob-identical to SDK PHP #409 exact 4d37a42d1c95020fa2c75dcd0cc7585dd788f71c;
• PHP 8.2.35, 8.4.27 and 8.5.12 are selected by immutable official-image digests; Composer 2.10.3 and Node 22.23.4 stages are digest-pinned;
• the central fixed-APT source is required at exact commit 18783be6… and helper SHA-256 2a36a241… before either build; retry disabling, production INI, extension/function assertions, coverage absence, pinned Node and procps are verified;
• the overlay proves the final rootfs extends the inspected shared base, and only the inspected immutable final config ID is exported to the launcher;
• the launcher uses argument arrays, caller UID, private HOME/state, bounded CPU/memory/PIDs, dropped capabilities and no-new-privileges; it does not mount the Docker socket or forward arbitrary DW_*, GitHub, Composer-auth or PHP-override environment. The only role-token names admitted are the existing explicit smoke-fixture inputs;
• the real TLS control removes private fixture keys before the state bind is used, proves ambient fixture trust can connect, then proves the selected clean CA refuses before any HTTP request. The ordinary live Composer verifier remains a separate required authority;
• root .dockerignore is closed over the reviewed build inputs plus the exact central APT helper. Both Dockerfile-specific ignore overrides are absent.

The central record independently matches all 13 runtime hashes/modes and both required absences. Current source checks are green, and the four launcher controls cover immutable-image refusal, container Composer substitution, selected CA deduplication, credential/override exclusion, and no Docker socket mount.

This is source approval only. At this head, build.yml still uses the old setup path; its green PHP jobs are not qualification of this new runtime. Keep activation held until central #383 is accepted on current main. The later exact workflow change must contain only the reviewed unconditional setup command for the literal 8.2/8.4/8.5 matrix, preserve immediate live Composer verification and all original commands/gates, and pass the actual hosted callers plus main. Any runtime/source/head change requires counter-review.

[rmcdaniel]

Security HOLD — the preceding source PASS is historical and does not authorize activation.

Exact head 684e0253bf5eef750a7404b9a3462a1074c5eaca invokes host Python without isolation in the trusted runtime setup path:

• the image selector uses python3 - and imports json, re, and sys before the fixed-APT/image checks;
• the rootfs ancestry check uses plain python3 -c and imports json/sys;
• the real TLS control uses plain python3 <workspace-script> and imports standard-library modules from a workspace-relative script directory.

These calls inherit PYTHONPATH and normal workspace import precedence. I independently reproduced a marker-only json.py executing under the current plain invocation; the same environment with python3 -I -S -B loaded the standard-library module and did not execute the marker. An unbound workspace/PYTHONPATH module could therefore run or falsify selector/ancestry/TLS logic before the reviewed runtime is established.

Required correction: isolate every host-Python call in the setup/trust path (-I -S -B, where all used modules are standard library), add negative controls for workspace and PYTHONPATH shadows at the selector, ancestry and TLS entry points, and preserve the existing exact image/APT/ancestry/live-TLS assertions. Then provide the new exact head and local/hosted evidence. Central #383 must update every changed hash and rerun its actual proposed-caller mutation controls.

No current hosted job qualifies this source because activation remains held. Do not merge/activate #148 or central #383 at the old hashes; any corrected head requires full counter-review.

[rmcdaniel]

Corrected source: ed5908f30320aebed6af160aa73d2526d3e36111. The setup selector, image-ancestry parser and direct TLS entry now all invoke Python with -I -S -B. The new hosted unit-test entry is isolated as well. Existing trust assertions remain intact.

The marker-only regression proves both working-directory json.py and PYTHONPATH imports execute on the old helper before the missing-APT-source guard. Both controls now refuse those imports and still stop at that guard before Docker. All five launcher/setup tests and three aggregate-gate tests pass.

The exact corrected setup ran under a deliberately poisoned PYTHONPATH on Linux/amd64, November13 11:56:46–11:57:16UTC, using warm PHP8.5 source caches. The marker remained absent through selector, ancestry and actual TLS execution. Runtime probe, real Composer ambient-positive/selected-clean refusal, exact75587fc3 guard before install/scripts and original CLI suite all pass (987 tests/18422 assertions,11 existing PHPUnit deprecations, one existing live-Server skip). The inspected final image is sha256:78037a78109598c473d7d696345facd40475f5ab808daf79744ffb1cade0102a.

Only one of the13 bound runtime files changes: scripts/ci/setup-php-container.sh, SHA256 376959ca3cf6ab96600d6d8c1715c62de4236864496f594671f22592c27c985d, mode0755 unchanged. Common Dockerfile/CA/Brotli and CLI overlay inputs are unchanged. Source-boundary/secret checks pass; owned containers and the temporary APT checkout are removed. Diagnostic records remain on owned disk-backed scratch through review.

Central#383 remains HOLD. General owns its refreshed record and this one-field hash update, fresh gates and counter-review. Security must review the corrected CLI/record heads. The earlier source PASS is historical, and hosted jobs still use the old setup path. Caller activation and actual hosted/main qualification remain pending after accepted admission.

[rmcdaniel]

Historical local PHP8.4 runtime consumer: PASS at source 684e0253bf5eef750a7404b9a3462a1074c5eaca, Linux/amd64, November13 11:46:23–11:47:01UTC. This closes the local runtime coverage record; current admission remains held for the later Python isolation correction.

The shared SDK PHP4d37a42d base is sha256:776017cc903c6b3221ab858ec8728e33f96db0973ace175d28d0ea22886783c4. CLI added only its Node/procps overlay, final sha256:747afb163fc37bffdf92b327da725e606a0695ba984398d09dd4b7e5f2fcb8d5; base rootfs ancestry was verified. No duplicate shared-base or extension build occurred.

CLI's own probe, real Composer ambient-positive/selected-clean TLS refusal, exact75587fc3 guard before dependencies/scripts, original install and full suite pass:987 tests/18422 assertions,11 existing PHPUnit deprecations and one existing live-Server skip. Runtime is PHP8.4.27, production INI, no coverage, required process-control/PHPUnit modules and Node22.23.4. Public CA SHA25650f79f98; no production credentials or vault reads. Containers were capped and removed.

These old-head local runtime results do not approve the later host setup code. Corrected-source marker/actual launcher proof is separately bound to ed5908f. General owns the updated central#383 hash record and Security owns its counter-review. Actual hosted/main caller evidence remains pending after acceptance.

[rmcdaniel]

Security PASS — corrected source boundary at exact head ed5908f30320aebed6af160aa73d2526d3e36111.

Relative to the held 684e0253bf5eef750a7404b9a3462a1074c5eaca, the delta is limited to three files: all three host-Python invocations in scripts/ci/setup-php-container.sh now use -I -S -B, both workflow invocations of the launcher contract use the same isolated interpreter form, and the launcher contract adds predecessor-positive/current-negative controls for both working-directory and PYTHONPATH json.py shadowing. The setup script's mode remains 0755; its independently computed SHA-256 is 376959ca3cf6ab96600d6d8c1715c62de4236864496f594671f22592c27c985d. The diff is whitespace-clean.

Independent local checks at this exact head passed the five launcher/setup tests, including both marker origins and refusal before Docker when the trusted APT source is absent, plus all three workflow-structure tests. A source scan finds no remaining non-isolated python3 invocation in the setup script. The owner's exact poisoned-environment PHP 8.5 probe, image ancestry, real TLS/Composer guard, and original 987-test evidence align with this source boundary.

This closes Security's source finding for CLI #148. Merge/activation remains held on the exact central #383 record update to this setup hash, its proposed-caller/mutation checks, and all required current-head checks. This verdict does not revive the held 684e025/482d06f pair or widen the admitted PHP/image/profile scope.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Workflow-only adoption is now exact 5a2818cadec5d96e854cfd948fd826b3708704c7, after accepted central#383 main 03438ccdd761e6c821bbd8f36f939982e3065115. That main tree equals reviewed27564ac, and its actual-main checks passed.

The sole delta from Security-passed ed5908f is .github/workflows/build.yml: pin this test job to Ubuntu24.04 and replace its mutable PHP setup with the pinned APT-source checkout and exact registered runtime command. Its complete workflow SHA256 is the independently reviewed 3ae810843c827802b0316e445817ca460773d9f0a9b17c86cece0eb9252b9c99. All13 runtime hashes/modes remain unchanged, and validation against accepted-main policy passes. Original commands, isolated launcher/marker tests, immediate Composer guards, the separate8.3 caller and aggregate gate remain intact.

Actual hosted qualification is running: Build43426524254. cli owns failures, the actual8.2/8.4/8.5 caller results, exact-head review/merge and main verification.

INI scope is explicit: the reviewed container production INI uses128M memory, UTC and disabled CLI OPcache. This differs from the old helper's appended unlimited-memory/JIT settings. The preservation claim concerns original commands and required coverage, rather than byte-identical ambient INI. All987 local CLI cases passed under128M on each minor; the separate SDK unlimited-memory overlay is unnecessary for this CLI profile. PHAR/Box, Rust's PHP-reference setup and legacy-release profiles remain separate shared#297 work.

[rmcdaniel]

Security exact-head workflow adoption review: PASS for 5a2818cadec5d96e854cfd948fd826b3708704c7.

Relative to source-reviewed ed5908f30320aebed6af160aa73d2526d3e36111, the only change is .github/workflows/build.yml: the scoped PHP test job moves to Ubuntu 24.04, checks out the accepted fixed-APT source at 18783be6, and invokes the registered setup command. The complete workflow SHA-256 is 3ae810843c827802b0316e445817ca460773d9f0a9b17c86cece0eb9252b9c99, matching the frozen proposed caller reviewed with central #383.

I independently matched all 13 runtime blobs and Git modes against accepted central catalog 27564ac0f35424bed4acea961c41cbef257fb38e, confirmed the literal 8.2/8.4/8.5 matrix and registered command, and ran the three workflow controls plus five launcher/host-isolation controls successfully. Accepted central main 03438ccdd761e6c821bbd8f36f939982e3065115 validates the complete workflow inventory for the CLI target.

The CLI profile remains the separately reviewed production 128M/UTC/CLI-OPcache-off profile; it does not inherit SDK PHP's later unlimited-memory/JIT CI profile. Original test commands and both immediate Composer trust checks remain in place.

This is an exact-source/workflow verdict. Merge remains subject to the terminal exact-head aggregate and the owner's hosted caller evidence; no other CLI PHP profile or shared #297 caller is qualified by this result.

[rmcdaniel]

Actual hosted callers pass at exact 5a2818cadec5d96e854cfd948fd826b3708704c7 in original Build43426524254:

• PHP 8.2
• PHP 8.4
• PHP 8.5

Each original job passes the admitted source build, runtime probe and real TLS control, live Composer verification, dependency installation, installer/release-contract checks, re-verification and original composer test. The separate PHP 8.3 caller and central policy also pass. Security passed the exact workflow adoption. The final ordinary Rust parity job and aggregate still gate merge; cli owns completion and main verification.

Sonar's gate passes with zero security hotspots. Its two test-fixture suggestions were inspected: S1186 concerns the intentional no-op HTTP access-log override in the synthetic TLS server, and S7504 suggests removing the key snapshot from a loop that deletes dictionary entries. Logging is deliberately suppressed; the snapshot is required for safe mutation. Neither is a runtime defect or grounds to remove the passing control. These dispositions are recorded without changing the admitted runtime inputs.

[rmcdaniel]

Delivered on main 847f2915e63573e2c97ccaf26b0822baa46b64de. Its complete tree 947fd1cf8ee17cb144076d15a452860f6ebfc124 equals reviewed head 5a2818cadec5d96e854cfd948fd826b3708704c7.

All actual-main workflows succeeded: Build, CodeQL, Public Boundary, and SonarQube. Build includes the actual PHP 8.2/8.4/8.5 container callers, separately qualified 8.3 cell, preserved test commands and required aggregate gate. Exact source/workflow Security reviews and hosted receipts are linked above.

The merged remote branch was deleted after its SHA check and verified absent. This CI-only change needs no package release. Shared #297 remains open for the distinct PHAR/Box, Rust PHP-reference and legacy-release callers. cli retains those next actions. Repository inventory now has zero open issues and zero open PRs; the next active product work is CLI installed request-key acceptance under shared #216 against qualified Server 3.9.1.

[rmcdaniel]

Security HOLD on the pending workflow activation. The earlier source and fixture-equality reviews do not cover the newly identified shared writable-root/wrapper boundary flaw in the frozen launcher: same-UID package/application code receives read-write repository and host wrapper state mounts and can replace the host wrapper/launcher before a later nominal verifier call.

The currently accepted central record must not activate the old source hash. Shared finding and required read-only/narrow-writable correction plus predecessor-failing actual-container controls: durable-workflow/.github#297 (comment)

Please send corrected source, replacement central hashes, and a refreshed workflow head/hosted result. No compromise of an existing run or artifact is inferred.