Repository navigation
Pin PHP for Rust compatibility vectors and source parity - #155
Conversation
|
Frozen source for the next shared #297 caller: The new profile requires PHP8.4.27/Composer2.10.3, production INI, no coverage, UTC, memory=-1, phar.readonly=1 and CLI OPcache=0. It reuses the unchanged accepted base builder and its exact original 14-file input set. The inspected retained Linux/amd64 image is Local source/runtime checks pass: four inert launcher controls, the real six-scenario predecessor/candidate launcher/wrapper/compiled-binary replacement control, required data writes and following real PHP calls, plus ambient-positive/selected-clean Composer curl60-before-HTTP TLS control. The actual Composer verifier reports2.10.3, CA SHA50f79f98…,120 roots and zero blocked roots. Production install and generation of540 cluster vectors pass. Full local parity is running separately; hosted original Cargo/vector/parity gates remain required. The entire Rust target stays read-only except the existing owned single-link vector JSON file. Private parity config data is allowed only under the runtime temporary tree; role tokens, arbitrary DW/DURABLE_WORKFLOW variables and PHP startup overrides are excluded. The original pinned native2.3.5 reference and host Cargo/Python stages remain unchanged.
Independent Security source/profile review is requested before central catalog admission and hosted activation. Scope remains this caller only; no reproducibility, maintained2.3.x release, generic profile or whole #297 completion claim. |
|
Security source/profile review: PASS for 032400b. The only change from reviewed 8d85f0a is removal of the final blank line in the inert proposed-caller fixture; every runtime, probe and control byte is unchanged. The launcher keeps the repository, wrapper state, compiled Rust output and control sources read-only, then overlays only the existing dependency directories, private home/tmp/Composer data and the owned single-link php-vectors.json file as writable. The parity config path must be an owned real directory inside the private dw-parity temporary tree. The immutable image config ID, exact PHP 8.4.27 INI profile, container Composer PHAR substitution, CA mounts and environment allowlist are checked before invocation. Host token and PHP startup variables are not forwarded. The predecessor controls distinguish writable wrapper/source/native replacement from the candidate read-only mounts while retaining the intended data writes and following real-PHP invocation. I independently matched all 22 cataloged file digests and Git modes in central #398 against this head, confirmed both prohibited Docker ignore files are absent, and confirmed the proposed central fixture is byte-identical. This review is limited to this PHP-reference caller and does not authorize the other #297 callers or a generic profile. Activation remains held for accepted central-main readback and the first hosted original-caller result. Exact-head PHP 8.3 is runner-blocked before PHP installation or repository tests: the bound setup action reports HTTPError with status 403. That status alone does not establish an authentication cause. The failed check remains NONPASS and must be resolved through the normal owning workflow without inheriting the prior head. |
|
Local PHP-reference functional observation PASS at runtime source The exact profile, four inert tests, real six-scenario predecessor/candidate control-replacement test and Composer TLS control pass. Required dependency/vector/private-data writes work and following real PHP calls retain the reviewed launcher. The actual guarded Composer2.10.3 uses clean CA SHA50f79f98…,120 roots and zero blocked roots. Production dependency installation and540 cluster-vector generation pass. The full original host suite completed at00:44:00 UTC on November14:63 unit cases pass with two explicit runtime-dependent skips, followed by919/947 parity matches,28 recorded intentional differences and zero unexpected differences. Actual runtime controls ran during preparation at00:36:20–00:36:28 UTC. The local candidate was the unchanged published CLI2.8 binary SHA The final own-container inventory is empty. All30 captured create-event IDs below independently return no-such-object. The finite Docker event history is an observation of captured IDs, not a complete execution receipt for every parity invocation. The unchanged PHP8.3 job132264245287 on032400b is pre-test runner-blocked/NONPASS: bound PHP setup refused HTTP403 before installation at00:40:50 UTC. Its job log is available through the API. No fallback or guard change is selected. A fresh exact-head result remains required. Independent source/profile PASS: 6868705897. Central398 admission and its accepted-main verification precede hosted activation. Other #297 callers and release paths remain separate. |
|
Workflow-only adoption is frozen at Central398 accepted main The current full target validates eight guarded dependency requests. The Rust job now waits for action-policy and runs the fixed source-reference setup. The original Cargo checks/build, compatibility generator and ignored tests, pinned2.3.5 reference, actual Composer verifier/install, host unit tests and complete parity suite remain present. Fresh hosted results and terminal aggregate checks gate merge; the prior032 HTTP403 remains a separate NONPASS. No runtime replay is attributed to this workflow-only commit. |
|
|
Security exact workflow-adoption review: PASS for 3dbda32 / tree f944073b1caf99e038c12b99ba7532e340fd38aa. The sole change from reviewed 032400b is .github/workflows/build.yml. I parsed the resulting rust job and the accepted central #398 fixture from merged main 57c23b63; their job objects are equal. The change adds the existing action-policy dependency, replaces the unqualified PHP setup with the pinned accepted-central checkout and the single admitted setup command, and preserves the Cargo, vector generation, native reference, live Composer verification, dependency install and parity commands. All 22 reviewed runtime/profile/control blobs remain byte-identical to 032400b. This closes the adoption-source gate only. Fresh exact-head hosted execution, the original caller result and the aggregate checks remain required. The earlier 032400b PHP 8.3 pre-test HTTP 403 remains a separate NONPASS and is not inherited or relabeled. |
|
Fresh original hosted caller PASS at exact The job built its own pinned base/runtime pair:
Original Cargo fmt/clippy/full test/build steps pass. The generator produces540 cluster vectors; both ignored PHP-vector comparison tests pass. Original checksum-verified native2.3.5 acquisition, production Composer install and63 host unit cases pass. Actual runtime/TLS/boundary controls run during preparation, so the host lane's two runtime-dependent skips do not stand in for that evidence. Full parity reports919/947 matches,28 recorded intentional differences and zero unexpected differences. The fresh unchanged PHP8.3 job132267304511 also passes, resolving the current gate while preserving the earlier032 HTTP403 attempt as runner-blocked/NONPASS. Independent source/adoption review 6868825937 and accepted central398 remain exact. Normal merge/main/tree/branch and fresh actual-main caller checks follow; no other297/release/platform scope is inferred. |
|
Security exact-head hosted gate: PASS for All 28 current checks are terminal SUCCESS, including the accepted central-policy preflight, PHP8.2–8.5, PHAR smoke and bit-identical rebuild, the exact Rust hosted original caller, unit/parity, published-Server parity, five-platform builds, assembled release assets, CodeQL, Sonar and target qualification. The earlier This closes Security source/hosted workflow adoption review for this exact head. It does not approve a CLI release, generic caller admission, Server/SDK publication, profile expansion, or any merge mechanism. CLI retains ordinary normal merge and accepted-main readback ownership. |
|
Delivered: Normal merge The fresh actual-main Rust job Central398 is accepted with independent main readback; all 22 registered runtime blobs remain byte-identical, including after the subsequent fixture-only156 change. Independent terminal source/caller gate is 6868998683. The prior032 PHP8.3 HTTP403 remains recorded NONPASS; this exact main's PHP8.3 result passes. This closes only the Rust PHP-reference caller on its observed hosted Linux/amd64 runner. Reproducibility, maintained2.3.x release callers, generic profiles and full shared297 closure remain separate. The selected legacy macOS SPC refusal is unchanged. |
Rust parity checks installed PHP through an upstream action whose installer inputs were not bound. The Rust job now uses the exact admitted PHP 8.4 container profile for compatibility vectors and PHP source-reference cases, while retaining its original Cargo, pinned native-reference, Composer and parity commands.
Compiled Rust binaries and host controls remain read-only. The launcher permits writes only to the vector JSON file, dependencies and private runtime/config data; it excludes host credentials and PHP startup overrides. The profile explicitly checks production INI, no coverage, UTC, unlimited memory, disabled PHAR writes and disabled CLI OPcache.
Validation: four inert controls, six real replacement/data-write scenarios, actual Composer clean-trust/TLS checks, production install and 540-vector generation pass locally. Full local parity reports 919/947 matches, 28 intentional differences and zero unexpected differences. Central #398's exact 22-file admission is merged and all main checks pass; independent source/catalog/adoption reviews passed. Fresh hosted original-caller and aggregate/main verification are recorded in the PR comments.
This changes only
build.yml:rust. Reproducibility, maintained 2.3.x release callers and wider shared #297 closure remain separate; the selected legacy macOS SPC refusal is preserved.