[rmcdaniel]

Move the PHP8.1/8.2/8.4 unit matrix and fixed8.1 Carbon2 job onto the accepted read-only container runtime. Preserve the full support matrix by moving PHP8.3 into its own qualified stock411a job. The Carbon caller names its one intentional composer.json write with literal carbon2; the unit matrix remains read-only. Every new runtime job waits for action-policy.

Keep the existing commands, Carbon2 constraint, lint, numeric artifacts, Avro budget and PHP8.1 HTTP-only check. The required aggregate includes the separate8.3 job. No framework/transition cell or gate is removed; their remaining migration stays separately owned.

Source/runtime authority is SDK412/main e2720a1 and accepted shared386/main cdfce90, whose two14-file records bind this exact proposed caller0ee1d57. Security source/catalog review and all source/main checks passed. Four local RO consumers pass real TLS/Composer plus9025tests each; predecessor replacement controls fail and corrected controls pass. This PR still requires independent workflow review, actual hosted guarded builds/original functional commands, required aggregate, normal merge and main readback. No hosted qualification is borrowed from local or peer results.

Refs durable-workflow/.github#297; durable-workflow/.github#386; #412.

[rmcdaniel]

Normal base refresh is now b4b74b8ab75f5ac10c76c37039f4a83953afdad2, merging accepted #407/main aa7948af without rebasing or force-pushing. The unit, stock-8.3, Carbon and required aggregate job blocks are byte-identical to proposed 0ee1d57; only accepted #407 content entered through the base.

The first actual hosted caller 43447094950 passed all five PHP jobs: each full suite ran 9,025 tests / 87,895 assertions / 56 skips; PHP 8.1 also passed the HTTP-only platform control. Container setup ran the real TLS and read-only replacement controls. All original request guards, commands and aggregate checks passed; the entire check rollup was green. Accepted central record is .github@cdfce90c365f685d78af295c17b54cb15ee4b795 (#386), with its actual-main receipt recorded there.

Owner: sdk-php. Next: independent Security counter-review of this exact workflow/aggregate head, green current-head checks, normal merge, then actual-main caller readback. Remaining framework and transition profiles are separate #297 work.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head PASS for b4b74b8ab75f5ac10c76c37039f4a83953afdad2.

The complete own delta against accepted base aa7948af7778ad38fc1c352b991804e05c51604a is one workflow file (.github/workflows/ci.yml, +110/-30). I independently extracted the four changed job blocks and compared them to reviewed proposal 0ee1d57b7debe081a6f65eff75763f9db3379d4b: test (3,195 bytes), test-php83 (4,028), carbon-2 (3,012), and target-branch-qualification (2,135) are byte-identical. The parsed test and carbon-2 jobs also exactly equal accepted central fixture .github@cdfce90c365f685d78af295c17b54cb15ee4b795.

The unit matrix remains the closed literal 8.1/8.2/8.4 set; fixed Carbon 2 remains a separate 8.1 command/profile; stock 8.3 remains on the qualified host setup with isolated Composer state, exact trust guard and required process controls. Every networked Composer operation keeps its immediate verifier. The aggregate both needs test-php83 and requires its result to be success; all prior aggregate requirements are unchanged. The ordinary connected job remains an intentional skip because this PR did not request that dispatch.

Current exact-head checks are now terminal green, including all five PHP jobs, central policy, aggregate, scans and analyzers. This verdict is limited to the workflow/aggregate adoption; it does not inherit qualification for separate framework/transition profiles beyond their own passing checks and records. Normal merge and post-merge main readback remain owner gates.

[rmcdaniel]

Normal integration is complete: merge 48520c6fe98cbc689241dfe0e50bd8b61cda3ff9 has tree 36efbd883880931ded0349af2fd38a97b62e749a, equal to Security-reviewed b4b74b8. The remote topic branch is absent (GitHub 404).

Actual-main CI 43451942006 passed. The guarded PHP 8.1/8.2/8.4 matrix, protected stock 8.3 job and fixed 8.1 Carbon-2 job all completed their original commands; each full suite ran 9,025 tests / 87,895 assertions / 56 intentional skips. Read-only replacement/TLS controls and the PHP 8.1 HTTP-only platform control passed. The required aggregate includes the independent 8.3 job and is green. Source/profile admission remains the exact per-job central #386 record; no older writable launcher record was reactivated.

Owner: sdk-php. This closes these unit/Carbon caller migrations. Remaining #297 work is the eight framework compatibility cells and two established Laravel transition cells; their existing checks remain present while their scoped migrations are prepared. Product release and #216/timeout acceptance remain separate.