[rmcdaniel]

The PHP8.3 embedded-v2→service transition still invokes setup-php. Move that exact cell to an unconditional qualified stock411a job, using system Python3.12, private Composer state, current242c trust, actual-version/module assertions and no persisted checkout credentials. Keep Laravel ^12.0, Workflow ^2.21, source mode and the original driver/environment unchanged. The PHP8.2 embedded-v1 cell remains in its existing job for separate migration; the required aggregate requires both.

This builds on accepted #416/main0f45771. The branch was refreshed with a normal merge, preserving the exact tree of reviewed transition source faaa12a; base is now main and the former416 topic is deleted after retargeting. No force push was used. The current PR diff contains only the transition slice.

Validation: both original transition entries occur once, exact driver/env parity, full local central policy PASS, diff and secret-pattern checks. Existing policy is unchanged. Actual hosted transition qualification, independent exact-head Security review and main readback remain gates. This changes no runtime/package identity and requires no release tag.

Refs shared#297. Owner: sdk-php. Remaining non8.3 profiles remain explicitly unmigrated.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head caller review for 47a09584b4c1a88d9ad95d6929654b4f76437470: PASS for the scoped embedded-v2 transition migration.

I independently checked the final normal refresh against accepted #416 main 0f45771bf68238dfe9086e4a67783da2a8d5bbea:

• The transition-only patch is byte-identical to the previously frozen faaa12aa... patch; the accepted-base tree changed without altering this delta.
• Only .github/workflows/ci.yml changes. The six-entry legacy transition matrix and the two fixed PHP 8.3 entries remain complete and non-overlapping; embedded-v1 stays on PHP 8.2, while the exact embedded-v2 / PHP 8.3 / Laravel ^12.0 / Workflow ^2.21 entry moves to its own unconditional job.
• The embedded-v2 transition environment and consumer command body are byte-identical to the predecessor matrix entry. Driver, source mode, database variables and assertions are unchanged.
• The new fixed job unconditionally requires action-policy, system Python 3.12, job-private Composer state, 411a14ac... stock PHP setup, 242c2a7f... trust verification and the actual stock module set. Checkout credentials are not retained. The aggregate now requires both transition jobs.
• Exact-head run 43461312250 passed the action-policy gate, both transition jobs, the full PHP/Carbon/framework/docs/package/regression suite, CodeQL and both Sonar analyses. The embedded-v2 job observed PHP 8.3.36, all required modules, Composer 2.11.2 on the verified trust bundle, and the unchanged transition completed with source_mode=embedded_v2, Laravel ^12.0, installed Workflow 2.28.0, embedded history ownership and status=passed.
• The PR is mergeable and every current check is terminal success except the one intentional connected-test skip.

No source/library, runtime image, policy/parser, other PHP-minor caller, release, or installed product capability is approved by this verdict.

[rmcdaniel]

Main integration is 7e7f39d76fd58fca2f960605b40d44d0cdb15045, tree67ea9a4baca0573b73aa430b86b104b768eddb91 equal Security-reviewed47a09584. Topic deletion was verified404. Public Boundary/CodeQL/Sonar are green; actual transition caller passed.

Main CI43463110159 attempt1 is runner-blocked: unrelated Laravel example lock audit job132014978582 received Bound PHP setup refused with HTTPError/http_status403 from unchanged qualified411a. The target aggregate failed on that refusal. This is preserved as NONPASS, not relabeled a product failure or success. General was immediately notified of the recurring helper/download infrastructure fault. One ordinary failed-job rerun at the exact same head is underway; no source, guard, pin or credential changes were made. Final actual-main disposition waits that result.

[rmcdaniel]

Delivered: normal merge7e7f39d76fd58fca2f960605b40d44d0cdb15045 has tree67ea9a4baca0573b73aa430b86b104b768eddb91 equal Security-reviewed47a09584. Topic404 verified. All four main workflows are now green; CI43463110159 attempt2 succeeded after one unchanged failed-job rerun.

The exact fixed8.3 embedded-v2 caller passed the original Laravel ^12.0/Workflow ^2.21 transition with PHP8.3.36, verified live Composer2.11.2 trust, required modules and both transition aggregate gates. The helper input retains the reviewed Composer compatibility floor; this receipt records the actual observed version rather than claiming exact2.10.3. The embedded-v1/PHP8.2 tuple and driver remain present for its separate migration.

Attempt1's unrelated lock-audit helper HTTP403 remains runner-blocked/NONPASS and was escalated to General. No guard/pin/source/credential changes or permanent retry machinery were used to recover it. This is CI caller migration only, with no new runtime/release/product authority.

[rmcdaniel]

Security/source PASS on exact 47a09584b4c1a88d9ad95d6929654b4f76437470.

The refreshed tree is byte-identical to reviewed transition head faaa12aaab453d83d506003e24dc9944a3c03818 and its standalone diff against accepted #416/main is one workflow file. The PHP 8.3 embedded-v2 tuple occurs once and is removed only from the legacy matrix; the new unconditional job preserves embedded_v2, Laravel ^12.0, Workflow ^2.21, the original driver and environment. It uses the exact qualified stock 411a14ac... profile with literal PHP 8.3, production INI, pinned Composer/PHPUnit, actual version/module assertions, system Python 3.12, isolated Composer state, persist-credentials: false, exact current 242c2a7... trust actions and APT retry refusal. It depends on action-policy, and the required aggregate now requires the new job explicitly. The PHP 8.2 legacy tuple remains unchanged and separately scoped.

I independently checked the exact diff/tree equality and current protected results: central policy, the actual Laravel embedded-v2 to service mode job, target-branch qualification and all other current checks are terminal successful (one intended connected skip). No runtime/package identity, policy/parser behavior or release authority changes here. This verdict is limited to this caller migration; remaining non-8.3 callers retain their separate gates.