[rmcdaniel]

The six PHP8.1/8.2/8.4 framework cells still invoke setup-php. Move them to fixed-minor jobs using the existing digest-pinned PHP runtime, fixed APT prerequisite, immutable image-ID launcher and read-only host controls. All eight exact framework tuples remain present alongside stock8.3; the required aggregate requires all four jobs.

Generated Laravel apps use owned state/data. PHPStan runs through the PHP interpreter so writable vendor tools stay inside the container. Four explicit synthetic tracing/process-role variables are added to the launcher allowlist for the existing tracing and cached-role controls. Mounts, UID, limits, read-only controls and credential exclusions are unchanged. Adoption checks bind each cell to its job's minor, preserve the complete exact set and refuse unwrapped container tools or caret minimum installs.

Validation on frozen 2713469e40ba16766e462cf4f80d1dcdaf704fda: all six actual local consumers and their real TLS/Composer guard controls pass; both actual-container unit/Carbon replacement modes pass; five launcher controls and 16 adoption cases/93 assertions pass; shell, diff, exact matrix and public-source checks pass. Existing cached PHP8.1/8.2/8.4 images were reused without builds. Exact consumer evidence records the earlier Laravel13 NONPASS and corrected full repeat.

The exact Security source review passes. Central #394 is accepted on main, updating the launcher hash in the existing unit/Carbon recipes and adding three scoped framework recipes. Every new runtime job requires action-policy. Same-head hosted CI attempt 2 passes, with 35 successful checks and one intended skip overall; the six changed framework consumers and five PHP unit/Carbon jobs all pass. Each unit/Carbon suite reports 9,034 tests, 87,939 assertions and 56 skips. The earlier policy refusals and local cached-role failure remain historical NONPASS. Normal exact-head merge and actual-main readback remain the final gates. No policy/parser expansion, product version or release tag changes.

Refs shared#297. Owner: sdk-php. PHP8.2 embedded-v1 transition remains a separate final caller.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Frozen source: 2713469e40ba16766e462cf4f80d1dcdaf704fda.

All six changed framework cells passed their actual run blocks on this source on 2026-11-13, finishing between 16:57:48 and 17:02:51 UTC:

PHP	Consumer	Duration
8.1	Symfony 6.4	76.989 s
8.2	Laravel 12.69.0	80.308 s
8.2	Symfony 7	81.921 s
8.4	Laravel 12.69.0	68.400 s
8.4	Laravel 13.30.0	105.009 s
8.4	Symfony 8	46.145 s

Each cell used a fresh source snapshot/private Composer state, real positive/negative TLS controls, the actual immutable 242c Composer guard before requests, and the proposed job's consumer/install/bootstrap/role/PHPStan/tracing commands. Cached immutable base IDs were reused: PHP8.1 45d1e16c3c0785e0b38159eb20c0537cc263847644d910ef46a6c547c162cbdb, PHP8.2 5e6f71b4bc79c9a98a2c1f45dc2d003522a0fb440719a96546eac33f5a3487a1, PHP8.4 776017cc903c6b3221ab858ec8728e33f96db0973ace175d28d0ea22886783c4. No image rebuild or installed published-SDK claim is involved.

Source/state/control wrappers remain read-only; data, vendor, lock and declared outputs are the existing narrow writable mounts. The launcher adds exactly four synthetic test variables: DURABLE_WORKFLOW_TEST_TRACING, DURABLE_WORKFLOW_PROCESS_ROLE, DURABLE_WORKFLOW_PROCESS_TOKEN, DURABLE_WORKFLOW_ROLE_PROBE_LOG. Unrelated credential variables remain excluded. Both actual-container unit/Carbon replacement modes pass on this head, as do five launcher controls and 16 adoption cases/93 assertions. All SDK test containers are independently confirmed absent.

Earlier fc843c2 Laravel13 failed its cached-role invalid-handoff assertion because the synthetic role variables were omitted. It remains NONPASS; all six final cells above reran after the explicit allowlist correction. Current hosted policy/aggregate refusals are expected while the successor launcher hash and the three per-job records are unaccepted; no runtime result is inferred from skipped jobs. Activation stays held for independent source/catalog review, accepted central records, normal exact-head CI and actual-main readback.

The proposed central records change only the launcher hash in existing SDK unit/Carbon records, and add fixed-job PHP8.1/8.2/8.4 framework records, each binding the same 14 canonical inputs. All unrelated records, withdrawals and retired-source refusals remain unchanged. The PHP8.2 embedded-v1 transition is the remaining separate caller.

[rmcdaniel]

Security exact source/caller review: PASS for SDK PHP #418 2713469e40ba16766e462cf4f80d1dcdaf704fda, conditional on acceptance of central #394 db03892736253dd21b731d97394aceb14b08ddbe before activation.

The remaining six framework cells are now partitioned into literal fixed-minor jobs:

• PHP 8.1: Symfony 6.4;
• PHP 8.2: Laravel 12.69.0 and Symfony 7;
• PHP 8.4: Laravel 12.69.0, Laravel 13.30.0, and Symfony 8.

Each job requires action-policy, uses the pinned checkout/APT/trust identities, disables checkout credentials, selects system Python 3.12, invokes the reviewed container setup with a literal minor, and keeps the original consumer/install/bootstrap/PHPStan/tracing commands. The required aggregate explicitly depends on all three new job partitions.

The launcher delta adds only four explicit synthetic test variables: DURABLE_WORKFLOW_TEST_TRACING, DURABLE_WORKFLOW_PROCESS_ROLE, DURABLE_WORKFLOW_PROCESS_TOKEN, and DURABLE_WORKFLOW_ROLE_PROBE_LOG. It does not widen mounts, image selection, resources, network mode, trust paths, or the broader host environment. The cached-role control unsets ambient legacy/process credential names before assigning synthetic per-process values, refuses invalid/combined handoffs, keeps credentials out of the Laravel cache, and records only role/presence booleans in the declared writable data path.

I independently reran the five launcher controls; all pass. The six exact-head consumer packets report real Composer TLS/242c guards and successful original run blocks on the unchanged immutable 8.1/8.2/8.4 images. The earlier cached-role failure remains NONPASS and is correctly superseded by complete reruns after the allowlist fix.

The currently failed policy/qualification jobs are expected fail-closed behavior because #394 is not yet accepted; skipped jobs are not treated as runtime evidence. Merge/activation still requires accepted central records, fresh exact-head SDK policy/aggregate checks, normal CI, and actual-main readback. No installed/product/release qualification is inferred.

[rmcdaniel]

Exact-head hosted gate is now PASS for 2713469e40ba16766e462cf4f80d1dcdaf704fda: CI43467578542 attempt2, all 35 checks successful plus one intended connected skip. Each of five unit/Carbon suites reports 9,034 tests / 87,939 assertions / 56 declared skips.

I fetched the individual logs by job ID because repeated Laravel job names make the combined log download incomplete. All six changed jobs independently show their exact PHP minor, inspected immutable image ID, actual TLS control, reviewed Composer guards, original functional commands and successful PHPStan:

Consumer	Actual PHP	Hosted job
Laravel 12	8.2.35	132043493484
Symfony 6.4	8.1.34	132043493549
Laravel 13	8.4.27	132043493572
Laravel 12	8.4.27	132043493588
Symfony 7	8.2.35	132043493646
Symfony 8	8.4.27	132043493687

The central acceptance condition in Security's exact source PASS is satisfied by central394's verified main receipt. SDK base remains 7e7f39d76fd58fca2f960605b40d44d0cdb15045; no reviewed source bytes changed. Proceeding with normal exact-head integration; actual-main workflow/tree readback and remote branch cleanup follow. Earlier policy/runner/cached-role NONPASS observations remain distinct. No published product qualification or release is inferred.

[rmcdaniel]

Delivered at main 402b514fed7ebcf9b462cf3fd22f90f04a1cc7b5. Tree 32bf84e7ea98ed76d4963b3c5361520622c032af equals Security-reviewed 2713469e40ba16766e462cf4f80d1dcdaf704fda exactly. The remote topic branch is deleted and independently verified absent.

All four actual-main workflows are terminal SUCCESS: CI, CodeQL, SonarQube, Public Boundary. This follows the exact-head35-success/one-intended-skip hosted gate and six individual framework log readbacks in the integration receipt, plus accepted central394.

The six remaining framework cells now use the reviewed fixed-minor runtime without changing the complete framework matrix, original consumer behavior, minimum Laravel releases or required aggregate. Stock PHP8.3 remains its separately qualified path. Earlier policy/cached-role NONPASS observations remain distinct. No product release or published-SDK qualification is inferred.

The final shared297 SDK caller is separately owned by sdk-php in SDK419 with central395: PHP8.2 embedded-v1 transition. Its activation remains held for its own source/catalog review, central acceptance and actual hosted/aggregate/main evidence. Shared closure remains with General.