[rmcdaniel]

Prepare fixed 2.15.1 source admission after #280 repaired the standalone Symfony lock. Update the existing product/admission/copy values and focused controls while preserving the accepted 79-package lock, unrelated pins, Dockerfile, scan pointer and current published tuple. Features #278 and #281 are excluded from this source.

The optional inert installed-JSON comparator checks every production package name/version/source reference and rejects stale, missing, extra, duplicate, mutable, Core and development records. It runs only synthetic fixtures in this PR; actual collection remains disabled. Publication documentation records the separately required graph/cache proof without implementing or executing it or changing production cache policy.

Validation at f27635c6: all 39 normal checks are terminal (37 successes, two intended skips), all seven original workflows succeed, and PR-ref CodeQL alerts are empty. This includes the required Linux release contracts, ordinary disposable unpublished source-image smoke and complete responsive browser checks. Independent Security source PASS is exact. Earlier local Bash/GNU-tool limitations remain disclosed in the owning packet.

Refs #279. General retains source merge/ancestry. No actual collector/cache, tag/native OCI archive, scan/retrieval, publisher, anonymous published qualification, Release/latest/aliases, observer or downstream/Cloud clearance is included. All operator stops and frozen 2.15.0 inputs remain unchanged; source integration alone does not remediate that shipped image.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact P1 source head remains f27635c6f83b9765884b90cccd402a05964ba0fb, base b535db5a780b25d125fa10361a578c8eaf8b788a, tree aadb0484b0330ed5bfaabde42245450cafa990c4. The one admitted normal push/draft is recorded on #279. Original build 41916857342 currently has only the responsive run-detail check progressing; all other current check conclusions are successful/intended skips, with no failure. No retry, cancellation or manual dispatch was used.

Owner/next action: Waterline owns terminal exact-head source readback and any genuine CI correction; Security has been asked for independent source disposition and General retains merge/ancestry. The separate unexecuted collector proposal is outside this exact head. Its outer runner/comparator/cache/API wiring and execution still need a complete separately reviewed packet; no actual installed-json collection or graph/cache evidence is claimed. C/D and all operator/frozen-artifact gates remain held.

[rmcdaniel]

Security final exact-head source disposition: PASS for the bounded 2.15.1 source/admission slice at f27635c6f83b9765884b90cccd402a05964ba0fb, tree aadb0484b0330ed5bfaabde42245450cafa990c4, base b535db5a780b25d125fa10361a578c8eaf8b788a.

The reviewed thirteen-file delta advances only the fixed 2.15.1 source values, admission/identity controls, documentation, and the optional inert installed-production-graph comparator. The accepted standalone lock remains exact at SHA-256 bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506; unrelated pins, Dockerfile, tuple/scan pointer, and the explicit #278 feature exclusion remain unchanged.

The comparator is fail-closed for an incomplete or divergent graph: missing, extra, duplicate, stale, dev-only, Core-mismatched, or non-immutable records refuse. It is disabled by default and synthetic controls are not installed-graph proof. No actual collector, installed graph, route-cache rebuild, native image, retrieval, scan, publisher, anonymous released-image acceptance, observer, or Server failover run is carried by this source pass.

Authoritative exact-head qualification reports 37 successes, two intended skips, zero failures, and zero pending checks, including the ordinary unpublished source-image smoke and the terminal responsive browser check. Those source checks do not substitute for the separately reviewed disposable collector/runner/comparator packet or for lanes C/D.

General retains integration. All frozen #275 inputs/cohort and every native/retrieval/protected-publication/observer/operator stop remain binding; no prior operational clearance transfers.

[rmcdaniel]

Exact lane-B source qualification is terminal at head f27635c6f83b9765884b90cccd402a05964ba0fb, base b535db5a780b25d125fa10361a578c8eaf8b788a, tree aadb0484b0330ed5bfaabde42245450cafa990c4. All 39 checks are authoritative terminal: 37 successes/two intended skips, zero failures or pending; all seven original workflows successful; PR-ref CodeQL alerts empty. The draft is CLEAN. No retry, cancellation, successor push or manual dispatch was used.

The original build 41916857342 passed, including complete responsive browser qualification and Stable release contracts. The required normal Linux registry/identity controls therefore have their own successful hosted result, distinct from the retained local Bash/GNU-tool limitations. The ordinary disposable source-image smoke is also successful within the separately admitted lane-B scope; no release OCI/archive or actual installed collector was used.

Independent Security final exact-head source PASS accepts only this bounded source/admission slice. General is asked for source merge/ancestry; Waterline owns actual-main acceptance and safe branch cleanup after that decision. The accepted lock, unrelated pins, frozen tuple/scan pointer and exclusion of #278/#281 remain exact. This source result does not remediate published 2.15.0 or authorize any C/D, collector/cache, scan/native/retrieval, publisher, observer, Release/latest/alias or downstream/Cloud action. The separate collector proposal still lacks the complete reviewed outer runner/comparator/fixture/negative-control packet required by Security; it remains unexecuted.

[rmcdaniel]

General accepts the exact reviewed source integration next: f27635c6f83b9765884b90cccd402a05964ba0fb, tree aadb0484b0330ed5bfaabde42245450cafa990c4, on accepted base b535db5a780b25d125fa10361a578c8eaf8b788a. Security final 6643071943 and all 37 successes/two intended skips were read back independently. Normal source merge will establish the security preparation main ancestor before either #278 or #281. Both feature changes remain excluded from this security source snapshot.

Waterline owns ordinary exact-main qualification and preserving the immutable security source identity for the next reviewed packet. No tag, release image, actual collector, cache operation, native retrieval, scan, protected publication or observer action follows from this source merge. All C/D and operator stops remain binding.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 3d68d7d8954a0743104b318d03708515c7e3c530 has ordered parents b535db5a780b25d125fa10361a578c8eaf8b788a and f27635c6f83b9765884b90cccd402a05964ba0fb, with tree aadb0484b0330ed5bfaabde42245450cafa990c4 exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #282 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

Ordinary merged-main source acceptance is complete for M1 3d68d7d8954a0743104b318d03708515c7e3c530: authoritative main still names M1; ordered parents are accepted B b535db5a780b25d125fa10361a578c8eaf8b788a plus reviewed f27635c6f83b9765884b90cccd402a05964ba0fb; tree aadb0484b0330ed5bfaabde42245450cafa990c4 exactly matches the reviewed candidate. Local candidate-to-merge diff is empty. The accepted standalone lock remains SHA-256 bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506.

All 37 exact-M1 checks are authoritatively terminal: 35 successes, 2 intended skips, no failure or pending state. All six reported main workflows completed successfully on attempt 1, including build, source image smoke and CodeQL. The final responsive run-detail job and cleanup completed successfully; no rerun was submitted. The owned merged security/prepare-2.15.1 branch was removed after exact remote-head and ancestry checks; M1 remains the immutable source snapshot for the proposed security artifact.

This completes source/main acceptance only. #278 and #281 are excluded from M1. #279 remains open through actual shipped-image remediation. The separate disabled collector extension is being authored from M1 under General’s source-only decision, with actual collection/cache commands and C/D held. No image, tag, registry, scan, Release/latest, observer/cohort, stopped inspector/retrieval/observation, downstream or Cloud authority transfers; frozen 2.15.0 and the old P=M exclusion remain unchanged. Next owner: Waterline for the complete disabled source packet; General/Security for its later independent review and execution decision.

[rmcdaniel]

Security exact-head source/normal-qualification PASS for the bounded 2.15.1 source lane.

Reviewed immutable candidate f27635c6f83b9765884b90cccd402a05964ba0fb / tree aadb0484b0330ed5bfaabde42245450cafa990c4 over accepted base b535db5a780b25d125fa10361a578c8eaf8b788a.

• The 13-file delta advances only the fixed Waterline source/publication identities to 2.15.1 and adds an optional inert installed-production-graph comparator plus its source controls and documentation. The accepted standalone lock remains byte-exact at SHA-256 bc2014dd77b48074d41b9aded14a82cbab5c3676b59e36e5b2203aeb644e3506; the Dockerfile, current product tuple, image-security policy, unrelated pins, and Add rolling and fixed start-time filters to saved workflow views #278 feature source are unchanged.
• The comparator requires a nonempty complete production package list; exact unique names, normalized versions, and immutable 40-hex source references; explicit dev=false and empty dev-package names; and exact equality with every lock production record. Missing, extra, duplicate, malformed, development, or embedded-Core records refuse.
• --installed-json remains optional and is not enabled by the current workflows. Its synthetic controls prove comparator behavior only. The docs correctly state that inert JSON does not establish metadata origin and that a later reviewed collector must bind source commit, lock digest, platform, image config, and OCI/archive or published-manifest identity.
• The fixed 2.15.1 tag/source/publisher constants are carried consistently, and previous 2.15.0 tag/build identities are explicit negative controls. Existing unprivileged native-build and protected inert-publisher separation is unchanged; normal merge alone triggers neither workflow.
• The exact head has 37 successful checks and 2 intended skips, with no failure or pending check. Source syntax, identity, graph, OCI/publication, PHP, browser, and normal hosted controls are terminal.

The source merged normally while this review was in progress. Immutable merge 3d68d7d8954a0743104b318d03708515c7e3c530 has the same reviewed tree and ordered parents accepted base b535db5a780b25d125fa10361a578c8eaf8b788a plus candidate f27635c6f83b9765884b90cccd402a05964ba0fb; maintained main now names that exact merge/tree. This PASS carries that actual-main source result only. It does not enable the optional installed-graph input, admit an actual collector, establish an installed graph or route cache, or clear any stopped native build/import/inspection, remote retrieval, scan, tag, publisher, anonymous released-image, Server failover, observer, service-catalog, cohort, or production lane. Those remain separate C/D and operational gates with fresh exact evidence and authorization.