[rmcdaniel]

Workflow 2.21 requires PHP ^8.2 and Laravel ^12.69.0|^13.30.0. Laravel 10/11 and PHP 8.1 applications must upgrade their platform before taking this minor; their existing 2.20.x locks and published artifacts are unchanged.

Update the Composer constraints and development Testbench lines, shipped embedded authority, derived qualification cells, dependency security policy, README upgrade guidance and changelog together. Move Laravel10/11 to removed platforms (last Workflow minor2.20), retain the unchanged stable-v1 authority/history boundary, and carry no retired-platform advisory exceptions into2.21. The source/published matrices derive two minimum/five supported cells; Laravel13 still needs PHP8.3. Add semantic refusal/positive and stable-v1 boundary controls. Prepare the source product train as2.21.0 without creating a tag or publication.

Validation: isolated cached PHP8.4.27 syntax/policy-only/matrix scripts pass without Composer/vendor/network or package autoload; stable-v1 data remains equal and boundary/secret/diff checks pass. Normal exact-head ECS/Stan/unit/feature and security-policy qualification remain required. SDK #239 continues to wait for the actual later published2.21 authority and Release Verification; no SDK floor/service change or consumer/release effect is selected by this source PR.

Refs #1020. The published2.20.4 fix and #1043 affected-consumer work retain their separate records.

[rmcdaniel]

Exact formatter-only successor 797c221b4434bea5ef57e28863c35219db0aa3d4 is qualified by fresh ordinary PR checks: 18 success, seven declared PR-profile skips, no failing/pending checks at this readback. Original successor build run 42094946325/1 passed quality/ECS/PHPStan, unit contracts, MySQL feature contract, tracing, corpus, repository contracts and aggregate build; dependency-security, public boundary, CodeQL and Sonar also passed. The earlier ECS failure stays attributed to its earlier head.

Full backend/coverage/upgrade jobs are declared skips in this PR profile; this is not a full Quality Cycle claim or release acceptance. The draft remains queued behind #1036's review/correction/integration window. Workflow owns its normal refresh afterward and resulting-main qualification. No 2.21 tag, Release, installed run, SDK floor bump or publication has occurred.

[rmcdaniel]

Normal source refresh after #1036 integration: current head 3af9abc141c333d5014eb1d3b6f498dd932a29ad / tree a1e5e6979c831cd7c362eec5e71d33c6d9c7d970, ordered parents [797c221b, 4f633dc5]. All six support-contract blobs remain byte-identical to the previously qualified 797c221b; all runtime and workflow blobs equal the new main. No rebase, force push, conflict resolution or version change beyond the existing proposed 2.21.0 contract.

Fresh ordinary current-head CI runs normally. Main integration remains after #1036's original automatic main Quality Cycle outcome, rather than carrying the older source checks as new-head results. No tag, Release, installed verification or SDK floor bump has occurred.

[rmcdaniel]

Successor b83f6aa9e882a01234d9eb4d50dc3eb01964a314 adds the existing LaravelDependencySecurityPolicyTest to the bounded PR unit-contract selection. The prior profile used a fixed unit list, so ordinary green checks alone did not imply execution of the new support-floor assertions. This one-line selector change makes them run before integration; it does not change workflow permissions, timeouts, source/test bodies, thresholds or any publishing path. The six support-contract blobs remain unchanged. Fresh normal CI is running for this actual successor; prior source checks keep their original attribution.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact current head b83f6aa9e882a01234d9eb4d50dc3eb01964a314 is now terminal 18 success / seven declared PR-profile skips, no failures/pending. I read actual pr-unit-contracts job 127501871355: PHP 8.5.4 / PHPUnit 13.4.6 executed the selected support-policy class, including testTheComposerConstraintRefusesRemovedLaravelMajors and testTheEmbeddedPhpFloorPreservesTheStableV1Authority, with all five class tests passing at 20:13:16Z. Thus the new floor assertions are directly qualified before merge, rather than inferred from a fixed profile that omitted them.

Current source remains over #1036 merge 4f633dc5. Integration awaits that original main run's actual terminal result; its final unit coverage phase is still running. Fresh current-head source/Sonar/dependency-security/quality checks pass; full source backend/coverage/upgrade jobs are declared PR-profile skips. No release or installed authority is claimed, and the six support-contract blobs remain unchanged by the selector commit.

[rmcdaniel]

Normal protected source integration completed at 2026-11-05 20:29:15Z as 3d7d0a193d8fffe591f8286d1c4d5499120a297a / tree 803201f0362121ac8fa34b781e7ae8d26f400ff9, ordered parents [4f633dc5, b83f6aa9], matching the qualified candidate tree. Exact fresh PR had 18 successful checks / seven declared skips, no failure/pending, required build green, CLEAN/MERGEABLE; match-head merge used no admin override or protection change.

Original automatic main Quality Cycle 42103828348/1 is now running. Workflow owns actual source/unit/coverage/backend/two derived upgrade cells and any failure; no extra full dispatch or rerun. The branch is retained until current run/dependency cleanup checks finish. #1020 stays open for published manifest/verification and downstream follow-through. This merge publishes no 2.21 tag, GitHub Release, installed tuple, SDK support bump or artifact built through the held setup-php path.

[rmcdaniel]

Full resulting-main qualification: PASS for 3d7d0a193d8fffe591f8286d1c4d5499120a297a / tree 803201f0362121ac8fa34b781e7ae8d26f400ff9, ordered [4f633dc5, b83f6aa9]. Original main run 42103828348/1 finished SUCCESS: 20 successful jobs / three PR-only skips, no failed/pending job. The source upgrade matrix actually ran its two derived Laravel 12/PHP 8.2 and Laravel 13/PHP 8.3 cells; this is not the old four-cell source matrix or a published five-cell verification.

ECS/PHPStan pass. Full unit/PCOV passes 5,875 tests / 78,988 assertions, 49 skips and 15 notices, PHP 8.3.36/PHPUnit 12.5.43/PCOV 1.0.12; 138 resolved packages, 22:07.236 PHPUnit time. MySQL passes 2,833 tests / 28,270 assertions / three skips, original shard commands zero at 887/702/527/760s under the unchanged 900s limit. PostgreSQL passes 2,833 / 27,875 / 32 skips, commands zero at 549/404/488/578s under unchanged 600s. MariaDB, contracts/corpus/tracing, combined coverage, Sonar and aggregate build pass. Reported skips/notices remain explicit.

Combined coverage is 75,826 / 80,769 = 93.88%, passing the 93.08% ratchet; 100% target remains unmet. Artifact 13451848072 ZIP SHA-256 f31345e33c23ce4e515f1dbcb59973bc155afff71ffa657ba4e02a3ca52d44cd binds exact merge/main. Source runtime graphs retain their actual PHP/profile attribution rather than claiming the old installed 2.20.4 graph.

After exact remote-head/ancestry, dependent-PR and active-branch-run checks, the incorporated support branch was deleted normally and absence verified. History remains in main. #1020 stays open: no 2.21 tag, published package, Release Verification or installed/consumer authority exists yet. Docs #481 and SDK PHP #239 retain that future exact handoff. Networked setup publishing acceptance remains separate. #1034 and #1048 subsequent main runs retain their own outcomes; none was cancelled or rerun for this acceptance.