[rmcdaniel]

Both embedded Laravel applications lock Workflow 2.20.3, which can deadlock when continue-as-new overlaps unrelated signal admission on MySQL REPEATABLE READ. Raise both minimums and canonical locks to published 2.20.4, source/dist e3664430fd1b795aadaca89c835d5281502a01ce, and update the qualified tuple and README summary. Core's registry-only installed proof passed 22 tests / 221 assertions.

Separate source integration from image publication: devcontainer-image.yml now accepts only an explicit dispatch on main. Remove its automatic push and weekly schedule triggers. All seven publication jobs, architecture settings, scans, anonymous qualification, promotion dependencies and main-ref guards remain unchanged. Normal source CI, PR candidate-image qualification and required contexts are unchanged. This lets the Core source update integrate without starting the held APT-built image publisher.

All 126 root and 118 microservice non-Core package records are unchanged, including the patched Symfony graph. The playground SDK-only lock, other SDK/service pins, Server 3.0.5 digest and historical upgrade warnings are preserved.

Validation: canonical metadata-only updates and strict Composer validation for both pairs; both app/tuple graph validators; artifact resolver; public-boundary, staged-secret and diff checks. Cached PHP 8.4.27 / Composer 2.11.1 checked 299 effective trust stores with zero blocked roots. Structural checks confirm dispatch-only triggering and byte-equivalent publication jobs/settings. The existing PHPUnit workflow contract now requires manual-only triggering and all main-ref guards; normal CI exercises it. No local dependency installation or app autoload ran.

Tracks #318 and Workflow #1043. No dispatch or image publication is selected. Later publication still requires the accepted central #295/#297 path and its existing effect gates. The separately scoped app-bootstrap MySQL proof and final public-image follow-through remain explicit owning-issue work. No repository-local installer/guard, required-context exception or protection change is added.

[rmcdaniel]

Source candidate is complete at 6fb73b5e73db8c235474fb526df924a8dcb87850, tree 5ccc9d8243675d68a41d185513721d74dd164e5e, base 580d0eacb573b5b92aa5a404d1697f1dac25efc0: six files, +22/-22. Both canonical locks select published Workflow 2.20.4 with source/dist e3664430fd1b795aadaca89c835d5281502a01ce. All 126/118 non-Core package objects, all other tuple members, the playground SDK-only lock and complete warning paragraphs compare unchanged to the base.

Bounded local source validation used existing cached PHP 8.4.27 / Composer 2.11.1 image 49c9. Both updates ran with no install/scripts/plugins/autoloader, normal advisory enforcement, a closed child environment and no host credentials/vendor cache. The actual trust verifier inspected 299 stores with zero blocked roots. Each lock reported one Core update and no security advisories, then strict validation passed. Both app/tuple graph validators, artifact resolver, public-boundary and staged secret/diff checks passed. No dependency/vendor installation or app autoload was run locally.

The first container stopped before Composer because scratch inputs were unreadable under its default UID; that original failure is retained in this attribution. Running with the scratch owner's UID completed both metadata updates in 9.342 seconds. Exact container ID/name checks and the owned prefix are empty for the metadata and network-none graph checks. No image was pulled/built and no APT/setup/runtime test or publication occurred locally.

Next action owner: sample-app. Ordinary required source CI is now active on this exact head. Fix concrete failures on this PR; no blanket Security source-review selection is needed. Keep draft/auto-merge off while the actual seven-job main publisher's networked-APT publication path and separate app-bootstrap installed scope remain unresolved. The accepted upstream 22/221/0 installed proof is reused, not rerun. This is a source candidate, not affected-consumer or published-image delivery.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General's selected source separation is implemented at current head 52bcb3f78689d54fcb1035d498fc0661c0b25c68, tree c0cdc1f78add3abd66ddd2852afba6ba52f0b7c1, base 580d0eac. Final scope is eight files: the six-file Core adoption plus the publisher event separation and its existing unit contract.

Source pushes and weekly schedules no longer start image publication. The explicit manual-main publisher retains every job, permission, architecture, provenance/scan/anonymous-qualification/promotion setting and dependency. Normal source CI, PR candidate-image qualification and every required-context contract are unchanged. Local structural checks demonstrate the trigger change and complete equality of the retained job/settings graph; the new PHPUnit assertions run in normal current-head CI. No APT/setup/installer implementation or repository/ruleset setting changed.

Next action owner: sample-app: finish fresh current-head required CI and integrate normally when green. This removes the concrete automatic-publication merge follower; no separate Security source review or General per-PR approval is requested. The explicit publisher remains unexecuted under its actual central-fix/effect conditions. Earlier source-head results keep their actual attribution; none is relabeled as a current-head pass. The specific app-bootstrap installed scope and eventual public-image result remain on #318.

[rmcdaniel]

Source integration checkpoint at exact 52bcb3f78689d54fcb1035d498fc0661c0b25c68 / tree c0cdc1f78add3abd66ddd2852afba6ba52f0b7c1, unchanged base/main 580d0eac: all four protected required contexts are successful (Target branch qualification, polyglot smoke, dual-platform Compose aggregate, SonarCloud). No current check is failed. Some non-required timer/recovery/candidate-image checks are still running; they remain pending and are not reported as passes.

Both actual PHP 8.4/8.5 root jobs install Workflow 2.20.4 and pass 191 tests / 1,628 assertions, including the dispatch-only publication contract and embedded conversation signal/continue-as-new handoff. Each retains the same existing Playground warning. Both microservice jobs pass. Normal advisory audit, central action policy and source/graph checks pass.

Owner sample-app will integrate via the normal protected merge path under General's ordinary source flow and selected publication separation. There is no automatic source-push or weekly image publisher in the candidate, and no manual dispatch, build/publication promotion, installed-native scope or production effect is selected. Preserve the original pending PR runs and verify resulting-main source acceptance; future image and remaining app-bootstrap outcomes stay explicit on #318.

[rmcdaniel]

Normal source merge is verified at c49d7948552e954f607708a045cb323a9e279c6d, ordered parents 580d0eacb573b5b92aa5a404d1697f1dac25efc0 and 52bcb3f78689d54fcb1035d498fc0661c0b25c68, with exact candidate tree c0cdc1f78add3abd66ddd2852afba6ba52f0b7c1. All four protected required contexts were green before the ordinary merge; no admin/force/waiver was used. The merged remote head is independently absent, the local branch is retained and checkout is clean at actual main.

Resulting-main acceptance is in progress: 16 of 17 original workflows are successful, with only original SDK timer run 42093244753 still active. No failing main workflow/check exists. Earlier pending non-required PR checks retain their own attribution and were not relabeled to perform the merge.

The merged publisher source is dispatch-only, and the main run inventory contains zero devcontainer image runs. No manual dispatch, image publication/promotion, source-only replacement controller, APT/setup guard copy, account/protection change or deployment was performed. This verifies the selected source-separation behavior; future publication remains subject to its actual central-fix and effect conditions.

General retained one focused deterministic app-kernel concurrent continue-as-new/unrelated-signal source follow-up in existing ordinary CI after main acceptance, reusing Core's byte-proven fixture and forced interleaving. No full 22-case Core repeat or manual installed cell is planned. Owning #318 stays open for that source case and the separately held future image result.

[rmcdaniel]

Source and ordinary main acceptance are complete for #319 at actual main c49d7948552e954f607708a045cb323a9e279c6d, exact candidate tree c0cdc1f78add3abd66ddd2852afba6ba52f0b7c1. All 17 original workflows / 30 check runs passed, every workflow on attempt 1. The final original SDK timer run 42093244753 is terminal success. No duplicate dispatch, retry, waiver or manual image operation was used.

The merged event separation is verified in actual main: publisher is manual dispatch on main only, and the resulting-main inventory has zero image-publisher runs. Both source/PR qualification workflows and protected required-context names remain unchanged. The remote merged branch is absent; local candidate retained, current checkout clean, all owned metadata/graph containers and completed scratch removed.

Root PHP 8.4/8.5 current-head checks each passed 191 tests / 1,628 assertions with the same existing Playground warning; microservice checks passed. Both canonical locks consume exact published Workflow 2.20.4/e366 with 126/118 other package objects unchanged. Historical warnings, the other SDK/service tuple and patched Symfony graph are preserved.

This completes the selected source-integration slice, not an image-publication result or a named-v2 concurrent app-kernel claim. General retained one focused deterministic app-kernel concurrent source case in existing CI. Sample-app now owns that two-file follow-up under #318, reusing the byte-identical upstream fixture and forced interleaving. The separate future published-image path remains held for central-fix/effect acceptance.