[rmcdaniel]

The development image currently reaches its first Brotli APT operation on an official PHP 8.4.27 Bookworm parent whose publisher inventory contains apt/libapt-pkg6.0 2.6.1. Adopt the accepted central source route from .github #309, preserving PHP 8.4.27 and both native architectures.

• Pin both development-image PHP stages to the exact fixed-parent index b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe. The central publisher inventory binds both child/config/attestation/SPDX subjects and reports apt/libapt-pkg6.0 2.6.2; this source record is not installed-image proof.
• Both existing image callers check out central commit 18783be6bef737cc778e4c7282a8797e39daa61a without persisted credentials, verify actual HEAD and the guard SHA-256 2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576, then prepare Buildx. COPY the central file directly from that disposable local context; no guard implementation is committed here and no external-image fallback is added. The context includes the file and excludes its Git metadata.
• Run the same stock-shell guard before each PHP stage's first RUN reaches Brotli, and again before direct APT and Playwright --with-deps. It establishes the native installed pair without Python or package acquisition. Preserve every other parent/tool/product pin, dependency graph, trust check and runtime behavior. The completed-image startup qualifier invokes the same copied guard after application preparation to retain the final installed-pair readback. The production Dockerfile is unchanged.

Local validation: all 54 pure Python controls pass; six consumer controls cover both stage/order/context positives and early/later/missing-source mutations. Four inert executions of the actual workflow verification block accept the exact source and refuse wrong HEAD, changed bytes and a missing file; the guard itself is not executed locally. Parsed YAML comparisons preserve the existing jobs/DAG/platforms/settings after removing only the two new source steps. Ten product/lock inputs are byte-identical. Public-boundary and staged secret/diff checks pass. No local image/layer acquisition, container, Cargo/toolchain or application/installed execution.

General selected this narrow SOURCE adoption and normal PR qualification. Existing ordinary CI owns the PHP contract tests and the two native untrusted image build/startup results. Required checks and protections are unchanged; push: false and read-only PR permissions remain. The explicit seven-job main publisher remains manual-only with its existing scan/anonymous/native qualification/promotion path; it is not dispatched by this PR. Actual publication and production effects retain their separate decisions. The initial hosted Ubuntu/PHP8.3 profile is not used as Bookworm acceptance.

Tracks #318 and Workflow #1043. No closing reference: #318 stays open through its real public-image outcome or General's explicit artifact disposition. Source checkpoint and the remaining exact image-effect packet will be returned after original qualification and normal integration.

[rmcdaniel]

Current-head source checkpoint: 4807b129e9b1e255c621a958590b1aa78c0f7d6d / tree 0c2cc4031b29ae50649aef23ad7bc9a3e997e5d7, based on accepted main 42d9af5957832ed2b0413c7fea1853e4d47ed3f4.

All four expected protected contexts now PASS: Target branch qualification, docker compose sample workflows, polyglot smoke (PHP/Python/Rust), and SonarCloud Code Analysis. Original CI 42117388017/1 passes both root PHP suites at 193 tests / 1706 assertions, retaining the existing Playground warning; both microservice suites, 53 Python source controls and policy/aggregate pass. The unchanged app-kernel case reports installed Core 2.20.4/e366, Laravel 13.34.0, MySQL 8.0.46/REPEATABLE READ, distinct PDO connections/active named shared transactions, one signal attempt and exactly-once application on both PHP versions.

Original native candidate qualification 42117387768/1 is still running. Both amd64 and arm64 have completed the immutable central checkout and actual HEAD/file-hash verification successfully before entering Buildx. Their actual installed APT-pair and startup results are pending; source inventory is not relabeled as that acceptance.

Applicability is bound to accepted central 18783be6 (guard blob 5d76f646, 2233 bytes, SHA-256 2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576), same-PHP fixed index b3e907a1…200fe, both native platforms and both first-RUN/Brotli boundaries plus later direct APT/Playwright. Five consumed local source controls reject removed early/later guards and external COPY fallback. Four inert identity-block controls reject wrong HEAD/changed/missing file. Parsed caller comparisons preserve all existing job/DAG/platform/settings; ten product/lock files and production recipe are byte-identical. The central guard is not committed or reimplemented here.

Owner/next action: sample-app will finish the original native outcomes, fix concrete failures, integrate normally when qualified and verify resulting main/cleanup, then return the exact public-image effect packet to General and Workflow #1043. No local image/toolchain/runtime operation, publisher dispatch, promotion or production change. The explicit seven-job manual-main publisher remains unexecuted; #318 stays open for its actual image receipt or General's explicit artifact disposition.

[sonarqubecloud]

Quality Gate passed

Issues
10 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Incremental head 7d9da8374bfae362c8913cf9d23d694e40c838a6 / tree 2ca39bbca68814bdedb5b8eff24ae913d9ff07f4 adds one invocation of the same copied central read-only preflight to the completed-image startup qualifier, after application preparation. Its additional consumed source control and shell syntax pass; all 54 local Python controls pass. No new guard implementation or package operation is introduced.

The original earlier head 4807b129 retains actual native qualification PASS in 42117387768/1: both amd64 and arm64 log four actual build-boundary readbacks with native apt/libapt-pkg6.0 2.6.2 / 2.6.2, successful central file hash verification and installed Workflow2.20.4 in both app seeds. Native Codespaces qualification passes in47s/42s. These are original earlier-head results, not current-head clearance or public-image acceptance.

Fresh original qualification on the successor is required for the new final startup readback and current source. Previous pending PR jobs may be canceled by the existing PR concurrency policy on source update; no failed job is retried or reported green. Publisher remains undispatched; owner sample-app continues current-head checks, normal qualified integration/main and exact remaining image-effect packet.

[rmcdaniel]

Current-head applicability and native qualification PASS: 7d9da8374bfae362c8913cf9d23d694e40c838a6 / tree 2ca39bbca68814bdedb5b8eff24ae913d9ff07f4, original 42119023628/1.

Native job	Actual installed client/library	Completed-image qualification
amd64 127566206954	apt 2.6.2 / libapt-pkg6.0 2.6.2 at four build boundaries and final startup readback	PASS, 51s; final pair 22:16:27.595Z
arm64 127566207358	apt 2.6.2 / libapt-pkg6.0 2.6.2 at four build boundaries and final startup readback	PASS, 44s; final pair 22:15:17.200Z

Both jobs verify exact central HEAD 18783be6bef737cc778e4c7282a8797e39daa61a and guard SHA-256 2a36a2417e8947357ea6f6cbc2f6c53a834f3c069f8013a34d6d861b7123d576 before Buildx, preserve both native platforms, build with push: false, and pass existing Codespaces/tool/trust/runtime/cleanup qualification. This is actual native installed-pair evidence; the publisher SPDX source record retains its separate scope. No public artifact was produced by these jobs.

All four expected protected required contexts are present and SUCCESS. Original CI 42119023683/1 passes both PHP suites at 193 tests / 1706 assertions plus the existing Playground warning; 54 Python controls, both microservice suites and policy/aggregate pass. The unchanged installed Core2.20.4/e366 concurrent app-kernel case remains PASS on PHP8.4.27/8.5.12, real MySQL8.0.46/RR, distinct active named shared transactions, one signal attempt and exactly-once application. Other original SDK/timer workflows still pending are not claimed green early; no current-head check is failed.

Owner/next action: sample-app performs the normal protected source merge and exact resulting-main acceptance, then returns the remaining seven-job manual publisher input/effect packet for General's separate selection. The preserved publisher first writes immutable architecture tags/indexes, scans exact public SBOMs, performs anonymous/native qualification, then conditionally promotes main; no part of that effect is dispatched by this PR. #318 stays open through the actual public-image outcome or General's explicit artifact disposition.

[rmcdaniel]

Normal protected source integration is complete: #323 merged at 2026-11-05T22:19:26Z as main 75329c1975bc2dc4c76bb6f6b389b8f2e69f8e3c, exact ordered parents [42d9af5957832ed2b0413c7fea1853e4d47ed3f4, 7d9da8374bfae362c8913cf9d23d694e40c838a6], tree 2ca39bbca68814bdedb5b8eff24ae913d9ff07f4, identical to the accepted candidate. All four protected contexts and both native image qualifications passed before the ordinary match-head merge; no waiver/admin/force or protection change.

The actual applicability/native receipt retains original current-head five-point installed apt/libapt2.6.2 readbacks on each native architecture, 51s/44s completed-image qualification, source HEAD/file-hash binding, PHP193/1706 and unchanged installed Core2.20.4/e366 concurrent app acceptance. This does not claim a public artifact. Some original SDK/timer PR checks were still pending at merge and are not relabeled green early.

Actual main/parents/tree are independently fetched and verified. The merged remote branch is absent; local source candidates are retained and actual-main checkout is clean. No local image/toolchain/runtime operation or producer dispatch occurred. Original resulting-main checks are now running; sample-app owns concrete failures and final current-main acceptance. #318 remains open through an actual public-image receipt or General's explicit artifact disposition.

[rmcdaniel]

Terminal accepted #323 source/main receipt: main 75329c1975bc2dc4c76bb6f6b389b8f2e69f8e3c / tree 2ca39bbca68814bdedb5b8eff24ae913d9ff07f4 has 15/15 original workflows and 28/28 check runs PASS on attempt 1. Final original SDK timer 42120509189/1 succeeded at22:37:55Z (18m23s). Candidate 7d9da837 also has17/17 original workflows PASS. Exact normal merge/ordered parents/tree, merged remote branch absence, retained candidates and clean checkout are verified. No local sample-app containers/networks/volumes or ongoing observer remain.

Both main PHP suites pass193 tests/1706 assertions with the existing Playground warning, installed Core2.20.4/e366, Laravel13.34.0, actual MySQL8.0.46/RR, distinct PDO/shared active transaction barriers, one signal attempt and exactly-once application. Original native qualification passes both platforms with four build-boundary plus completed-image apt/libapt2.6.2 readbacks, exact central source binding and51s/44s startup qualification. No publisher ran.

This source/main acceptance is preserved. It is not registry admission: the old effect-packet PASS was superseded before dispatch because publishing jobs lacked the organization-required Environment. Draft #324 is the selected minimal successor (three writer environment fields + focused test). General separately configured the empty main-only environment. sample-app owns its normal fresh qualification and exact successor packet; no dispatch or registry effect is selected. #318/Core1043 remain open for the actual image outcome or General's explicit artifact disposition.