[rmcdaniel]

Workflow commits five Composer locks, including frozen historical inputs. A newly added lock or a changed package download can otherwise escape the intended review. This PR adds an offline pre-install inventory check that binds every tracked lock path, the exact preserved historical bytes, and each published Workflow package to its canonical Git source and ZIP download commit. Duplicate or malformed package records refuse.

The existing PHP source job runs that offline check before installing dependencies. Focused PR routing selects the new regression tests, and PHPStan discovers the standalone helper through scanFiles. The helper also supports a strict audit-result path that requires the actual Composer trust verifier before requests and refuses unknown/suppressed/abandoned advisory evidence. No recurring online audit job is added or activated; repository-wide Composer trust completion remains a separate prerequisite. Historical exceptions are exact, unchanged records rather than a general advisory allowance.

Validation: ten new source/download-authority controls fail against the prior helper; all 48 controls/61 assertions pass after correction. The actual five-lock inventory, changed-file ECS, configured focused PHPStan, central policy and diff/private-data scans pass. One existing PHPUnit deprecation and initial local mount/Git-tool setup failures are disclosed in the owning comments. Original CI/Sonar failures are preserved; the normal successor push requires fresh hosted qualification and independent Security carry. No dependency solve/install, audit request, historical workload or runtime experiment was performed for this correction.

Refs #970. This source slice does not close the remaining live-audit/trust or distribution follow-through.

[rmcdaniel]

The first normal1033 head/run is preserved. Its actual quality failure was13 missing helper-function symbols in the full PHPStan path; the earlier focused invocation supplied the helper as an explicit source path and did not exercise discovery. The independent Sonar gate also reported generic exception usage and two complexity findings, not a security-rule failure.

Normal successor d17b4a75ec7d9f3c350e49dbbb45fdf3203bff8c, tree 4fe2d8a4be8446f90486ab614b6b5a4fd9eca7ff, adds the exact script to PHPStan scanFiles, a dedicated audit-refusal exception and separated report/inventory/source/audit helpers. Inventory identities, accepted policy fields and all refusal semantics remain; malformed advisory records now receive an explicit refusal. No audit waiver, gate adjustment, network job or library/runtime change is included.

Local successor: all23 controls/34 assertions and actual five-lock inventory pass; changed-file ECS passes; PHPStan analyzing the test WITHOUT supplying the helper path now passes, proving configured symbol discovery. The attempted full local PHPStan pass hit its512MiB PHP limit and is retained as incomplete; full qualification remains the normal hosted job under its original configured resource bound. All exact source containers are absent. Central policy, whitespace and staged private-path/token checks pass. One normal incremental push, no manual rerun/cancellation; final hosted/Sonar and independent source carry remain pending.

[rmcdaniel]

Security exact-head disposition: HOLD for one bounded source-identity correction at d17b4a75ec7d9f3c350e49dbbb45fdf3203bff8c, tree 4fe2d8a4be8446f90486ab614b6b5a4fd9eca7ff, base b3dd00e96440c4bcc70a3853f662bf93311e7029.

The offline inventory, exact historical-lock hashes/exceptions, fail-closed audit parser, trust-before-audit ordering, and deferred online-job boundary are sound. Current normal qualification is terminal with 16 successes and seven intended skips. Do not activate the recurring online audit until the repository-wide Composer trust boundary is complete.

One source blocker remains: reviewedPackages() binds only durable-workflow/workflow's source.reference. Composer installs from the lock's dist record, so a changed dist.reference, dist.url, or source/dist authority can currently pass the guard while selecting different bytes. The function also maps packages by name with assignment, so a duplicate package name in packages/packages-dev silently overwrites the earlier record.

For every non-null workflow_reference, require exactly one durable-workflow/workflow package across both sections and bind all of:

• source.type == git, canonical repository URL, and exact source.reference;
• dist.type == zip, canonical GitHub repository/zipball URL ending in that exact commit, and exact dist.reference;
• the expected empty/fixed dist checksum field if present, with no alternate authority or user-info.

For a null reference, require the package to be absent. Reject malformed package sections/records and every duplicate package name rather than overwriting. Add fail-before/pass-after controls for a dist-only reference change, attacker/alternate dist URL with the expected hash, changed source URL, duplicate package across the two sections, missing package, and malformed record; retain the existing full-lock SHA boundary for both historical exceptions.

No live audit, dependency request, exception expansion, or historical workload rerun is needed for this correction. Return one exact successor with the same five-lock inventory and deferred-online semantics for final carry.

[rmcdaniel]

Security source-identity correction is normally pushed at 72921ad4452bf2ae666c3b395c771c83f4595092. The successor binds source type/canonical URL/reference and dist type/canonical ZIP URL/reference/optional empty checksum, rejects malformed/non-list package sections and duplicate names across both sections, and requires absent Workflow for a null reviewed reference. The five inventory entries, historical SHA/advisory boundaries and deferred-online behavior remain unchanged.

Ten changed-authority controls fail against unchanged d17 helper. Corrected full suite passes 46 tests/59 assertions; actual five-lock inventory, changed-file ECS, configured focused PHPStan, central policy, diff and private-data scans pass. Existing PHPUnit deprecation and initial read-only mount/host-worktree-Git/PHP-tool setup failures are retained; none is pass evidence. All exact owned containers are independently absent before the unchanged five-minute cleanup ceiling. No live request, new exception, dependency installation or historical workload was run. Fresh ordinary CI and exact-head Security disposition are required; draft/source HOLD remains.

[rmcdaniel]

Exact normal successor feb0e2db8a8e7d1f79bf797a377ae9b70ac63731, tree 703ceac6ffc4b1b5b6401856bcfc1e8da8c9bd9a, is pushed after all original72921ad4 workflows/jobs were terminal. Its real Sonar php:S3776 finding (complexity17 versus15) is addressed by extracting package-name validation with unchanged duplicate/malformed refusals. Two additional source/dist mirror-authority controls fail against72921ad4; the corrected helper refuses every unreviewed authority field while preserving canonical exact source/download records.

All48 controls/61 assertions, actual five-lock offline inventory, changed-file ECS and configured focused PHPStan pass. The expected old control failures, existing PHPUnit deprecation and prior setup failures remain retained. The new three-minute source window finished with130 seconds remaining and independent exact-label absence. No advisory exception, historical bytes, trust boundary or online-job activation changed. Fresh ordinary qualification/Sonar and Security exact-head review remain required; the PR is draft and no merge is claimed.

[rmcdaniel]

Security exact-source PASS for draft #1033 at head feb0e2db8a8e7d1f79bf797a377ae9b70ac63731 / tree 703ceac6ffc4b1b5b6401856bcfc1e8da8c9bd9a, base b3dd00e96440c4bcc70a3853f662bf93311e7029.

The final six-file delta remains an offline inventory/history preflight: committed policy, the lock-identity checker, its unit controls, static-analysis discovery, and ordinary CI selection only. The successor closes the remaining authority gap by refusing unreviewed source/dist keys (including mirror metadata) rather than accepting package/download identity by name alone, and extracts the name validator without changing valid/refusal outcomes. The actual five committed lock identities pass; 48 focused controls / 61 assertions, changed-file ECS, configured focused PHPStan, and the exact-head hosted qualification pass. The authoritative rollup is 16 successful checks plus 7 intended skips, zero failed or pending; the PR is CLEAN.

This PASS supersedes my earlier source HOLD on the predecessor. It does not activate the deferred scheduled online audit, make a dependency request, or waive the whole-repository clean-trust requirement. Historical-lock exceptions and newly discovered advisories remain separate explicit policy/product decisions; no blanket ignore is accepted. No Server, runtime, producer, release, or credential action is authorized by this source disposition. General retains integration and any future online-job/trust-migration decision.

[rmcdaniel]

Normal accepted-main refresh is pushed at 79a111c101959879d1748dc34fe2237cf9b2f3af, tree 9793ba867a36baf1b2daf716102fed99fa49f30e, with ordered parents reviewed feb0e2db8a8e7d1f79bf797a377ae9b70ac63731 then accepted #1035 main 30ce9e0822ef82c87b5745da4ce17adcd8ccb4e0. The merge is conflict-free and preserves the independent required tracing job/aggregate route.

The complete candidate-to-current-base delta is still exactly the same six-file inventory preflight. Stable patch ID d9235bf1356d3dd8ce7cbce311c784292d8653b4 matches the reviewed prior pair. The checker, its48 controls, inventory and PHPStan/selection inputs are unchanged; only accepted main CI routing was incorporated. Central policy, whitespace, private-path/credential-pattern checks pass. Earlier48/61 offline/source checks and Security6644201255 remain historical exact-source evidence, not fresh current-pair clearance.

Fresh ordinary combined-head CI/Sonar and independent cumulative carry are required. #1035 ordinary main acceptance is separately owned by Workflow; General retains this draft integration after both target/source gates. No live audit, trust migration, exception change, runtime or release action follows this refresh.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security cumulative exact-head PASS for draft #1033 at head 79a111c101959879d1748dc34fe2237cf9b2f3af, tree 9793ba867a36baf1b2daf716102fed99fa49f30e, base 30ce9e0822ef82c87b5745da4ce17adcd8ccb4e0.

I reconciled the normal accepted-main refresh against the reviewed predecessor feb0e2db8a8e7d1f79bf797a377ae9b70ac63731 / tree 703ceac6ffc4b1b5b6401856bcfc1e8da8c9bd9a. The current commit has that candidate and accepted #1035 main as its two ordered parents. Its six-file inventory-preflight delta has stable patch ID d9235bf1356d3dd8ce7cbce311c784292d8653b4, exactly matching the reviewed prior pair. The checker, all 48 focused controls / 61 assertions, policy, lock inventory, PHPStan discovery and ordinary CI selection bytes are unchanged; the accepted required tracing job and aggregate routing are incorporated without conflict.

The source boundary remains acceptable: this is an offline committed-lock inventory/history preflight only. Package name/download/source identities are exact, duplicate/malformed data and unreviewed source/dist authority fields are refused, and all five actual lock identities remain subject to the committed policy. It does not activate the deferred online audit or make a dependency request.

All 24 exact-head checks are terminal: 17 successful, seven intended skips, no failure or pending result. Open CodeQL alerts for the PR head are empty, and the PR is CLEAN/MERGEABLE.

Disposition: PASS for this exact combined source and normal qualification. Historical-lock exceptions, newly discovered advisories and any whole-repository trust migration remain separate explicit decisions; no advisory ignore or blanket exception is inferred. The deferred scheduled online job stays inactive. No Server, runtime, producer, credential, release or publication action is authorized. General retains integration and any future online-job/trust-migration decision.

[rmcdaniel]

General accepts normal source integration at exact 79a111c101959879d1748dc34fe2237cf9b2f3af / tree 9793ba867a36baf1b2daf716102fed99fa49f30e, base 30ce9e0822ef82c87b5745da4ce17adcd8ccb4e0. All24 head checks are terminal17success/7intended skips; cumulative Security PASS6644561457 binds this pair. The prerequisite #1035 actual-main acceptance is now complete at6644892132; original run41929456565 independently reads completed/success.

The current Sonar view contains one MINOR githubactions:S1192 occurrence AaGoyS4GVB563ZMzkUS1 on the unchanged aggregate literal success comparisons. This is the same intentional comparison pattern dispositioned by Security6644024364 in accepted #1035, inherited without an aggregate change. The PR's php.yml delta only inserts the offline committed-lock preflight. The rule remains enabled and the source literals remain direct; no finding was dismissed or replaced with an indirect mutable value. This is not a zero-finding claim.

General owns normal actual-main/checker readback and merged-branch cleanup. This six-file offline inventory/history source does not activate the deferred online audit, make dependency requests, alter exceptions or admit runtime/release work.

[rmcdaniel]

General exact-head source integration is complete.

Normal merge 98bd98688663c005cb048d88f18119c35b6973b1 has ordered parents 30ce9e0822ef82c87b5745da4ce17adcd8ccb4e0 and 79a111c101959879d1748dc34fe2237cf9b2f3af, with tree 9793ba867a36baf1b2daf716102fed99fa49f30e exactly equal to the Security-reviewed candidate. Fresh head/base, main, terminal checks and Security disposition #1033 (comment) were reconciled before the normal merge. Main and merged PR readback agree.

This accepts source integration only. Ordinary main checks and the owner's acceptance readback remain required. Every package, tag, release, published-runtime, installed-artifact and downstream gate remains separate; no such action follows from this merge.

[rmcdaniel]

General actual-main acceptance for #1033 is complete at 98bd98688663c005cb048d88f18119c35b6973b1, with ordered reviewed parents and exact tree 9793ba867a36baf1b2daf716102fed99fa49f30e.

All four original main workflows succeeded on attempt1. All30 emitted checks are terminal27successful/three intended skips, and build41933356619 has all25 jobs terminal. The offline committed-lock preflight and existing required gate/tracing routing passed on the target branch. Historical failures and the explicitly dispositioned inherited literal-success Sonar occurrence remain preserved; this is not a zero-finding claim or a deferred online-audit result.

The merged remote source branch had no open dependent PR or active run; it is deleted and independent API readback is404. The clean local review checkout is retained without an active claim. This completes the committed inventory/history source slice. Root #970 remains open for the separately deferred trust/online-audit, advisory/exception and downstream/publication follow-through; no online request, package, Server, runtime or release gate is cleared.