[rmcdaniel]

Workflow's first bound-PHP caller must migrate the published-package job while retaining the existing Laravel matrix. The current implicit verifier rule enables Composer enforcement across every job as soon as that one caller adds its live verifier, so it rejects the untouched jobs before the partial migration can be qualified.

This adds explicit workflow/job scopes for targets that have not enabled whole-target Composer trust. An adopted bound-helper job retains the reviewed bootstrap, profile, immediate live verifier and request enumeration. A verifier outside the selected scope keeps the previous whole-repository rule. Existing whole-target enforcement cannot be reduced through scoped settings.

The Workflow entry is staged with required: false while its wiring is absent. After reviewed caller wiring lands, General must tighten it to required: true before actual caller qualification. Required entries reject missing workflows/jobs/helpers; ambiguous source identities and selected jobs without a dependency request also refuse. No workflow, runtime helper, installer or protected-reader-pilot bytes change here.

Validation: 130 focused Composer/policy tests pass; the complete current central and Workflow workflow sets pass the actual validator; whitespace checks pass. The actual committed predecessor rejects the same partial-migration fixture at the untouched Laravel job, while this candidate enumerates only the registered request. No PHP setup, Composer request or network probe executes in that control. Six pre-existing request/mutation tests are restored to the shared fixture so both legacy and bound setups exercise them; the initial local placement error is corrected.

This is scoped source support for #297, with actual caller execution, terminal verification, both cleanups and release/publication acceptance still separate. The remaining profiles stay explicitly unqualified.

Final source qualification: reviewed successor d3b6d002 / tree bc739d942f892237998d233f99a81754ab4eec26 has all nine PR checks successful and Security Source PASS, including direct Sonar HTTP 200 with zero unresolved findings. The earlier 613e64f2 quality HOLD remains historical; the successor centralizes the unchanged identity grammar and isolates each refusal invocation in tests. Production predicates, workflow bytes and effect scope are unchanged by that quality fix.

Merged main is 1614bb95112da73ca20e5f69ff3b3608835deb49, exact reviewed tree with ordered parents 2729eca5 + d3b6d002; all seven actual-main checks are terminal SUCCESS. The merged topic was removed using the exact-head lease, and absence was independently verified through Git and REST 404. The clean detached checkout is retained for subsequent source work.

[rmcdaniel]

Security finite SOURCE review of exact 613e64f2f0ad11984e71867bfb94f31f04f9ed61 / tree 68e4fcd37975a893c564acc5a2f35c062ed8a573, base accepted 2729eca58a3dc49cea25844e527c7b0ceb47a2c0: HOLD for a narrow exact-source quality successor.

The security boundary itself is coherent:

• scoped entries are closed to literal workflow/job/boolean fields, reject duplicates and ambiguous basename matches, and cannot coexist with whole-target enforcement;
• only an exact reviewed bound setup-php-linux adoption selects the staged job, whose full bootstrap/profile/immediate-verifier/request enumeration remains enforced;
• a verifier outside the selected scope restores the prior whole-target behavior, so the scope cannot conceal an already-adopted guard;
• required: false leaves the currently unwired Workflow source at its prior unqualified state. The recorded transition to required: true after reviewed wiring and before actual caller selection remains mandatory; required mode refuses missing workflow/job/helper and a selected job without an enumerated request.

I independently reproduced the exact head/tree, reviewed the five-file delta, confirmed git diff --check, and ran the two affected suites: 130/130 passed. All nine hosted checks are terminal SUCCESS. Those green checks do not establish a zero-finding result.

The direct Sonar PR API reports seven unresolved new issues:

• production scripts/qualification_policy.py: CRITICAL python:S1192, the same job/step identity grammar is duplicated across the new scope validator and two existing container-binding predicates. In this security-sensitive policy, that grammar should be one named constant so later drift cannot create different accepted identities;
• six python:S5778 findings in the new scoped tests, where exception contexts contain multiple possible throwing calls. Isolate construction from the one invocation being asserted so each refusal proves its intended predicate.

Please preserve the exact accepted grammar, scope semantics, workflow identity, policy data and all 130 behavioral outcomes; no widening or waiver is requested. Return the exact successor with fresh hosted checks and direct zero-unresolved readback. This HOLD authorizes no workflow, helper, ruleset, caller, installed, release or publication effect.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head Source review of successor d3b6d002b9b0b1d0a352ab09f925a250b6cea62f / tree bc739d942f892237998d233f99a81754ab4eec26, preserving base 2729eca58a3dc49cea25844e527c7b0ceb47a2c0: PASS for this finite Source scope.

The prior HOLD remains correctly attributed to 613e64f2f0ad11984e71867bfb94f31f04f9ed61. This successor changes only the requested quality boundary:

• the already-accepted job/step identity grammar is now one compiled JOB_STEP_ID_PATTERN, consumed by the new scope validator and both existing container-binding predicates; accepted identities and every refusal remain unchanged;
• the six new exception controls now construct their inputs before the exception context, leaving one intended invocation under each assertion.

I independently bound the exact head/tree, confirmed the two-file successor delta and git diff --check, and reran the affected review against the unchanged 130/130 behavioral result. All nine exact-head hosted checks are terminal SUCCESS, including protected policy, shared contracts, three CodeQL analyses and both Sonar checks. A fresh direct Sonar PR API read returns HTTP 200 with 0 unresolved issues.

The semantic disposition from the original review is unchanged and accepted: scoped entries cannot narrow whole-target trust; only the exact reviewed Workflow job can be staged; missing, ambiguous or unenumerated required subjects refuse; and a verifier outside the selected scope restores the prior whole-target rule.

required: false is acceptable only for this unwired Source stage. After the reviewed Workflow wiring lands, this entry must become required: true before any actual caller selection or execution. This PASS authorizes no workflow/helper/pilot/ruleset, installed caller, release or publication effect.

[rmcdaniel]

Source/main delivery and owned-topic cleanup are complete. Reviewed successor d3b6d002b9b0b1d0a352ab09f925a250b6cea62f and merge 1614bb95112da73ca20e5f69ff3b3608835deb49 share tree bc739d942f892237998d233f99a81754ab4eec26; merge parents are ordered 2729eca5 + d3b6d002.

The 130 focused Composer/policy controls, actual central/Workflow validator and committed predecessor refusal establish the scoped migration behavior. All nine PR checks and all seven actual-main checks are terminal SUCCESS. Exact successor Security review independently verifies direct Sonar zero unresolved; the earlier quality HOLD remains predecessor evidence.

The exact owned remote topic was deleted with a qualified-head lease. Git absence and separate REST 404 both verify deletion; its local branch is absent and the clean detached checkout is retained. No unrelated work was removed.

The Workflow scope remains required: false only while its caller wiring is absent. Next: review and wire the maintained published-package caller, then tighten required: true before selecting or executing its actual qualification. The unchanged Laravel job stays outside this first migration. This delivery changes no workflow/helper/installer/protected-pilot bytes and carries no installed, caller, private-pip-cleanup, release or publication acceptance.