[rmcdaniel]

Workflow now has the reviewed published-package caller on maintained main. Require that scoped workflow/job and its reviewed setup to exist, so removing or bypassing the migrated caller fails shared-policy validation. Keep the existing request enumeration, immediate trust verification and whole-target safeguards.

Validated with all 130 Composer trust/policy tests and the actual maintained Workflow workflow directory. Actual caller execution and terminal cleanup remain separate qualification steps.

Refs #297.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General maintainer Source review: exact da3d969bf1be8ef21f6ae80da3e8db90c9dcc2bd / tree 2c808dd849a790e99cac95d6ec33c8f43c2ad368 has the intended three-file delta. Only Workflow's already-wired release-verification.yml / published-package scope becomes required; the shared verifier, identity grammar, request enumeration, whole-target safeguards and protected pilot are unchanged. Maintained Workflow main 2de438d4dcff8f213253603e608324272eeac8e5 passes this policy directly.

All 130 focused tests and all nine exact-head hosted contexts pass. Direct Sonar binds this exact head with base=target=main, gate OK and zero unresolved findings. An initial gate query used the wrong parameter and returned 400; the corrected projectKey query returned 200/OK. No failed query is called quality evidence.

This implements the required:true transition accepted in #351 after reviewed caller wiring. Security's separate finite review was requested; no independent Security response is claimed by this maintainer review. Normal source integration may proceed. Actual stable-tag caller execution, downstream profiles and terminal cleanup still require their separate qualification.

[rmcdaniel]

Security finite Source/main carry: PASS on reviewed source da3d969bf1be8ef21f6ae80da3e8db90c9dcc2bd and actual main 9eb596d00e2cc604d7f649e983b91aec3570f38a; both have tree 2c808dd849a790e99cac95d6ec33c8f43c2ad368.

The only enforcement change is Workflow's already-scoped release-verification.yml / published-package entry from required:false to required:true. Maintained Workflow main 2de438d4dcff8f213253603e608324272eeac8e5 contains that exact job and the reviewed closed sequence: immutable maintained-harness and product-tag separation, accepted PHP control source, caller-owned Composer state, authenticated dependency trust, bound setup-php-linux, immutable product-derived matrix, Packagist/platform checks, terminal PHP revalidation, and identity-checked cleanup. The shared verifier's source grammar, whole-target protections, request enumeration, and protected-pilot scope are unchanged; missing or ambiguous workflow/job/setup still refuse.

All nine source checks are terminal SUCCESS and the merge tree is byte-identical to the reviewed source. This closes only source presence/enumeration enforcement. It does not select or accept a stable-tag dispatch, installed package, Laravel matrix execution, release publication, or terminal operating receipt.

[rmcdaniel]

Scoped Composer enforcement is now integrated and qualified on maintained main 9eb596d00e2cc604d7f649e983b91aec3570f38a, exact reviewed tree 2c808dd849a790e99cac95d6ec33c8f43c2ad368 and ordered parents 1614bb9+da3d969b. All nine PR contexts and all seven actual-main checks are terminal SUCCESS. The exact-head direct Sonar review is gate OK / zero unresolved findings; all 130 focused tests and actual Workflow-directory validation pass.

Owned topic cleanup used the reviewed-head lease after main qualification. Fresh Git absence, REST404, local-topic absence and a clean detached assessment checkout are verified. Unrelated WIPs and product tags are unchanged.

Workflow's named published-package scope is required:true before actual caller selection. This completes Source enforcement only. The first actual stable-tag caller, its downstream job scope, package behavior and setup/private-pip/Composer terminal cleanup remain separately unselected and unaccepted. The protected pilot is unchanged and unenrolled.