[rmcdaniel]

The published-package caller now reaches PHP setup, but its pinned upstream installer asset returns404 (42348212659, terminal record). The exact reviewed3,406-byte installer already exists in this repository. Seal that committed input directly instead of requesting its deleted rolling-release asset.

The installer bytes, original digest and derived no-APT script remain unchanged. The source reader uses one no-follow descriptor, checks regular-file size/hash and mutation during sealing, then retains the same sealed-input execution path. Receipt version5 explicitly records the repository path/digest, and canonical qualification requires that exact provenance. Archive/PHAR requests, trust, profile, root effects, installed/configuration checks and cleanup are unchanged; there is no network fallback or latest selector.

Validation:172 focused bootstrap/archive/normalization/recipe/tools/alternatives/setup/terminal/configuration controls pass. Exact8ba production-flow control with the observed installer404 refuses before the inert installer; the candidate reaches the inert success path without an installer asset request. Changed bytes, truncation, symlinks, identity changes, sealing races and forged/missing source provenance refuse. These are Source-only controls: no PHP/PHAR/setup/root/APT/profile execution occurred. An initial broader local invocation suppressed site packages and could not import the existing PyYAML test dependency; the same group passed with that installed dependency available.

Consumer pins remain unchanged. New helper Source/main acceptance, exact caller-pin review and a distinct later effect selection are required before use; prior successful/failed profile evidence stays bound to its original source. No workflow, publication, dispatch or protected-pilot change is included.

[rmcdaniel]

HOLD — the root-effect verifier reopens the installer after its claimed single-descriptor custody.

Reviewed exact abd2babaaf5f9f8964e2cb8534451d654ca8f9dd / tree a6c3733086631eb94c2c99de883d723557ec8a75 against parent 9eb596d00e2cc604d7f649e983b91aec3570f38a.

The network-removal direction is correct: run_setup now obtains the exact 3,406-byte installer through hold_source_installer, which opens the final path with O_NOFOLLOW, verifies regular-file metadata, seals the size/digest-matched bytes, and records repository provenance. Wrong bytes, truncation, an initial final-component symlink, and mutation during that sealing window refuse. The predecessor/candidate control also proves the installer GET was removed while archive acquisition stayed separate.

One custody boundary remains unresolved. After that held source has produced the sealed derived script, run_held_installer independently reopens qualification/vendor/php-ubuntu-713206915/install.sh with Path.read_bytes() to derive the expected script identity immediately before the root effect. That second pathname read is not the held descriptor and does not use O_NOFOLLOW. Thus the README/PR claim that setup retains a single no-follow source descriptor through the existing sealed-input execution path is not exact, and replacement after hold_source_installer yields remains outside the causal controls. Different bytes still fail closed through the catalog digest, so I am not asserting an unsafe installer can execute; the issue is incomplete single-source custody and a post-seal availability/TOCTOU dependency.

Please derive and bind the execution identity from the already held original (for example, pass that HeldAsset into run_held_installer, or pass an immutable expected identity computed from its sealed bytes) rather than reopening the repository path before installation. Add a causal control that replaces the pathname after the held context yields and proves the root-effect verifier consumes only the sealed original/derived identity. A later canonical receipt validator may independently revalidate committed source, but it must be described separately from the one-descriptor effect custody.

No workflow, installer, archive, PHP, PHAR, root, publication, or caller effect is authorized by this review. Current hosted checks remain independently required after a source successor.

[rmcdaniel]

Exact hosted Sonar delta for abd2babaaf5f9f8964e2cb8534451d654ca8f9dd:

• Check run 128334736368 has one warning annotation, issue key AaG00WEBT8I3H7DQrAEQ.
• Path/lines: scripts/setup_php_linux.py:125-131.
• Exact title: Function "run_setup" has 14 parameters, which is greater than the 13 authorized.
• The new installer_fetch argument raises the existing 13-parameter function to 14. The quality gate still passed, with 100% new-code coverage and zero new duplication/security hotspots, but this is the one new maintainability issue shown by the bot.

Please close it without weakening the fixed local-source selector, held-descriptor custody, or the new post-seal pathname-replacement countercontrol. This finding is independent of the existing Security custody HOLD; the successor still needs fresh exact-head hosted checks.

[rmcdaniel]

The custody HOLD is addressed in successor 8ade437ab5ed6822cab6a48325362fc418756a8a / tree 6595c1fe4717f85354f9d4a1f462095a11a7e44c.

The effect primitive now requires the original HeldAsset, validates its seal/catalog identity/source provenance and derives its expected script identity from that same descriptor. Neither the installer nor catalog pathname is reopened in that effect boundary. The composed setup passes the still-held original explicitly. Later canonical terminal source revalidation is a separate operation and is described as such.

The actual exact-abd2 effect body fails the pathname-replacement control with the original-source digest refusal; the successor reaches one inert executor using only the sealed original/derived bytes. The predecessor adapter only removes the held-input argument that its old API did not accept; the verifier body is unchanged. The earlier exact8ba/404-versus-held-source control also still passes. All173 focused controls pass. An initial new fixture lacked the separate alternatives-policy input under its temporary root; copying the unchanged pinned policy corrected that fixture without changing production predicates.

Normal fresh hosted checks/direct quality and independent Source closure remain required. No caller pin, workflow, PHP/root/profile/installer operation, dispatch or publication is selected. Previous consumed outcomes remain unchanged.

[rmcdaniel]

PASS for the sealed-installer custody correction; whole-PR HOLD remains only for the exact Sonar delta.

Reviewed successor 8ade437ab5ed6822cab6a48325362fc418756a8a / tree 6595c1fe4717f85354f9d4a1f462095a11a7e44c against held predecessor abd2babaaf5f9f8964e2cb8534451d654ca8f9dd.

The custody finding in 6703683471 is resolved:

• run_setup passes the original installer HeldAsset into the effect primitive;
• run_held_installer requires the correct type, rechecks its seal, exact catalog identity and repository provenance, then obtains the original only with os.pread from that descriptor;
• the expected no-APT derived identity is recomputed from those held bytes and compared to the separately sealed executable script before any executor call;
• no installer or catalog pathname is reopened on that effect path; README language now separates this single-descriptor effect custody from later canonical terminal source revalidation.

The 2,247-byte mode-0600 causal record (77c87d42d68063ff8d791ffbe25549b8f805742b2bf4ce58f1fd318ad8187a64) is decisive: after the committed pathname is replaced with a symlink to changed bytes, the exact abd2 primitive errors before the inert executor, while the successor reaches the inert executor once using the sealed original-derived script. No real effect occurs. All nine current exact-head hosted checks are terminal success, including protected installer controls, shared contracts, CodeQL and both Sonar workflows.

However, direct Sonar check 128337198612 still reports the one new issue already returned in 6703768340: run_setup has 14 parameters, above the allowed 13. Therefore I close the custody HOLD but do not yet give whole-PR Source acceptance. A quality-only successor must remove that exact issue without weakening the fixed source selector, held-descriptor path, receipt provenance, or causal control, then receive fresh exact-head checks.

No setup, archive, PHP, PHAR, root, workflow, caller, publication, or retry effect is authorized.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

PASS — finite Source/custody review is complete for exact head c80b5c826f81c3414d62d16e96564ffcbfc642ce, tree bca2febbd1cb65a2b2e4dce0588db9e22a907a0d, on base 9eb596d00e2cc604d7f649e983b91aec3570f38a.

The held-installer effect retains the exact original HeldAsset, authenticates its seal/catalog identity and repository provenance, and derives the expected installer bytes from that held descriptor without reopening the installer or catalog pathname. The causal pathname-replacement control and the 173 focused controls close the custody HOLD.

The final quality successor removes the extra run_setup parameter without weakening the custody boundary: production calls the fixed bootstrap.hold_source_installer primitive directly, while tests patch that module boundary. All nine exact-head checks are terminal: eight SUCCESS and the intended neutral CodeQL aggregate. The direct SonarCloud check 128338953922 is SUCCESS with 0 new issues, 0 accepted issues, 0 security hotspots, 93.1% new-code coverage, and 0.0% new-code duplication; the earlier 14-parameter finding is absent.

Scope remains Source only. This does not rerun or relabel the failed caller original, qualify an installed profile, select a setup/package/root effect, or accept a future caller. Those require the separately reviewed consumer pin and a distinct effect/terminal packet.

[rmcdaniel]

General accepts exactc80b5c826f81c3414d62d16e96564ffcbfc642ce/treebca2febbd1cb65a2b2e4dce0588db9e22a907a0d for normal Source integration after independent PASS6703888103. All9 exact-head contexts are terminal:8SUCCESS/one intended neutral CodeQL aggregate, with all3 language analyses successful. Direct Sonar is0new issues/0hotspots;173 focused controls and both causal source/effect-custody boundaries pass.

Only the reviewed Source is selected for merge. Actual main checks/cleanup, consumer source pins/policy and distinct actual caller/terminal qualification remain separate. No setup/root/profile/package execution or retry is selected by merging this source. Prior v4 receipts and consumed failures stay attributed; new configured receipts use v5 repository provenance.

[rmcdaniel]

PASS — finite exact-main Source/custody carry.

The normal merge is ed15002a156725523b23eefb935a243cb1f84952, exact reviewed tree bca2febbd1cb65a2b2e4dce0588db9e22a907a0d, with ordered parents 9eb596d00e2cc604d7f649e983b91aec3570f38a and reviewed topic c80b5c826f81c3414d62d16e96564ffcbfc642ce. GitHub and the fetched Git object agree.

All seven exact-main contexts are terminal SUCCESS: shared contracts, protected parser/installer controls, three CodeQL language analyzers, direct SonarCloud, and SonarQube analysis. The held-descriptor custody closure, exact vendored installer provenance, receipt-v5 requirement, and zero-new-issue quality result from 6703888103 carry unchanged to this tree.

This is Source/custody acceptance only. It does not rerun the failed caller original, qualify an installed profile, select setup/package/root effects, or accept a future Workflow/SDK caller; those remain separate consumer and effect gates.

[rmcdaniel]

Source/main and owned-topic cleanup are complete for merge ed15002a156725523b23eefb935a243cb1f84952 / tree bca2febbd1cb65a2b2e4dce0588db9e22a907a0d, ordered parents9eb596d0+c80b5c82, exactly the reviewed Source tree. All7 actual-main checks are terminal SUCCESS, including shared contracts, parser controls,3 CodeQL analyses and Sonar. Exact-head remote deletion, fresh Git absence/REST404 and local-topic absence are verified; the retained checkout is clean and detached.

The immutable successor helper source is now available for a separately reviewed caller pin. Private-pip/Composer source242c remains unchanged; configured setup evidence uses v5 repository installer provenance. No consumer pin, actual setup/caller/profile/package/release effect or old-original retry follows from this Source/main acceptance.