[rmcdaniel]

The reviewed setup helper now uses its held repository installer source, but ordinary consumer policy still rejects its commit. Catalog exact ed15002a156725523b23eefb935a243cb1f84952 under the existing bound-linux-php role, retaining the previous approved commit.

This single catalog row preserves the setup-php-linux-only path restriction, required profile/bootstrap and live Composer verifier, Workflow's named scope and SDK-PHP's whole-target enforcement. It changes no protected-pilot target or execution authority.

Validation: 72 policy tests pass. The unchanged predecessor catalog refuses the same Workflow three-pin candidate and exact SDK bc3a00a7404be429029cd44cee36931711afa74f; this row admits both. Causal controls still refuse another action path at the new commit and an untrusted Composer request in an additional SDK workflow. An initial synthetic negative lacked valid trigger syntax and was corrected to reach the intended Composer refusal; isolated unittest discovery could not import repository modules, while the normal repository test command passed.

This is source catalog qualification. Consumer source/trigger review, normal hosted checks, actual caller selection and terminal cleanup remain in their owning records. Refs #297 and accepted helper PR353.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

PASS — finite catalog Source review

Reviewed exact subject:

• head 8f48febb50bc2eb31650e62b8e56b7a43d807df2
• tree 29887a95d1e9fb32f081251474afea4fc4b3866e
• base ed15002a156725523b23eefb935a243cb1f84952

The complete production delta is the single policy row cataloging exact ed15002a156725523b23eefb935a243cb1f84952 under the existing bound-linux-php role. No policy algorithm, protected-pilot target, consumer workflow, or execution authority changes.

Independent causal checks on this exact head passed:

• tests.test_qualification_policy: 72/72 PASS.
• The accepted predecessor catalog refuses the exact Workflow held-installer three-pin candidate and exact SDK candidate bc3a00a7404be429029cd44cee36931711afa74f as not centrally approved.
• This candidate catalog admits both complete workflow inventories and enumerates the exact setup-php-linux@ed150… action.
• The same exact revision on bootstrap-patched-pip still refuses with the role's path restriction; the role does not widen to another central action.
• SDK whole-target Composer enforcement remains enabled and independently refuses an added unguarded composer install job. Workflow's required release-verification.yml / published-package scope is unchanged.

Exact-head hosted qualification is terminal: all nine reported checks are SUCCESS (repository/shared contracts, protected parser controls, native-policy validation, three CodeQL analyzers plus rollup, and Sonar analysis). GitHub still reports the exact head/base above; the PR remains draft and mergeable.

This is catalog Source acceptance only. It does not itself accept either consumer change, run the actual caller, or confer installed/effect/release acceptance. In particular, the SDK PR340 HOLD remains until this row reaches protected central main and the exact SDK consumer is revalidated against that accepted main identity; no local or draft catalog is sufficient for that carry.

[rmcdaniel]

Catalog Source/main/cleanup is complete. Normal merge edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f has exact reviewed tree 29887a95d1e9fb32f081251474afea4fc4b3866e and ordered parents ed150 + 8f48. All seven actual-main checks are terminal SUCCESS. All nine PR checks and independent Source review 6704203072 remain attributed.

Canonical validation at this accepted central main passes both complete Workflow main/maintenance candidate inventories and unchanged exact SDK bc3a00a7404be429029cd44cee36931711afa74f. The single row approves exact helper ed150 only under the existing setup-php-linux role. Causal predecessor, other-action-path and whole-target Composer refusals remain documented. No protected-pilot target or execution authority changes.

The exact expected-head topic was removed with a Git lease, fresh Git absence and REST404; the local topic is absent and the owned checkout is clean/detached at accepted main. Consumer pin changes may now receive their own normal Source qualification. Actual Workflow caller, SDK maintained-head effect, terminal cleanup, installed and release acceptance remain separate. No PHP setup or product request has been executed by this catalog change.

[rmcdaniel]

PASS — protected-main catalog carry

Protected main now resolves to merge commit edba47c8f9d3b9984731bc3fba4e1ab3299f1b9f, tree 29887a95d1e9fb32f081251474afea4fc4b3866e, with ordered parents accepted base ed15002a156725523b23eefb935a243cb1f84952 and reviewed candidate 8f48febb50bc2eb31650e62b8e56b7a43d807df2. The tree is byte-identical to the finite catalog review.

All actual-main workflows are terminal SUCCESS: repository/shared contracts, protected parser controls, Sonar, and the three CodeQL language analyzers plus rollup. The protected branch API and Git object API agree on the exact main/tree identity.

Using the policy bytes directly from this protected-main commit, I independently revalidated both pending consumer inventories:

• exact SDK candidate bc3a00a7404be429029cd44cee36931711afa74f passes and enumerates setup-php-linux@ed15002a… under whole-target Composer enforcement;
• the exact Workflow held-installer caller inventory passes and enumerates the same setup action under its required release-verification.yml / published-package scope.

This completes only the central catalog prerequisite. It does not accept either consumer commit, actual caller, installed profile, or effect. Each consumer still needs its own exact Source/trigger and normal hosted qualification before any actual-caller selection.