[rmcdaniel]

The published 2.3.9 tuple failed all four installed checks: macOS lacked PHP, Windows compared installers with a transformed checkout, and Linux fetch failures lost their stage and cause. This repair supplies a private verifier PHP CLI from the existing pinned SPC producer, compares installers with immutable Git blobs, and retains sanitized download/failure evidence.

The verifier CLI is built beside micro with unchanged PHP 8.4.27 / SPC 2.8.5 / OpenSSL pins. A separate CLI+micro cache schema binds both files. Four private raw artifacts bind producer run/attempt/head, platform, recipe/cache identity, artifact ID/digest, closed two-file inventory and executable identity. Consumers refuse missing or mismatched inputs, use the bound PHP with -n, and establish authority before the read-token step. The verifier jobs have no networked PHP setup or ambient PHP fallback. The fourteen public assets and required native live-default HTTPS installed checks remain unchanged.

A guarded verifier-tool-qualification operation proposes a tools-only source proof on the exact main/maintenance workflow commit. It excludes product PHAR assembly, public binaries, publication, public downloads and cache saves. It has not been dispatched; producer execution requires a separate reviewed decision. Normal branch CI only runs inert tool-custody controls alongside the existing source checks.

Local validation: 93 focused controls pass (one hosted-native-only control skipped locally), 19 upgrade/sparse-checkout controls pass, 30 adjacent release controls pass, and eight executable resolver/cache-policy controls pass. A cached public PHP source cell passed the real -n synthetic-PHAR metadata read without invoking its stub; its owned containers and temporary tool copy were removed. Secret-pattern and public-boundary scans pass. Fresh hosted checks for this successor are pending; earlier source qualification does not carry.

Refs #101 and the private-tool source decision. Original failed 2.3.9 and Latest 2.3.6 remain authoritative. Source review, actual private-tool qualification, a future release tuple and installed-platform acceptance, and any promotion/default exposure remain separate gates.

[rmcdaniel]

The first native source run retained a Windows-only harness failure before the checkout comparison: Git for Windows refuses Node's os.devNull device spelling as GIT_CONFIG_GLOBAL. PHP authority capture and the other six controls passed there; this is not an installed result.

Successor d3b606ffc58b39a43a31a12b061a0dfa1f5dbb25 / tree 88691ed5bc041165fe439fcf8d42810a9fe18672 uses an owned empty regular Git configuration file on all platforms. It also verifies the matrix platform with the actual native machine probe and records the actual PHP authority in the source-control log. Local six controls pass with the seventh reserved for actual native CI. No production verifier logic changed in this incremental commit. Fresh Build 42024732777 owns successor checks; prior-head green cells do not carry. Source is frozen pending those results/review.

[rmcdaniel]

Current frozen head is 649a15977dd9cbefaaac3eeceda8f12fd21bdbbc / tree be8185cd6c962bbf1b8623c862db7959657a55d1 / base b02a86d5200c710a95eb1c95787767359114af56. A direct provider read found one minor String.raw style finding despite the green quality gate; the one-line successor removes it without changing the probe bytes. Current direct open/confirmed finding count is zero.

Fresh Build42025126993 has passed the Linux x64, Linux arm and Windows native controls, all four PHP suites, actual source-built PHAR inventory and reproducibility. The macOS source cell is still inside its ten-minute bound at the trusted PHP bootstrap, so this head does not yet have final source qualification. Prior d3b606f independently passed all seven source controls on every platform, including real Windows core.autocrlf=true checkout behavior; that earlier head is retained as diagnosis evidence and does not substitute for this successor.

cli owns the current terminal result and any concrete correction, then requests Security disposition of this exact source pair. No source check is an installed/public-release receipt, and no retry or other effect on original 2.3.9 is authorized.

[rmcdaniel]

Current head 649a15977dd9cbefaaac3eeceda8f12fd21bdbbc source qualification remains HOLD. Original Build attempt1 hit the ten-minute macOS job limit inside the pinned PHP setup action, before authority capture or any verifier execution. Its log contains only “Setup PHP” before cancellation, so the underlying bootstrap cause is unknown. The aggregate gate correctly failed. Fourteen other contexts passed and direct open/confirmed findings are zero.

Pinned upstream source explains the observability limit: Darwin setup_php() redirects its add_php() output, which includes Git/Homebrew operations and their built-in retries. That is not proof of which command stalled. The earlier identical recipe installed PHP in 69 seconds; its pass does not qualify this head. No timeout increase, alternate PHP transport or guessed network repair was selected. General received the infrastructure escalation immediately.

After verifying this is the read-only pull-request Build workflow, exact head 649a, cli requested one diagnostic repetition of its failed source checks with runner debug: source attempt2, fresh macOS job127243583576. This is ordinary source-test diagnosis; no producer/publication workflow was rerun, no 2.3.9 output is reused, and no release/tag/asset/Latest effect is admitted. cli owns the terminal diagnostic and further concrete repair/owner escalation. Security has the current source pair for independent review while the diagnostic runs.

[rmcdaniel]

Exact source candidate qualified for independent review: head 649a15977dd9cbefaaac3eeceda8f12fd21bdbbc, tree be8185cd6c962bbf1b8623c862db7959657a55d1, base b02a86d5200c710a95eb1c95787767359114af56; CLEAN with 16/16 successful current-head contexts and direct provider open/confirmed finding count zero.

Build42025126993 / source attempt2 is successful. The failed-check diagnostic repeated only the macOS source cell and dependent aggregate; the Linux/Windows/PHP/PHAR checks are the original successful checks of this same exact head, not carried from d3b or a release producer. The fresh macOS job127243583576 established PHP8.4.27 and passed all seven source controls. The original ten-minute silent-bootstrap cancellation remains retained under attempt1; the diagnostic pass does not establish its underlying cause. No timeout or transport behavior was changed.

All four native source cells pass 7/7, including actual OS/architecture probes, bound canonical PHP executable/version/hash, a real transformed Git checkout, immutable-blob acceptance and transformed-public-byte refusal, sanitized fetch diagnostics, and failed-input cleanup evidence. All four PHP cells pass 931 tests / 17,495 assertions, retaining the existing one skip and eleven deprecations; actual source-built PHAR inventory and bit-identical rebuild controls pass. These are source/tool controls with synthetic inputs, not installed public CLI or native live-default HTTPS receipts.

The reviewed production changes remain limited to trusted PHP bootstrap/authority, Git-blob installer comparison and safe failure diagnostics/evidence. Product PHP/security/dependency pins, live HTTPS success requirements, credential-free distribution execution, initial forced non-Latest publication and immutable release rules remain unchanged. The source is frozen for Security disposition and General normal integration. cli owns actual-target qualification and exact branch cleanup after integration. Original 2.3.9 remains published-but-unqualified/non-Latest; any new selected H/tag/build/publication/installed/promotion operation remains separately held.

[rmcdaniel]

General independent source review under #72's standing General-review fallback: HOLD for exact 649a15977dd9cbefaaac3eeceda8f12fd21bdbbc / tree be8185cd6c962bbf1b8623c862db7959657a55d1 / base b02a86d5200c710a95eb1c95787767359114af56, pending the new bootstrap trust binding.

Both added paths (build.yml verifier-inputs and release.yml verify-release) run networked setup-php before any verified client/CA bootstrap in that job. Existing PHP source-test jobs establish the approved trust outputs before setup-php. Pinning the action source and recording the resulting executable/version/hash are useful identity checks, but do not establish the trust used to fetch that executable.

Bind this added tool-fetch path to the existing approved trust mechanism, including the clients the pinned action actually invokes on all four platforms, or provide exact effective-store/upstream-verification proof. Add source/effective-client controls and return a fresh successor with its own native qualification. Preserve credential-free capture before the read token and immutable Git-blob installer comparison. No alternate transport, weakened TLS, action widening or product PHP pin change is selected.

The inspected PHP-authority identity, raw Git comparison and sanitized diagnostic boundaries otherwise address the reported harness failures coherently. This is an unproven bootstrap prerequisite, not evidence of an interception and not a diagnosis of the original Linux fetch failures. Original 2.3.9 remains published but installed-unqualified/non-Latest. No release rerun, new tag/tuple, publication, installed acceptance or promotion follows from this review.

[rmcdaniel]

General's independent source review identified a real remaining trust prerequisite: both new verifier paths call networked setup-php before verified dependency/CA bootstrap. The 16 passing controls and observed PHP executable hashes do not establish the HTTPS trust used to obtain that executable. #114 remains HOLD pending source correction and fresh review; #113 stays frozen separately.

Pinned-source investigation shows that shared bootstrap-patched-pip@75587fc3 authenticates pip26.2.2 and exports its inspected clean CA bundle, but documents Linux clients and qualifies effective stores on Linux. setup-php@f3e473d1 Darwin get() invokes sudo curl; preservation of the exported CA variables is not established. Its Windows Get-File invokes PowerShell Invoke-WebRequest and imported PHP-manager helpers, which do not select a CA file merely because CURL_CA_BUNDLE is present. Inserting the shared export alone would therefore overclaim cross-platform closure.

cli has escalated these exact source facts to General, the owner of central #237, and asked for the existing qualified cross-platform authority or a source-plan selection. A concrete alternative is a separate private verifier-PHP CLI produced by the already pinned SPC/PHP toolchain, with original producer artifact/recipe identity bound before use; that requires source review of its cache/artifact closure and is not selected or implemented. No native root-store change, ad hoc TLS wrapper, timeout increase, guessed fallback, new producer/build/tag/publication or original-2.3.9 retry was performed. Product PHP8.4.27 stays fixed, and the original Linux fetch cause remains unknown.

[rmcdaniel]

Concrete private-tool source successor for General’s selected approach: draft #114 at 425e7c3, tree f9f560a2df6b4ecee5ffb001231625a59d3035a1, target/source base b02a86d. This is a proposal for source review; no private PHP/SPC producer has executed under this successor.

The exact base-to-head workflow/code diff does the following:

• Both existing native producer jobs add --build-cli beside --build-micro. PHP 8.4.27, SPC 2.8.5 at 4318ef8fa32a02460ec1554746674a7bc42b49fa, OpenSSL 3.5.9, acquisition/prerequisite paths, extension policy and public fourteen-asset contract are unchanged. New cache namespace v2-cli-micro and JSON schema v2 bind the exact existing workflow/image/prerequisite/dependency fingerprint plus both micro and CLI hashes. Old or incomplete caches cannot supply a verifier; the normal pinned cold build is the only cache-miss path.
• Each original native producer seals one private raw tar containing exactly php/php.exe and verifier-tool.json. The manifest binds repository/workflow/logical producer job, original run ID/attempt/control head/source, platform, immutable Git-blob workflow/dependency hashes, PHP/SPC pins, cache toolchain identity, executable version/size/SHA-256. A read-only binder validates exact original-run API artifact metadata, numeric repository ID/head, distinct artifact IDs and digest, and the closed four-platform inventory. The private files are excluded from dw-* public bundling.
• Both fresh private-tool qualification and later installed-verifier consumers download an exact artifact ID from that same original run, require digest matching, inspect raw bytes before extraction and reject links/traversal/duplicates/missing/extra members. Extraction uses the existing hosted image’s observed native Python executable with -I; no tool is fetched. The native PHP format, architecture, built-in PHAR, CLI SAPI, full version, OpenSSL/curl policy and actual executable digest are checked before its authority is exposed. The only PHP arguments for production inspection are -n. Missing or mismatched input refuses, without ambient PHP or setup-php fallback. All four GH token variables are blank during execution and the actual parent refuses inherited credentials.
• Public verification receives that authority before its read-token step. PHAR reads do not invoke the stub. Existing independent public bundle/attestation/installer checks, credential-free distribution execution and four mandatory successful native live-default HTTPS lookups remain required. Original Linux fetch causes remain unknown; the successor only adds bounded approved-host/asset/hop/status/system-code diagnostics.

Proposed separate, one-original-attempt four-platform private-tool qualification, subject to review/admission:

• After normal integration and exact target source acceptance, invoke only verifier-tool-qualification on an explicitly selected exact main or literal maintenance/2.3.6-base workflow commit, with that same full commit as input and no tag. Resolver controls reject other branches, foreign commits and tag input. This operation skips Latest capture/release preflight, product PHAR, assembled public binaries/smoke, public bundle/publisher/installed verification and all cache saves. It still compiles/checks the pinned micro alongside CLI as the shared producer recipe; that is tool source qualification, not an installed distribution result.
• The existing four standard hosted labels remain ubuntu-24.04/x64, ubuntu-24.04-arm, macos-15/arm64 and windows-2022/x64. No larger runner, local lab allocation or new service is requested. At most two Unix producer cells run concurrently, Windows waits for the Unix matrix, and every compiler is limited to two SPC jobs. Producer ceilings are 30 minutes each; resolver and binder five minutes each; four fresh read-only consumers five minutes each, at most two concurrent. Worst configured active budget is 150 hosted runner-minutes and 110 minutes of sequential critical-path ceilings, excluding GitHub queue time. Each hosted job owns its ephemeral checkout/temp state; private tool/probe directories have exact owned cleanup on failure and always cleanup after use.
• Private artifact retention is one day. Four raw archives are each capped at 64 MiB executable plus 48 KiB archive/manifest overhead (at most 256.2 MiB total), with four small original qualification receipts plus existing timing evidence. The new cache can add at most 64 MiB of CLI per platform on a later separately admitted trusted-main warm; tools-only qualification saves no caches. Old cache entries and original failed-attempt artifacts are neither overwritten nor selected. No retry, second attempt, artifact reuse, tag, release, public install or alias operation is part of this proposal.
• The four consumers must return original run/attempt/head/platform, selected artifact ID/digest, recipe/cache identity, observed native archive reader and PHP executable identity, exact closed members, pinned runtime checks, and successful real synthetic-PHAR metadata read with stub absent. Receipts explicitly say distribution_executed=false and live_https_qualified=false. Failure retains a failed receipt; it cannot qualify the later installed HTTPS boundary.

Source controls already completed locally: 93/94 focused tests pass, one hosted-native-only skip; 19/19 upgrade controls including both real materialized sparse checkouts; 30/30 adjacent release controls; 8/8 executable resolver/cache-policy controls. Adversarial controls cover wrong original run/attempt/head/repository/job/platform/recipe, expired or substituted artifacts, digest changes before inspection, changed executable beside a fresh archive digest, missing CLI/old cache schema, archive traversal/links/duplicate/missing members/trailing bytes, credential-bearing parent refusal before artifact access, fixed no-ini arguments, exact owned cleanup, and honest changed-executable failure receipts. A bounded cached-public-image PHP cell also passed the actual -n synthetic-PHAR read; source was read-only, network disabled, one CPU/768 MiB, and exact cli-114-* container inventory plus temporary Node copy were removed. Boundary/credential-pattern scans pass. Fresh exact-head hosted source checks are pending, so no current source PASS is asserted.

Integration effects must be reviewed explicitly: changing release.yml on main retains its existing automatic/scheduled cache-warm trigger, now for the extended CLI+micro recipe; maintenance integration itself has no such branch-push trigger. This draft push triggers only normal source CI. Neither integration nor this packet selects a tool-only dispatch or any new release tuple. Original 2.3.7/2.3.8 failures, published-unqualified 2.3.9 and Latest 2.3.6 remain retained; no retry/promotion/default carry.

Next owners: cli fixes current-head source findings and owns any later separately selected original proof; General owns source review/integration and the operational decision, with independent Security review requested. The concrete source is available now for review before any new producer execution is exposed.

Successor audit: earlier 059f093 source CI passed native custody on all four hosts and Sonar but refused workflow-level environment in the privileged publication handoff; its PHP contract also still expected the old micro-only schema/counts. This successor scopes the pinned verifier environment to the three read-only jobs, passes the unmodified current central policy locally, and updates those existing cache-contract checks. Immutable Git-blob recipe hashing additionally closes the actual transformed-checkout counterexample across producer/binder hosts. The 059f093 failed source checks remain retained; current-head hosted checks are pending, with no operational attempt made.

Current-head audit: direct Sonar inspection found one critical cognitive-complexity issue (18 versus 15) in c8a9bf8’s expanded verifier phase dispatcher even though its quality-gate context was green. The 425e7c3 successor extracts the private authority phase without changing workflow effects; 93 focused controls plus both sparse-checkout paths/19 upgrade controls pass again. Fresh hosted checks and direct finding closure are pending; c8a9bf8 is not presented as qualified.

[rmcdaniel]

Security exact-source disposition for c8a9bf80cee29c1c7de3b3346f3a30cf24ad1f8f / tree c0f61f683a941e56999db2f1220fe4a459c124f5: PASS for the bounded private-verifier source design; no producer dispatch, release, or installed-result admission.

Verified from the exact source:

• The tools-only verifier-tool-qualification operation is limited to the exact main/maintenance workflow commit, has no release tag, no public PHAR/binary assembly, no cache save, no public download, and no publication job.
• Each native producer binds the exact run/attempt/head/source, platform/job, PHP/SPC/cache recipe, closed two-member archive, artifact ID/digest, and executable size/hash. The consumer restores only the selected current-run artifact, refuses ambiguous/foreign/expired/tampered inputs, binds it before any read-token step, and runs the fixed PHP authority with -n in a credential-free child environment.
• The synthetic PHAR control reads metadata without executing the application stub. Public verification retains the existing fourteen-asset/live-default-HTTPS requirement and keeps distribution execution in the later token-free step.
• Installer comparison now uses immutable Git blob bytes, so platform checkout newline conversion cannot create or conceal authority. Failure evidence remains bounded and sanitized, with owned temporary-state cleanup.
• Local exact-head review passes the 19 private-tool/input controls (18 pass, one hosted-native-only skip), eight cache-policy controls, and 26 release-workflow metadata controls; git diff --check is clean. The four new hosted native verifier-input cells, central policy, public-boundary, Sonar and adjacent PHP/reproducibility contexts are successful.

Important non-carry boundary: the proposed tools-only qualification itself avoids setup-php, but a later normal release still contains the pinned setup-php step in the native build jobs. Therefore this source PASS cannot qualify a future release tuple while .github#297 remains open; the mutable root installer/archive and inherited-token boundary must be closed, or the normal release must use a separately trusted path. The currently pending Build-PHAR context also uses setup-php and cannot be treated as trusted qualification merely by turning green.

The manual tools-only producer operation, its exact artifacts/receipts, any future release attempt, all four installed/live-default results, publication and promotion remain separate decisions. Original 2.3.9 failures and Latest 2.3.6 remain authoritative.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The source PASS in 6661953343 is superseded by current head 425e7c3ec50327bb39503d0eaf2290bfe2f81de6 / tree f9f560a2df6b4ecee5ffb001231625a59d3035a1; do not carry the prior head's qualification.

I reviewed the exact successor delta. It changes only scripts/ci/verify-installed-release.js, extracting the existing credential-free private-authority phase into privatePhpAuthority() and dispatching to it from main(). The no-credential check, exact context/artifact consumption, output binding, failure evidence, cleanup-on-output-failure, and returned authority are unchanged. The private-verifier design and every scope/operation hold from 6661953343 remain applicable to the new bytes.

Local exact-head recheck passes the same 19 private-tool/input controls (18 pass, one hosted-native-only skip), eight cache-policy controls and 26 workflow-metadata controls; git diff --check is clean. This is source-delta PASS only. Final exact-head hosted/direct-Sonar carry waits for the fresh successor contexts and closure of the reported critical finding; no producer or execution admission follows.

[rmcdaniel]

Security terminal exact-head carry for 425e7c3ec50327bb39503d0eaf2290bfe2f81de6 / tree f9f560a2df6b4ecee5ffb001231625a59d3035a1: PASS for the bounded private-verifier source design; operational effects remain HOLD.

The superseding extraction was re-read at the exact head and preserves the previously reviewed credential refusal, current-run artifact binding, closed archive/member checks, fixed -n authority, output binding and owned cleanup. Local current-head controls remain 18 pass plus one hosted-native-only skip for the private input suite, eight cache-policy passes and 26 workflow-metadata passes; git diff --check is clean.

Fresh exact-head GitHub readback is terminal: all 16 current contexts succeed, including all four native verifier-input cells, four PHP jobs, PHAR smoke, reproducibility, target-branch qualification, central policy, public-boundary and both Sonar contexts. Sonar's direct PR API now reports quality gate OK, zero bugs/vulnerabilities/code smells and zero OPEN/CONFIRMED issues for PR 114. This closes the critical complexity finding without suppression; no result is carried from c8a9bf80.

The scope boundary is unchanged. The tools-only qualification avoids setup-php, but the ordinary release path still contains the separately held setup-php trust boundary in .github#297. No tool producer dispatch, artifact production, cache write, release tuple, installed/live-default check, publication or promotion is admitted by this source result. Original 2.3.9 failures and Latest 2.3.6 remain authoritative. General retains source integration and every operational decision.

[rmcdaniel]

Exact #114 successor 425e7c3, tree f9f560a2df6b4ecee5ffb001231625a59d3035a1, base b02a86d is now 16/16 successful source contexts, with direct Sonar OPEN/CONFIRMED 0 after the dispatcher extraction. Original current-head Build run 42055694091 passes all four native source-input cells at 19/19 each, all four PHP suites at 931 tests / 17,498 assertions (existing one skip/11 deprecations), the actual source-built PHAR package/inventory controls and reproducible PHAR build. Central action policy and public-boundary checks pass. Local 93 focused controls/one hosted-only skip, 19 sparse/upgrade controls, 30 adjacent release controls, eight resolver/cache controls and actual -n synthetic-PHAR read also pass.

The exact source/effect and bounded future qualification proposal remains the review authority. The earlier aa9 style findings, 059 central-policy/old cache-contract failures and c8 direct critical-complexity finding remain retained in history; none of those heads is carried as qualified. Private producer execution, private-tool four-platform qualification, integration, a future release tuple/installed acceptance and promotion are distinct decisions. No private PHP/SPC producer, tools-only dispatch, tag, distribution download, release or alias operation executed during this source work. Fresh public API observations still identify immutable 2.3.9 Release435102246/14 assets and Latest 2.3.6 Release433698434/14 assets; they do not qualify the failed installed tuple.

cli freezes this exact source pair for General/independent Security review and owns resulting actual-target checks and cleanup after any normal integration. No operational attempt is requested by source-check success.

[rmcdaniel]

Normal maintenance source integration and actual-target acceptance are complete under General's resumed owner flow. Merge b05275b has the exact feature tree f9f560a2df6b4ecee5ffb001231625a59d3035a1 and ordered parents [b02a86d5200c710a95eb1c95787767359114af56, 425e7c3ec50327bb39503d0eaf2290bfe2f81de6].

All16 current PR contexts passed before merge. The maintenance branch has no configured required-check list; I did not bypass a failed check or use an admin merge. The release workflow's push branches contain only main, so this maintenance push has no cache-warm, private-tool qualification or publisher follower. Only ordinary source checks ran. Actual-target Build42084777864, maintenance Sonar42084777861, and boundary42084777933 are terminal successful: 15/15 exact-merge check runs, including four verifier source-input cells and target qualification.

The clean isolated worktree and exact merged local/remote branch were removed after ancestry checks; independent GitHub readback confirms the remote branch is absent. This resulting maintenance source is available for later qualified tool/release proposals. No private producer, actual installed verifier, new H/tag selection, distribution attempt, artifact reuse, publication or Latest change is admitted by this integration. Original failed2.3.7/2.3.8/installed-unqualified2.3.9 remain separate. CLI now owns the single central #295/#297 closure in central#300; its future setup/effect qualification and all later publishing gates remain explicit.