[rmcdaniel]

Port namespace:list and namespace:describe through the published SDK 4.12 transport. Both commands preserve PHP resource context and output shapes, use the existing connection/auth/TLS compatibility path, and make one target request without retrying or following pagination. List supports JSON/JSONL and the namespace table; describe preserves the resource document and literal human-readable fields.

Namespace visibility uses the global namespace routes. It preserves Server-provided resource names without inserting the selected profile namespace. Encoded names, HTTP refusal data/exit codes, malformed or non-array responses, empty unnamed items, literal output and refusal before request on usage/TLS/compatibility failures have source controls. Redirects are refused without following or reporting a successful read; this is an explicit documented difference from the PHP reference's redirect handling.

Validation after a normal merge of accepted main 6261dd8: 162 Rust tests pass (two existing ignored), fmt/clippy pass, 13 parity-harness controls pass, and 65 PHP-source comparisons have 63 matches plus two documented redirect differences and zero unexpected differences. Secret-pattern/public-boundary scans and exact local container cleanup pass. Hosted checks and independent review are pending. Prepared create/update/delete work remains on its separate branch and is excluded from this diff.

Refs #72. This adds two source command ports to the 20 accepted ports; it does not qualify an installed archive, stable 2.5 release, live Server behavior, TLS opt-out support or the docs #457 adoption handoff. Product pins and release/publication gates are unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The original #115 source Build run 42056380169 attempt1, exact head31967780, failed its reproducibility prerequisite: job127345765024 received HTTP504 while scripts/build.sh fetched the existing Box4.6.6 URL from GitHub. The failure occurred before the first PHAR was built, so it is not evidence of differing PHAR bytes. Other PHP source, native Rust build/security checks pass; parity qualification was still finishing when the failure was investigated.

I verified the exact run is pull_request, .github/workflows/build.yml, head31967780, original attempt1 terminal failure, then requested one ordinary failed-source-job diagnostic repetition of that run. Existing bounds, version/URL/trust paths and checks remain unchanged; no downloader fallback, automatic retry machinery or source change is added. The original504 remains retained, and success will be reported only from the fresh actual attempt. General was informed directly of the infrastructure failure. No private PHP/SPC producer, tag/distribution/release/installed/promotion attempt is repeated or selected by this PR-source operation.

[rmcdaniel]

Security exact-source disposition: PASS for head 31967780df4a05a1357cc6b28a7c8b1109d52647, tree aa2e5be8432945c4c3b219c734ebc66dc98c02a5, base 6261dd856c4dd9cc63e8cb247aa5daa15ffded46, limited to the two read-only namespace visibility ports.

Reviewed boundaries:

• namespace:describe supplies the requested name as one RawRequest path segment, so slash/query/fragment/UTF-8 bytes are encoded inside that segment; empty, . and .. refuse before the target request;
• list and describe reuse the pinned SDK connection, bearer token, namespace header, control-plane/worker protocol headers, TLS refusal and compatibility preflight;
• each command makes one target request, does not retry or consume a cursor, and 301/302/303/307/308 responses refuse without following Location or reporting a successful read;
• HTTP errors preserve the existing bounded diagnostics and exit mapping; managed-runtime 403 retains the credential-class guidance;
• human output escapes control/markup-bearing remote values while machine output preserves the response bytes/data shape;
• the selected profile namespace is not inserted as a namespace-resource identity. List items retain their Server-provided resource context, and describe uses the requested name only as the published PHP fallback when the Server omits a usable name.

The exact source controls cover encoded names, one-call behavior, redirect refusal, auth/header propagation, compatibility/TLS/usage pre-request refusal, malformed/invalid JSON parity, literal output and error envelopes. git diff --check is clean, and current GitHub readback is terminal at 26/26 successful contexts with direct Sonar reporting zero new issues/hotspots.

Important non-carry boundary: Server-provided namespace names here are read-only presentation/context data retained for PHP parity; this source does not qualify those returned names as authority for future create/update/delete operations. Prepared mutation ports remain separate. No installed archive, live Server, TLS opt-out, stable 2.5 release, docs adoption, package or publication result follows.

[rmcdaniel]

Correction to the full-tree identity in #115 (comment): local Git and the GitHub Git-commit API both bind head 31967780df4a05a1357cc6b28a7c8b1109d52647 to tree 85cb77ee0cae60ad0d0af94abd8cd296d172fe00 (parent ebb591f3f580cecd40ed975ce430af8617f019ec). PR base remains 6261dd856c4dd9cc63e8cb247aa5daa15ffded46 and the reviewed base-to-head bytes/disposition are unchanged. The erroneous tree literal aa2e5be8… in the first line is not carried and must not be used as a reviewed identity.

[rmcdaniel]

Normal source integration and actual-main acceptance are complete under General's resumed owner flow. Merge eb2fce0 has the exact reviewed tree 85cb77ee0cae60ad0d0af94abd8cd296d172fe00 and ordered parents [6261dd856c4dd9cc63e8cb247aa5daa15ffded46, 31967780df4a05a1357cc6b28a7c8b1109d52647].

Before merging I verified current required checks, the clean exact base/head, and automatic followers. The eight Rust source/test/parity/documentation paths do not match PHP cache-warm's release-workflow path filter; tag/dispatch-only publishers have no source-merge follower. No publication/private producer was triggered. Actual-main Build42084021132, Sonar42084020919 and the public-boundary/native analysis complete with 16/16 successful exact-merge check runs, including target qualification and Rust parity.

The clean isolated worktree and exact merged local/remote branch were removed after proving ancestry; independent GitHub readback confirms the remote branch is absent. Accepted source coverage is now 22/86. Namespace create/update/delete remains separate prepared source, needing normal refresh onto this actual main and fresh checks. No installed/live Server/stable2.5/archive/TLS-opt-out/release/docs457 acceptance follows from this source result.