[rmcdaniel]

Central policy main now rejects unchanged CLI and Rust SDK workflows with a Composer helper-directory error. Revert the complete #240 merge to restore the supported preflight used by those callers. The resulting tree is exactly 23f9bc3c3798cb6aab6ccf5f9cd210854b820c65 (tree 9de2bb025246652ad24f67126911b821ab86c07d), preserving the accepted revision-2 metrics contract and every earlier change.

The protected-App pilot is withdrawn from main. Its source remains recoverable at e97b0285af33feacb488c91bf1c6b981b06eb300; App, environment, credential and activation work remain held. The uncommitted classifier experiment is excluded. Refs #237 and the rollback disposition on #240.

Validation: exact parent-1 tree equality and added-line credential/private-path boundary pass. All 69 existing qualification/Composer tests pass. Exact unchanged CLI 3e2d3b283ec99473c87af50e7442bac17ee8cc26 (7 workflows) and Rust SDK cdc7a94c1b3438e3b5b6be231955874128b0b907 (5 workflows) both reproduce the directory refusal under deployed 5445aac3 and pass the full local preflight under this revert. These controls use immutable Git archives and the reviewed hash-locked parser offline. Initial local runner setup/inventory errors are excluded from those passes.

Fresh normal central CI and post-merge unchanged caller runs remain required. The current-main protected-App workflow refuses because the App identity is absent, before token creation or check issuance; this expected refusal is separate from rollback-source qualification. Caller workflows and product source are unchanged by this PR.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
94.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security rollback review — exact cf8664d72b66e74dfe8af2dbd52f2a5b101d9477

PASS for the exact rollback source and normal merge. This is recovery from the live #240 central-validator regression, not approval of the protected-App design or activation.

• Exact head tree is 9de2bb025246652ad24f67126911b821ab86c07d. It is byte-for-byte identical to accepted pre-Require isolated hash-locked policy parser installation #240 parent 23f9bc3c3798cb6aab6ccf5f9cd210854b820c65; git diff 23f9bc3c..cf8664d7 is empty. The sole parent is deployed regression 5445aac39547e47def63d1f9a88b53cbc12d1b28.
• GitHub reports the PR draft, cleanly mergeable, and unchanged at that exact head. The current potential merge 8d17bff7392ef0f722e798679d30cad0c8d1ea30 has ordered parents 5445aac3 + cf8664d7 and the same accepted tree 9de2bb02.
• Every normal exact-head gate is terminal success: Shared contract tests, all three CodeQL analyses plus aggregate, SonarQube and SonarCloud. There are no pending normal checks.
• The sole failure is the current-main Protected workflow policy negative control, run 41839769618. It checked out the immutable base and stopped at the empty POLICY_GATE_APP_ID; App-token creation and check issuance were both skipped. No protected write occurred. The rollback deletes this workflow.
• General reports 69 retained qualification/Composer controls and complete unchanged CLI 3e2d3b2 / Rust cdc7a94 workflow preflights pass on the rollback tree, while exact deployed 5445aac3 reproduces the refusals. The abandoned classifier is absent from this commit.
• No App, key, variable, secret, Environment, Actions event policy, ruleset or live setting changed. The recoverable Require isolated hash-locked policy parser installation #240 source stays on its branch for a separately supported design.

General may mark this exact head ready and perform the normal merge with immediate remote parent/tree/main readback. After merge, require one fresh unchanged CLI and Rust hosted preflight/aggregate readback against restored central main before declaring fleet recovery complete. Any Server #1027 preflight refresh remains draft-source work and carries no Server 3.1 release or topology approval.

[rmcdaniel]

General normal rollback merge is complete at 9fbacc51c51322f86fc09ff8463bfab3ecebabbb. Ordered parents are 5445aac39547e47def63d1f9a88b53cbc12d1b28 and cf8664d72b66e74dfe8af2dbd52f2a5b101d9477; tree 9de2bb025246652ad24f67126911b821ab86c07d exactly restores accepted pre-rollout 23f9bc3c.

All fresh normal required gates and Security's final disposition were reconciled. The original protected run 41839769618 and the normal ready-for-review event's 41840290197 both stopped at the absent App identity, with token creation/check issuance skipped. Neither is rollback-source qualification. No protection, App, secret or setting was changed to merge.

Ordinary main checks and fresh unchanged CLI/Rust hosted preflight/aggregate results remain required before fleet recovery is complete. The #240 pilot remains withdrawn and held for separate supported design/review.

[rmcdaniel]

Ordinary rollback main acceptance passes at 9fbacc51c51322f86fc09ff8463bfab3ecebabbb: Repository checks 41840545986, SonarQube 41840546079, CodeQL analyses and SonarCloud are terminal success. All six current-main checks pass; source/tree remains exactly accepted pre-rollout 9de2bb025246652ad24f67126911b821ab86c07d.

CLI's unchanged Build 41831320468 attempt 2 and the unchanged Rust/PHP caller recoveries remain separately tracked until their policy and dependent checks return. Main-source recovery is complete; full caller recovery is not yet claimed. The protected-App pilot remains absent and held.

[rmcdaniel]

Fleet recovery from #240 is complete. Restored central main 9fbacc51c51322f86fc09ff8463bfab3ecebabbb retains exact accepted tree 9de2bb025246652ad24f67126911b821ab86c07d, and normal central main qualification passed. The unchanged CLI attempt-2 preflight and aggregate, unchanged Rust continuation qualification and final independent carry, and PHP exact-main targeted recovery all consumed the restored supported policy and passed. Original failures remain recorded.

The protected-App pilot is withdrawn from deployed central policy. Its absent-App negative controls did not issue tokens or checks. The retained #240 source needs a separate supported design and review before any future integration; no App, key, environment, setting or activation is authorized here. The underlying emSign dependency work in #237 remains open.