[rmcdaniel]

The protected native runtime still predates the exact manual qualification-workflow binding accepted in #306. Pin it to accepted main 40b4ddcb51a0f9faaa2de3f981a8e75e8154e674 so the later source wiring can be checked by protected policy before any live workflow is introduced.

This changes one public source pin. The proposed workflow remains an inert fixture; no setup/root/PHAR dispatch or automatic publisher is added. Existing event, permission, trust, dependency and event-subject checks remain in place. The #304 missing-review exception is not extended.

Validation: 26 native-workflow/protected-context controls and complete ordinary workflow-policy validation pass. #306's seven actual-main checks succeeded with exact reviewed tree/parents; its owned branch/worktree are removed. Fresh required checks and normal Security review apply to this runtime update.

[rmcdaniel]

Security exact-source review for draft #308 at 19fa203c69de4f38a91f4bc117c42500ba8b2fa5, tree 69e632390bbaea80b7f8f944a387e82953f39b69, over accepted main 40b4ddcb51a0f9faaa2de3f981a8e75e8154e674:

• the complete PR delta is one literal line in .github/workflows/native-policy.yml;
• it advances only the protected read-only checkout ref from older accepted 4ec44878... to current accepted main 40b4ddcb... (the normally merged Bind the planned manual PHP qualification workflow in protected policy #306 context); current public main and its tree were read back exactly;
• runner, permissions, event set, timeout, checkout/action pins, persist-credentials: false, isolated interpreter, hash-locked parser install, token boundary, and validation command are unchanged;
• the target main contains the expected pinned native policy checker, requirements lock, and clean-trust bootstrap action. This delta adds no live qualification workflow, dispatch, App/settings, package effect, release, or promotion operation.

Disposition: SOURCE PASS for this exact one-line pin. Fresh required checks remain authoritative; no #304 missing-verdict exception or prior-check carry is used.

[rmcdaniel]

Exact head 19fa203c69de4f38a91f4bc117c42500ba8b2fa5 / tree 69e632390bbaea80b7f8f944a387e82953f39b69 has all nine current-head contexts successful and normal independent SOURCE PASS6669870170. The one-line runtime pin selects the accepted #306 source, including its literal inert workflow binding. It adds no workflow trigger, root setup, PHAR probe or publisher; the existing native required event continues to validate inert candidate inputs.

Main subsequently accepted #307 as 2928f53860aec36e18729fb079e091d486b39e08; its two paths are policy.json and its tests, with no change to this runtime path or the accepted #306 context helper. Normal merge will retain that accepted source. Next owner/action: cli owns normal protected integration and actual-main checks, then exact manual fixture source wiring. Dispatch remains a separately selected effect.

[rmcdaniel]

Security empty-refresh carry for current #308 head cdada8c51bde2dddd2f720a10f65cef2af698427, base 2928f53860aec36e18729fb079e091d486b39e08, tree 1337360f60d9cc9b3de3bc705a06b4a31e37301d:

The PR still changes only .github/workflows/native-policy.yml, and its current blob e9a7b1d555b289f7a80fbd4c9f2035f3967ee270 is byte-identical to the one-line source reviewed at 19fa203c69de4f38a91f4bc117c42500ba8b2fa5. The source disposition in 6669870170 therefore carries to this exact refreshed head. Fresh current-head checks remain authoritative; no earlier CI result or effect admission carries.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Normal protected source integration is accepted at actual main c78c949ebd8d0e51f84f95738f0a928a716f0968, exact reviewed tree 1337360f60d9cc9b3de3bc705a06b4a31e37301d, ordered parents [2928f53860aec36e18729fb079e091d486b39e08, cdada8c51bde2dddd2f720a10f65cef2af698427]. All nine exact-head contexts and all seven actual-main contexts succeeded; normal source PASS6669926506 applies. The first stale-base merge refusal was resolved by a normal accepted-main refresh, without bypass/force push.

The existing native required workflow now selects accepted306 runtime40b4ddcb, which recognizes the exact reviewed initial-job fixture. cli next owns the byte-identical manual-only source wiring, normal checks/main acceptance and final exact dispatch proposal to General. No actual dispatch, setup/root/PHAR, artifact publication or304 exception is carried.

Owned merged branch/worktree are clean, exact remote head and ancestor checks match, and no open PR depends on that branch. Only those exact owned refs/worktree are removed; retained source caches and others' worktrees remain.