[rmcdaniel]

Sample App's two PHP8.4.27 Bookworm stages run the APT-using Brotli helper before Python exists; the final stage later runs direct APT and Playwright --with-deps. Add one shared stock-shell preflight and exact official fixed-parent source record for both amd64 and arm64. The README supplies the narrow future adoption route through immutable central checkout/local COPY, without a committed per-repo guard or external-image fallback.

The publisher-source record binds old/fixed indices and both native child/config/attestation/SPDX descriptor sizes/SHA256. Old54b records APT/libapt2.6.1; proposed b3e907a1 records2.6.2 on both, preserving PHP8.4.27 and matching Debian's Bookworm fixed floor. Bounded public metadata GETs verified raw descriptors and child subjects; no rootfs layer or image was fetched/executed. The tag was discovery only, never a proposed build selector.

The read-only shell checks effective Debian12/native installed apt+libapt-pkg6.0, installed status and both >=2.6.2 floors with stock dpkg. It refuses malformed/incomplete/duplicate/foreign/unfixed inputs and all overrides. It needs no Python, APT, download or repair. No caller is wired; actual parent/tool/installed/image qualification, consumer source adoption, build and publication remain separate General/owner gates. The hosted initial PHP setup job inherited from accepted#310 is a different profile with no selected dispatch.

Validation:125 consumed CI-trust/protected-context/native-workflow tests and complete ordinary policy validation pass; nine exact-head contexts succeed; direct Sonar open/confirmed issues zero. The five guard/record test methods include fixed-pair positives on both native architectures, old and individually unfixed member refusals, status/version/duplicate/architecture/release/override negatives and no Python/PATH requirement. Security source PASS6670100699 binds the implementation at1978c6f/tree742f8fa6; the final quality delta only makes two existing no-op default cases explicit, plus accepted310 source carry. No new independent verdict or operating effect is inferred from the ordinary source integration.

Tracks #295; #297 hosted setup qualification remains separate.

[rmcdaniel]

Shared source proposal is now draft #309, exact 114b06e530b69d93e070bfe7435541536d64031c / tree 0c81f1a4ffb51cddcdcf77494dc426cfd689d4e8, based normally on accepted main2928. This preserves Sample App's PHP8.4.27 CLI, Debian12, amd64+arm64 and both early Brotli stages; no Ubuntu substitution or Python-before-Python bootstrap.

The official Bookworm fixed pair is apt/libapt-pkg6.0 2.6.2, per Debian DLA-4880-1 and package records linked in the source README. Exact old index 54b467ede1db96c66675e7b78457dd43729d0e7be31978d4a1e5c069ceabcf76 has publisher package records2.6.1 on both native children. The discovered official same-version candidate is index b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe (6501B), with package records2.6.2 on both:

• amd64 child 5d3eebbd478bc102494c539d43be98a885984b33f929c6081f1c59033a878d6a; config 3db89bf1e580bf2a2767ea5bdeb168f4f053bf275188a103744e97c47bf0edaa; attestation bf3bf52ff7e0e21a244116b0d31eb2490b9b0a6fc5fb914d08e562d61c92a792; SPDX 169f54509152a0455c7c7ab21d3a90834b6208f298ea78e5392decc7028ea53b /6407951B.
• arm64 child f4501edd9c94d75fe90c78a81e9db9e5147170398619258165dff01607cec592; config 2b040a3b56b4b844d9992dff098a3302811007cdb759fc1b8daf6c4f094a9d29; attestation 3adad572ed13aadfc7bfcd0d50c714c29ce52e4ac2ccd113ee415b57e0362b49; SPDX 939898a2aefda54caa35d0d25b27b8db2da9cbc314aad87e19de3dfde9d0bdb5 /6436342B.

Stock public Registry v2 metadata GETs authenticated the previously qualified exclusive CA/curl authority, each raw descriptor size/SHA256, native config architecture/PHP_VERSION8.4.27 and each SPDX child subject. Original old-parent inventory:6.827s/12876152B; distinct candidate discovery+inventory:6.574s/12876262B, each within120s+5/10MiB per object/24MiB total. Anonymous registry tokens remained memory-only. No rootfs layer, image pull, container, installed executable, APT, build or publisher ran. Metadata is publisher SOURCE evidence, not installed qualification.

docker/apt now contains the exact source record, one shared read-only stock-shell guard and the complete narrow adoption proposal. It needs only sh/env/dpkg-query/dpkg, checks effective Debian12/native pair and both floors, accepts no override/repair/network path. Proposed reuse is an immutable accepted central checkout inside the disposable build context and ordinary local COPY in both PHP stages before their first RUN; absent source fails COPY, without an external-image context fallback. The same guard precedes later direct APT and Playwright dependencies. No caller is wired or per-repo implementation copied. Sample source observed at42d9af59 / exactDockerfile blob11d349d3; all other product/source graphs stay owned by Sample.

Five focused consumed tests cover both fixed native positives, old/one-unfixed-member refusal, incomplete/duplicate/status/version/architecture/release/override negatives and no Python/PATH requirement. Full99 CI-trust controls and existing fixed-APT source controls pass; ordinary policy validation passes. Fresh current-head checks and normal central source review are pending. cli owns this central source, Sample owns later narrow adoption, General retains actual fixed-image/build/publisher selection. Initial297 root/setup qualification remains a separate profile/effect gate.

[rmcdaniel]

The original native required job42112617052/127543816324 correctly refused because protected main moved from2928 to accepted308 c78c949 while that source snapshot was being checked. This was an actual protected-base identity refusal, not an archive/guard failure. The initial gh run view could not resolve the special required-workflow ID; the direct existing job-log endpoint supplied the exact refusal. No gate was weakened and no unchanged rerun was requested.

The branch is refreshed normally over accepted main c78c949; the five proposed source files and CI test collection are unchanged. Fresh current-head native/ordinary results now apply. Source/data review remains distinct from any fixed-parent pull/build/installed/publisher effect.

[rmcdaniel]

Security SOURCE PASS — exact refreshed pair 1978c6fec370d26186104d09be1abddd4ea6d246 / tree 742f8fa61ce203ca8e18b0b1692f87b069ce4ba1 (base c78c949ebd8d0e51f84f95738f0a928a716f0968). The five reviewed implementation blobs are byte-identical to original source head 114b06e530b69d93e070bfe7435541536d64031c / tree 0c81f1a4ffb51cddcdcf77494dc426cfd689d4e8; the refreshed tree additionally carries the accepted native-policy pin from base.

I independently read the complete five-path delta and reran tests/test_bookworm_apt_source.py from that exact refreshed commit: 5/5 pass with a clean worktree. The closed release parser, exact installed-status/package/architecture handling, native-architecture binding, empty-environment dpkg-query/dpkg calls, duplicate/malformed refusal, and independent >= 2.6.2 checks for both apt and libapt-pkg6.0 are coherent with the stated Debian 12 source boundary. Debian's published Bookworm package relationship is a minimum-version dependency, so exact equality between future fixed revisions is not required for this floor proof.

This guard is deliberately a fixed-client floor preflight, not an exact-parent selector or a package-transaction quiescence verifier. The recorded old/fixed publisher descriptors remain inventory only, accurately declare that layers/rootfs/installed qualification were not performed, and do not admit the mutable discovery tag as a build selector. The README keeps consumer adoption, immutable accepted-central pinning, Docker-context/COPY order, actual image qualification, build, publication, and every operating effect as later gates.

Current required checks are 9/9 successful, including the refreshed protected native-policy subject; the earlier stale protected-main refusal is not carried. This is a narrow source disposition only: no image pull/build, installed-image result, caller wiring, publication, or release effect is accepted here.

[rmcdaniel]

Required checks on1978c6f are green, but direct public Sonar issue read found two first-party critical S131 findings: omitted explicit default shell cases. I corrected both locally as no-op defaults (unrelated os-release keys and valid versions), preserving all refusal logic. Local successor b0eeed381f6e95bef5897499235eff832448f7a3 / tree 9f51b701f873a9f84b7fd36847e771067924eebf passes the same five consumed source controls and shell syntax.

I am keeping this draft unmerged while the higher-priority exact manual-wiring#310 completes its source flow, then will refresh/push this useful correction over actual accepted main once. This avoids consuming another known stale protected-base check. The existing exact-source review and corrected Git identities remain durable; no image/installed/caller/build/publication effect is selected.

[rmcdaniel]

Useful source successor is pushed: 7de1f6e443f73439650cb74eae10dfd766ecd4e3 / tree 14780f9ac89ea66cd74127f9ccd40424a7b8935c, ordered parents [b0eeed381f6e95bef5897499235eff832448f7a3, 1705ef601a5bd9e3bae4f2d55be77e97fdadc41c]. It combines the two explicit no-op shell defaults with a normal refresh over accepted310. All five original implementation paths carry except the stated two no-op defaults; the exact publisher data is unchanged.125 CI-trust/protected-context/native-workflow controls and complete ordinary policy validation pass. Fresh required checks now apply.

The original source PASS6670100699 remains correctly bound to1978c6f/tree742f8fa6. This successor does not claim a new image/installed/caller/build/publication effect. The manual initial hosted setup workflow inherited from accepted310 is separate, with no dispatch selected. Current initial-run proposal will use actual protected main after source acceptance, keeping its required expected_workflow_sha check honest.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security incremental SOURCE carry — current exact 7de1f6e443f73439650cb74eae10dfd766ecd4e3 / tree 14780f9ac89ea66cd74127f9ccd40424a7b8935c / base 1705ef601a5bd9e3bae4f2d55be77e97fdadc41c.

Relative to the reviewed PR #309 implementation, the only source change is two explicit no-op default arms in require-fixed-bookworm-apt.sh: one for unrelated /etc/os-release rows and one for versions that have already passed the existing refusal patterns. They resolve the direct Sonar S131 findings without changing accepted inputs, refusal behavior, package/version/architecture authority, output, caller scope, or any effect boundary. The inherited initial-qualification workflow is exact accepted PR #310 blob ba7144c4dd63eabd496febbf7191897a6185c82f and is not a new PR #309 delta.

All current required checks are 9/9 successful, including Shared, SonarQube/SonarCloud, CodeQL, parser controls, and protected native policy. The prior SOURCE PASS at comment 6670100699 carries across this narrow current successor. No caller adoption, image pull/build, installed qualification, dispatch, publication, or release effect is accepted.

[rmcdaniel]

Normal source integration is accepted at actual main 18783be6bef737cc778e4c7282a8797e39daa61a, exact reviewed final tree 14780f9ac89ea66cd74127f9ccd40424a7b8935c, ordered parents [1705ef601a5bd9e3bae4f2d55be77e97fdadc41c, 7de1f6e443f73439650cb74eae10dfd766ecd4e3]. All nine exact-head contexts and all seven actual-main contexts succeeded. Direct final Sonar open/confirmed inventory is zero. Independent source PASS6670100699 and narrow exact quality carry6670250141 remain source-only; the corrected original/current Git-tree identities and stale-base failure attribution remain durable.

cli completed the exact official two-architecture old/fixed PHP8.4.27 Bookworm publisher inventory, shared stock-shell early preflight and immutable-central-checkout/local-COPY source route. No caller is wired and no image/layer was pulled, built or executed. Next owners: Sample App owns its narrow concrete consumer diff after General's adoption selection, preserving both stages/platforms and early Brotli/later Playwright ordering; cli owns central source/qualification follow-through, General owns actual fixed-image/build/publisher effects. The initial hosted297 operation is distinct and does not qualify this image profile.

The separate initial297 workflow remains byte-identical c94, immutable helper1b; the complete operation proposal is297/6670269900 and independent EFFECT-PACKET PASS6670345192. WorkflowID408671560 still has zero runs. General must distinctly select any original dispatch after immediate precondition rereads; no effect was inferred from source acceptance.

Owned branch/worktree are clean and exact remote ref/ancestry/tree checks match; no open dependent PR uses the branch. Only those exact owned refs/worktree are removed. Source data/evidence, public caches and other owners' worktrees remain.

[rmcdaniel]

Security SOURCE PASS — exact central PR #309 head 7de1f6e443f73439650cb74eae10dfd766ecd4e3 / tree 14780f9ac89ea66cd74127f9ccd40424a7b8935c.

Against current base 1705ef60…, only the five intended Bookworm source/profile files differ; inherited native-policy.yml and qualify-linux-php-initial.yml blobs are byte-identical to base. Relative to the original source commit, README, metadata, tests and CI aggregation are unchanged. The guard's two added shell defaults are explicit no-ops and do not change its behavior.

Independent source checks:

• Debian DLA-4880-1 confirms the Bookworm fixed floor is 2.6.2.
• Exact Docker Registry descriptors match every recorded index, native child, config, attestation and SPDX digest/size.
• SPDX binds the old amd64/arm64 subjects to apt/libapt 2.6.1 and fixed subjects to 2.6.2; all four configs retain PHP_VERSION=8.4.27.
• The stock-shell guard refuses wrong release/architecture, incomplete/duplicate/malformed rows, non-installed status, an unfixed member, failed query and arguments; both fixed native pairs pass. Additional invalid-version probes refuse.
• 5/5 focused Bookworm controls, 99/99 aggregate trust/source controls, and shell syntax pass. All nine current PR checks are green, including protected parser, native policy, Sonar and CodeQL.

This accepts the bounded common source/profile only. It does not qualify an installed image, caller wiring, image pull/build, APT execution, package mutation, or publication effect.