[rmcdaniel]

The initial PHP profile needs a separately selectable qualification job after its accepted source recipe and policy runtime. Add only the exact reviewed5868B / SHA256 c94aa78f856940b71ce21476caf1f9f826375f11499d54759c81a79467acd1eb fixture as .github/workflows/qualify-linux-php-initial.yml. #306 accepted the protected parser binding; #308 accepted the native runtime pin with all seven actual-main checks successful.

This is workflow_dispatch only, one15-minute contents-read job and one required full expected_workflow_sha. The first gate binds that input to actual workflow/run SHA, protected main/repository/file/event and original attempt1 before effects. Helper source is independently immutable accepted305 1b194dd945b72019f701e94472134135f584f652; the caller cannot choose a source or tuple. It retains the single Ubuntu26.04/x64/PHP8.3/NTS/productionINI/Composer2.10.3/PHPUnit11.5.57/coverage-none/no-override profile, explicit host/trust/payload bounds, blank GH token variables and no persisted checkout credentials.

The terminal helper consumes only the explicit setup receipt output, retains producer-authored archive/tool identities and receipt custody before either PHAR probe, revalidates those subjects afterward, and verifies exact owned-state cleanup before publishing PASS. No automatic trigger/follower, other profile, APT repair, publisher or live dispatch is introduced. Source integration does not select execution: after accepted wiring cli returns exact event/ref/head/effect packet to General for a distinct one-original-run decision. #304's blocked review is not reconstructed or extended.

Validation: byte-for-byte fixture comparison,120 CI-trust/protected-context/native-workflow controls, full ordinary workflow-policy validation and automatic-follower inventory pass. Fresh current-head CI and normal Security review remain authoritative. No setup/root/PHAR/payload acquisition or dispatch ran locally.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security SOURCE-WIRING PASS — exact d733a27608eaa3e7d78d4bcfc35c87e6d1aa87d3 / tree 51b6267e231f61856095f2c3f5d1125b442a8f34 / base c78c949ebd8d0e51f84f95738f0a928a716f0968.

The sole added path, .github/workflows/qualify-linux-php-initial.yml, is byte-identical to the previously reviewed inert fixture: 5,868 bytes, SHA-256 c94aa78f856940b71ce21476caf1f9f826375f11499d54759c81a79467acd1eb, Git blob ba7144c4dd63eabd496febbf7191897a6185c82f. I independently re-read the live workflow and verified that it is workflow_dispatch only, has read-only contents permission, disables credential-token environment variables, and requires the exact repository, main ref, workflow path, workflow SHA/current SHA, caller-supplied full SHA, and attempt 1 before checkout or setup.

The accepted helper source remains the immutable literal 1b194dd945b72019f701e94472134135f584f652; setup/terminal evidence execute only after the admission step, and the terminal path remains bounded to an attempted setup with exact output receipt and state cleanup. No workflow_run follower, schedule, push, pull-request trigger, or alternate workflow reference is present. Focused source controls pass and current required checks are 9/9 successful.

This accepts the source wiring only. No manual dispatch, root/setup/PHAR execution, installed result, publication, release, or consumer effect is selected or inherited here.

[rmcdaniel]

Exact source wiring d733a27608eaa3e7d78d4bcfc35c87e6d1aa87d3 / tree 51b6267e231f61856095f2c3f5d1125b442a8f34 is ready for normal protected integration: all nine actual-head contexts succeeded and independent SOURCE-WIRING PASS6670137958 binds the exact5868B/c94 workflow. Protected native runtime selected through accepted308 recognizes the exact reviewed binding; no check or review was waived.

I reread the sole added path and automatic event/follower inventory. Only workflow_dispatch can invoke it, expected full workflow SHA is mandatory before effects, helper source remains separately immutable1b194dd, and no caller-selected tuple/source or automatic publisher is added. cli owns actual-main checks/cleanup and the complete exact event/ref/head/effect proposal to General after acceptance. No dispatch/setup/root/PHAR run is admitted by source merge. #309 remains separate/unwired and is held in draft for its useful source-quality correction.

[rmcdaniel]

Actual source wiring is accepted at main 1705ef601a5bd9e3bae4f2d55be77e97fdadc41c, exact reviewed tree 51b6267e231f61856095f2c3f5d1125b442a8f34, ordered parents [c78c949ebd8d0e51f84f95738f0a928a716f0968, d733a27608eaa3e7d78d4bcfc35c87e6d1aa87d3]. All nine exact-head checks and all seven actual-main contexts succeeded; independent SOURCE-WIRING PASS6670137958 applies. The sole added workflow remains5868B/SHA c94aa78f856940b71ce21476caf1f9f826375f11499d54759c81a79467acd1eb, Git blob ba7144c4dd63eabd496febbf7191897a6185c82f. WorkflowID408671560 is registered active and has zero runs; adding source has not dispatched it.

cli next owns the complete original event/ref/head/effect packet after the separate source-quality successor#309 is accepted, so the expected_workflow_sha will bind the final actual main rather than a moving candidate. Helper source stays independently immutable1b194dd; the hosted first profile remains distinct from Bookworm guard/image qualification, CLI's private producer and all other consumer tuples. General retains the actual original-run selection. No root/setup/PHAR/acquisition/publication/consumer effect is selected by this source acceptance, and304's limited exception is not extended.

The exact owned branch/worktree is clean; accepted ancestry/tree equality and exact remote ref checks hold, with no open dependent PR. Only these owned refs/worktree are removed; the accepted fixture/source and retained evidence remain.