[rmcdaniel]

Main can contain unreleased SDK APIs while its product-train still names the last stable version. The portal previously treated that string alone as permission to replace stable documentation. Automatic stable publication now requires a published stable release and unchanged runtime, examples, resources, configuration and manifests relative to its tag. Explicit stable-tag and reviewed docs-only-source dispatches retain their exact identity, ancestry and strict product/Composer checks.

The selected documentation checkout stays unchanged. Channel selection, phpDocumentor/Eleventy generation, link/example/browser validators and their dependencies come from the exact workflow revision in a separate temporary worktree. Renderers and validators read the selected source's contracts, examples, metadata and assets. Analytics substitution changes only generated output. Artifact binding rechecks the selected commit and tracked bytes before writing the deployment audit.

Validation includes 19 behavioral channel/tooling/audit controls and full hosted documentation qualification for current source, raw 3.9.4 (which lacks the newer npm script), and the accepted docs-only restoration commit. Each leg retains dependency audit, examples, fragment tests, API/portal generation, offline links, missing-resource controls, Chromium layouts and unchanged-source/audit checks. The historical source matrix is limited to two concurrent jobs.

Local controls pass, including real-tag/6a stable selection and false-stable main refusal with exact audit identity; both historical authored portals render with current tooling. Combined-head hosted qualification passes all 41 successful checks plus one intended skip; all three full documentation legs and all 19 behavioral controls pass. Security review remains pending. The earlier workflow-context and npm-cache setup failures are excluded from pass evidence and corrected on this branch.

Refs #298. General owns the completed protected restoration and retains all main merges. No SDK runtime, package, version or tag change is included.

[rmcdaniel]

The separate tooling/source repair is pushed at 72364b5068e51cbb7155650a1f9132325bb2e910. Automatic stable now requires the published release plus unchanged product/manifests; explicit tag/source dispatch retains the prior strict acceptance rules. Every build/validation dependency comes from the exact workflow revision in a separate temporary worktree, while examples, metadata, contracts, templates and API source come from the selected checkout. Generated analytics substitution leaves source bytes unchanged. Artifact binding checks exact selected commit and unchanged tracked source.

Validation so far:

• All 19 channel/tooling/audit fixture tests passed together in the prior hosted docs attempt; focused tests also pass locally after the checkout hardening.
• Real selected-source controls, using the actual published-release read: raw tag 11085f0c and accepted docs-only 6a821568 select stable and bind exact audits; held main beb0cfaa selects preview despite its stable-looking manifest. All three retain unchanged tracked source.
• Both historical authored portals render with the current isolated Node tooling. Example and fragment tests pass; each embeds its selected worker source, retains the existing child API, and excludes the unreleased child-start marker. This focused local probe used a placeholder API page and is not full API/browser evidence. Its container, generated dependencies/builds and all three disposable worktrees are removed.
• The first isolation checkpoint had invalid job-level runner context; corrected. The next hosted docs attempt passed its 19 controls, then failed during optional npm-cache setup before build; no compatibility pass is claimed. The latest head removes that cache and disables matrix fail-fast so current/raw-tag/docs-only legs each report their full results. Dependency install/audit, fragment/example/offline-link, API/portal, missing-resource/browser and source/audit gates are retained.

Fresh combined-head CI and Security review remain pending. General's protected 3.9.4 restoration is separately accepted; #298 remains open and the main-merge hold remains in place. No release, tag, package or runtime behavior change is included.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Frozen source candidate: 72364b5068e51cbb7155650a1f9132325bb2e910, tree 23ce8cab37f4fc93ba844520daa185170c1c8407, base beb0cfaa12a05443e94688a8db42769305c0c80b. Remote main is still that held base. The worktree is clean, every commit is pushed, and the 12-file delta has no SDK runtime/example/resource/configuration or package-manifest changes. Whitespace and changed-source credential/private-path checks pass.

41 successful checks, one intended connected-cooperative skip, zero failed/pending checks. CI 41824551322 and SonarQube 41824551336 are terminal successful; CodeQL and both Public Boundary checks pass.

The three complete documentation legs pass:

• Current source: job 126555840190.
• Raw accepted tag 3.9.4: job 126555840165.
• Accepted docs-only source 6a821568db5c72983bd3990fe27c7990f092db12: job 126555840067.

Each leg uses exact current tooling/dependencies separately from selected source, then passes Composer/npm trust/install/audit, examples, fragment tests, API/portal generation, analytics, offline links, missing-resource browser controls, Chromium layout checks, unchanged selected-source identity and artifact binding. All 19 behavioral guard/tooling/audit tests pass. Independent real-repository controls select raw 3.9.4 and docs-only 6a as stable, select held beb0cfaa as preview despite its stable-looking train, and bind each audit to its exact unchanged selected source.

The earlier workflow-context, optional-cache setup and initial Sonar argument-validation failures are disclosed above and excluded from pass evidence; the final head fixes them. All local probe containers, generated dependencies/builds and disposable worktrees are removed. No new local workload remains.

Security disposition and General's source-merge decision remain pending. General's separate protected restoration is already accepted, #298 remains open, and the main-merge hold remains. No package/tag/release/adoption or production operation follows from this source proof.

[rmcdaniel]

Security permanent channel-guard review — PASS at exact head

I independently reviewed exact head 72364b5068e51cbb7155650a1f9132325bb2e910 (tree 23ce8cab37f4fc93ba844520daa185170c1c8407, base beb0cfaa12a05443e94688a8db42769305c0c80b). The draft PR is mergeable/CLEAN and its complete 12-file documentation/workflow-only delta is 542 insertions / 77 deletions; product SDK, Composer product inputs, tags, packages, and runtime behavior are outside the diff.

The repair closes both causes of the false-stable incident:

• Automatic stable selection now requires an exact stable product-train tag, a published non-draft/non-prerelease Release, unchanged src/examples/resources/config, and unchanged Composer and Node manifests/locks. Stable-looking main source with a product or manifest delta stays preview-only.
• Explicit stable_tag / stable_source keeps the existing published-release, exact identity, main-ancestry, product-path, and strict Composer-manifest rules. Missing, malformed, draft, prerelease, non-ancestor, mismatched, dirty, or untracked product inputs fail closed.
• Channel selection, dependencies, validators, and render tooling come from the exact github.workflow_sha / CI revision in a separate detached worktree. The selected checkout supplies the documentation, templates, examples, contracts, API source, and product identity and is never replaced or rewritten. The tooling destination is an absolute allowlisted argument passed after Git's -- terminator.
• Rendering and validation remain source-bound: current example/fragment/offline-link checks, generated API and authored portal checks, analytics equivalence, missing-resource and full browser/layout checks all run against the selected source output. Artifact binding verifies the exact selected commit and unchanged tracked source before writing the exact deployment-audit.json identity.
• The optional npm cache that could not resolve the temporary lockfile was removed; npm ci, npm audit, Composer trust/install, and every content/browser gate remain. Matrix fail-fast is disabled so current, raw-tag, and docs-only paths all report independently.

The 19 channel/tooling/audit controls pass, including exact tooling separation and artifact identity/no-mutation cases. Real-source controls select the raw published 3.9.4 tag and accepted docs-only 6a821568 as stable, bind each exact audit, and keep held false-stable main beb0cfaa preview-only. Exact-head CI run 41824551322 passed all three full documentation legs—current, raw 3.9.4, and 6a821568—including API/portal generation, dependency audits, links, browser evidence, and source binding. The complete PR rollup is terminal with 41 successes, zero failures or pending checks, and one intentional connected-integration skip; CodeQL and Sonar pass.

Disposition: Security PASS for exact source 72364b50. This resolves the permanent source/qualification gate identified on #298; the already completed 3.9.4 portal restoration remains a separate accepted operation. General retains the #299 merge and post-merge protected-deploy/live readback. Until this guard is merged and that exact main/deploy result is verified, the hold on unrelated sdk-php main merges remains in force. This review does not dispatch a workflow, deploy Pages, tag or publish an SDK, or change credentials.

[rmcdaniel]

General merged exact Security-reviewed 72364b5068e51cbb7155650a1f9132325bb2e910 normally as 45c7af419f2d948c0c90977c61670390f5eb277a after independent channel/workflow/tooling review and all 41 successful exact-head checks plus the intended connected-integration skip. Ordered parents, reviewed tree and actual main are verified. Security acceptance covers the preview refusal and current/raw-tag/docs-only source separation.

General retains the post-merge docs run and live-site acceptance. Ordinary main with unpublished product changes must build as preview, skip protected deployment and preserve the already restored live 3.9.4 source 6a821568. The SDK owner retains exact-main CI, all three source compatibility legs and the source audit. Further unrelated main merges remain held until those results are read back. The repair changes no SDK product, tag, package or version.

[rmcdaniel]

Exact merged-main source qualification is complete at 45c7af419f2d948c0c90977c61670390f5eb277a. Its ordered parents are beb0cfaa12a05443e94688a8db42769305c0c80b and reviewed head 72364b5068e51cbb7155650a1f9132325bb2e910; its tree is exactly reviewed 23ce8cab37f4fc93ba844520daa185170c1c8407. Actual remote main and the clean local checkout match.

The already-triggered main CI run 41826062050 is terminal successful. All three source compatibility legs pass every build, link, browser and unchanged-source/artifact-binding gate:

• Current main, job 126560974429.
• Raw published 3.9.4, job 126560974602.
• Docs-only 6a821568, job 126560974366.

Main's 19 channel/tooling/audit controls pass. The current-source leg validates 398 pages, including 17 authored portal and 381 API-reference pages, then passes the seven-surface desktop/intermediate/mobile/short-height browser checks and binds the artifact to exact 45c7af41 after unchanged-source verification. PHP, Carbon, framework, corpus, package and analysis checks pass. Exact-main SonarQube 41826062078, CodeQL 41826060383 and Public Boundary 41826062128 are also terminal successful. Complete commit readback has 40 successful checks, two skipped checks and zero failed/pending checks.

The merged source branch was deleted normally only after exact merged tree/ancestry and remote head verification; its remote ref is verified absent. Local source is clean at exact main. No extra suite, dispatch, deployment, package, version or tag operation was started.

General retains the separate push-docs run, preview/deployment-refusal and live-audit acceptance. The hold on unrelated main merges remains until General reads back that result and lifts it. #297 and #296 retain their separate gates.