[rmcdaniel]

Maintenance pushes failed Sonar's branch restriction, while maintenance PR results used the main analysis baseline. Scope Sonar to main pushes and PRs targeting main, and document the operator-selected maintenance quality evidence: ordinary CI plus Security Source review. Historical NONPASS/403 and wrong-base results remain attributed in #342.

Only the Sonar trigger branch lists and contributing guidance change. Analysis steps, permissions, action pins, scanner arguments and main routing are unchanged, as are every ordinary CI/docs/release/runtime byte. This nonblocking follow-up is merged as8c523ba9514869653182bf6af86984084d6cfd6e/tree999af80a3626d00712c7283773b516693886ee84; the already-published3.9.5 tag stays fixed at57562b53. No account, plan, provider or credential effect is included.

Validation: parsed old/new workflow comparison and central action policy pass; exact Security Source/routing PASS, all33 PR checks (32success/one intended skip), actual maintenance CI and boundary pass. No maintenance Sonar job was triggered; that is intentional nonrequired scope, not a Sonar PASS. Final merge/qualification/cleanup receipt confirms the exact tree/parents and completed topic-ref/worktree removal.

Fixes #342.

[rmcdaniel]

Security finite SOURCE PASS for exact 8673ad43aefe483bb8dde39a5ee4d391b6fa62f6 / tree 999af80a3626d00712c7283773b516693886ee84, parent maintenance merge 57562b53e429a2c3ae1e9aa531ed781e9429bd59.

The exact two-file binary diff is 1,600 bytes / SHA-256 0d812caa1783c08edbbf13c2592d8b0667685cb911f72e4ba91c858291e59bf0, and git diff --check is clean. The workflow delta removes only 3.9.x from the Sonar push and pull-request branch filters and adds two explanatory comments. The analysis job, permissions, same-repository PR guard, concurrency behavior, runner, timeout, checkout/scanner pins, credential name and scanner arguments are byte-identical. Main push and main-target PR analysis remain selected.

The documentation accurately preserves the selected maintenance contract: ordinary CI plus finite Security Source review, with no claim that a main-baseline result qualifies maintenance. It explicitly requires an actual revision/baseline/target check before any future maintenance analysis route. Production, tests, dependencies, ordinary CI, release workflow and release metadata are unchanged.

The historical maintenance provider 403 and wrong-main-baseline observations remain NONPASS evidence; this change does not relabel them. It selects no Sonar account, organization, plan, credential, project, visibility, rules, threshold, main-label or provider effect. It also grants no release, tag, package, installed behavior or benchmark acceptance.

This is source/routing acceptance only. Normal exact-head checks were still running at review time; merge/current-main proof and the separately owned 3.9.5 release execution remain outside this PASS.

[rmcdaniel]

Normal Source integration and actual maintenance qualification are complete. Merge 8c523ba has exact reviewed tree 999af80a3626d00712c7283773b516693886ee84 and ordered parents 57562b5 +8673ad43; the synthetic PR mergef79f56c2 has the same tree and parents.

All33 PR checks are terminal (32 success / one intended skip), including CI42318895588 and both boundary runs. Security Source/routing PASS binds the exact two-file delta. Actual merged maintenance CI42319538478 and boundary42319538591 also SUCCESS. No maintenance Sonar scan was triggered: this is the intended nonrequired scope, not a fabricated Sonar PASS. Main push/PR routing and analysis bytes remain intact.

The3.9.5 release was already fixed at57562b53 before this separate merge. Its tag remains unchanged and the complete published/installed proof is 337/6699764564. This follow-up changes no release/runtime/support bytes or account/plan/provider/credential settings; retained historical403 and wrong-main-baseline observations remain NONPASS evidence.

After verifying merge ancestry and clean state, I removed only my completed #337/#343 worktrees and topic branches, then verified all exact paths and local/remote head refs absent. The tag, maintained3.9.x, active draft340, unrelated draft219 and operator/previous-session WIP refs/worktrees are preserved. The installed verification's two exact containers are already removed. #342's routing/documented-quality criteria are delivered.