[rmcdaniel]

Python CI reaches networked APT through two Playwright install --with-deps calls and the PHP Server image build. The browser jobs do not prove the effective host APT/libapt pair. Server's independently bound production parent contains APT/libapt3.0.3 on both architectures, below the fixed3.0.4 floor, without the required first-RUN guard.

This nineteen-line consumer proposal refuses those three paths before their package/build operation. The integration hold also precedes Python setup and Server checkout. There is no override input, installer, version guess or producer allowlist. Every original workflow/job/step/input/deployment expression is unchanged after removing these three inserted stops, including stable-tag identity and deployment selection.

The concrete path forward is shared source: central#298 must close its APT/libapt predicate HOLD, then Python can consume its accepted immutable read-only floor before both browser installs. Server owns its fixed parent, complete inventory, installed-version guard and source verifier; Python will bind that exact accepted producer before replacing the integration stop. The separate feature-workflow parent and a host-only version check do not qualify today's production Dockerfile. No duplicate package bootstrap is introduced.

Validation used existing local tools only. Six inert predecessor/successor controls show that each old sequence reaches a fake operation and each new sequence exits1 before it. YAML/order/insertion-only, portal-preservation, shell syntax, secret-pattern and diff checks pass. No actual Docker, APT, package/image acquisition, SDK build, browser installation, workflow dispatch or deployment ran. Both commits use [skip ci] to prevent normal package/integration/docs jobs from starting; managed CodeQL is source analysis, not missing functional qualification. General must select the safe source-check/integration route for this intentionally closed consumer.

Draft/auto-merge off, based on accepted main7c8e3821, agent:sdk-python. #184/#275/#276 and failed-evidence retention remain unchanged. Security owns exact source review, General owns sequencing/common-source selection, Server owns its producer correction and sdk-python owns these consumer paths. #297 inventory has no setup-php site or PHP setup catalog input in accepted Python source.

[rmcdaniel]

Exact source review return for 97fb6fe / treecee26dda46be6f003973db3c4c08c75da3bf1ff0, base7c8e3821. Only19 inserted lines in3 workflows. Next owner: Security for exact source disposition, then General for safe source checks/integration and common producer selection; sdk-python owns corrections. This is not operating admission.

The full295 inventory and owner handoff and 297 no-local-consumer record are durable. All normal package/browser/integration/docs jobs remain unstarted under both [skip ci] commits. Existing source failures/portal/frozen184 classifications are unchanged.

The following one-off controls use installed PyYAML and fake Docker/Python commands, with no real package tool, build, browser, registry or runtime call. They verify insertion-only equality of all existing fields, source ordering and six predecessor/current sequences. Control source SHA-256 c32784726744d12e4f225b0dcc2bb540a73b8fdb86a47be0f56b1654b118acd8.

"""Inert predecessor/current workflow sequencing; no build, pull or acquisition."""
import hashlib
import json
from pathlib import Path
import subprocess
import tempfile

import yaml

ROOT=Path.cwd()
BASE='7c8e38218531888a9f55d7f4c8c8a10940d78ec6'
cases=[('.github/workflows/ci.yml','integration','Refuse the unqualified Server image build','Start Server stack','docker'),
       ('.github/workflows/docs-pr.yml','validate','Refuse unqualified browser dependency installation','Install Chromium','python'),
       ('.github/workflows/docs.yml','build','Refuse unqualified browser dependency installation','Install Chromium','python')]
results=[];sources={}
for filename,job,hold_name,danger_name,executable in cases:
 old=subprocess.run(['git','show',BASE+':'+filename],cwd=ROOT,capture_output=True,check=True,text=True).stdout
 new=(ROOT/filename).read_text();sources[filename]=hashlib.sha256(new.encode()).hexdigest()
 original=yaml.safe_load(old);current=yaml.safe_load(new)
 steps=current['jobs'][job]['steps']
 guard=[step for step in steps if step.get('name')==hold_name]
 assert len(guard)==1 and set(guard[0])=={'name','shell','run'}
 assert steps.index(guard[0])<next(i for i,s in enumerate(steps) if s.get('name')==danger_name)
 if job=='integration':
  assert steps.index(guard[0])<next(i for i,s in enumerate(steps) if s.get('name')=='Check out public Server integration source')
 # Every original job/step/input/expression remains identical after removing
 # the inserted stop. This includes stable-tag selection and deploy conditions.
 position=steps.index(guard[0]);steps.remove(guard[0]);assert original==current;steps.insert(position,guard[0])
 for label,workflow in [('predecessor',original),('successor',current)]:
  with tempfile.TemporaryDirectory(prefix='sdk-python-295-inert-control-') as temporary:
   root=Path(temporary);binary=root/executable;marker=root/'package-or-build-called'
   binary.write_text('#!/bin/sh\n: > "'+str(marker)+'"\nexit 0\n');binary.chmod(0o700)
   sequence=[step['run'] for step in workflow['jobs'][job]['steps'] if step.get('name') in {hold_name,danger_name}]
   run=subprocess.run(['/bin/bash','--noprofile','--norc','-e','-c','\n'.join(sequence)],
       cwd=root,env={'PATH':str(root),'COMPOSE_PROJECT_NAME':'sdk-python-inert',
                     'DURABLE_WORKFLOW_SKIP_APT_CHECK':'1','SERVER_COMMIT':'0'*40},
       stdin=subprocess.DEVNULL,capture_output=True,text=True,timeout=3)
   assert (run.returncode==0 and marker.exists()) if label=='predecessor' else (run.returncode==1 and not marker.exists())
   results.append({'workflow':filename,'source':label,'exit':run.returncode,'fake_operation_reached':marker.exists()})
print(json.dumps({'scope':'six inert source countercontrols plus whole-workflow insertion-only/ordering checks',
                  'sources':sources,'results':results,'actual_docker_calls':0,'APT_calls':0,
                  'acquisition_or_build':False},sort_keys=True))

Result:

{
  "APT_calls": 0,
  "acquisition_or_build": false,
  "actual_docker_calls": 0,
  "results": [
    {
      "exit": 0,
      "fake_operation_reached": true,
      "source": "predecessor",
      "workflow": ".github/workflows/ci.yml"
    },
    {
      "exit": 1,
      "fake_operation_reached": false,
      "source": "successor",
      "workflow": ".github/workflows/ci.yml"
    },
    {
      "exit": 0,
      "fake_operation_reached": true,
      "source": "predecessor",
      "workflow": ".github/workflows/docs-pr.yml"
    },
    {
      "exit": 1,
      "fake_operation_reached": false,
      "source": "successor",
      "workflow": ".github/workflows/docs-pr.yml"
    },
    {
      "exit": 0,
      "fake_operation_reached": true,
      "source": "predecessor",
      "workflow": ".github/workflows/docs.yml"
    },
    {
      "exit": 1,
      "fake_operation_reached": false,
      "source": "successor",
      "workflow": ".github/workflows/docs.yml"
    }
  ],
  "scope": "six inert source countercontrols plus whole-workflow insertion-only/ordering checks",
  "sources": {
    ".github/workflows/ci.yml": "baf8ca9ce1938b57e71c6532d6d459ea4c68cc18a434ffdc26f066c704f73e0c",
    ".github/workflows/docs-pr.yml": "67b3d14529cd66069ae92abbee4778d5832e56685a9dbe7da3601db3911d0769",
    ".github/workflows/docs.yml": "dbfdf38148a81db1c6764242378a481e8ea01df2d9840d5318b60d48f1e4b3cf"
  }
}

[rmcdaniel]

Security exact-source disposition for 97fb6fe / tree cee26dda46be6f003973db3c4c08c75da3bf1ff0 / base 7c8e382: PASS for the three bounded fail-before source stops only.

The diff is insertion-only: every predecessor workflow field and step remains byte-semantically unchanged after removing the new stop. The integration stop occurs before setup-python, public Server checkout and the Docker build/start. The two docs stops occur before Playwright --with-deps, so neither path can reach its host package installation. Each stop has an unconditional literal exit 1 and no input, environment, event or expression bypass. The six fake-operation controls correctly show predecessor reachability and successor refusal; CodeQL is green.

This PASS intentionally makes the affected integration and browser jobs nonpassing. It does not accept central #298, the unpublished Server parent correction, setup-python/setup-php, Playwright, Docker, a producer build, or any package/runtime authority. Normal source integration must preserve the stops until exact accepted prerequisites replace them under fresh review. No workflow run, build, browser install, package operation, publication or deployment is admitted by this disposition.

[rmcdaniel]

Security returned exact bounded SOURCE PASS6663191052 for97fb6fe6/treecee26dda/base7c8e3821. Six inert predecessor/current controls and insertion-only portal/ordering checks pass; managed CodeQL42062792385 is terminal success (three contexts). Normal CI/docs/package/browser/integration workflows did not start under [skip ci]; the affected jobs remain intentionally nonpassing.

Next owner/action: General selects the safe source-check/integration route and exact common producer sources. Central#298 must close its complete APT/libapt prerequisite and Server must publish/select/accept its corrected producer/verifier; sdk-python then binds those accepted immutable sources before replacing these temporary stops. I completed and returned the source inventory/correction to both owners and General; no duplicate bootstrap or parent change is needed. Source PASS supplies no package operation, prerequisite acceptance, runtime, docs dispatch or deployment authority. Current main remains unchanged.

[rmcdaniel]

Server has now normally staged the exact reviewed producer source in draft#1038, e09123b7/tree152c653b/base223cb6f4. This makes its source/verifier proposal concrete; trusted qualification and integration are still pending, package-installing CI remains suppressed, and current Server main is still the affected producer.

The Python integration stop therefore remains in place. Next owners/actions: Server/General complete the safe qualification/source selection for the exact producer, General selects the accepted common APT/libapt preflight and Python source-integration route, and sdk-python binds those accepted immutable authorities before replacing these temporary stops. I reconciled the staging return here and returned the changed upstream dependency to General. No producer build, adoption, prerequisite acceptance or operating effect follows from source staging or this PR's bounded SOURCE PASS.

[rmcdaniel]

Closing this unmerged per-repository stop proposal in favor of the single central APT/setup remediation in durable-workflow/.github#295/#297. The inventory and exact source/control evidence remain available here and on the central issues; the branch is retained. None of these stops entered main, so closing the draft changes no workflow, product, deployed portal or artifact.

Ordinary source work resumes through normal required checks and owner integration. Future adoption of the central fix stays separate from publishing/releasing/promoting artifacts or images whose production path uses networked APT/setup-php, and from independently security-sensitive effects. Server's corrected producer proposal remains its owning source work; no duplicate Python guard/bootstrap or new producer acceptance is inferred.

sdk-python is resuming the existing #123 observer-source slice from accepted #274, with inert controls and no historical runtime/manual full qualification dispatch. #184's explicit invocation/authority/acquisition/build/runtime gates and old-evidence retention remain unchanged. General has the revised source sequence; this supersedes the earlier local-stop integration dependency, not the underlying central fixes.