From 775cc303094c0ccd73ecd49b9a2a886409d60fa2 Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Thu, 5 Nov 2026 16:11:33 +0000
Subject: [PATCH 1/2] Stop integration before the unqualified Server APT build
 [skip ci]

---
 .github/workflows/ci.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0744f227..c61579f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -210,6 +210,13 @@ jobs:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
           path: sdk-python
+      # The Server PHP parent contains affected APT. Keep this consumer closed
+      # until #295 selects an accepted fixed parent and first-RUN version guard.
+      - name: Refuse the unqualified Server image build
+        shell: bash
+        run: |
+          echo '::error title=Server producer blocked::Integration image builds require the fixed APT producer in durable-workflow/.github#295.'
+          exit 1
       - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"

From 97fb6fe6cdb919d766dcc8342687c89beb0adc7b Mon Sep 17 00:00:00 2001
From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com>
Date: Thu, 5 Nov 2026 16:17:01 +0000
Subject: [PATCH 2/2] Refuse browser APT dependency setup until the common pair
 check is accepted [skip ci]

---
 .github/workflows/docs-pr.yml | 6 ++++++
 .github/workflows/docs.yml    | 6 ++++++
 2 files changed, 12 insertions(+)

diff --git a/.github/workflows/docs-pr.yml b/.github/workflows/docs-pr.yml
index 64d22a92..212ad73c 100644
--- a/.github/workflows/docs-pr.yml
+++ b/.github/workflows/docs-pr.yml
@@ -38,6 +38,12 @@ jobs:
           clients: pip,python
       - name: Install package and documentation dependencies
         run: pip install -e '.[docs]'
+      # Central #298 must prove both APT and libapt before this networked install.
+      - name: Refuse unqualified browser dependency installation
+        shell: bash
+        run: |
+          echo '::error title=APT prerequisite blocked::Browser dependencies require the accepted APT/libapt preflight in durable-workflow/.github#298.'
+          exit 1
       - name: Install Chromium
         env:
           NODE_OPTIONS: --use-openssl-ca
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 4232aff6..5978c9f7 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -106,6 +106,12 @@ jobs:
           echo "version=$version" >> "$GITHUB_OUTPUT"
       - name: Install package and documentation dependencies
         run: pip install -e '.[docs]'
+      # Central #298 must prove both APT and libapt before this networked install.
+      - name: Refuse unqualified browser dependency installation
+        shell: bash
+        run: |
+          echo '::error title=APT prerequisite blocked::Browser dependencies require the accepted APT/libapt preflight in durable-workflow/.github#298.'
+          exit 1
       - name: Install Chromium
         env:
           NODE_OPTIONS: --use-openssl-ca