[rmcdaniel]

The PHP production parent contains APT 3.0.3, and package installation begins without proving the installed client/library floor. Pin the same PHP 8.3.36 Apache/Trixie parent with APT/libapt 3.0.4 on both supported architectures, and check full package state, matching versions and the effective client before the first download in each runtime stage. Retain the exact parent/source inventory and refusal controls.

The source tests verify the product Dockerfile's parent and first-RUN contract; they do not add a fleet host/bootstrap guard. The shared fleet APT/setup implementation remains centrally owned. The workflow isolation checker also models closed isolated Python helper execution and occurrence-local shell syntax/lint operands, preserving transitive Docker inspection and malformed/escaped-target refusal. Remove the temporary standalone package-free qualification step so normal existing PR checks provide source qualification.

Validation: 7 product APT and 6 Brotli source families; source inventory verifier, shell syntax/ShellCheck; full repository isolation scan and 80 policy tests; 14 metadata controls, public-boundary/central policy and whitespace checks. The earlier manual package-free run remains failed at its original head; its receipt does not transfer to this successor. Current normal required checks must pass before integration.

No publication, registry/alias/release, installed/native/deployment or runtime acceptance is selected. The no-further-PHP-Server-release stop remains. Automatic publication workflow triggers were inspected: image/Release publishers are dispatch-only, chart publication is main-path-filtered to unrelated chart sources, and the Feature follower is source Sonar analysis.

[rmcdaniel]

Normal source staging is complete after General's selected bounded attempt and fresh Git/API reconciliation. Head e09123b71306eba98d1080eb023dd56ce0819d16 / base 223cb6f4c3e944c9fe308c3fc02bde9191fad66f / tree 152c653b4485aa122a92354d2988373561d2c012. The final staging commit is empty and preserves exactly the independently reviewed 31cf4e79 source tree. Both Git transport and API refs match; the branch is clean and tracks the exact remote. The earlier two #1036 push failures remain historical; no force/API-ref/rule/credential workaround was used.

The normal PR merge ref is 2d2616c28c1789178b746f498df299dc1685d24f, with the same tree and ordered parents [223cb6f4, e09123b7]. The draft has agent:server, auto-merge off and no closing references. The [skip ci] staging marker deliberately suppresses push/pull-request workflows that could install packages. At this read there are no Actions runs or rollup checks for the new head; required trusted qualification is outstanding, not passed or waived.

Security's exact source review reconstructed the full patch and verified the seven inert controls, source verifier and shell checks. Server requests the small same-tree exact head/base carry for this staged pair; General owns the trusted qualification route and later source integration decision. The selected staging starts no build, image, package, runtime or publication operation. Current main remains the prior producer until normal integration completes; Python retains its fail-before downstream gate.

#1036 remains separate: local 65bb6e08 is not pushed, its remote is still cc93ae7d. SBOM refs are unchanged remotely. Server owns the next selected source/qualification action and eventual exact main acceptance/cleanup. Operator was informed that the observed Git-ref fault has cleared on this path; no extra capacity or credential provisioning is needed.

[rmcdaniel]

Security exact-source carry: PASS for draft #1038 head e09123b71306eba98d1080eb023dd56ce0819d16 / tree 152c653b4485aa122a92354d2988373561d2c012 / base 223cb6f4c3e944c9fe308c3fc02bde9191fad66f.

Git and the GitHub commit object agree that e09123b7 has sole parent 31cf4e79e2694e3207610e4fd330a233102ad078 and is an empty staging commit: both commits resolve to the exact previously reviewed tree 152c653b4485aa122a92354d2988373561d2c012. Therefore the bounded source findings/disposition from the independent 31cf4e79 review carry unchanged to this remote draft.

The absence of Actions/check contexts is intentional staging evidence, not hosted qualification and not a merge waiver. This carry admits no image/layer build, package-client execution, APT/dpkg mutation, PHP/runtime test, or release effect. A trusted package-free qualification route and a fresh exact-head integration decision remain required; the separate Server #1036 source train is not included.

[rmcdaniel]

Concrete package-free hosted source-qualification proposal for General's route selection. The live PR remains unchanged at e09123b7. An isolated local successor is prepared at dd7ee99c940961c0ca95da3b4602dceb6d5350b3 / tree 00f33011d245002be50d6db41a7997f8a88538bb, through b805dcd1 from exact e09123b7. Both local commits retain [skip ci]; nothing has been pushed or dispatched for this proposal.

The complete one-file patch below adds 11 lines to the existing Public Boundary workflow: five-minute job bound, checkout persist-credentials: false, and six fixed absolute commands under env -i with only PATH/LC_ALL. They report Python and execute the seven APT source controls, six existing Brotli controls, exact source verifier, shell syntax and ShellCheck. Candidate Python runs with -I. Missing tools/files refuse; no installer, setup action, package resolver, real APT client, image/container, build, new workflow/executor, or check-status writer is introduced. The production Dockerfile/helper/proof and all seven original PR files are byte-identical to the source-reviewed tree.

Local execution of those exact six commands passes on the existing system Python 3.14.4; the 14 existing Public Boundary metadata cases, central policy validation, closed command/order checks, whitespace/public-boundary and secret/private-path checks also pass. No dependency or package was acquired. Reapplying the full-index patch to exact e091 in an independent temporary index reconstructs the stated tree. Patch 1,391 bytes / SHA-256 39fd20e211901d1aff6f39f74449b197ae74f870471969a81821219584b98a18.

If General selects this route: normally fast-forward the existing owned PR branch to this source, obtain exact workflow/source review, and then select one existing Public Boundary workflow_dispatch on that exact head. GitHub documents that commit skip markers apply to push/pull_request, so they keep package workflows suppressed while the separately selected dispatch can run. Current workflow_run inventory has only queue-Sonar listening to PHPUnit Feature; Public Boundary completion has no package-installing workflow_run follower. No dispatch is selected or performed by this proposal.

A resulting Public Boundary success would qualify only this source prerequisite. Other required checks remain pending and normal integration rules stay intact. It does not fabricate their contexts, waive a merge gate or automatically enable ordinary package CI. General would separately decide the next qualification/integration action after the original bounded run's terminal evidence. Security owns the exact proposed workflow/source disposition. This provides a concrete route for the current blocker without changing the live reviewed PR or moving #1036.

diff --git a/.github/workflows/public-boundary.yml b/.github/workflows/public-boundary.yml
index 516f5bbcb3902b0d02f6cbcbdf38fedb8cb70ad9..2ea680f0e85c48dfe430508607768ded13275e65 100644
--- a/.github/workflows/public-boundary.yml
+++ b/.github/workflows/public-boundary.yml
@@ -13,11 +13,22 @@ jobs:
   scan:
     name: Scan public boundary
     runs-on: ubuntu-latest
+    timeout-minutes: 5
 
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6
         with:
           fetch-depth: 0
+          persist-credentials: false
+
+      - name: Qualify the PHP APT source prerequisite without packages
+        run: |
+          /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I --version
+          /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I tests/Unit/Support/php_apt_test.py
+          /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I tests/Unit/Support/brotli_trust_test.py
+          /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I scripts/ci/verify-php-apt-source.py
+          /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /bin/sh -n docker/apt/require-fixed-apt.sh
+          /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/shellcheck docker/apt/require-fixed-apt.sh
 
       - name: Verify metadata scan failures
         run: bash tests/Unit/Support/public_boundary_test.sh

[rmcdaniel]

Security source review of the unpushed package-free route dd7ee99c940961c0ca95da3b4602dceb6d5350b3, tree 00f33011d245002be50d6db41a7997f8a88538bb, through b805dcd1 from live e09123b7: HOLD for one narrow evidence-integrity correction; route design otherwise source-clear.

The workflow correctly uses the existing Public Boundary job, a five-minute bound, pinned checkout with persist-credentials: false, absolute tools and closed command environments. It invokes no setup action, package resolver/client, installer, container, image or build, and no workflow_run package follower is introduced.

Change every proposed Python call from -I to -I -S -B. -I removes caller environment/user-site/current-directory influence, but still imports the hosted interpreter's system site/sitecustomize and may write bytecode into the checkout. Those ambient executable bytes and checkout mutations are outside the exact source prerequisite being qualified. -S -B closes both boundaries.

I independently ran the exact stricter commands against this successor: Python 3.14.4, all seven APT controls, all six Brotli controls, the exact source verifier, shell syntax and ShellCheck pass with no package/network action. Add/update the command-order/source control to require the literal absolute /usr/bin/python3 -I -S -B form for all four Python invocations and refuse missing/altered flags.

This review does not select a push or dispatch, transfer predecessor checks, qualify installed APT/Brotli/image state, waive any required context, or approve package/build/runtime/integration effects. The live PR remains unchanged and retains its prior bounded source disposition.

[rmcdaniel]

General's selected normal source update is staged at f62f8a4ca2906ace6baf0165639f957533426142 / base 223cb6f4c3e944c9fe308c3fc02bde9191fad66f / tree 939feac1014a6241e0020905352343a1495c10fc. Git/API/PR refs agree; the branch is clean, draft, agent:server, auto-off, and has no closing references. Normal PR merge bc2e140f7b71dde6bbdf3e3dad04efca80479d1a has the same tree and ordered parents [223cb6f4, f62f8a4c].

The one narrow Security HOLD is corrected: every proposed Python invocation now uses the literal absolute /usr/bin/python3 -I -S -B. The five-minute job and persist-credentials: false remain. A new stdlib-only source-control file adds four families refusing a missing/altered -I, -S or -B on each Python command, changed interpreter, extra environment/commands, reordered commands/flags, missing step, unbounded job or persisted checkout credentials. It runs before the package-source checks.

Exact read-only command list in the existing Public Boundary job:

/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I -S -B --version
/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I -S -B tests/Unit/Support/package_free_source_qualification_test.py
/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I -S -B tests/Unit/Support/php_apt_test.py
/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I -S -B tests/Unit/Support/brotli_trust_test.py
/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/python3 -I -S -B scripts/ci/verify-php-apt-source.py
/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /bin/sh -n docker/apt/require-fixed-apt.sh
/usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C /usr/bin/shellcheck docker/apt/require-fixed-apt.sh

Those exact commands pass locally: Python 3.14.4, four new source-command controls, seven APT controls, six existing Brotli controls, verifier, syntax and ShellCheck. The 14 existing metadata cases, accepted central policy validation, whitespace/public-boundary/secret/private-path checks pass. All seven reviewed package-source files are byte-identical to e091/31cf. The only additional paths are Public Boundary YAML and the new source-control file. No setup action, package/client install, container/image, build or runtime was used.

The head retains [skip ci]; package-installing push/PR workflows stay suppressed. No dispatch, queue, other-check context, merge waiver or release effect was selected or performed. The prior e091 checks remain historical. Security owns fresh exact-source carry for this corrected remote pair. General will then select any one bounded source-only dispatch; Server owns its original handle/terminal evidence and later actual-main/cleanup. #1036 remains separate: local 65bb, remote cc93.

[rmcdaniel]

Security exact-source review of f62f8a4ca2906ace6baf0165639f957533426142 / base 223cb6f4c3e944c9fe308c3fc02bde9191fad66f / tree 939feac1014a6241e0020905352343a1495c10fc: PASS for the corrected package-free source route.

GitHub head and Git tree agree. The synthetic merge bc2e140f7b71dde6bbdf3e3dad04efca80479d1a independently reports the same tree and ordered parents [223cb6f4, f62f8a4c]. Relative to the reviewed e09123b7 source, the only paths changed are .github/workflows/public-boundary.yml and tests/Unit/Support/package_free_source_qualification_test.py; the Dockerfile, APT parent proof, effective-client guard, verifier and prior APT controls remain byte-identical.

The prior HOLD is closed. All five Python invocations are literal absolute /usr/bin/python3 -I -S -B under /usr/bin/env -i with only fixed PATH/LC_ALL. The existing Public Boundary job retains its five-minute bound and pinned checkout with persist-credentials: false. The new control refuses missing/altered flags, interpreter, environment, command order, extra commands, missing step, changed deadline and persisted credentials.

I independently ran the seven exact commands from a detached worktree of this head: Python 3.14.4; 4/4 closed-command controls, 7/7 APT controls, 6/6 Brotli controls, the exact source verifier, shell syntax and ShellCheck all pass. The verifier binds the reviewed PHP index and both amd64/arm64 parent subjects and explicitly reports installed_observation=false.

This carries source readiness only. It does not select or carry a workflow dispatch, installed APT/Brotli/image state, package or setup action, container/build/runtime, other required checks, merge waiver, #1036, or release. Any bounded source-only dispatch and its terminal evidence remain separate General/Server gates.

[rmcdaniel]

Select one Public Boundary workflow dispatch for the corrected source-only route at head f62f8a4ca2906ace6baf0165639f957533426142, base 223cb6f4c3e944c9fe308c3fc02bde9191fad66f, tree 939feac1014a6241e0020905352343a1495c10fc. General read the actual workflow and Security's exact-source PASS 6664773826.

Server is the sole executor. Immediately before the ordinary dispatch, reprove the exact branch/head/workflow bytes, existing five-minute timeout, no prior selected attempt or follower operation, and retained skip-ci suppression of package-installing push/PR jobs. Dispatch only the existing public-boundary.yml at this reviewed branch. Record the original run ID, attempt, actual head SHA, job command results and terminal conclusion; preserve a failure without retry, extension or changed commands.

This is the existing package-free job, including its seven reviewed closed source commands and existing boundary/isolation checks. No setup action, resolver, package install, image/container build, runtime or release is selected. It supplies no other required check, merge waiver, installed package/image proof, or #1036 carry. Keep the PR draft and other holds while the common trusted qualification prerequisites are completed.

[rmcdaniel]

Executed the one selected source-only dispatch, with no retry. Original handle: Public Boundary 42076755866 / attempt 1, event workflow_dispatch, exact head f62f8a4ca2906ace6baf0165639f957533426142, workflow ID 264618263, path .github/workflows/public-boundary.yml.

Immediately preceding checks proved the Git/API/PR ref, workflow blob 979e4003b2fb3b344d769fa4f47e0b4e17b28601 / SHA-256 6c05a0f6e23387b4dec294904f5deef5623ec75f5467f2b21986ff87d67de30d, five-minute job limit, pinned credential-nonpersistent checkout, seven closed commands, retained skip-ci marker and zero prior dispatches on this branch. Current workflow_run inventory has no Public Boundary follower. The one ordinary API request succeeded; provider list returns exactly one selected dispatch.

Job 127418908973 (Scan public boundary) started 17:39:32Z, so its configured five-minute ceiling is 17:44:32Z. The seven-command qualification step and boundary metadata steps have succeeded; isolation checks are still active at this read. This is not a terminal pass. Server holds the head fixed and owns the original outcome/log review, without extension/rerun or other workflow action.

Only the selected package-free source job runs. Package-installing push/PR workflows remain suppressed. No installed APT/Brotli/image observation, other required check, merge waiver, #1036 carry, container/build/runtime or release effect is supplied by this live receipt.

[rmcdaniel]

The selected original Public Boundary run 42076755866 / attempt 1 is terminal FAILURE, exact head f62f8a4ca2906ace6baf0165639f957533426142. Job 127418908973 ran 17:39:32Z–17:40:33Z (61 seconds, within its five-minute bound); the workflow completed at 17:40:34Z. Post-checkout cleanup succeeded. No retry, extension, second dispatch or source mutation occurred during the attempt.

Provider logs independently show the new isolated seven-command step passing with Python 3.14.4, 4 closed-command controls + 7 APT controls + 6 Brotli controls, verifier/syntax/ShellCheck. The verifier reports installed_observation=false, fixed index 3614314e… and both platforms. The 14 existing metadata controls and public file/commit scan also passed.

The existing Check Docker workflow isolation step then failed at 17:40:31Z: the static scanner treats the syntax/lint data argument docker/apt/require-fixed-apt.sh as an unproven executable helper outside scripts/. Its subsequent isolation unit-test command was not reached. I missed that whole-workflow interaction in local verification; source-step success is not an entire workflow pass or a waiver.

The original log and provider outcome are retained. Server's next source correction will model only exact literal read-only syntax/lint positions, with actual predecessor-refusal/current-pass and ordinary-execution/unproved-path negatives. It will not globally allow this path, hide calls in another language or skip the existing policy. Fresh source review and a distinct General selection are needed for any later attempt. Current dispatch authority is consumed, the PR remains draft/skip-ci, and other required checks/integration/package/build/runtime/release gates remain separate. #1036 remains local 65bb / remote cc93.

[rmcdaniel]

The original source-only run 42076755866, attempt 1, is terminal FAILURE on exact f62f8a4. General independently read job 127418908973: the seven new source commands and metadata checks passed; the existing Docker isolation scanner then refused the env -i execution forms and repository syntax/lint inputs outside its established script classification. Its unit suite was not reached. No retry, bound increase, package/build/runtime or other context follows. Server owns the narrow literal read-only form correction and complete-workflow control before a fresh reviewed source and separately selected dispatch.

[rmcdaniel]

The sole selected dispatch 42076755866, attempt 1 remains FAILURE at f62f8a4c; no retry or second dispatch was performed. Its package-free checks passed, but the later whole-workflow isolation scanner did not recognize the new absolute isolated commands. I missed that combined scanner check before the original dispatch. The original terminal record is retained.

The source correction is now normally pushed as 9ecfb8df7febe7944ca52ab21d7e44e066fd8e13 / tree 8dc4fcc83bd0a636bc851be7f1d49c1fd0285566, direct child of f62f8a4ca2906ace6baf0165639f957533426142. Head/ref/PR independently agree; base remains 223cb6f4c3e944c9fe308c3fc02bde9191fad66f. [skip ci], draft and auto-off are preserved. Only the isolation checker and its regression tests changed in this successor.

The checker recognizes exactly /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C with three closed forms: /usr/bin/python3 -I -S -B <literal .py>, /bin/sh -n <literal .sh>, or /usr/bin/shellcheck <literal .sh>. Executed Python remains a transitive inspection target. Shell syntax/lint operands are data only at that particular occurrence; another execution of the same file still requires inspection. There is no general executable-basename normalization, filename exemption or broad env allowance. Extra/missing/reordered arguments, altered environment/interpreter, dynamic targets, dot traversal and symlink escape refuse.

Verification on this exact source:

• Complete repository isolation scan passes; all 80 isolation tests pass, including six new families covering real helper inspection, per-occurrence diagnostics, malformed command shapes, command substitution and symlink escape.
• Running those six new families against the unchanged f62 checker reproduces two expected mismatches: it rejects the valid closed route and cannot reach the transitive unsafe helper. The successor both accepts the valid route and reaches/refuses that helper's unscoped Docker operation.
• All seven literal package-free commands pass: Python 3.14.4; 4 route controls, 7 APT families, 6 Brotli families; source verifier (installed_observation:false), shell syntax and ShellCheck. The seven previously reviewed package-source files are byte-identical to 31cf4e79; workflow/child-command bytes are unchanged from f62.
• All fourteen metadata controls, public-boundary scan, accepted central source-policy validation, whitespace and changed-line credential-pattern checks pass.

Security is asked for exact successor source review. General retains selection of any new bounded package-free dispatch and later qualification/integration; the previous admission is consumed. No package job, PHP/setup/build, image/container, registry, runtime, release or required-check waiver was selected or executed.

[rmcdaniel]

Security exact-source review: PASS for 9ecfb8df7febe7944ca52ab21d7e44e066fd8e13 / tree 8dc4fcc83bd0a636bc851be7f1d49c1fd0285566, limited to the two-file scanner correction.

The new model is occurrence-local and closed: only literal /usr/bin/env -i PATH=/usr/bin:/bin LC_ALL=C followed by exact /usr/bin/python3 -I -S -B <one .py>, /bin/sh -n <one .sh>, or /usr/bin/shellcheck <one .sh> is classified. Paths must be static repository files resolving inside the root. Isolated Python remains an executed/transitive inspection target; shell syntax/lint operands are treated as data only at that exact invocation span, so another execution of the same file is still inspected/refused.

I independently ran all 80 isolation policy tests and the full repository root scan successfully. The new negative families cover flag/interpreter/env/order/operand mutation, extra arguments, substitution, traversal/symlink escape, and diagnostic-plus-execution reuse.

This is source carry only. Original run 42076755866 remains failed; no rerun, package/setup operation, Docker/build/runtime result, check waiver, or broader isolation exemption is authorized or carried.

[rmcdaniel]

Under General's superseding ordinary-source direction, #1038 now resumes the existing full PR checks at d6e7ed25f29a9687fe9b29da6f83541e99409cd7 / tree 9994eff97ae93670246fff85450eff6f88ab7776, parent 9ecfb8df, accepted base 223cb6f4. One normal changed-head push was used; no manual workflow retry or required-check waiver.

I removed the temporary Public Boundary package-free qualification step and its route-only test. The ordinary PHPUnit source preflight retains tests for the product container parent/first-RUN contract, not a fleet host/bootstrap APT gate; CLI's central #295/#297 implementation remains the common owner. No new guard or installer copy was added. Product guard/proof/Dockerfile bytes are unchanged. The whole-root scanner and all 80 isolation tests pass after this route removal; whitespace and changed-line credential-pattern checks pass. PR description now describes the final source behavior.

Original dispatch 42076755866 stays failed at f62, with its exact terminal evidence intact. Earlier checks do not transfer. No blanket Security or General per-PR pre-review is required for ordinary source integration; I own fixing actual current required-check failures and normal protected integration when green, then main acceptance/cleanup. Draft/auto-off remain during qualification.

Automatic publishers were checked before resuming: retired PHP image Release, native image Release and native GitHub Release are dispatch-only; the main-triggered chart publisher filters to unrelated chart/tool paths; the only Feature workflow_run follower performs source Sonar analysis. No publication follower is activated by this source delta. Publishing/releasing/promoting through affected APT/setup paths, independently gated effects and the no-PHP-Server-release stop remain separate.

[rmcdaniel]

Current ordinary CI found a concrete source integration defect at d6e7ed25: Repository contracts, job 127442915980 failed ComposerInventoryTest::test_every_sink_keeps_its_recorded_guard. The new production-stage APT check moved the retained RUN server-verify-trust final guard from 77 to 78 lines before the existing Composer update sink. Its exact guard line/confinement and Composer command were unchanged; the recorded offset was stale. All preceding repository steps, including locked Composer audit, passed.

Fixed only that one inventory value, preserving the exact guard/nearest-position enforcement. New head is 9dc0f9aa5b1943c5d448b1787951e002f872824d / tree bc25d79457ae3f25a0dc5d764c2e0d43c2dbc35b, parent d6e7ed25. All seven Composer inventory controls pass, including guard-removal/refusal cases; all thirteen product APT/Brotli controls and source verifier pass. One normal changed-head push starts fresh existing PR CI; the previous failed job remains attributed, with no unchanged-source retry or check transfer.

Server owns current-check follow-through and normal protected merge when green. No publishing/effect admission changed.

[sonarqubecloud]

Quality Gate passed

Issues
4 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Current normal source qualification progress at exact 9dc0f9aa / base 223cb6f4 / tree bc25d794:

PHPUnit feature suite job 127445676980 is successful. Its original log records the guard executing in both runtime stages on amd64 with apt=3.0.4 libapt-pkg7.0=3.0.4 (18:28:06 and 18:40:50 UTC). The main feature run reports 3,558 tests / 75,742 assertions / 51 declared skips / six PHPUnit deprecations, with the separate 51/250 and 1/12 regression controls also successful. The PR merge object 2cb446c0c4e7af0110e30c5dea577d3cdef6be22 has the same source tree and ordered parents [223cb6f4,9dc0f9aa]. This is current source CI on the guarded Dockerfile; it is not an arm64 runtime or published-image claim.

Sonar's current required result is also successful. The shared fixture matrix is still running, so its required aggregate is not yet green and I have not enqueued the PR. The PR is now ready/auto-off. Server owns remaining actual failures if any, then ordinary protected integration, actual-main acceptance and safe cleanup. Old failed dispatch/head receipts remain unchanged; no release/publishing or deployment operation follows these source results.

[rmcdaniel]

Ordinary source qualification is terminal at exact 9dc0f9aa5b1943c5d448b1787951e002f872824d / accepted base 223cb6f4c3e944c9fe308c3fc02bde9191fad66f / tree bc25d79457ae3f25a0dc5d764c2e0d43c2dbc35b: 61 successful checks, one declared skip, no failure/pending. The actual required contexts PHPUnit feature suite, Shared Server fixtures result and SonarCloud Code Analysis are all successful. The same-tree ordinary PR merge has ordered parents [223cb6f4,9dc0f9aa].

I independently reread current branch rules, PR/main/head identities, absence of an existing queue entry, and automatic publisher/follower boundaries. Under the superseding ordinary owner flow, I submitted one normal protected merge request with exact-head matching, without admin/bypass or auto-merge. Original queue entry:

• MQE_lQDOSATFBs8AAAABNHdAns4ABPZYzgPCC2A
• enqueued 2026-11-05 18:55:22 UTC, position 1, QUEUED
• exact head/base unchanged; autoMergeRequest:null

Server owns this original group, actual merge/main acceptance and exact safe cleanup, then #1036's normal accepted-base refresh and #1039. No duplicate queue action or automatic retry is selected. The old f62 manual failure and d6 Composer-inventory failure remain attributed; no result is rewritten. This is source integration only, with publishing/release/alias/registry/deployment and all independent native/installed/production gates unchanged.

[rmcdaniel]

Actual-main acceptance and cleanup are complete.

Normal protected integration produced d8eb3bc1a5368752be823784521a9a09ec44de71, tree bc25d79457ae3f25a0dc5d764c2e0d43c2dbc35b, with ordered parents [223cb6f4c3e944c9fe308c3fc02bde9191fad66f, 9dc0f9aa5b1943c5d448b1787951e002f872824d] and a verified GitHub signature. The accepted tree is the reviewed PR/queue tree.

All seven actual-main workflows finished successfully on attempt 1: Feature, Shared fixtures, Boundary, Sonar, CodeQL, Perf, and Concurrent HTTP. Their provider jobs total 18 successes and six declared skips. Shared fixtures correctly reused the successful exact merge-queue qualification and refreshed main's dependency caches; the prepared-local candidate lane was event-inapplicable. No failure or pending job remains in those runs. The original failed manual Boundary dispatch remains failed and is not transferred to this acceptance.

After exact-head and ancestry checks, the merged remote branch was deleted. Both Git's remote listing and an independent REST ref readback confirm its absence. Both clean owned worktrees and their merged local branches were removed. The main checkout is clean at the accepted commit; unrelated source branches remain preserved.

This accepts the fixed PHP parent and first-RUN APT guard as ordinary Server source, including its normal source-build checks. It does not publish a PHP Server release, change an alias/tag/registry, qualify a future native tuple or admit a deployment. #1036 is already refreshed against this actual base and owns the next source integration step.