[rmcdaniel]

Native SBOM evidence needs an exact connection between the OCI platform/config, SPDX content and the release's source/run identity. This adds bounded OCI archive graph checks, SPDX 2.3 and provenance-predicate validators, reviewed tool/dependency inputs and synthetic source controls for those boundaries.

Archive validation rejects ambiguous paths, duplicate members, links, wrong subjects/platforms, inconsistent config/layer graphs and resource-limit violations without extraction. Policy validation checks document references, checksums, relationships and the fixed release/run/platform identity. Ordinary source CI runs both test modules through a separate hash-locked dependency job; promotion-contract discovery stays limited to its own dependency-free families.

This is a bounded component of #1012. The actual exporter, archive custody, scanner invocation, generated output, provider/attestation authority and publication wiring remain unfinished; generation is null and the standalone generation path refuses. No build/export/scan/registry/attestation effect is enabled by these source tests.

Validation on actual accepted Server base cf069f63: 40 SBOM controls, 42 promotion controls, 84 isolation controls and 17 pip/Composer inventory controls pass; the full isolation scan and accepted central-policy inventory validation pass. No local wheel, image or layer was acquired and no local package was installed. Head 19ba1bbf / tree bb80f5b4 is a normal non-rewriting merge of the prepared source and actual accepted main. Fresh ordinary CI qualifies this exact head; historical checks are not transferred.

All 61 current ordinary checks are terminal: 60 success / one declared skip, including all three required contexts and the actual SBOM source-test job. Protected source integration does not qualify generation or publication.

[rmcdaniel]

Prepared ordinary source-test wiring for this draft, without starting its full PR train ahead of the selected #1038 → #1036 → #1039 order.

Exact source is 1bb29ec93bdee9b36c56ad59dc5517cd6d4e096c / tree 1aaf8593a36ac52e32912c8820105c35d9fc3d5e, parent fed5b115. It is preserved on owned WIP branch wip/server/1012-source-ci-1bb29ec9; the PR head remains fed5b115 until its normal refresh/publication slot in the ordered train.

The five-file successor adds a real bounded source-test job to the existing PHPUnit workflow, preserving the closed five-step central action preflight. After the existing approved patched-pip action, isolated pip installs the five fixed wheel URLs with required SHA-256 hashes and no dependency solve. Isolated Python runs only the synthetic archive/predicate tests. The source requirements are checked against the existing metadata and the new pip sink is bound to the actual checked bootstrap in the ordinary sink inventory. No fleet APT/setup guard or installer is copied.

Forty SBOM source families, ten pip inventory controls, complete repository isolation scan, central source-policy validation, whitespace/public-boundary and changed-line credential-pattern checks pass locally. No wheel/layer/image was acquired and no local package was installed for this work; these tests use existing development tooling. Actual normal source CI for this successor will qualify development test execution only, never the future confined generator/validator or any archive/scan/publishing effect. Generation remains null. Server owns the eventual accepted-base refresh, ordinary required checks and remaining producer source.

[rmcdaniel]

The ordered #1039 preparation is now preserved at a516260529673ab98d9fc14d9dc3e9167fef57b1 / tree 1fb719b62bd2e026c98419ff3ce08ddafc990b45 on the existing owned WIP ref wip/server/1012-source-ci-1bb29ec9. It normally combines the source-test wiring with #1036's prepared source (which already contains the qualified #1038 source). Actual accepted-main ancestry must still be merged before publishing this successor to the PR ref; current PR head stays fed5b115.

This combined-source check caught and fixed one real future CI interaction: the promotion-only workflow's native_*test.py discovery would also load SBOM tests without that job's schema dependencies. Its trigger/discovery patterns now select the qualification and alias families explicitly. Both intended discovery commands pass all 29+13 promotion tests; all 40 SBOM source tests run in their separate dependency-qualified job. No tests were disabled or silently treated as skipped.

Combined verification: full repository isolation and 84 isolation tests pass, both promotion families pass, 17 pip/Composer inventory controls pass, central policy validation and whitespace/changed-line credential-pattern checks pass. Source metadata flags still prohibit the future confined validator/generator effects; README now distinguishes the original metadata-only observation from ordinary development test-tool installation. No local wheel/image/layer acquisition or install, scanner, Docker/container, registry/attestation/Release or runtime operation occurred. Server owns actual-base refresh and normal PR checks after #1036 reaches main; no blanket per-PR source review gate is added.

[rmcdaniel]

The normal maintained-base refresh is published to this PR at 19ba1bbfee0a1e37ebe2c877caa1542308e9da9f / tree bb80f5b4e29c106b505c39601386aaf063aea81a, ordered parents [a5162605, cf069f63]. GitHub now reports actual accepted base cf069f6396f29e8f90563a6d75108779e30c3a2a; the PR stays draft, auto-merge off and with no closing references. The actual merge tree equals the independently predicted combined tree. No branch history was rewritten.

The earlier #1036 actual-main prerequisite is complete in its acceptance/cleanup receipt. The refreshed delta is only this component's 16 paths; accepted promotion, retention-comparison and CI pacing source are inherited unchanged.

Current combined source verification passes: 40 SBOM, 42 promotion, 84 isolation and 17 pip/Composer inventory controls, plus the complete repository isolation scan and accepted central policy's actual workflow inventory validation. The SBOM dependency job is separate from the narrowly selected promotion families, so the latter does not accidentally import schema dependencies. These checks used existing development libraries; no local wheel, package, image or layer acquisition occurred.

Fresh ordinary PR checks are starting for this exact head. Historical checks do not qualify it. This source component still does not wire or admit an actual exporter/archive, scanner, generated SBOM, provider attestation or publication. Generation remains null. Server owns current CI/corrections and the later protected integration/main acceptance; the remaining #1012 producer and artifact qualification steps stay explicit.

[sonarqubecloud]

Quality Gate passed

Issues
38 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Submitted the current exact source pair once through the normal protected merge queue at 2026-11-05 21:58:06 UTC.

Head 19ba1bbfee0a1e37ebe2c877caa1542308e9da9f, accepted base cf069f6396f29e8f90563a6d75108779e30c3a2a, tree bb80f5b4e29c106b505c39601386aaf063aea81a. Independently fetched ordinary PR checkout f0a192eb246c813578c54bd63a9f24a7e9ab1448 has the same tree and exact ordered parents [cf069f63, 19ba1bbf]. Local/remote source head and accepted main agree; the owned checkout is clean.

All 61 current ordinary checks are terminal: 60 success / one declared skip, including all three required contexts and the actual Native SBOM source components job. No historical checks transfer. The PR was marked ready after this verification; it has no automatic merge request or closing references.

Entry MQE_lQDOSATFBs8AAAABNIsT2s4ABPZYzgPDYSU, position 1, initially QUEUED. No entry existed before this single normal submission. I own its original group/result, actual-main acceptance and safe cleanup. No unchanged-source rerun or further submission is automatic.

The actual changed-path inventory reaches no automatic artifact publisher: native publication, alias promotion and GitHub Release remain dispatch-only; no chart paths changed; PHP Server publication remains stopped. This accepts source tests/components only. Exporter, actual OCI archive/custody, scanner, generated output/provider authority, attestation and publication remain the named #1012 work; generation is null.

Original queue group independently fetched as 0166afb225c75feb8f67d2d8963e49183550763c, the same tree and exact ordered parents above. Original attempt-1 runs: Shared Server fixtures 42117403315, PHPUnit Feature 42117403316, Public Boundary 42117403327. Their terminal result remains pending.

[rmcdaniel]

Actual-main acceptance and cleanup are complete. Normal protected #1039 merge is 0166afb225c75feb8f67d2d8963e49183550763c, tree bb80f5b4e29c106b505c39601386aaf063aea81a, with exact ordered parents [cf069f6396f29e8f90563a6d75108779e30c3a2a, 19ba1bbfee0a1e37ebe2c877caa1542308e9da9f]. Independent fetched Git and REST objects match; GitHub's signature verifies. Merge time was 22:22:39 UTC.

The single original protected queue entry MQE_lQDOSATFBs8AAAABNIsT2s4ABPZYzgPDYSU completed normally. Its original group is the accepted merge above. Shared 42117403315 has all 45 jobs successful; Feature 42117403316 and Boundary 42117403327 also passed, all attempt 1. No second submission or rerun occurred.

All six actual-main source/analysis/graph workflows passed on attempt 1: Boundary 42120974678, Sonar 42120974653, Feature 42120974629, Shared 42120975696, CodeQL 42120972088, and dependency graph 42120981395. Their provider jobs total 16 success / 6 declared skips. The separate Merge queue Sonar workflow-run 42123321766 is the expected non-merge-group skip. Current commit checks are terminal: 69 success / 8 skips / 0 pending or failing. All three effective protection contexts, with their pinned integration IDs, are green.

The actual-main SBOM source job 127573031328 independently reports 10 archive + 30 policy tests, all passing. This is the bounded source component of #1012. Generation remains null/unwired; exporter format/output, custody, scanner execution, generated results, provider/attestation authority and publication remain unfinished. Ordinary source CI does not qualify those effects or a published native tuple.

After fresh exact-head and ancestry checks, both owned merged refs were deleted: feat/server-1012-native-sbom at 19ba1bbf and wip/server/1012-source-ci-1bb29ec9 at a5162605. Independent Git listings are empty and both REST refs return 404. The clean source worktree/local feature branch were removed. The session checkout is clean and fast-forwarded to accepted 0166afb2; unrelated and held refs are preserved.

The next source action is the prepared #1040/#699 literal-parser PR on this accepted base, followed by its own fresh ordinary CI. The reviewed local retry-v2 proposal remains separate and does not enable a producer or SDK adoption.