Repository navigation
Integrate and maintain SonarQube Cloud across repositories #187
Description
Outcome
Use SonarQube Cloud across the product repositories as a maintained source-quality check, with accurate repository badges and meaningful review of findings.
Acceptance
- Each repository is bound to its corresponding Sonar project; private source and results remain private.
- CI scans the exact checked-out revision, reports its quality gate, and preserves PR comments, annotations and checks.
- Forks receive no analysis credential. Approved actions are pinned, and scanner credentials are scoped to the scan step.
- Sources and tests are classified deliberately; generated files, dependencies and disposable outputs are excluded.
- Coverage is imported when a real report exists; missing coverage is never presented as measured coverage.
- Existing test, release and deployment checks remain required. Valid findings are fixed or explicitly triaged, with no blanket acceptance to manufacture a green gate.
- Readable setup and triage instructions describe the quality profile, gate, notification path and maintenance responsibility.
Server changes are limited to a separately coordinated CI/configuration/README window. No runtime, native/shared fixture, package version or frozen actor change is part of this task.
Activity
rmcdaniel commentedon Oct 15, 2026
Public rollout delivered
All 11 public repositories now have the pinned CI scanner, deliberate source/test classification, README quality-gate badges, and a required Sonar app check on main. The setup revisions passed main analysis; subsequent product changes qualify independently. Existing functional/release checks remain required, and trusted scanner secrets stay unavailable to forks.
Setup PRs: Workflow802, PHP175, Python155, Rust98/99, Server481, Waterline192, CLI51, AI21/22, Sample226 and Website237. Shared guard/docs188–191 pass on main. Waterline's complete candidate passes its normal audit, database/image, browser and Sonar checks; its byte-identical main tree has a passing Sonar scan while the automatic normal main copy still runs.
Useful tuning includes correcting test-script classification and Oracle-dialect misclassification of plain SQL, plus individual reviewed false-positive dispositions for concrete local fixtures. Existing production findings and held major-version branches remain open; a passing new-code gate is not a clean legacy-backlog claim. Product coverage is explicitly unmeasured in these static scans; the shared control-plane imports actual coverage.
PR comments, inline reports and checks stay enabled. Ongoing configuration and triage ownership is recorded; private-repository/account follow-through remains in its private owning record. Full organization completion is not claimed while that private dependency remains unresolved.
Completed setup branches/worktrees are retired. The Composer finding exposed during Waterline setup remains independently owned at Waterline193/194 through publication and installed verification. Passing visual archive collection is being narrowed separately; completed task-owned bulk screenshot exports were deleted without changing original check outcomes.
Finding review follow-through
PHP SDK169 now passes its exact CI and Sonar runs at
1d90256d, with35 successful checks/one conditional skip and zero open findings. Qualification code is confirmed as test code rather than production code. This reclassification reduced74 reports to4; three actual source cleanups then passed analyzer verification, and the intentional context-bearing example parameter has an individual acceptance reason. The example lock is unchanged and its remaining performance qualification is still open. Protected SDK111 source is unchanged: nine deliberate fixture/assertion/signature reports have individual accepted reasons, while its production finding remains open.Website review resolved eleven
javascript:S2871reports as false positives after reading all four affected scripts. These sorts normalize object-key sets, catalog names, advisory identifiers and generated Git path lists. Their deterministic UTF-16 string order is intentional. Replacing it with host-locale ordering would not fix a defect. Each report contains its specific source reason, independently read back asFALSE_POSITIVE; the rule remains enabled for other arrays. No source or product behavior was changed for these dispositions.Further source review resolved eight specific false positives with individual reasons and readback: guarded Helm extraction into fresh private directories, an explicit local CLI output path, temporary SSH keys deleted within the build layer, deferred-then-rethrown callback cancellation, intentional constructor validation, a noncryptographic wake-cache key and an internal test fixture writer.
Two Waterline installer reports were actionable. Waterline196 / PR197 replaces direct execution of downloaded installers and corrects the development container's Node18 versus locked Vite7 requirement. It is delivered at
0d8b8214, tree6e888e21, with candidate and independent fresh-main acceptance: actual image build, 93 frontend tests, production build, Sonar, database/Laravel, both service-image architectures and published-tuple checks pass. Main has 28 successful checks and three unrelated conditional skips. Issue196 is closed with the verified outcome. The first failed temporary-mount check remains failed with its concrete correction. Completed local resources and branches are removed.The Rust SDK blocking-sleep report is individually FALSE_POSITIVE after source review. Its test deliberately blocks a synchronous callback beyond the original query deadline, then asserts zero completion/failure submissions. An async sleep would remove the case being tested. The Python hardcoded-token report is also a conformance fixture: a synthetic value is passed to an in-memory transport at a reserved invalid host. Both source reasons and final statuses are read back; the runtime rules stay enabled.
Waterline's exact merged-main Sonar scan passes and independently marks both original unverified-installer reports CLOSED/FIXED. These are source fixes, distinct from the individually reviewed false positives.
Workflow803 corrects the Quality Gate badge layout. All applicable candidate checks pass, and actual GitHub-rendered main HTML confirms all six badges in the existing centered row. The Sonar image and destination are preserved.
The Server owner corrected runtime projection duplication, the eleven earlier maintainability findings and the later activity-summary complexity report. Current PR478 at
8a0b244bhas a passing app/scanner check, zero OPEN PR issues and 2.2% duplication under the unchanged 3% threshold, independently read from GitHub and Sonar. Exact whole-source CI remains separately pending; no native CI logs or artifacts were retrieved for this review.The wider legacy bug/security backlog remains under review. Neither a passing new-code gate nor these specific dispositions establish that every report is resolved. Incoming PR comments, annotations and checks remain enabled.
rmcdaniel commentedon Oct 16, 2026
README badge audit
Reviewed all 11 public repositories after the reported Workflow and Server alignment problems. Each live Quality Gate badge resolves to the correct Sonar project. Nine READMEs put it in a separate paragraph from their existing badge row.
Workflow's #803 is already delivered.
.githubhas one badge and no conflicting row.All nine candidates have been rendered through GitHub's Markdown API: Quality Gate now shares its existing paragraph with the other badges, and the four centered layouts retain their centering. Image and dashboard project keys are preserved. Only README markup changes.
All nine corrections are merged after their required CI and Sonar checks passed. Every actual default-branch GitHub README is verified: Quality Gate shares the existing badge paragraph, with the four centered layouts still centered. All nine completed remote heads are verified absent, and their clean local worktrees and branches are removed. This completes the reported badge audit without changing quality rules, thresholds or product behavior.
Sonar findings follow-through
The public-main security review found two MAJOR AI CI findings. Binary-only policy installation is a valid hardening change: central validator #192 is merged with 25 local policy/schema controls, hosted contracts and Sonar passing, including 100% new-code coverage. Its fresh main checks also pass. AI #24 is merged after all three compatibility profiles and required checks passed. All fresh main compatibility profiles, the qualification aggregate and Sonar pass. Main analysis marks finding
AaFA6a2F1hbbA_aB5roVFIXED at 01:16:46 UTC.The compatibility matrix intentionally resolves the selected Laravel/Testbench/PHPUnit ranges with Composer. Its separate warning is individually accepted in Sonar with the disposable-runner, read-only-token and no-secrets rationale. The rule remains enabled for other code.
All 11 public projects have zero security hotspots awaiting review at 01:04 UTC. Existing maintainability findings and unfinished product coverage import remain separate work; this is not an organization-wide all-clear. Sonar PR comments, checks and annotations remain enabled.
rmcdaniel commentedon Oct 16, 2026
Connect the existing Workflow coverage reports
Workflow already produces a unit Clover report and four MySQL feature Clover reports on its target-branch build. Its separate Sonar job never receives them. The other product CI configurations inspected currently produce no coverage report.
I am connecting those five reports to a separate scanner job in the same Workflow build. Select the producer's immutable artifact ID, retain the reports for one day as transport, download into a dedicated directory and leave the Sonar credential on the final scanner step. The existing tests, coverage ratchet, release gates and runtime source stay unchanged.
Main analysis will import reports for that exact checked-out source. Pull-request analysis remains explicitly unmeasured because its existing bounded jobs do not produce those reports. No report from another revision will be substituted. A shared policy/guide update will precede the Workflow integration.
Acceptance is a successful actual main import with nonzero measured source lines, plus preserved PR analysis, credential isolation and required functional checks. No coverage threshold reduction is proposed.
rmcdaniel commentedon Oct 16, 2026
The shared report-consumer policy is delivered in #193 at
6aa09fed720e705cb980f1af11296586c563c3df. Candidate and fresh-main contracts/Sonar pass. Reviewing findings beyond the green gate caught a complexity warning; separating upload validation from producer binding fixed it, with all 29 local controls unchanged and passing. The merged worktree and branch are removed.Workflow integration is delivered in Workflow #804 at
f661e84a947ac4c61876d73094a0f81308759059. Every applicable candidate and fresh-main job passes, including the full database/test/upgrade matrix, coverage and isolated Sonar. Logs confirm import of the unit Clover report and all four MySQL reports from the same run's bound artifact. Exact analysisd9881766-8efa-4cb4-bc93-a0a9334a7b2bhas that source revision and an OK gate. The API reports 93.7% line coverage across 76,266 source lines, with 4,785 uncovered, both for the project and specificallysrc/.PR analysis remains explicitly unmeasured because its bounded jobs do not generate reports. Other repositories without coverage reports retain that deliberate classification. Existing functional gates and quality thresholds are unchanged. The initial blanket no-secret assertion was replaced by the scoped scanner contract; no test job receives the analysis credential. This completes the coverage-import slice of #187, not all legacy finding or warning review.
rmcdaniel commentedon Oct 16, 2026
Sample App merged
479f09e8has an actual passing main analysis (178c878a-418f-437e-a9b0-ae4d61eacd7c), zero new duplication under the unchanged3% limit, and no OPEN/CONFIRMED PR229 issues. This is static-analysis acceptance, separate from its pending published-image checks.Reviewed two existing findings against all relevant source/callers, added an individual explanation to each, and confirmed both are RESOLVED/FALSE-POSITIVE:
pythonsecurity:S5144,AaFA6n8SPcPS43rrZGJ-,principal_gateway.py:95: this isolated test proxy's connection destination is the constantserver:8080. The forwarded path does not select the connection host, redirects are not followed, and its Compose role publishes no host port. The reported user-controlled network destination is absent.pythonsecurity:S2083,AaFA6n9bPcPS43rrZGKX,sdk_namespaces.py:28: all current filename callers use fixed fixture labels/identifiers and a finite namespace set. The operator helper validates that set and consumes the same fixture's owned records. No request or remote workflow name controls the filename.These are specific dataflow dispositions, with re-review conditions recorded on the findings. No rule/profile/threshold or notification change, no security probe, and no blanket fixture exclusion was made. The remaining Sample main backlog is not declared clear; other alerts still require individual handling.
rmcdaniel commentedon Oct 16, 2026
Reviewed four existing Workflow main findings against
b495970a372d1c25de97dea0326484471c49f807. Each now has a source-specific explanation and independently verifiedRESOLVED / FALSE-POSITIVEdisposition:AaFBJvJ1GQ1b2Gnbh7Tx,pythonsecurity:S2083,test-build-routing.py:168: this unittest helper writes inside its own temporary directory. Every filename caller is a fixed literal or fixed fixture list; there is no externally supplied path. Re-review is required if that input contract changes.AaFA69eNwBdSgiQr4iUlandAaFA69ewwBdSgiQr4iUv,php:S2201: bothserializable()helpers intentionally call native serialization to observe whether it throws, then return a boolean. Their callers need validation rather than serialized bytes. Removing the call would change rejection behavior.AaFA69GYwBdSgiQr4iIe,php:S1848,DefaultWorkflowTaskBridge::normalizeUpsertMemoCommand: the temporaryUpsertMemosCallconstructor validates empty maps, keys and portable values. The surrounding catch refuses invalid commands; the object need not be retained.No rule, threshold, test exclusion or notification setting changed. This is individual finding triage, with no security probe or new runtime qualification. The remaining main backlog stays open for review.
rmcdaniel commentedon Oct 16, 2026
Reviewed Website finding
AaFA6djqf2KKc_2IRfGc(javascript:S9383) against main2823c3fbff028fc63316aee61652e4efa70a0d87. The optional star-count refresh has an encompassing try/catch around fetch, JSON parsing, state updates and cache writing. Both request rejection and cancellation resolve normally, preserving the cached/default count.The individual report is now independently verified
RESOLVED / FALSE-POSITIVE, with that explanation and a re-review condition if the function starts rethrowing or moves asynchronous work outside its catch. No rule or threshold changed. Other Website findings remain open.rmcdaniel commentedon Oct 17, 2026
Reviewed the new Workflow788 benchmark reports and pushed 9a372211. Code fixes cover exception types, autoload inclusion, package ordering and strict emitted metadata; the synthetic stack now has an internal network. Six admission guards and the network control pass. Fresh exact-source Sonar38990478336 and the app check PASS. API readback confirms eight code findings CLOSED/FIXED, zero unresolved PR reports, 1.1% new duplication under the unchanged3% limit and100% hotspot review. Full review and original failure. Whole-source CI remains pending; no tracing-release claim.
Seven reports have individual decisions: three synthetic database credentials are false positives; private benchmark HTTP and three intentional scheduling patterns are accepted with precise reasons. The organization-wide current-main scan also found six S7688 style suggestions on already quoted resource guards in
limited-cohort.sh. Those are individually accepted: the checks retain exact UID/cgroup/CPU/memory/swap refusals and need no syntactic rewrite.No quality profile, threshold, rule or file exclusion changed. PR comments, checks and annotations remain enabled. This bounded review does not claim every historical issue or PR analysis is clear; the selected baggage regression still blocks the tracing release.
rmcdaniel commentedon Oct 17, 2026
The current findings review identified five real accessibility defects in Waterline's schedule/backfill and saved-view controls. They are tracked in Waterline #199 and corrected in draft #200.
Old production assets reproduce the missing accessible names. Corrected assets pass four desktop/mobile/theme browser profiles, including label focus, keyboard selections and the existing backfill payload; all 93 frontend tests pass. Exact-head Sonar and its app check pass with zero unresolved PR issues, zero new duplication and no profile/rule exception. Broader CI and publication remain pending. Existing-main reports will be checked after main analysis rather than manually marked fixed now.
This review does not imply that all legacy findings are resolved. Valid reports become source corrections; intentional behavior and false positives still need specific reasons. Comments, checks and annotations remain enabled.
rmcdaniel commentedon Oct 17, 2026
The combined enforcement audit confirms the ten public product repositories already require SonarCloud Code Analysis from the official App alongside their functional checks. My initial classic-protection-only query omitted those repository rulesets; no product repository setting was changed.
The shared
.githubrepository was the one missing the rule. Its active native rule25290868 now requires the same App check (integration_id12526) onmain, with no bypass actors. Independent readback confirms both that check and the existing Shared contract tests remain required, with strictness preserved. No runtime, scanner/profile/threshold, credential or notification change.Documentation #194 is merged at
92ee0347ffa1b681a96fc6f82fee7d32db2f6bf3, identical reviewed treec619413334b070a169c6e9080fb134cb194cfe75; all candidate checks and independent fresh-main contract run39002172733, Sonar39002172735 and App check PASS. The guide explains effective ruleset inspection, the unique App check and the existing trusted-branch path for fork contributions. Remote source head is deleted/404.All eleven public default branches therefore have the intended Sonar enforcement. Private-repository analysis remains a separate outstanding setup item; this is not a claim that its analysis or the historical findings backlog is complete.
rmcdaniel commentedon Oct 17, 2026
Reviewed the 28
pythonsecurity:S2083reports in the PHP SDK's adversarial corpus-policy tests at510be070.The reported flows pass fixture contents from
Path.read_textintoPath.write_text. The destination paths are fixed inside the privateTemporaryDirectorycreated bysetUp; the multi-case loop uses a literal destination dictionary. Forwrite_json, I also checked all nine reported caller flows: the fixed filename and JSON contents are separate arguments. These are not request-derived filenames or HTTP entry points.Marked those specific reports False positive, each with its source-linked explanation. Independent API readback confirms 28/28 have that resolution and a recorded reason, with none of this reviewed group left OPEN/CONFIRMED. This uses Sonar's issue-review workflow.
Three further reviewed reports received specific false-positive reasons:
shell:S4790andpython:S4790: archive trust requires pinned SHA-256 for cache and downloads. The later SHA-1 field and its test preserve static-php-cli's local-lock format; they do not establish archive trust.javascript:S2871: the code-unit sort compares a fixed ASCII contract-key set. Locale collation is not part of that equality check.All three resolutions and comments were independently read back.
The Sample App directory warning was actionable: #235 gives each CLI-observer call its own private temporary configuration directory, with success/failure/timeout cleanup controls. Source acceptance and new main analysis remain pending; it was not marked false positive.
The two Sample App container findings were reviewed and Accepted with explicit scope. Development SSH is intentional, password/root login are disabled, and the supplied Compose does not publish port22. The conformance Laravel image intentionally copies the repository-root build context, whose
.dockerignoreexcludes.env, Git, dependencies and runtime output; the image builds its fixture environment from.env.example. These dispositions cover the supplied clean development/conformance definitions, not arbitrary host mappings or extra local files. Both accepted statuses and reasons were read back; neither is reported as a code fix or universal safety guarantee.The security rule, scan scope, profiles, thresholds and production code are unchanged. No blanket test exclusion or historical-backlog clearance is claimed. The separate Waterline accessibility findings were genuine defects and were fixed in Waterline #200 for #199; the patch release remains under #201 qualification.
rmcdaniel commentedon Oct 17, 2026
Five genuine
Web:InputWithoutLabelCheckfindings are now fixed and released in Waterline2.11.2. The controls have translated names and associated labels; desktop/mobile and both-theme browser checks pass. Sonar marks the original findings CLOSED/FIXED. Owning outcome.Normal installation and the complete shipped asset set are verified. Sample236 passes all candidate and independent-main checks, including native published-image qualification on both architectures. Website243 is deployed and its actual public install/image commands select2.11.2. Both Sonar PR reports were read before merge:0 new issues/hotspots.
This resolves the actual accessibility defects without changing the rule, profile, threshold or exclusions.
Python #157 is another completed review: its initially green quality gate still reported two
python:S5778exception-test clarity findings. Both test setups were corrected before merge, with no rule, threshold or exclusion change. Final candidate and independent merged-main CI each pass all ten jobs, including actual HTTP integration. Main's official Sonar app check passes, and the two new observer files have zero open/confirmed findings. The existing whole-project backlog remains separate; this is not a claim that every Python finding is resolved.rmcdaniel commentedon Oct 17, 2026
Reviewed four existing Python checkout-helper findings under
pythonsecurity:S8705.One review found real behavior to fix: option-like clone destinations were
interpreted by Git. SDK Python #158
and PR #159 contain the
literal-argument correction and real local Git regressions. Both original
destination tests fail on the parent; the candidate passes all 20 checkout
controls and Ruff. Both candidate and independent main CI now pass all ten jobs,
including actual HTTP integration, with exact-main Sonar acceptance.
The three subsequent fetch/checkout/rev-parse reports are individually resolved
FALSE-POSITIVE with comments. The helper is a CLI, the destination follows Git's
single-operand
-C, commit inputs are checked as exactly 40 lowercase hexcharacters before subprocess execution, and
HEADis constant. New real Gitcontrols also exercise pinned commits in both option-like directory names.
No rule, profile, threshold or exclusion changed. The clone finding and the
rest of the existing project backlog are not cleared by those resolutions.
Final source is
ceb0cd79365255f5575dd745145b9af557f9d0b1, identical to thereviewed
5f253902tree; SDK158 is delivered.The analyzer still reports the clone call after the real correction. Its
residual flow ignores the literal
--terminator and treats this CLI as anHTTP source. That remaining report is individually resolved FALSE-POSITIVE
with the fixed-code and real-Git proof. This does not reinterpret the original
behavior as safe: the code was corrected and the regression is enforced.
rmcdaniel commentedon Oct 17, 2026
Reviewed three existing Python
S5332reports against exact mainceb0cd79.uses a synthetic URL with an in-memory
_RecordingTransport. The ordinaryclient is closed unused, and the replacement invokes its local response
handler without network I/O. This report is FALSE-POSITIVE.
are accepted for the isolated test fixture. The Compose stack explicitly uses
testing configuration, synthetic data and a public test credential; the
health probe itself sends no credentials. GitHub uses localhost. Alternate
runners may use the configured Docker host or gateway, so their test-network
trust remains part of this scoped acceptance. Sonar stores both decisions
as RESOLVED/WONTFIX.
Each finding has an individual rationale and API readback. No rule, threshold,
exclusion, SDK behavior or production-transport policy changed. Other actual
service connections remain subject to the rule.
rmcdaniel commentedon Oct 17, 2026
Four further security reports received source-specific review:
javascript:S4790at vite.config.mjs:13:MD5 supplies only the generated asset URL's cache-busting
?id=. It does notauthenticate users or verify untrusted content. The reported sensitive hash
flow is resolved FALSE-POSITIVE for this location.
pythonsecurity:S8705at check_release_metadata.py:85:all four call sites use fixed read-only Git verbs in shell-free argv. A
requested source ref is resolved first, and its result must be exactly 40
lowercase hexadecimal characters before the three fixed
git showpaths.This specific flow is resolved FALSE-POSITIVE. This is not a general exception
for CLI subprocesses; the separate checkout option bug was fixed in
Python #158 /
#159.
php:S6418reports at ExternalTaskInputContract.php:358and line512
flag synthetic
next_page_tokenexamples. Both decode to JSON containingonly an
after_sequenceoffset. They are pagination state in wire fixtures,not credentials. Both reports are resolved FALSE-POSITIVE after static review.
All four findings have individual comments and independent API readback confirming
RESOLVED/FALSE-POSITIVE. No rule, threshold, profile, scan scope, source code or
notification setting changed. The remaining historical reports still require
their own review.
20 remaining items
rmcdaniel commentedon Oct 19, 2026
Waterline #210 merged
06d4b0a3/ tree3abb72eb, identical to qualified8a951a83. All thirty applicable candidate checks pass, with the unrelated conditional cancellation-inspection source job explicitly skipped. It disables unnecessary npm lifecycle hooks and makes the catalog'snpxinvocation require the already installed package. Existing Playwright versions, Chromium installation, scenario assertions and publication behavior stay the same.Actual isolated installation/CLI checks pass for both selected versions (1.63.0 and 1.64.0) under UID 1000 with
--ignore-scriptsandnpx --no-install. The container and its packages/cache are removed. Independent main qualification now passes all twenty-nine applicable checks, including both real responsive-browser jobs, all database shards, all five Laravel compatibility profiles, image smoke and the live service tuple. The unrelated conditional cancellation source job is explicitly skipped. Main run39184217618and Sonar39184217649both pass at exact06d4b0a3. Direct Sonar main analysis confirms all four original reports CLOSED/FIXED, gate OK with no ignored conditions. No rule, threshold, severity or exclusion changed. The merged remote head is confirmed absent, and its clean local branch/worktree is retired. This workflow-only change requires no package release or image rebuild; the manually invoked catalog scenario is not claimed as rerun.rmcdaniel commentedon Oct 19, 2026
Sample251, exact d6d3e63, passes its Sonar gate with0.0%newduplication under unchanged3% and no ignored conditions. Its one S131 report, AaFSWMNgpr3bo2gBCB9O at scripts/sdk-timers.sh:110, was reviewed against the actual source: installed_packages loops over the literal php/python/rust list, and every possible value has an explicit case arm. There is no dynamic selector or reachable unhandled value. The report is individually RESOLVED/FALSE-POSITIVE; its source-specific comment and status were independently read back. Reassess if the loop gains a language or becomes dynamic.
The gate already passed before this disposition. No rule/profile/threshold/severity/exclusion changed, and no suppression was added. PR251 has zero OPEN/CONFIRMED findings; the older whole-project backlog remains open. Separately, this component fixes a real evidence-validator gap: two ordinary timer result controls prove the old observer accepted float30.0 as integer30. The type-exact correction passes them and all158 observer methods. This is not a claim of a runtime codec defect or actual package-upgrade qualification; the new published-package execution is still live.
rmcdaniel commentedon Oct 19, 2026
Current delivery and triage
Waterline header fix
Waterline211 merged at
85a3a4e116dbe5162bc8a3cbc07b82032dab62a6, whole4695dc5dd01c5b45c0c8cf43670a4db322624ea8, identical to reviewed754 and its tested synthetic merge. All30 applicable candidate and29 independent main checks pass; the existing conditional cancellation inspection is explicitly skipped in each. Independent main Sonar39208852177 names that exact merge and automatically closes all16 original header findings CLOSED/FIXED. None remain open for that rule; the gate passes without ignored conditions. Main build39208852234 is complete.Waterline2.11.4 is published at exact85a3; Packagist source/dist match. Image39210487387 passes publication, smoke and unchanged budget; index
sha256:013ac33bf0cec646d8b86b3771c764940266c48e5c5b83708f734bbe2c59c1c2independently names linux/amd64+arm64 with exact source/version labels. Published inspection39210979449 passes24 original calls/72 API-browser cases/36screenshots and24 CLI reads with wrong-selector/wrong-call refusals, zero mutations. The audited broader platform report remains fail (12pass/2not-covered); no whole-platform claim. Current tuple promotion and Sample254 acceptance remain pending, including Sample's stale bundled assets and independent SDK-update failure. No unchanged SDK/Server/Workflow release is needed. Initial690's Japanese observer timeout remains failed/causeunknown; no rescue or general accessibility certification.Source-specific dispositions
scripts/ci/release_package.pyon mainf7c243890b50895558ad7a755b910131116715d2, blob8a16977b7c6eb7663b37f390ac5d1c5b20a773de:AaFBMFZaBukGr1wPDQu6,AaFBMFZaBukGr1wPDQu4,AaFBMFZaBukGr1wPDQu7,AaFBMFZaBukGr1wPDQu3. Each is FALSE-POSITIVE with a persisted explanation verified through the API. The reviewed callers intentionally select source and local/checksum-matched published crate inputs, including temporary paths outside the checkout. This verifier only reads/parses/hashes them and emits structured identities. TAR handling reads exact unique regular members withextractfile; it performs no filesystem extraction, writes, network access, input execution or raw file-content output. No HTTP or registered agent-tool boundary exists. Reassess if those boundaries change. The older manifest-read disposition is a separate prior review.scripts/ci/dashboard-visual.mjs, exact Waterline85a3, blobd297016551eba896483d197296c30ace509a82da, are FALSE-POSITIVE with39 persisted comments verified. Iterations share a persistent browser session/window and mutate the same page, focus, scroll, zoom, refresh and screenshot state. The topbar clicks deliberately restore state before later observations. This matches the rule's dependent-resource exception. The new PR report's disposition transferred to main; no S9382 report remains open in this file. Reassess if cases gain independent contexts/windows.scripts/ci/interface-language-visual.mjs, exact Waterline85a3, blobeeee7ba4f58beed8c14b2538402d1ef0e2c48820, are FALSE-POSITIVE with17 persisted comments verified. The route handler closes over one mutablestate, and those iterations reuse one page/dialog: each state must be observed before changing state/navigation, and each dialog must be dismissed before the next action. The separate outer presentation/theme/width cases create distinct contexts; their19 reports remain OPEN and are not covered by this decision.These decisions change no rule, profile, threshold, exclusion, source or package. They do not make the remaining backlog reviewed or establish runtime security qualification. Existing test, release and deployment gates remain required.
Previously delivered work
PHP SDK183 merged
86600284913d0fdbc9006872e07e12e931fbfc61, whole974dcdbc6d5af182e2cd49066c85522478d7cc24. The real documentation finalizer regression fails on the prior nested-index canonical URL and passes after restoring the regex capture/slash. All36 applicable candidate and37 independent main checks pass; connected cancellation remains explicitly skipped. Docs39203310208 deployed that exact revision, confirmed by the public deployment audit and live root/Client canonical/OpenGraph metadata. The nested case is a fixture result, not a fabricated deployed page. Sonar automatically closes S6328AaFA6vItcQpz5BzX89h2. Released2.5.1 library files and dependency manifest are unchanged, so no library release is needed. Task resources and completed branches are retired.Three Rust docs-analytics S8707 reports (
AaFBMFbIBukGr1wPDQv0,AaFBMFbIBukGr1wPDQv1,AaFBMFbIBukGr1wPDQv2) were individually reviewed on exact mainf7c24389: the two CI callers selecttarget/doc; the checker reads local rendered docs without writes, subprocesses, network, raw-content output or an HTTP/agent-tool boundary. Their specific FALSE-POSITIVE explanations are persisted; reassess on a boundary change. Sample's S131 review and delivered conformance changes remain recorded at 6259480870 and 122/6259296328.Issue187 remains open for ongoing maintenance and unfinished Waterline publication/consumer acceptance. Coverage is not presented as measured when no report exists; pushed PR summaries, checks and annotations remain enabled.
rmcdaniel commentedon Oct 19, 2026
Sample254 is delivered at merge
954eebf699c55883e0a7aa231e193c7c34845c68, whole5f054bb358553258ee070e7e4d2405e4066c5766: all22 candidate checks and all24 independent main checks pass. Published multiarch devcontainer39216026219 also passes all six build/installed-consumer/promotion jobs. Its immutable index issha256:eb73b97565dccee209a7927a95145b079f1028d31a020dbe85f98d2a77e715f1. Waterline2.11.4 is normally installed and its bundled assets match; the unrelated original accepted-update stall remains open at Sample255.Specific Sonar tuning: reviewed19 javascript:S9382 findings in Waterline's outer language/presentation/theme/viewport loop at source blob
eeee7ba4f58beed8c14b2538402d1ef0e2c48820. These are accepted performance tradeoffs: qualification deliberately keeps one browser context live, with ordered setup/navigation/assertions/screenshots/cleanup. Parallel case execution would be a separate bounded resource change. All19 were transitioned ACCEPTED with that explanation; independent API readback verifies19 statuses and19 comments. They are not labelled false positives, and no rule, source exclusion, profile or threshold was changed. Earlier inner-loop/shared-page false-positive decisions remain separate.CI gap confirmed from the actual Sample252 and253 Sonar logs: Dependabot runs receive an empty SONAR_TOKEN and analysis exits3 with Not authorized. The Actions secret exists; the Dependabot secret is absent. The current plan rejects the scoped-organization-token feature; the available personal token has administrative authority. No credential was copied or new account/plan commitment made. The reviewed patches are now DELIVERED through maintainer-owned Sample257, candidate79d4ff6680f2b44e43057cb4ead8bd28f5d52792: ALL19 checksPASS, including real browser/consumer/candidate-image checks and Sonar39219482270/app. Independent API reports gateOK/ignoredConditions=false/zeroOPEN+CONFIRMED. Mergedb3241d9c62c8bb4d9bb51ddce388cfaa89ce0673 has the identical reviewed whole tree032e2dd4865bb03c1956e4d926ade2a43e4f64c2. ALL25 independent main checksPASS, including the original timer39221825811; main Sonar024512d3/39221825844 namesb324. Both-platform anonymous installed image qualification39221825804 PASSES all6 jobs; direct registry reads verify the identical GHCR/DockerHub current+immutable index20406fb5f378f2ac6d6b4a5c3b77936f09311fc2773cc31bde20c42030f04dd8 and exact source labels. Dependabot itself closed252/253 after the source merge; its original failed scans remain failed. Completed source, dependencies and raw are retired.
This qualifies the existing trusted CI path, not direct Dependabot credentials. Automatic analysis omits Rust, so it would reduce the current analysis scope. The full scanner remains enabled. PR comments, checks and annotations remain enabled; end-to-end inbox forwarding is still unverified. A fresh GraphQL check confirms subscriptions to Sample257, Waterline211 and Workflow788. Repository subscriptions are unset; the expected REST404 is not evidence of a missing token scope. No notification preference or permission is changed and no forwarding repair is claimed.
One additional specific decision: accepted Server php:S4790 issueAaFA7R1JE2B5KEujJuJH after reviewing exact analyzed source1682e1de. HistoryRetentionEnforcer uses SHA1 only to name its60-second opportunistic-maintenance throttle bucket; the original namespace remains the input to independently scoped, terminal/retention-checked deletion. A collision could combine throttle buckets temporarily but cannot substitute namespace or deletion authority. This bounded legacy cache-key risk is recorded in the issue, rather than labelled a false positive or used to disable the rule. No Server source or security probe is changed. Other alerts remain independently unreviewed/open.
rmcdaniel commentedon Oct 19, 2026
Three actionable Rust SDK
shell:S6506findings now have a source fix in SDK101, rather than a suppression. All four release metadata/archive requests share an HTTPS-only transport policy, including redirects. Certificate, checksum, provenance and publication guards remain active.The unchanged parent accepts initial HTTP and an HTTPS-to-HTTP redirect in real loopback controls. Both paths refuse after the fix; accepted HTTPS redirects and rejection of untrusted certificates also pass. The normal local release-tooling checks pass: 15 publisher tests, eight archive tests, four example-URL tests and the existing shell publication controls. No registry token or real publication was used.
This is delivered at merge
772677e186b39421c482473c020f3402f2daa789/ reviewed tree5e396545d544371643a4cfae03f92d032226faf1. Final candidate83adf9dand independent main each pass all 11 applicable checks; the two manual Server qualifications remain explicitly skipped. One additional Sonar request for an explicit curl status return was implemented and revalidated in the same PR.Fresh main analysis
00faa66a-efcb-47dd-9813-852ebd65817fidentifies that exact merge, gateOK/ignoredfalse, and automatically closes all three originalS6506reports as FIXED. The final PR has zero OPEN/CONFIRMED issues; the helper return finding is also CLOSED/FIXED. No quality threshold, rule or exclusion changed. No SDK package/runtime/version or consumer pin changed, and no publication was triggered. Other open findings and the separate notification-delivery gap are not cleared by this result.rmcdaniel commentedon Oct 19, 2026
Follow-through review found that the release workflow checks out the requested immutable package tag and then runs its scripts. SDK101 fixes the maintained source and future tagged tooling; existing-tag verification still executes its original helper. I am correcting that workflow activation gap with separately pinned maintained tooling and immutable package-source checkouts. Source identity, archive checksum, exact package comparison and publication authorization must remain intact. No existing tag will move and no SDK4 publication is authorized.
The related
text:S8570lockfile warning also has concrete evidence: the repository ignores rootCargo.lock, while the checksum-verified published3.5.5 archive contains one. Cargo's documented packaging behavior generates a lock when absent and always packages it. The release checker compares the entire crate, so its dependency resolution needs a reproducible input. Current main's manifest and Rust source match3.5.5; runtime/consumer changes are not proposed.The actual packaging-only control on exact3.5.5 source with Rust1.86 produces checksum348790ee after cc/find-msvc-tools/libc dependency drift. Restoring the verified published lock52020acf reproduces the entire immutable published archive exactly:04147fcb82f749ea1e308c0a3836e30454efc415d5933884d615ca4aae76bb2e. The new recovery CLI also restores those exact lock bytes into clean legacy source. No publication, registry credential or verification-build claim was used for these packaging controls.
This is delivered through SDK102 at2fb50208117a4fd8235e6dd0b8a8bc6cca7fa983, exactly reviewed942020c6/treecd50a88d. Maintained tooling and immutable source have separate pinned checkouts/identities; future CI/package/publish use the recorded lock. Legacy recovery requires a missing ignored lock, verified archive checksum/source/notes, bounded regular member and exclusive creation; complete archive equality remains mandatory. Local20publisher/13archive/4URL and four shell publication controls pass. Final candidate and independent main each pass all11 normal applicable checks; two manualServer qualifications stay skipped. Main documentation and actual release also pass, making14SUCCESS/twoSKIP checks on the merge.
The actual existing3.5.5 Release39240498213 passes10:53:46UTC. Its complete logs show tooling2fb/source4d, source-identity guard, fresh registry consumer Rust1.86/fresh_lockfiletrue/pass and finalalready_published. That maintained code requires complete checksum/archive/notes/VCS equality. Current registry confirms04147fcb and originalOct15 publication, with tag/GitHub Release unchanged. The tiny output artifact could not be directly downloaded (two zero-byte timeouts); no payload readback is claimed, no business rerun made. Ordinary complete-run logs were retrieved and read instead.
Main analysisa5b798be names2fb, gateOK/ignoredfalse, and automatically closes S8570 asFIXED. Four valid S5778 exception-test setup reports are corrected/CLOSED-FIXED. S8707 is individually FALSE-POSITIVE with precise protected-CLI/read-only-archive/exclusive-write reasoning; no rule/profile/threshold/exclusion change. All runtime/tools/cache retired10:48:33UTC, source/local/remote branch retired after merge, raw transport is removed after readback. Initial PATH127 and old unlocked fixture expectation remain setup observations. No SDK tag/runtime/version/consumer change; other organization findings, private setup and notification gaps remain open under187.
References: https://doc.rust-lang.org/cargo/commands/cargo-package.html and https://doc.rust-lang.org/cargo/guide/cargo-toml-vs-cargo-lock.html . This is a release-tooling follow-up under #187, not a new package release or reinterpretation of historical qualification.
rmcdaniel commentedon Oct 19, 2026
Acting on the child-job browser-tooling findings
Sample259 addresses three current Sonar findings in the existing child-workflow CI installation step:
AaFA6oDuPcPS43rrZGNWandAaFA6oDuPcPS43rrZGNX(githubactions:S6505), plusAaFA6oDuPcPS43rrZGNY(githubactions:S8543).The source now installs from the existing lockfile with lifecycle scripts disabled and invokes
./node_modules/.bin/playwrightdirectly. An absent local binary fails rather than allowingnpxto fetch an unselected package. Package versions, lockfile, browser version and runtime assertions are unchanged.Focused Node24.21.0 controls pass: 87-package locked install, zero npm audit findings, exact Playwright1.64.1 package/CLI/lock agreement, all six existing Node tests and the production Vite build. The actual candidate child browser/SDK job39246940009 passes: the revised commands install the locked tooling, selected browsers download, nine completion directions and cancellation/recovery cases pass, and the real connected Waterline reports 45 views through three access modes. Complete logs were reviewed and temporary transport removed. All eighteen candidate checks pass, including Sonar workflow/App/API with no unresolved PR issue or ignored condition.
Delivered
5ddbd3e5e5e929b43c9ff31e30eb099cb105941c/ whole874fd1be402f8a731495d87f1662bccdcb971835, exactly reviewed a0c693b0/synthetic98f682fa. All eighteen candidate and all seventeen independent main checks PASS, last timer completes12:27:46UTC. Main analysis63b56764-3aef-42f0-bfc9-a0c2129c2ef6names that merge, gateOK/ignoredfalse/newduplication0.0%; all three original reports are automatically CLOSED/FIXED. No issue acceptance/false-positive transition, exclusion or quality-policy change was applied.Independent main child39249612484 logs verify the changed install commands and browser downloads, nine distinct parent/child directions and45 successful connected Waterline views across three access modes. The main experiment passes12:16:56, hosted cleanup removes the network12:17:01 and no job was rerun. Source branches/worktree, local dependencies and temporary main transport320578bytes are retired after readback. No new package/image release is needed.
This is a specific source correction within the ongoing Sonar maintenance work, not a disposition of all unresolved reports. The accepted-update stall remains separately open and unexplained.
rmcdaniel commentedon Oct 19, 2026
Sample upgrade fixture: finding fixed and verified
Sample #260 introduced a valid
python:S5778report in an exception test. Commit1ad0b35bmoves roster construction outside the expected-failure block, leaving one operation whose exception is being tested. The affected test passes. Sonar's issue changelog explicitly records automatic OPEN → CLOSED/FIXED at 12:56:55 UTC; no rule, threshold, profile, exclusion or manual issue disposition changed.The source is merged as
701c937953bd8d04e3ad4e4e21dc40194630c501, identical to the reviewed tree. All twenty candidate and nineteen independent main checks pass. Final PR analysis has zero OPEN/CONFIRMED findings; exact main analysis14ef65fa-2984-44b7-9850-7101bca0ca4bpasses with ignored false and 0.0% new duplication. This finding-level result is not a claim that every existing project finding is resolved.Guide #204 separately passes all three candidate/main checks, with its exact main analysis and scope recorded there. The upgrade audit remains active for its other acceptance criteria.
rmcdaniel commentedon Oct 19, 2026
PHP documentation tooling delivered
SDK PHP #184 is merged at
cad2b8cc53cdac36e19e563fc37565438e386f1b/ wholec0c9ad102c12e76e52d16246b0eac1ac098b299e. Both CI and publication install dependencies with lifecycle scripts disabled, use the locked local Playwright executable and enforce the moderate-or-higher npm audit gate. Compatible documentation-tool updates clear the eleven affected dependency entries from the original graph. Playwright stays at 1.62.1; Sonar settings are unchanged.All 36 applicable candidate checks and 37 independent main checks pass; connected cancellation is explicitly conditional and skipped. The actual Pages publisher passes its fresh install/audit, three evidence tests, 326-page link/metadata/analytics checks and seven portal/API surfaces across desktop, intermediate, mobile and short-height viewports. Its deployment and live source marker both name the exact merge commit; linked live pages and assets return HTTP 200.
Exact main Sonar analysis
b310cea3-f205-45ff-824a-6e959a8c214chas gate OK with ignored conditions false. The changelogs forAaFA6vKTcQpz5BzX89iI,AaFA6vKTcQpz5BzX89iJ,AaFA6vKTcQpz5BzX89iKandAaFA6vKgcQpz5BzX89iMexplicitly record CLOSED/FIXED. No manual disposition or threshold change was made.Composer and all published SDK runtime/example/resource/config bytes still match immutable 2.5.1, so no SDK version or downstream runtime release is required. Local resources, worktree and branch are retired; temporary publishing logs are deleted after this report's readback. Organization-wide Sonar work remains open; this is the delivered installer slice.
rmcdaniel commentedon Oct 19, 2026
Delivered install safety and individual finding decisions
PR #210 is delivered at main
b2d9101c1e959abe505b846c793b2057faf8202f, whole6e4d92ea9737c4b8cc2b08db108147444e7ba929, identical to reviewed candidate8cbfad90. It fixes the twogithubactions:S6505reports in our contract and Rust-docs visual installs by disabling dependency lifecycle hooks. Packages and locks do not move. All three candidate and all three independent fresh-main checks PASS, including the actual hosted Ubuntu browser/contracts suite and analyzer. Main Sonar analysisbc9f3f36-e877-4a06-8b44-55abbe939b20names the exact merge revision; both original findingsAaFA6dSyRifDd95mErWVandAaFA6dSlRifDd95mErWOare individually verified CLOSED / FIXED at 19:49:39 UTC on October 19. The normal locked install and audit report zero advisories. The PR retains the unsuccessful local browser prerequisites as failures rather than calling them passing. The completed source worktree and local/remote branches are retired.Separately,
AaFA6dS8RifDd95mErWd/pythonsecurity:S8707is individually RESOLVED / FALSE-POSITIVE, confirmed by API readback. Its recorded flow labelsargparse.parse_args()as an HTTP request. Inspection of exact main5b703874shows a local maintainer CLI that intentionally accepts--policypaths and reads under the caller's own filesystem permissions. It exposes no web/delegated file-reading endpoint or elevated authority. Restricting that intended local argument would invent a policy-directory sandbox that this command does not provide. The independent manifest/report containment checks remain required and are not exempted. The complete reasoning is attached to that single issue.Two further findings in
qualification_policy.pywere individually inspected and are now RESOLVED / FALSE-POSITIVE, each with its own reason and API readback.AaFA6dTfRifDd95mErXHreports the intentional local--policyJSON read, andAaFA6dTfRifDd95mErXIreports the explicit local--evidenceJSON output. Both flows incorrectly identifyargparse.parse_args()as an HTTP source. This CLI uses the invoking user's permissions, exposes no delegated filesystem endpoint and promises no input/output directory jail. API results and policy contents do not select the output filename. This does not dismiss request-URL construction, process arguments, credential handling or other findings.The Python SDK's missing-lock finding
AaFA6u1lrKpiHhFp4ux-stays OPEN: current source really has no dependency lock and CI resolves broad development/build requirements. That needs reproducible CI tooling inputs, with the library's customer-facing compatibility ranges kept deliberate. It is not classified as another CLI false positive or hidden by changing Sonar settings.No rule, gate, profile, threshold or exclusion changed. The other historical findings remain open for individual review; green new-code gates do not mean those findings are resolved. All task-owned local dependencies, browser attempts and logs are removed; source and owning records remain.
rmcdaniel commentedon Oct 20, 2026
Website main review completed against source
7c478fb9and the latest analysis period. The inherited inventory was 128 unresolved findings, all created before the current new-code period. The period's new-issue counters are zero. This is not a claim that the repository has no outstanding findings.I independently inspected seven S2187 reports and individually marked them false positive, with file-specific evidence in Sonar. These files execute real
node:assertpositive and negative controls through ordinarynpm testornpm run build: protocol specifications, worker OpenAPI, protocol-page associations, localized links, localized search, dependency floors/cache behavior, and Node toolchain policy. An assertion failure exits their direct Node runner unsuccessfully. They are not empty test files. No rule, profile, exclusion, coverage metric or quality threshold changed.The four security flags remain open. Three flag lifecycle scripts during
npm ci; the lockfile and reviewedpatch-packagepostinstall explain why blindly adding--ignore-scriptswould break required Docusaurus/search/security patches. The qualification/deployment jobs have constrained permissions and do not pass publication secrets to the install step, but that does not eliminate lifecycle risk. The protocol job also needs checkout credential persistence hardened. The fourth report correctly identifies unqualified Git lookup from an npm-influenced PATH in the dependency checker. The next source change must isolate trusted patch execution and executable lookup, then run the existing complete website qualification. These are not false positives or a clean security audit.Other source findings stay actionable by context, including measured contrast, a link being used as a button, complexity and mutable-list keys. We will fix useful findings and retain reasoned individual dispositions, rather than clearing the inventory merely to show green. Recent translated guide changes do not account for this inherited source inventory.
Fresh PHP source reviews also have concrete results: Workflow867
f0fa989aand Server5314e837448now each return zero unresolved PR issues from the issue API, after focused source fixes for their actual findings. Their separate normal source, installed-artifact and customer acceptance requirements remain open. Sonar push comments/checks/annotations remain enabled.rmcdaniel commentedon Oct 20, 2026
Dependabot security PR qualification is working with the existing required Sonar gate.
The original bot-triggered analyses for Sample #265 and PHP SDK #200 had no SONAR_TOKEN and failed. The organization also requires the SonarCloud app check, so silently skipping analysis would not qualify either patch. I did not add the organization token to Dependabot or change the protected workflow/rules.
I reviewed each exact dependency diff, ran its clean installation/audit and relevant build checks, and adopted the identical tree with an empty maintainer-authored commit on the existing PR branch. Normal Actions then ran the unchanged Sonar workflow with the existing credential. Sample run 39507356153 and PHP run 39508382206 both pass, with actual SonarCloud app checks successful and zero OPEN/CONFIRMED PR findings in the public API. This is reviewed maintainer adoption followed by real analysis; no synthetic check or branch bypass is used.
Sample #265 and PHP #200 still need their remaining normal required source gates before protected merge. Reviews and exact results are on those PRs. Waterline #219 likewise retains its normal source/development-container/Sonar gates. Alerts will be called fixed only after default-branch graph closure is verified.
rmcdaniel commentedon Oct 21, 2026
Review of the Dependabot scan path
The exact .github #229 security update is merged and its two high-severity alerts are fixed; Security's final receipt is 6310500160. Its initial Sonar scan lacked a token. The same-source rerun passes after General temporarily supplied a repository Dependabot Sonar secret; no gate, analysis scope or threshold was changed.
Review of the earlier decision in this issue confirmed that the general Sonar credential was deliberately kept out of bot-triggered runs. GitHub confirms that a manual rerun retains the original Dependabot privileges, so a maintainer-triggered rerun alone is not an alternative credential path. GitHub's troubleshooting documentation describes that behavior.
Retain the existing reviewed-maintainer-adoption path for subsequent dependency patches: inspect the exact diff and clean dependency/test evidence, preserve the same source tree with maintainer adoption on its branch, then run the unchanged normal Sonar workflow. Required gates remain required. The one temporary Dependabot secret created for #229 has now been removed; the ordinary Actions secret remains. Eleven other managed repositories have their Actions credential and no Dependabot credential, consistent with that policy; they were not changed. Organization-level secret administration is not needed for this path.
This corrects General's earlier interpretation of the missing Dependabot secret as an accidental organization setup gap. No source, private-project visibility, profile, threshold, push comments/checks/annotations or release authority changes.