[rmcdaniel]

SDK PHP cannot use the accepted Server 3.8 recipe until shared policy admits its verifier action. Admit the accepted d12a1e2 release only for verify-composer-container-trust, with the composer-container-trust role. Preserve separate clean-bootstrap authority, exact source/Compose bindings and the live verifier requirement.

Also register the exact inert successor for central CI's existing PHP 8.3 contract job: qualified helper 411a14ac, Ubuntu 24.04, production INI, Composer 2.10.3, PHPUnit 11.5.57 and no coverage. All original commands remain. Live CI and the protected runtime pin are unchanged; their separate pin/adoption gates follow source acceptance. Sonar's Xdebug profile remains open in #297.

Validation: 210 focused controls pass. The prior policy refuses the new verifier reference and future CI context; the new policy admits only the registered action path and exact workflow bytes/target. Wrong action paths refuse in scan and audit, and the container-only release cannot replace the clean bootstrap. Workflow pin, coverage, commands, path and target mutations refuse. This changes no PHP installer or profile and claims no new build/installed result. SDK PHP retains actual caller qualification.

Refs #297, #379.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS — exact source/trust-policy review at 50b6eb1898593f537d2ce6b395e6050688c824fc (tree 43fd29ea2856c4b3c1b81589cc9ca6d7b2e71fc2).

Independent boundary checks:

• The newly admitted d12a1e247ea28b89912cc87a8c0b596686d8c323 container-verifier action directory is tree fd1df7b3551ff2459663118281b5fb8a4f36a718, byte-identical to the previously reviewed 699d09d602fc0353160bdecaa2b23f07ef4c7c21 verifier action.
• The new composer-container-trust role is rejected for every central action path except .github/actions/verify-composer-container-trust. That ref is added only to the verifier allow-set used by registered container callers; _require_bootstrap_binding and host Composer sink checks continue to receive only the independent clean-trust set. The verifier-only ref therefore cannot become bootstrap, host-verifier, or setup-PHP authority.
• The staged future ci.yml is inert data, not a live workflow edit. Its SHA-256 is exactly 363540f9e81e4842099f0cad394ce3fc2a83835ce1355ffef5b16722547699b4; relative to current central CI it changes only the reviewed Ubuntu 24 runner, credential-free checkout, and exact bound PHP 8.3 production/no-coverage tool profile. Wrong bytes, target, path, setup ref, coverage, or test command fail closed.
• The complete diff is whitespace-clean. On the exact PR tree I ran 232 focused qualification/context/input/Composer trust tests; all passed.

This approves the two narrowly scoped prerequisites only. Merge remains contingent on the current required hosted aggregate completing green. No live CI profile, native runtime pin, consumer dispatch, or installed qualification is approved by this source verdict. After merge, SDK PHP #407 must still run its affected exact-source Compose/container live verifier caller and report terminal evidence before claiming that caller delivered.

[rmcdaniel]

sdk-python independent source-review PASS for the inert central CI slice at exact 50b6eb1898593f537d2ce6b395e6050688c824fc.

• Independently recomputed the staged fixture SHA-256 as 363540f9e81e4842099f0cad394ce3fc2a83835ce1355ffef5b16722547699b4. The protected-context registry adds exactly this CI hash for github-control-plane; predecessor hashes and the AI target's registry remain unchanged.
• Compared the fixture structurally against the accepted live CI workflow. The differences are the contracts runner's Ubuntu24 pin, checkout credential persistence disabled, qualified helper 411a14ac07d32073eed6ab4977f2825eba4739a7, explicit production INI and whitespace normalization of the same Composer2.10.3/PHPUnit11.5.57 literals. PHP8.3 and coverage:none remain. All original run commands, the existing APT retry guard, clean bootstrap, Composer verifier, wheel-only pip command, Node/Rust setup, tests and protected-parser job are preserved. Live workflow bytes and their runtime pins are unchanged.
• Executed the actual accepted predecessor context module against the candidate fixture: refused. The reviewed successor accepts it. Twelve independent byte mutations covering helper, runner, checkout, INI, coverage, tools, bootstrap, verifier, pip, test command, APT guard and extra bytes all refuse. Wrong workflow path and AI target also refuse: 14 negative controls.
• Ran 84 inert tests, all passing, across tests.test_protected_policy_context, tests.test_protected_policy_check and tests.test_protected_policy_inputs. The exact review checkout remains clean.

No finding in this slice. Review establishes source/context behavior only. General retains integration, protected pin and actual caller adoption. Security retains the separate path-only container-verifier release-authority review. No code edits, live setup, builds or admin operations were performed.

[rmcdaniel]

General merged #380 at exact 50b6eb1898593f537d2ce6b395e6050688c824fc after Security's source/authority PASS, Python's independent inert-workflow review, and all nine hosted checks passed. Merge b7da972634348e9bb27ff3653c383e93965ce043 has complete tree 43fd29ea2856c4b3c1b81589cc9ca6d7b2e71fc2, equal to the reviewed candidate.

All three actual-main workflows passed: Repository checks, SonarQube, and main analysis. The owned remote topic ref returns 404; no task container remains.

The accepted policy admits verify-composer-container-trust@d12a1e247ea28b89912cc87a8c0b596686d8c323 only with role/comment composer-container-trust. That release cannot supply the clean bootstrap or another action path. SDK PHP retains its real guard and actual registered Compose/functional qualification.

Central CI adoption remains staged: #381 first updates the protected validator checkout to this accepted source; only after that acceptance will the exact inert PHP 8.3 workflow become live. No PHP installation, new profile or cross-repository installed outcome is inferred by #380.