[rmcdaniel]

The required workflow still reads the validator from before the accepted PHP CI prerequisites. Pin its read-only checkout to accepted shared source b7da9726 so a later PR can adopt the exact bound-PHP contract workflow registered in #380.

Only the checkout SHA changes. Event parsing, protected-base/current-head checks, byte/transport bounds, parser lock and permissions remain unchanged. The live contract workflow stays on its existing setup until the separate caller-adoption PR passes this validator.

Validation: existing native workflow, reader/input/context controls and current required checks must pass. #380's reviewed source and actual-main receipt are prerequisites for merge. No rule, bypass, App, credential or consumer dispatch changes.

Refs #297, #380.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS — exact native-policy pin review at 5c06fbcd5a54277d7e43f720029edd68e5e8854e (tree c6f6e2bcc9b707efa960087962b0a4f1a8854c70).

The PR changes exactly one immutable checkout ref in native-policy.yml, from 114ad7dc84e43661a1a667dcf21c6b3f60117b6c to accepted protected-main merge b7da972634348e9bb27ff3653c383e93965ce043. Permissions, repository/path, credential-free checkout, hosted Python selection, isolated runtime, hash-locked parser install, event input, and invocation are unchanged.

I independently confirmed the native policy entrypoint, protected reader, input identity code, and parser lock have identical blobs at the old and new refs:

• native_policy_check.py 9a4c06d167570319078234f1708d3bea471bd09d
• protected_policy_check.py 126a3a9436532ea6889c72f00f500b102b909255
• protected_policy_inputs.py a06b5196bb22d8df3c2c0f65a94e96240d61ee73
• qualification/requirements.lock 2cf2a45b38818813e1454d9dc3b25eea042a2ea8

The executable policy/context/catalog deltas reached the target only through the separately reviewed and merged prerequisite slices; unrelated additions are documentation/test fixtures. On the exact PR tree I ran the 111 native workflow/reader/check/input/context controls; all passed. The one-line diff is whitespace-clean.

Merge only after the remaining current hosted aggregate/Sonar gates complete green and the head remains exact. This approves the reviewed required-workflow source pin; it does not authorize a broader rule expansion, consumer dispatch, production operation, or reuse of the pinned ref outside this workflow boundary.

[rmcdaniel]

General merged the one-line native validator pin at Security-reviewed 5c06fbcd5a54277d7e43f720029edd68e5e8854e after all nine hosted checks passed. Merge 0486e654b1ff94f1dd34a5a4838277068ffcb6a6 has complete tree c6f6e2bcc9b707efa960087962b0a4f1a8854c70, equal to the reviewed candidate. The owned remote topic ref returns 404.

All three actual-main workflows passed: Repository checks, SonarQube, and main analysis. 111 focused native workflow/reader/input/context controls pass locally with the parser available to the isolated interpreter.

The required workflow now pins accepted source b7da972634348e9bb27ff3653c383e93965ce043; its file SHA-256 is 6067a3c5109134bf7f0b31bf17217c0dd92a59f385b0f698be5037a61a19e9be. Entry point, reader/input code, parser lock, permissions and events are unchanged. This selects no organization rule, bypass, consumer dispatch or production action. General retains the separate exact-fixture central caller adoption and actual hosted qualification.