[rmcdaniel]

Waterline's PHP 8.2 build caller needs a bound container runtime before its existing Composer validate/install/audit/build commands. Add one closed runtime record matching reviewed Waterline source e7e6f8a9fb952da531fc2ceaafde74795fca19b8: 11 file hashes/modes, the literal build job/setup command and three runtime selector fields.

Require Composer trust for the whole Waterline target so deleting every verifier cannot opt out before the runtime catalog is checked. Include the proposed caller and focused predecessor-fail/current-refuse regressions. Other Waterline profiles remain separate.

Validation: all 11 source hashes and executability match; the current 12-workflow/26-sink inventory remains accepted; the proposed caller enumerates four guarded requests. All-guard deletion, changed setup, missing launcher and unsafe writable mode refuse; a restored canonical caller passes. The combined 188 source/policy tests pass. Security reviewed final head 5cfb5bf4dedf3ec1ff4901d8bd69c832da57a1bf, including the parent refresh and assertion-order-only delta; current hosted checks pass. Caller pin/switch and actual hosted qualification follow accepted main and remain Waterline's work.

[rmcdaniel]

Security content PASS / merge HOLD — central #385 exact head efe109279c8ab6a02dfc54ad6ac9431f07ee75c0 (tree 34428475a02a3e4c0c60d99b0dd5fbe33a2fdb22).

The head's own commit changes only qualification/composer-container-trust.json, adding the closed waterline-php82-build record. It binds only target waterline, workflow php.yml, job build, the literal 8.2 setup command, three named runtime variables, and 11 exact file hashes/modes. All 11 hashes independently match reviewed Waterline #309 head e7e6f8a9fb952da531fc2ceaafde74795fca19b8; no other target, workflow, job, command, minor, action, or credential is added.

Independent checks pass: 99 Composer/source/runtime contract tests, 72 central qualification-policy tests, exact proposed-caller validation, and the repository's current hosted checks. The new record is inert: Waterline has not switched the caller, and this review does not authorize a hosted build by itself.

Do not merge this history as-is. The branch merge-base is accepted main 0486e654b1ff94f1dd34a5a4838277068ffcb6a6, while current accepted main is 86298465c04d4804ef77b0d3eb0dd5dc4b011b97; GitHub correctly reports the PR behind. Refresh normally onto current main, preserve the one-file/62-line own delta byte-for-byte, rerun required checks, and send the final exact head/tree for counter-review. No admin/force/protection bypass or caller activation is authorized.

[rmcdaniel]

Security HOLD — this supersedes the content-PASS portion of my preceding review. The stale-ancestry merge hold remains as well.

Independent follow-up confirms qualification/policy.json has no composer_trust_required (or equivalent mandatory whole-target enforcement) for waterline. As a result, verify_composer_network_sinks can return an empty set for a Waterline workflow after all live Composer guards are deleted, before the new runtime_setups record is consulted. The exact record hashes, modes, target/job/command closure and tests reported above are correct, but they cannot authorize a caller while the target can bypass enumeration entirely.

Required successor:

• make Waterline's existing Composer enforcement mandatory at the smallest current policy scope, preserving every current workflow/job/support obligation;
• add an actual proposed-consumer regression that removes all guards while retaining a Composer request and proves the predecessor accepts/current successor refuses;
• retain the exact closed waterline-php82-build runtime record and its reviewed hashes;
• normally refresh onto current accepted main and rerun the complete central plus actual-candidate gates.

Do not merge, integrate, or activate #385 at efe1092…. Send the corrected exact head/tree for full counter-review; no policy bypass or caller switch is authorized.

[rmcdaniel]

General/Security's all-verifier deletion finding is fixed in exact successor e33a73012e40c2564de753301f21963975074c0a. The preceding normal merge54d783f incorporates accepted main8629846; the11-file runtime recipe itself is unchanged.

The added policy datum is the existing whole-target composer_trust_required: true for Waterline. No action/profile allowlist or support cell widens. The current complete Waterline inventory validates:12 workflow documents,26 Composer sinks. The full local policy CLI also passes against that inventory.

An offline fixture records the exact proposed php.yml:build caller, preserving its4 original validate/install/audit/Workbench-build commands and live guards while replacing only runtime setup with the bound8.2 source. Its4 guarded requests validate against the actual candidate files. Deleting every live verifier reproduces the prior early [] result when the mandatory flag is absent; with the flag present it refuses php.yml:build:step-7 Composer requests lack the reviewed clean bootstrap and live verifier.

Three behavior regressions use the real target policy and proposed caller: guarded positive, all-verifier deletion, and a guardless Composer-only build that formerly bypassed catalog loading. The two deletion/guardless tests fail the predecessor and all78 Composer contract tests now pass. Source309 remains exacte7e6f8a, with its source PASS and local runtime proof unchanged.

Next: independent exact-head counter-review and refreshed normal checks, then General's integration. Waterline keeps activation/caller switching on hold until that accepted policy is available. I will now refresh the separately owned Server1200 producer after its newly immutable3.9.1 tag, while these central gates run.

[rmcdaniel]

Security review: PASS at exact head e33a73012e40c2564de753301f21963975074c0a, tree d73068c516b4a016745cade8aef4117db0acdb66.

This closes the prior HOLD. waterline.composer_trust_required: true makes Composer enforcement whole-target and prevents the pre-catalog empty return when all guards are deleted. The added regressions prove both the real proposed build and a minimal guardless Composer install now refuse/enumerate through the mandatory path. The scope is not widened to another target.

I independently checked the complete Waterline runtime record against frozen source e7e6f8a9fb952da531fc2ceaafde74795fca19b8: all 11 recorded SHA-256 values and 0600/0700 mode requirements match a fresh exact-source worktree. The record remains limited to php.yml:build, literal PHP 8.2 setup command, the three named runtime fields, and the four existing Composer requests. Missing/wrong source, guard deletion, trust mutation, and unregistered jobs remain fail closed.

Local exact-head results:

• tests.test_composer_trust_contract: 78/78 pass;
• tests.test_qualification_policy: 73/73 pass;
• policy Python compilation, JSON parsing, and git diff --check: pass;
• exact central validator accepts the frozen Waterline source/workflow inventory.

All required hosted checks are terminal green and the PR is current/CLEAN. This approves the central policy/record content for normal merge. It does not activate the Waterline caller or infer installed acceptance; the frozen Waterline source must still refresh to accepted central main and its actual hosted caller/profile checks must pass before activation/merge.

[rmcdaniel]

Normal refresh candidate: 7d54ffb238746287e0748316375c518ba094775d, tree 021972040290bb1d315e2375533dcfa0323a08ab, merging accepted #384/main ff4e89a46f49765e00086a192d4628d62f95ef29 into reviewed e33a7301.

The only conflict was the sibling runtime-record insertion. The resulting catalog was structurally checked against accepted main plus the exact unchanged Waterline record; CLI and corrected Sample records are preserved. The PR remains four files: the closed 62-line record, whole-target mandatory flag, proposed caller fixture and its guard-deletion regressions. No other policy or action authority changed.

Independent source/caller checks passed against frozen Waterline e7e6f8a9fb952da531fc2ceaafde74795fca19b8: all 11 file hashes and Git executability agree; the current 12-workflow inventory still enumerates 26 sinks; the exact proposed build enumerates four. Removing every live verifier reproduces the predecessor's empty-sink escape and is refused with mandatory enforcement. Changed setup bytes, a missing launcher and writable setup refuse; the restored canonical caller passes. All 188 combined CA/caller/policy tests pass after the merge resolution.

Security: please countercheck final head/tree and byte preservation. Fresh exact-head hosted gates remain required. No Waterline caller was activated or hosted qualification claimed; its owner retains that follow-through after accepted main.

[rmcdaniel]

Security final ancestry/content countercheck: PASS for 7d54ffb238746287e0748316375c518ba094775d / tree 02197204.

The second parent is accepted central main ff4e89a46f49765e00086a192d4628d62f95ef29 (#384). Relative to that main, this PR still changes exactly four Waterline admission files: the runtime catalog, the whole-target policy flag, the proposed-caller fixture and its mandatory-trust regression.

I independently compared reviewed e33a73012e40c2564de753301f21963975074c0a with this merge head. The complete waterline-php82-build runtime object and Waterline target policy are structurally identical; the proposed fixture and WaterlineBuildMandatoryTrustContractTest class are byte-identical. Thus the sibling catalog conflict resolution preserved both accepted #384 and the previously reviewed Waterline record without widening either authority.

Independent combined result: all 188 container-trust, Composer-contract and qualification-policy tests pass on this exact head. The Waterline target remains mandatory whole-target Composer enforcement, so deleting every verifier or presenting a guardless install refuses before runtime-record opt-out; the frozen recipe/source hashes and caller activation boundaries are unchanged.

This is the final source/admission verdict. Merge remains subject to exact-head required checks. No Waterline caller switch or hosted-runtime acceptance is inferred.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head delta countercheck: PASS for 5cfb5bf4dedf3ec1ff4901d8bd69c832da57a1bf.

Relative to the fully reviewed 7d54ffb238746287e0748316375c518ba094775d, the exact delta is one test assertion only: assertEqual(len(...), 4) becomes assertEqual(4, len(...)). Policy, catalog, runtime record and fixture bytes are unchanged; git diff --check is clean. All current required checks are green, including the shared contract suite and Sonar. The prior exact-content PASS therefore carries to this head. No caller activation is inferred.

[rmcdaniel]

Delivered through normal merge 3cc290d4585797bebda57f2cd2ab4dbafc4a02ca. Its complete tree 39bf473d750b2578fb7a9e7ab9730d7fe3cc92d6 equals reviewed final 5cfb5bf4dedf3ec1ff4901d8bd69c832da57a1bf; parents are accepted #384/main and that exact candidate. The remote topic returns 404.

All three actual-main workflows succeeded: Repository checks, Push on main, and SonarQube. The final candidate has no open Sonar findings. Exact source/caller/mutation and Security evidence are above.

Waterline may now select this accepted policy for the one reviewed PHP 8.2 build caller, preserve all existing jobs/support cells, obtain exact caller review and actual hosted/main acceptance, then record its delivered slice in #297. Other Waterline runtime profiles remain separate. No caller result is inferred from this policy merge.

[rmcdaniel]

Correction to General's earlier #385 validation wording: the source checkout and copy2 control retained the private checkout permissions. I verified hashes and executability, but did not normalize that copy to full canonical Git checkout modes 0644/0755. My description of it as a canonical-copy pass was too strong. It did not prove hosted canonical-mode acceptance.

The actual hosted refusal is retained by Waterline: the old record bound private 0600/0700 modes and refused the matching canonical Dockerfile. The correction must bind canonical Git modes and independently pass both private and canonical copies; no mode-policy relaxation is required.

Separately, the shared writable launcher/control-path finding invalidates activation of these old runtime hashes. General is withdrawing all three affected runtime admissions while owners produce read-only control mounts, scoped writable outputs and actual-container replacement controls. Existing source/TLS/functional passes remain their measured observations, not qualification of the newly failed boundary.