[rmcdaniel]

The fixed protected runtime correctly rejects #387’s new complex CI/Sonar workflow bytes because their exact reviewed identities are not yet admitted. This source-only step registers the two independently reviewed successors and freezes their bytes as inert fixtures, preserving the existing predecessor identities.

Only CI SHA256 ee4ddc9ad665490681b3f1a2676cdd4ce791d90677e2a931bdb4fea7cc9deb15 and Sonar 4eed5d82d6e5decf47d4aab1d1d203eb1060f8892216360b9308c3e710bbcd77 are added for the existing central target/path pair. They add the response-loss socket module and its actual source to normal tests/coverage. The controls prove both unchanged predecessors, reject missing admission, altered bytes/modules, wrong paths and wrong targets. No parsing or selector behavior changes.

All live workflows, runtime pins, credentials and caller records remain unchanged in this PR. After independent exact-source review, all current gates and accepted-main readback, #387 can adopt that immutable runtime source in its separate activation step. This PR does not permit use of the held fixture or provide #216 installed/legacy/upgrade acceptance.

Validation: 159 focused context/protected/native/workflow/qualification tests passed locally; all live workflow bytes and diff/secret checks verified. Security review of the exact future workflow bytes and transport source. Owning #387 successor and current protected-runtime refusal.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head review: PASS for c6c2978cfbc0e43d85a5f51fa6d70e2bd7e0f5ba (tree 1d94395556aec711b2752bfc0747f20683397125).

I reviewed the complete delta from accepted base cdfce90c365f685d78af295c17b54cb15ee4b795. It changes only the protected-context registry, two inert workflow fixtures, and their refusal controls; no live workflow, runtime pin, selector, or execution path changes.

Independent checks:

• the fixture digests are exactly the previously reviewed Share committed-response-loss fixture for command retries #387 workflow bytes: CI ee4ddc9ad665490681b3f1a2676cdd4ce791d90677e2a931bdb4fea7cc9deb15 and Sonar 4eed5d82d6e5decf47d4aab1d1d203eb1060f8892216360b9308c3e710bbcd77;
• removing only the declared response-loss module (and the Sonar source path) reconstructs the already accepted predecessors 363540f9… / f7fad836…, which remain admitted;
• missing registry entry, byte/module mutation, wrong path, and wrong policy target all refuse;
• git diff --check is clean and python3 -m unittest tests.test_protected_policy_context passes 34/34;
• all current hosted checks are green, including shared contracts, native-policy validation, CodeQL, and Sonar.

This approves only the inert identity registration. It does not approve or activate #387's live workflow/runtime adoption; that remains a separate exact-head review after this source is accepted on main.

[rmcdaniel]

Source-only #391 delivered at main d4770e6555fdb59b044f2e5919e95a24c0a25073, complete tree 1d94395556aec711b2752bfc0747f20683397125, exactly equal to independently reviewed c6c2978. All nine exact PR checks were green before normal merge; the topic branch was deleted after verifying its expected head and remote absence.

All three actual-main workflows passed: Repository checks 43448677923, Sonar 43448678025, CodeQL 43448697990. Security exact source PASS.

The two workflow-byte identities are admitted as inert data, with unchanged live workflow/pin bytes in this merge. Separate #387 adoption now binds this accepted immutable runtime and remains subject to its own exact-head Security review, current required checks and main readback. No shared proxy consumer or #216 installed/legacy/upgrade acceptance is inferred from this source-only delivery.