[rmcdaniel]

The CLI PHAR smoke job needs its own source-bound runtime admission before replacing the unqualified setup-php caller. This adds one cli-php-phar-smoke record for cli/build.yml:build-phar, the exact setup command, three private runtime fields, two required input absences and 24 file hashes/Git modes. All existing catalog records and whole-target Composer enforcement are unchanged. There is no policy/selector code change or live workflow activation.

The record binds CLI154 source a6b0aa97, including its inert proposed caller. Source/profile PASS covers the runtime code and local726 observation; bounded successor PASS covers only the five required action-version comments. The fixed PHP profile, read-only host controls/Box and narrow data overlays are distinct from the existing test-minor admission. No generic profile, full legacy toolchain or release acceptance is inherited.

Validation: 88 focused policy/Composer tests pass, including four new recipe tests with all24 file mutations, both absence violations, wrong workflow/job, ignored/conditional/overridden setup, all-verifier deletion and an unguarded extra job. The actual public CLI source also passes both current and proposed whole-target validation; ten actual source/guard/scope mutations fail closed. Source/private-path checks pass. Normal exact-head CI and independent record review still gate merge.

After accepted-main identity and checks, CLI owns workflow-only activation, independent caller countercheck, actual hosted original commands and normal CLI merge/main proof. Shared#297 remains open for the separately owned profiles and General's cross-repository closure.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact catalog/source review PASS for 1681bd4f96e6aa73e5ee3c343e9e5009643f95f7 / tree 758723d8, scoped to the CLI PHAR-smoke admission.

Independent checks:

• the complete delta is exactly the one closed runtime record, byte-identical proposed-caller fixture, and four refusal/control tests; no policy, selector, workflow or existing catalog record changes;
• deleting only cli-php-phar-smoke from the candidate catalog makes the complete JSON value-equal to base 54c6a2b...;
• all 24 recorded file hashes and canonical Git modes independently match CLI source a6b0aa974fe9418c67b8116f86a83dd5f5c2d6b2;
• the central fixture is byte-identical to that source fixture, SHA-256 e9d0ecc505ac2b4cb4d2c636665385f806b9eec056301ceb6d000c63321e2545;
• the record binds only cli/build.yml:build-phar, the exact setup command, three private runtime outputs and the two required absent files. CLI whole-target Composer trust remains mandatory;
• the four new exact-head tests independently pass. They require every bound file and absence, refuse wrong job/workflow, unguarded extra sinks, conditional/ignored/overridden setup, deleted live verifier and unreviewed job environment.

This admits only the already reviewed CLI154 PHAR caller source to the central catalog. Current exact-head checks, normal merge/main equality and cleanup remain. CLI still owns the later workflow-only hosted activation and original-command evidence. No live workflow activation, generic PHP profile, PHAR/release qualification, full shared297 closure or other catalog authority is inferred.

[rmcdaniel]

Accepted main is 7ffdb96/tree758723d861b77aefa4e379c268fbf556fe897f16, exactly equal to reviewed1681bd4f. Normal merge/main/tree equality and remote topic-head identity were verified; the remote branch is deleted and absent. All three actual-main workflows PASS: Repository checks43529627065, CodeQL43529627023, Sonar43529626864. Independent24-file/source/fixture PASS and all9 PR checks preceded merge. No policy/selector code, existing catalog entry or whole-target Composer guard changed. This completes the inert closed-source admission only. CLI154 retains exact workflow-only adoption, independent countercheck, actual hosted caller and CLI merge/main proof; no generic profile or wider297/release acceptance is inferred.