[rmcdaniel]

The PHAR smoke caller now builds with the source-bound PHP container profile instead of the unqualified setup-php path. Its original generate/install/compile/info/list commands are preserved. The job waits for action-policy and uses an explicit Ubuntu24 runner.

The setup reuses the accepted image/ancestry source, then independently prepares the PHAR profile. Production INI plus a fixed read-only override provides PHAR writes, unlimited PHP memory within the container cap, UTC and CLI-opcache off. Host launchers, repository controls and the reviewed single-link Box artifact stay read-only; only vendor/build/generated metadata and private runtime data are writable. Composer guards inspect the actual container PHAR, and Box's internal child commands reopen its verified read-only artifact.

The exact 24-file admission is delivered in central397. Existing test-minor source/admission and every other workflow job remain unchanged. Source/profile, fixture and workflow-only independent reviews are recorded on this PR.

Validation:

• Actual migrated caller43530682026/job132247376704 passes its own fresh image/ancestry, production/module/profile probes, actual Composer guard, TLS and replacement controls, and all five original commands. Exact runtime/guard receipt.
• The local726 observation passed the original commands plus guard and all5 source controls; all20 created IDs are absent. Earlier partial failure at Box child reentry remains recorded NONPASS and is fixed.
• Both actual current/proposed workflows pass whole-target policy validation; ten source/guard/scope mutations refuse. 88 focused central contract tests pass. Source/private-path checks pass.

This qualifies only the PHAR smoke caller after normal PR/main gates. The official Box4.6.6 asset is identified by its reviewed size/hash and retains the same4.6.5 banner seen in the prior hosted caller. Reproducibility, Rust PHP-reference, maintained2.3.x release profiles and the selected unavailable legacyMacSPC execution path remain separate under shared#297. No package release or generic profile acceptance is proposed.

[rmcdaniel]

PHAR-smoke source is frozen at 72692ad, tree 573296ea4257d045e507f3a55bd70fa482874315. Proposed exact caller targets only build.yml:build-phar, explicitly Ubuntu24/Linux-amd64. The live workflow is unchanged, so existing hosted PHAR success is not acceptance of this new profile. All14 bound files of the admitted test-minor recipe remain byte/mode identical.

The separate setup delegates the unchanged pinned image builder, strictly parses six private output fields without shell sourcing, then prepares this profile. No new base image/build source is introduced. The fixed read-only PHAR INI asserts phar.readonly=0, memory_limit=-1, date.timezone=UTC and opcache.enable_cli=0; the existing module/production-INI/no-coverage probe still runs. Repository/control/state roots are read-only; only vendor, build output, the single owned/nonlinked generated-info file, and private home/tmp/Composer data are writable. Box is outside those overlays, owned/single-link mode0400, and checked against the independently reviewed release asset before PHP loads it. Its internal child reentry uses that same read-only PHAR path.

Exact-source local caller evidence, 2026-11-13 23:25:38–23:25:51 UTC:

• Retained inspected image sha256:747afb163fc37bffdf92b327da725e606a0695ba984398d09dd4b7e5f2fcb8d5, PHP8.4.27, Composer2.10.3, coverage none, Node22.23.4. No base rebuild or borrowed caller qualification.
• All five original commands pass: generate-build-info; production Composer install with the original flags; box compile --no-parallel; box info build/dw.phar; and php build/dw.phar list. The actual container Composer PHAR first passes the unchanged242c trust guard (fileSHA d7eea290…), selected public bundle SHA256 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785, empty additional-root store and zero blocked roots. Generated PHAR SHA256 80d6e458c8d25719cff15fec0e4ec3f3d64611ef48aa69cdcd66acd79ffcd731 is local functional evidence, not a published artifact.
• The actual new launcher passes ambient-positive/selected-clean curl60-before-HTTP TLS control. All5 source controls pass with the inspected image, including six predecessor/candidate launcher/wrapper/Box-replacement scenarios. Candidate data writes succeed, controls/Box stay unchanged, and following host entries execute actual container PHP. The two deliberately corrupted predecessor host wrappers execute their markers instead. Link/symlink output and hardlinked Box controls refuse before Docker.
• Exactly20 created Docker IDs from this bounded window were captured and independently inspected absent after --rm cleanup. Two predecessor following calls are marker shell wrappers, so they create no Docker container. No production credentials, vault, ports or source-control writes were exposed to PHP; the host environment was cleared before the consumer.

The official Box4.6.6 asset remains SHA256 aa0966319f709e74bf2bf1d58ddb987903ae4f6d0a9d335ec2261813c189f7fc, 2,947,031 bytes, as independently reviewed on #150. Its observed banner is 4.6.5@0964604; the existing pre-migration hosted smoke job132179262056 reports the same banner. Identity is the reviewed release asset, not an invented matching version string.

Earlier eee166 source remains NONPASS for the complete caller: compile succeeded, but box info relaunched the guard path as Box and failed its argument/identity check. The corrected entrypoint is covered by the successful full sequence above. Sonar's real style findings were fixed; the new unittest file follows the existing test_*.py test classification. No rule, exclusion, suppression or gate was weakened. Superseded710 Build was canceled after726 replaced it; only current-head CI supplies the next gate.

Independent source/profile review, exact central closed-record/proposed-consumer mutation checks, actual hosted activation and normal merge/main qualification remain required. I retain the CLI-PHAR-only catalog draft; existing test admission stays unchanged. Reproducibility, Rust PHP-reference, maintained2.3.x release profiles and the selected legacyMacSPC refusal remain separate.

Exact created IDs (all independently inspected absent):

f12cf8829c451338a4f274235a815f45fb0d389dd2b72c1927d042aac4d5c3a6
11579f02d61a722347fbe25f48ae32e442ca41d7bab70fbcabdd9fda52fe07f8
3a6e4fbe72d8469ac8ed7dafbd75a955f2139bd8f31a106a28cd80761f36d3c9
f7a11afee18823a579adb05e350e411e1e47e72bc45bfdfd26782344116dec28
f7315f8082ff798181946ce3ca4978987f4c89f1c4ceac363925daed5f221e15
d73015242ebda5811e7dd987da54471a1238593f163a7af76fa52a0abccb0200
398facac94eee84841793fe791e0bbe8be8a19c50921fe45c08160d39ecf25a8
6b03cdea51b3dd0bed58fb15f4ec7927bf8d4d2c372b5703b201b698b4b7b93f
07b0c42741b7d0e158ffd44a4e54ed03c4f9ae21e989540896a50e0f142e6fd9
c13985813c94072c3ccc0a1912043f20b84fcb298143ce6703238016e743155e
168ec46e2059e8aced8e2577e9a4a2a5b7894129ecf020b4a89f8aca17d9a7f7
2b8ba0ae7b841e1b95d6556bed506ee58342f30965b42ab197f5a0420da0ecab
2e6f6409dd2d8aa1b95b89528c31cd649c1b34e02ec1e54d6d90282c8b32868f
ee5eebf89a96e74c47e519e52672a7436c6658f16e1301b6c0a307d146382d3b
8e839413f9246fee3e5a349b1a5b05454df9c24d1509af728d6915c2f07b8938
81f0b4b85ebf6046b38dacbdf83a257ee72fd6a45d0ca010dc9d95a9330c26d9
6cbf038907f1d3d0650a88a16e7d50a19a99be0bc3fc8b36b6fafe9157c45f7a
55f2350d95ee3ee7e3505c87e46276192f035f0af1d8824cb5f1fa5e3ab9cc60
28f8fd7f200372b5b7a22d73cf7d205c155d9ba9d4f2dae94e6f24a98bc954d6
37066d4555edc55fd4d8669f821013bfbfcdbe0f6bf2ba3b9682eb1f852219ac

[rmcdaniel]

Security source/profile review of exact 72692adf5592929daa253cf774faa65748b6c5f7 / tree 573296ea4257d045e507f3a55bd70fa482874315: PASS, scoped to the proposed CLI PHAR-smoke caller and its retained local observation.

Independent checks:

• the ten-file delta is source-only; the live workflow is unchanged. The proposed fixture contains one build-phar job and parses as a 12-step Ubuntu 24.04 caller;
• the setup delegates to the unchanged accepted image builder and treats its six outputs as data. It requires the exact key set and relationships before appending anything to the real workflow environment/path;
• repository and private-state roots are mounted read-only. Writable overlays are limited to vendor, build output, the single owned/nonlinked generated-info file, and private home/tmp/Composer state. Host launchers, profile, Box artifact, checkout controls, and the rest of private state remain read-only;
• the generated file rejects links/hardlinks; Box is outside writable overlays, owner/single-link/mode-0400 checked before launch, and exact size/digest/uid/link/mode are rechecked in the PHP guard immediately before loading;
• Box child reentry is bound back to the same verified read-only PHAR through the corrected script identity. The earlier complete-caller failure remains a valid NONPASS;
• the environment allowlist excludes the demonstrated credentials and PHP startup override. The actual Composer PHAR substitution is explicit, and the accepted trust guard remains before dependency execution;
• immutable image config ID, caps, no-new-privileges and resource bounds remain; no mutable image tag or pull path is introduced;
• the exact Python source controls pass independently (4 pass, 1 effectful skip without explicit inputs), shell syntax/diff checks pass, and the proposed YAML is valid;
• the retained local receipt names source 72692adf..., image 747afb16..., all five original commands, the trust guard, TLS and six predecessor/candidate replacement scenarios. I independently rechecked all 20 recorded full container IDs: every inspect is the exact missing-object form and every ID-filtered inventory is empty;
• GitHub's official Box release asset 233947190 independently rehashes to aa0966319f709e74bf2bf1d58ddb987903ae4f6d0a9d335ec2261813c189f7fc at 2,947,031 bytes. Its embedded 4.6.5@0964604 banner is therefore an observed property of that exact 4.6.6-tagged asset, not an identity substitution. Keep the banner explicit; do not relabel it as an independently demonstrated 4.6.6 runtime version.

This establishes the proposed caller source/profile and the bounded local observation only. It does not activate the live workflow, admit a generic PHP profile, qualify the central catalog record, publish a PHAR, or cover reproducibility, Rust reference, maintained 2.3.x, release, or legacy-macOS paths. The exact closed central record/proposed-consumer mutation, fresh hosted activation, current-head CI completion, and normal merge/main verification remain separate gates.

[rmcdaniel]

Security exact successor rebind PASS for a6b0aa974fe9418c67b8116f86a83dd5f5c2d6b2.

The complete delta from reviewed 72692adf5592929daa253cf774faa65748b6c5f7 is one inert proposed-caller fixture and exactly five readable pinned-action comments: two checkout v6, setup-python v6, and two accepted central-action clean-trust labels. The action SHAs, job/steps, runtime/profile/guard/test blobs and all executable bytes are unchanged; git diff --check is clean. The comments satisfy the central policy preflight without changing action identity or behavior.

The retained local execution remains attributed only to 72692ad...; no replay is needed or inferred for comment-only bytes. The prior source/profile PASS and all remaining limits carry forward: proposed-caller/closed-record admission, terminal current-head checks, hosted activation and normal merge/main verification remain separate. No live workflow, generic PHP profile, PHAR publication or wider release authority is granted.

[rmcdaniel]

The proposed caller needed the normal readable action-version comments. Successor a6b0aa9 changes only those five fixture comments; independent bounded PASS confirms every runtime/profile/guard/test blob is unchanged. Local execution remains attributed to72692ad. Closed admission is now central397, exact1681bd4f: only one24-file CLI-PHAR record, the identical inert proposed caller and refusal tests; existing entries/whole-target enforcement are unchanged. Both current and proposed actual CLI source validate; ten actual source/guard/scope mutations fail closed and88 focused policy tests pass. The live CLI workflow still has not switched. Accepted central main, exact hosted activation/current CI and normal CLI merge/main proof remain required.

[rmcdaniel]

Closed-source admission is accepted at central main7ffdb96ae4562deb4fad98e91cf4df7841da070b/tree758723d8, equal to reviewed1681bd4f, with all three actual-main workflows successful and remote topic absent: final397 receipt. Workflow-only successor c6a80ef/tree635c637c now adopts exactly the reviewed PHAR job fixture. All24 registered blobs and every other job are unchanged; the same aggregate still covers the new policy-gated caller. Full actual workflow/action/Composer validation passes with8 dependency requests. Independent adoption countercheck and actual hosted original commands/current checks now run; merge/main and remaining297/release scopes are not inferred.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact workflow-adoption review of c6a80eff620d57859d81b50677365b2b21635d46 / tree 635c637c641c81015bcd548912a14ee642a37090: PASS for the workflow-only source delta.

I independently confirmed:

• the entire delta from reviewed a6b0aa97 is confined to .github/workflows/build.yml's build-phar job;
• parsed YAML for the live build-phar job is object-equal to the byte-reviewed a6b proposed-caller fixture (12 steps, needs: [action-policy], Ubuntu 24.04); every other job and all 24 admitted source/profile blobs are unchanged;
• central #397 merged normally at 7ffdb96ae4562deb4fad98e91cf4df7841da070b, and its tree 758723d861b77aefa4e379c268fbf556fe897f16 exactly equals reviewed 1681bd4f.

No local PHAR/profile replay is required for this exact adoption. Current exact-head hosted checks, including the real Build PHAR (smoke test) job, are still running and remain merge gates; retain the normal post-merge main proof. This does not expand to generic PHAR admission, full #297, package/release or publication authority.

[rmcdaniel]

The actual migrated PHAR smoke caller PASS is now recorded at unchanged workflow-adoption source c6a80ef: Build43530682026/job132247376704.

Subject	Observed identity/result
Runner/profile	Ubuntu24/Linux-amd64; PHP8.4.27; Composer2.10.3; coverage none
Freshly inspected base config ID	sha256:ee268e87a6b4094f33b878accb5b39061446f58804395b05152801b998caed86
Actual caller runtime config ID	sha256:b67768d629e79f819c86afa4a51d0d87d9ed7adee6275df788bee1d70090eadf
Active PHAR settings	readonly0, memory-1, CLI-opcache0, UTC; required production INI/modules/Node probe PASS
Actual Composer trust	bundle50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785;120 certificates; both blocked roots0; actual container Composer PHAR
Profile controls	actual TLS accept/refuse and all5 new tests PASS, including paired predecessor/candidate replacements
Original commands	generate info, production install with original flags, Box compile, Box info and PHAR list all SUCCESS

Source/profile PASS726, fixture-only PASSa6b, accepted central 397/7ffdb96 main proof and workflow-only PASSc6a are distinct gates. The earlier local726 observation remains attributed to726; this job supplies its own fresh image/ancestry, settings, guards, controls and original-command evidence.

Full current-head required checks, normal CLI merge/main/tree verification and remote branch cleanup remain pending. This is one PHAR smoke cell. Reproducibility, Rust PHP-reference, maintained2.3.x release profiles, the selected unavailable legacyMacSPC execution path and full shared297 closure remain separate.

[rmcdaniel]

The PHAR smoke caller correction is delivered through accepted main 6df4ec4. Complete tree 635c637c641c81015bcd548912a14ee642a37090 equals reviewed/hosted source c6a80ef exactly. Normal merge parents and source equality were checked; the remote topic matched the reviewed head before deletion and is verified absent. Historical source/evidence remains preserved.

All four actual-main workflows are terminal SUCCESS:

• Build43532397245, including the migrated PHAR caller and required aggregate.
• CodeQL43532396209.
• Sonar43532397254.
• Public Boundary43532397003.

The fresh actual-main PHAR job132253134136 independently rebuilds/inspects its runtime and passes all five original commands plus the actual Composer guard, module/profile probes, TLS and replacement controls. Its base config ID is sha256:f7815fc7b5820ff2811c0c4bfb9e4904c48dd00ed0591431a298581c85d8470c and caller runtime is sha256:eabb79bc1e8ae8349917ac236f5c3c1c71bdeb766b3e67633eac4b0fc6b417af. Observed PHP8.4.27/Composer2.10.3, production INI, phar-readonly0, memory-1, CLI-opcache0, UTC and coverage none match the closed profile. Selected bundle50f79f98… has120 roots and both blocked roots0. All five new tests and three existing/new runtime controls pass.

Source/profile review, fixture successor review, central397 accepted-main proof, workflow-only adoption review, actual PR caller tuple and all28 PR checks preceded normal merge. Local726 observations and earlier incomplete eee166 execution retain their original scopes and are not relabeled. The official Box asset hash/size and its retained version-banner caveat are unchanged.

This closes build.yml:build-phar on Ubuntu24/Linux-amd64 only. Existing test-minor admissions and other jobs remain unchanged. Reproducibility, Rust PHP-reference and maintained2.3.x release profiles remain CLI-owned, separately qualified work under #297; the selected legacyMacSPC refusal remains in force. No package release, generic profile, other-platform qualification or complete #297 closure is claimed.

[rmcdaniel]

Security independent post-merge verification: PASS for the scoped CLI PHAR workflow adoption. Merge 6df4ec4 has tree 635c637c641c81015bcd548912a14ee642a37090, exactly equal to reviewed head c6a80ef. The remote topic is absent. All 18 exact main-commit check runs are terminal SUCCESS, including Build PHAR smoke, target qualification, PHP 8.2 through 8.5, Rust parity, reproducibility, CodeQL, Sonar and public-boundary checks. This completes the post-merge/main gate for build.yml build-phar only. It does not expand to generic PHAR admission, full shared 297, another platform, package publication or release authority.