Repository navigation
Drop Laravel 10 and 11 from service-mode support in the next minor (upstream EOL, unfixed advisories) #239
Description
Status: delivered and accepted; closed as completed (closure direction 6720364756, 2026-11-08). SDK 3.10.0 removed Laravel 10 and 11 from service-mode (bridge) support, coordinated with Workflow 2.21. Existing SDK 3.9.x applications keep their own contract. The bare SDK keeps PHP ^8.1, and stable-v1 scope is unchanged.
Done-when gates, reconciled
| Gate | Evidence |
|---|---|
| Workflow handoff: the published embedded Laravel 12/13 support manifest and Release Verification authority | workflow#1020, closed 2026-11-07 (Workflow 2.21.0: drop Laravel 10/11 and PHP 8.1 from embedded v2) |
| Source: the adoption contract, framework CI matrix, transition fixture/authority, docs and changelog changed together; constraints derived from the published Workflow contract | #350 "Align next-minor Laravel bridge with published Workflow 2.21" (6ec471d2), then 3.10.0 release source #353. Bridge: PHP ^8.2, Laravel ^12.69.0|^13.30.0, Laravel 13 needs PHP 8.3. The provider refuses unsupported or unknown framework/PHP versions before registering anything. |
| Publication | SDK 3.10.0 (tag 4e6c6b7b, GitHub Release 437881850, 2026-11-07), on Packagist with source and dist at 4e6c6b7b |
| Guide | Live Laravel guide, re-read 2026-11-08 10:28 UTC: HTTP 200, SDK 3.10, Laravel ^12.69.0|^13.30.0, PHP 8.2/8.3 floors and the Laravel 10/11 transition present |
| Installed supported graphs: five cells, SDK 3.10.0 + Workflow 2.21.1, exact ZIPs and the real interpreter proved | PHP 8.4.27, Laravel 12.69.0 and 13.30.0: audit 6718312072. PHP 8.2.35 / Laravel 12.69.0, PHP 8.3.36 / Laravel 12.69.0, and PHP 8.3.36 / Laravel 13.30.0: graph G audit 6719742965 |
| Refusal, dependency layer (R): ordinary advisory blocking refuses affected installs before activation | Laravel 10.50.4, 11.57.1, 12.68.0 and 13.29.0. Each gave Composer exit 2 for exactly one root Laravel advisory cause, with the frozen advisory set, and no lock or vendor. Captured audit 6720364756 |
| Refusal, installed guard (B): the installed SDK predicate on the real PHP 8.2.35 and 8.3.36 interpreters | Selection and audit 6720235778. 13/13 synthetic inputs per interpreter, each with the exact message: Laravel 10/11/12.68/13.29, null, and Laravel 13 on PHP 8.2 refuse. Real-metadata provider registration succeeds. |
Limits (kept as accepted)
- R proves Composer's resolution refusal, not an installed Laravel 10/11 boot.
- B feeds explicitly synthetic version inputs to the installed predicate and checks provider registration against real metadata; it does not boot Laravel 10/11 or override Composer metadata.
- The bridge graph cells do not qualify console-worker
pcntlbehavior on the stock 8.2/8.3 images. - Earlier results: all earlier NONPASS records keep their original attribution. No advisory ignore, package install, retry or SDK 3.11 acceptance is implied.
- Retention: evidence, consumers and owned images stay through the 2026-11-08 23:30 UTC Phase F manifest.
Unchanged scope
The #185 published native child-all and installed-SDK acceptance gate stays separate. This issue assigned no version branch, tag, package release, portal override or runtime action beyond the selections recorded in its comments.
Original issue text (historical, superseded by the status above)
Laravel 10 and 11 are past upstream end of life. Published advisories affect those majors without a fixed release, so the coordinated next minor will remove them from service-mode framework support. The stable Laravel portal already carries the EOL warning and recommends Laravel 12/13; live/source verification confirms delivery. Its historical transition-version sentence will be corrected with the coordinated support handoff.
The accepted planning target is SDK 3.10.0 coordinated with Workflow 2.21.0. Earlier 3.9.0 wording is superseded. Existing 3.9.x applications retain the current supported contract; this issue does not authorize a breaking 3.x patch or infer a bare-SDK PHP interpreter drop.
Owner Workflow: complete Workflow #1020 and return the actual published embedded Laravel 12/13 support manifest and Release Verification authority. Owner sdk-php: once that handoff exists, update the service-mode adoption contract, framework CI matrix, transition fixture/authority, documentation and changelog together. Derive framework constraints and its PHP floor from the reviewed embedded contract; preserve stable-v1 scope. The proposed Laravel constraint is ^12.69.0|^13.30.0, subject to that actual published authority.
General owns the combined-minor source cohort/publication decision. The existing #185 published native child-all and installed-SDK acceptance gate remains separate. No version branch, tag, package release, portal override or runtime action is assigned by this issue. Keep it open until the coordinated support change and published/guide acceptance are delivered.
Activity
Disclose Laravel 10 and 11 end of life in 3.8.2
rmcdaniel commentedon Nov 4, 2026
Current product decision from General: this change targets SDK 3.10.0, coordinated with Workflow 2.21.0. The earlier 3.9.0 target in the issue body is superseded.
Blocked until Workflow 2.21.0 publishes the Laravel 12/13 embedded support contract. Then update the SDK service-mode contract, support matrix, CI, docs and changelog together, retaining the notice that Laravel 10/11 applications can stay on 3.9.x. The transition-authority check requires the SDK service contract to match the published Workflow embedded contract.
rmcdaniel commentedon Nov 4, 2026
Current coordinated target remains SDK 3.10.0 after Workflow 2.21.0; the original 3.9.0 body target is obsolete. Fresh readback finds Workflow 2.20.3 published, no 2.21.0, and existing Workflow #1020 owns the precise embedded-contract change. Its earlier 2.20.2 prerequisite is complete.
I asked the Workflow owner to take #1020 after current P1 work or return a specific scheduling decision to General. The request includes the exact published manifest/Release Verification handoff and explicit framework PHP-floor treatment.
sdk-php owns the service adoption contract, framework CI matrix, transition fixture/authority, docs/changelog and published minor follow-through once that authority exists. I audited the current contract and EOL notice; they still accurately retain 10/11 for the 3.9 line. No early contract divergence or support drop is made here. General owns the cross-package release order.
rmcdaniel commentedon Nov 5, 2026
Verified the existing stable EOL notice before proposing another documentation change. The live Laravel guide returns HTTP 200 and already states that Laravel 10/11 are past upstream EOL, some advisories have no fixed release on those majors, and applications should move to Laravel 12/13. The notice links this issue. This interim user-facing warning is delivered.
The guide source is byte-identical at published 3.9.4, accepted stable-doc source 6a82156, and accepted main f4bd280: SHA-256 ffe0fee1dd8c6f059be60ec2a4975ed149afc0cf10da04af8ba12889b331cdad. Live deployment audit remains exactly 6a82156, SHA-256 43c0159fc3ee9317a32e644e20d61d47d2fbf64d23194efe7b8e1f2b86514cd1. Live Laravel HTML is 34,286 bytes, SHA-256 c0ec4af1c91278dae3cca9e5df21eeb329d3a07dd96b789db87b52ccdaa6c155.
The surrounding transition sentence still names historical 3.8.x / Workflow 2.17.1 and “next SDK minor”. That sentence is not current release-cohort authority: the accepted target is now coordinated SDK 3.10 / Workflow 2.21, with 3.9.x retention. sdk-php will correct that historical wording with the actual contract/matrix handoff rather than add a duplicate EOL warning or infer a stable publication override. No documentation source or live site was changed by this verification.
Remaining owner/action: Workflow completes #1020 and returns the actual published 2.21 embedded support manifest plus verifier. sdk-php then updates the matching service contract, framework matrix, transition authority/fixture, guide/changelog together, deriving the PHP framework floor from that reviewed handoff. General retains combined-minor cohort/publication; #185's immutable published flat-child-all plus installed-SDK tuple remains a separate package gate. The bare SDK PHP floor is not changed by inference, and the issue remains open for the support transition.
rmcdaniel commentedon Nov 5, 2026
I reconciled the current dependency: Workflow #1020 remains open and no published 2.21 framework authority was returned. I asked its current owner for the actual Laravel 12/13 manifest, Release Verification handoff and explicit framework PHP-floor decision after current source priorities.
Workflow owns that authority; sdk-php then changes the matching service contract, CI, transition fixture and docs/changelog together. General retains the 3.10 cohort/publication decision. The delivered EOL warning and historical transition sentence are already distinguished above. The bare SDK PHP ^8.1 floor is preserved; no early support drop or duplicate warning is needed.
rmcdaniel commentedon Nov 5, 2026
The service-mode EOL warning is already live. The transition-version sentence is historical wording and remains recorded for the coordinated framework update. The bare SDK PHP ^8.1 floor stays separate from embedded framework support.
Published Workflow 2.20.4 still declares PHP ^8.1 / Laravel 10–13. Core #1043's actual installed 22/221/0 proof is complete and existing-tag notes are published; its old unexecuted-proposal wording no longer blocks this source slice.
Current producer action: Workflow has started isolated
workflow/1020-core-2.21-supporton currentcd8831d5. Its durable owner return owns the coherent PHP ^8.2 / Laravel 12–13 manifest, derived matrices, removed-support security policy, Composer refusal/authority controls and README/upgrade/changelog, preserving stable-v1. Ordinary source development needs no new per-PR General selection. Workflow #1047 is now normally merged as3d7d0a193d8fffe591f8286d1c4d5499120a297a; the published-authority gate is unchanged. Its resulting-main QA is a separate producer source acceptance, not Release Verification for a published2.21 tag. No 2.21 published manifest, tag or Release Verification exists yet.Next action / owners: Workflow completes that source change and normal qualification, then the separately authorized publication supplies the actual 2.21 manifest and Release Verification. sdk-php consumes that exact authority before changing its bridge contract, matrix and transition docs; General retains final coordinated minor/publication decisions. I drove the upstream follow-through by returning the cleared installed-proof prerequisite, obtaining the active source-owner response and recording it here. No early SDK support/floor change, duplicate runtime test, tag or release was started. Normal #311/#312 acceptance supplies no substitute for the published framework authority.
General separately selected SDK 3.10.0 source preparation on the existing PHP ^8.1 / Laravel 10–13 contract (#313); it does not consume the future 2.21 platform change early.
Docs #481 boundary: the published bare SDK retains PHP
^8.1. Its current service-mode Laravel bridge separately declares^10.50.4|^11.56.1|^12.69.0|^13.30.0, with each framework major imposing its own PHP floor. Once actual published Workflow2.21 authority/verifier is supplied, sdk-php derives the coordinated bridge matrix/transition docs from that reviewed handoff; no embedded source change silently raises the bare service-SDK floor. General retains this handoff before final combined3.10 freeze/tag. Current service-mode guidance and examples remain SDK-owned.rmcdaniel commentedon Nov 5, 2026
Docs #481 now has qualified draft #482, with all 11 contexts and eight-locale qualification. The support/install/upgrade preview keeps bare SDK PHP
^8.1independent, sends service bridge authority to the SDK-owned Laravel guide, preserves every service example and stable-v1 file, and makes no early SDK floor/matrix change. The old combined Laravel 9–13 destination guarantee is replaced by target-specific published requirements.Workflow #1020 has the exact request for the actual 2.21 package/manifest plus Release Verification; the docs draft stays unmerged/auto-off for its final support promotion. Your coordinated bridge adoption/transition guide remains separately owned here after that producer authority, with no SDK release, version selection or installed proof inferred from this docs preview. No additional SDK build/test/release action is requested.
rmcdaniel commentedon Nov 6, 2026
2026-11-06 owner reconciliation.
Fresh normal registry readback still gives Workflow 2.20.4, source
e3664430fd1b795aadaca89c835d5281502a01ce, PHP^8.1and Laravel^10.50.4|^11.56.1|^12.69.0|^13.30.0. Bare SDK 3.9.4, source11085f0c624674a4b70d3a6fb3e83eaff3869fcb, independently retains PHP^8.1. Workflow's newer support source is not published 2.21 authority. I read Workflow's current publication dependency and central297's accepted private-pip source / next profile adoption; neither supplies the missing published manifest/verifier handoff.Workflow owns narrow adoption of the applicable shared setup inputs, then the actual 2.21 package/manifest and original Release Verification. sdk-php owns the coordinated bridge contract, derived matrix/transition authority and stale transition sentence after that handoff. General owns the final combined-minor decision under #293. I returned this dependency to Workflow and retained the separate bare-SDK/framework support distinction. The accepted P0 redesign preserves published support and does not remove Laravel10/11 or raise PHP floors through presentation changes. The existing EOL warning remains delivered.
rmcdaniel commentedon Nov 6, 2026
I re-read Workflow #1020 and the current central297 acceptance. The matching Ubuntu24 initial setup tuple is now accepted, clearing the old raw-profile wait, but actual Workflow caller adoption plus published 2.21 support manifest and Release Verification are still outstanding. Current published Workflow remains 2.20.4.
The separately selected P0
3.9.xsource cut in #335 deliberately keeps published Laravel10/11/12/13 support and bare-SDK PHP^8.1 unchanged. General/Workflow own the actual 2.21 producer/verifier handoff and final combined-minor decision; sdk-php owns coordinated bridge constraints, framework matrix, transition authority and guides after that handoff. I preserved the existing EOL warning and this source/published distinction in the maintenance review. No support-floor change or release is selected by that patch source.rmcdaniel commentedon Nov 7, 2026
The actual normal-registry SDK3.9.5 manifest preserves PHP^8.1 and Laravel10/11/12/13 constraints; the maintenance release does not perform this coordinated EOL support change. I verified that support boundary in the installed release. Next owner/action remains General/Workflow's actual first-caller qualification and published2.21 support-manifest/Release Verification handoff under #293, then sdk-php owns the matching bridge constraints, matrix, transitions and guides. The accepted initial Ubuntu24 profile needs no repeat; it is not blanket caller adoption.
rmcdaniel commentedon Nov 7, 2026
I reconciled the newly accepted first-caller Source/policy wiring in central #297 with its still-unexecuted actual caller proposal. The latest actual Workflow release remains 2.20.4. Source wiring and the SDK P0 cohort do not select the coordinated Laravel support-floor change.
Next owner/action remains General/Workflow: actual first-caller terminal/cleanup and the published 2.21 support-manifest/Release Verification handoff under #293, then sdk-php changes bridge constraints, matrix, transitions and guides together. General has been asked. The installed 3.9.5 PHP/Laravel constraints and accepted raw Ubuntu24 profile are preserved.
rmcdaniel commentedon Nov 7, 2026
The first-caller status is now concrete: the consumed original is NONPASS before PHP or product requests. Workflow #1058’s system-Python correction is merged at
f3142313e42b004492ebf247b463d509a0a12940; that Source fix does not establish a qualified actual successor or published2.21 support metadata. The corresponding SDK #340 correction is Source/CI accepted and remains effect-held.I rechecked the actual Workflow release: it remains2.20.4. General still owns the qualified actual successor and published2.21 support-manifest/Release Verification handoff under #293; sdk-php then changes bridge constraints, matrix, transitions and guides together. The new initial native-consumer Source harness #348 does not change that support-floor authority. General has the concrete handoff, and installed3.9.5 PHP/Laravel constraints remain intact.
rmcdaniel commentedon Nov 7, 2026
The support-floor handoff now has a concrete second caller failure: corrected Workflow 42348212659/a1 under central297 passed system-Python/private-pip trust and then refused the pinned installer read with404 before PHP/product requests. This does not establish published2.21 support metadata or compatibility authority. The latest actual Workflow release remains2.20.4.
General has the specific immutable-installer-source/qualified-caller request and retains the published2.21 manifest/verifier handoff. SDK-PHP then changes bridge constraints, matrix, transitions and guides together under #293. Maintained harness349 supplies later installed controls, while315/340 remain effect-held. No support floor or published3.9.5 constraints changed.
rmcdaniel commentedon Nov 7, 2026
The caller prerequisite has advanced to the independently accepted actual corrected Workflow run, with terminal/custody reconciliation. The two earlier NONPASS originals retain their original scope. Actual latest Workflow is now 2.20.5, target
b8f6bcdb951602b22259274b13b2261fdebff542; I verified its primary published release record.The missing input for this support-floor change remains the published2.21 support manifest and normal verifier, owned by General under #293. That specific handoff is already requested. SDK-PHP then updates bridge constraints, the framework matrix, transitions and guides together and performs the actual installed controls. The 2.20.5 repair, held SDK #340's prepared preview packet and caller acceptance do not establish that future support floor. Published SDK3.9.5 constraints remain unchanged.
45 remaining items
rmcdaniel commentedon Nov 8, 2026
#239 installed Laravel 10/11 and below-floor refusal: packet for review (design and exact bindings; no container, acquisition or install selected or run). This closes the gate left open in packet 6718354015 ("Laravel 10/11 and below-floor refusal: no installed control exists"). Graph G's accepted cells and retained evidence are unchanged.
Finding: with normal trust, Composer refuses these installs before the bridge can run
Read-only metadata (Packagist
p2and the security-advisories API, 2026-11-08 ~09:50Z):php^8.1dcbc876d5bfbPKSA-b41t-wbzk-9q51,PKSA-d5tc-s1qs-h781,PKSA-m5cs-t1y6-qpcs,PKSA-3r5d-mb8f-1qw9,PKSA-mdq4-51ck-6kdq^8.2e4f74d439ab3^8.21343c22b92edPKSA-d5tc-s1qs-h781(<12.69.0)^8.36e2c36371696PKSA-d5tc-s1qs-h781(>=13.0.0,<13.30.0)335429f2/9c008e7cPKSA-d5tc-s1qs-h781(>=13.0.0,<13.30.0|<12.69.0) is exactly the bridge floor^12.69.0|^13.30.0.composer.jsondoes not require or conflict withlaravel/framework, so nothing in the SDK blocks these graphs. Composer's advisory blocking does. The held consumer config setsaudit.block-insecure: true, and the heldcomposer.phar7a2d379denforces it: graph F'sadvisory-refusalcontrol, and the real 8.4 graphs' clean audits.DurableWorkflowServiceProvider::register()callsLaravelPlatform::assertSupported(InstalledVersions::getVersion('laravel/framework'), PHP_VERSION_ID)before merging config or binding anything, and throws the fixed message.Proposed cells (each needs a separate selection; one install or check pair at a time)
R: real dependency-layer refusals. These need a controller successor H, not yet written, which adds profiles whose pass verdict is the expected Composer refusal.
Bounds: installer image
49c9e0fc, held trust (composer.phar7a2d379d, CA50f79f98, verifyd7eea290),--network bridge, and the same env/cap/timeout as G. No check container, because nothing installs.Profiles:
require(exact)config.platform.php239-l10-refuselaravel/framework10.50.4239-l11-refuselaravel/framework11.57.1239-l12-belowlaravel/framework12.68.0239-l13-belowlaravel/framework13.29.0Workflow is omitted, because Workflow 2.21.x itself requires the floor. Platform targets are the oldest retained interpreters each framework allows. There are no ignore or
--no-auditflags, and the advisory policy is unchanged.PASS requires all of:
laravel/frameworkand exactly the profile's advisory IDs above (no other blocking reason, such as a platform conflict);composer.lockand novendor/;An install that succeeds, or a refusal for any other reason, is NONPASS.
B: installed bridge admission on real interpreters (offline, read-only). One new held check script, no install.
Where it runs: in the check images with network none, against the retained, read-only G consumers:
run239-l12-p82-root/consumeron604de2f0(PHP 8.2.35), andrun239-l13-p83-root/consumeron628102249d93(PHP 8.3.36).What it calls: the installed
DurableWorkflow\Bridge\Laravel\LaravelPlatform::assertSupported()from the SDK 3.10.0 dist (inventoryc562d378) for reported framework versions, with the realPHP_VERSION_ID.Expected results:
10.50.4,11.57.1,12.68.0,13.29.0, their normalizedx.y.z.0forms, andnull12.69.0,12.69.0.013.30.0Every refusal must be the exact message
The Durable Workflow Laravel bridge requires PHP ^8.2 and Laravel ^12.69.0|^13.30.0; Laravel 13 requires PHP ^8.3. Upgrade the application platform before activating the bridge or retain the existing SDK 3.9.x release while upgrading.Positive control:
DurableWorkflowServiceProvider::register()with the consumer's real installed version (12.69.0 or 13.30.0) admits, and bindsServiceConfiguration.Stated limit: B substitutes the reported version passed to the installed predicate. It does not make Composer report a refused version, because
InstalledVersions::reload()cannot override the vendorinstalled.phpwhile the autoloader is registered. B proves the installed predicate and message on real interpreters. R proves real installs are refused. Neither is a real L10/11 application booting the provider; that would need ignored advisories.What is not proposed
conflictonlaravel/frameworkin the SDK: it would also block bare-SDK users, who keep PHP^8.1and need no Laravel floor.^8.2and 13 needs^8.3. It is covered by B's13.30.0-on-8.2 case and the existing unit testLaravelPlatformTest.Next
R and B need separate effect selections after source review. Retained evidence and images stay untouched until Phase F.
rmcdaniel commentedon Nov 8, 2026
Proceed with source preparation of R + B from 6719776124. No resolution, install, container or acquisition is selected yet.
I independently read Packagist's advisories API at 09:35:40Z and its package metadata at 09:36:03Z. The selected Laravel versions/refs and PHP requirements match the packet. Advisory
PKSA-d5tc-s1qs-h781affects>=13.0.0,<13.30.0|<12.69.0, including all four proposed refusal versions. The other four stated advisories cover the selected Laravel 10/11 patches. The two captures are 18,820 B / SHA-2562d2d1d13a3add59acd70ae91628fb4ab03c8630fda7ce461b315e871413af608and 1,013,238 B /e9f2930ea74482bd06026c9a20b1c51bf22bef9829aa94ce1a9ece06e2d56537. Correct the packet's “~09:50Z” metadata timestamp: it is later than both the comment and current observation; cite the actual retained retrieval time instead.R should use ordinary advisory blocking and the exact declared graphs. A refused resolution is evidence only when Composer reports the expected Laravel advisory cause, has no unrelated conflict or acquisition failure, and leaves no lock/vendor. Unexpected advisories or changed metadata are a new result to review, not permission to ignore them. Freeze the relevant advisory identities and distinguish their package-specific output from a generic nonzero exit.
B should exercise the installed SDK's admission predicate on the real retained PHP interpreters, retain exact refusal messages and positive controls, and verify normal provider registration against each consumer's real installed supported framework. Its supplied-version cases remain explicitly synthetic inputs to the installed predicate. They do not represent an installed Laravel 10/11 application boot or override Composer's real installed metadata.
That distinction answers the customer need without turning off advisory blocking: ordinary affected installs are refused before activation; the SDK's installed guard also refuses the declared unsupported platform values. Keep the actual scope in the eventual acceptance and reconcile #239's stale planning paragraph after these gates are qualified. Return the concrete controller/check/admission/launcher bytes and inert controls for review. Published SDK 3.10.0, the accepted G consumers, their locks and retained images remain unchanged.
rmcdaniel commentedon Nov 8, 2026
#239 R + B refusal gates: graph controller H source and controls for review (no resolution, install, container or acquisition run). This answers design acceptance 6719888226 (2,385 B /
5f5de9fa). G (20aa983b), its accepted cells, consumers, locks and images are unchanged.Correction: registry capture time
My packet 6719776124 cited "~09:50Z". That time was wrong: it was later than the comment itself, and I had not retained that retrieval. The retained capture is now
refusal-meta/:2d2d1d13a3add59acd70ae91628fb4ab03c8630fda7ce461b315e871413af608laravel/frameworke9f2930ea74482bd06026c9a20b1c51bf22bef9829aa94ce1a9ece06e2d56537Both are byte-identical to General's 09:35:40Z / 09:36:03Z captures. The versions, refs, PHP floors and advisory sets in the packet are unchanged.
Bytes
graph-prep/run-graph-install-h.sh567d0e4917ab0d00e45a4a49a150cb224483ec1bd0997e9ff123c3bdfd8773a0admit239h.sh07e2775af837e8eaf68ae68a038c8a2d837c1106482f13aa63101bc381e457bclaunch239h.shea8541e41693b3479f754529d966a0f78b1462b25edc8c5790f7483785cc5795graph-prep/control-h/check-admission.php579711063da8bb80d635db58256202e868a4976c02d83e06129d41f9a93279a7fake-docker-graph-h.sh531986aadd9ca6fecd4bcabb5f4dfe8578ab88411ea1901e31bb6e503af07cc6controls-graph-h.sha07b7a784eced2b885fab5b40fd0e38f56a7337df9971d62614763e24f6232e6sandbox-controls-graph-h.sh0be80ea7956e29922540620e5cc368448b873c00f919e53926457880a949a7f0753d0b7907312aa0a914034f1361124b4811b37ee09c759cd54e987623b95ba4H, its admission and its launcher are generated from G's exact bytes by
mk-graph-h.py, which asserts G's hashes and that each replacement occurs exactly once. The complete diffs are below. The held file count goes from 8 to 9 (control/check-admission.php).R profiles: ordinary advisory blocking refuses the declared affected graph
Profiles. Each runs G's unchanged installer stage only:
install-graph.sh7eb9d4e4, installer49c9e0fc, held trust,--network bridge, the same env, cap and timeouts. No check container runs.239-l10-refusePKSA-3r5d-mb8f-1qw9 PKSA-b41t-wbzk-9q51 PKSA-d5tc-s1qs-h781 PKSA-m5cs-t1y6-qpcs PKSA-mdq4-51ck-6kdq239-l11-refuse239-l12-belowPKSA-d5tc-s1qs-h781239-l13-belowPKSA-d5tc-s1qs-h781PASS verdict (all of these):
trust-before-install.jsonpresent andtrust-before-audit.jsonabsent, so the trust check ran and the install never succeeded;composer.lockand novendor/;Your requirements could not be resolved…and exactly oneProblem 1;Root composer.json requires laravel/framework <V> … found laravel/framework[v<V>] but these were not loaded, because they are affected by security advisories ("…"). This is the held Composer 2.10.3 PHAR's own wording, read fromcomposer.phar7a2d379d;PKSA/GHSA/CVEID appears anywhere in the log;curl error,failed to download,could not be downloaded,TransportException,could not authenticate,failed to open stream,requires php,your lock file,no matching package found.The receipt keeps the log's bytes and SHA-256.
Not done: no ignore flags or advisory overrides. An unexpected advisory, a missing advisory, a second problem or changed metadata is NONPASS, a new result for review.
B profiles: installed admission on the real retained interpreters
239-adm-p82run239-l12-p82-root5cb011fa…bd4bd6604de2f0(PHP 8.2.35)239-adm-p83run239-l13-p83-root86ddee94…b2f7a1628102249d93(PHP 8.3.36)--network none;php /control/check-admission.php.vendor/autoload.phpexists, the lock SHA-256 matches exactly, and the consumer has no writable entry.PHP_VERSION, SDK 3.10.0, and the consumer's installed framework (12.69.0 or 13.30.0);LaravelPlatform::assertSupported()with 13 explicitly synthetic reported versions: 10.50.4, 11.57.1, 12.68.0 and 13.29.0, each also in its.0form;null; 12.69.0 and its.0form; 13.30.0 and its.0form. All refusals must be the exact message, and 13.30.0 is refused on 8.2 but admitted on 8.3;DurableWorkflowServiceProviderwith Composer's real installed metadata, which must bindServiceConfigurationand merge its config.Hard-isolated controls
They ran in the same bubblewrap profile reviewed for d and G. The isolation proof passed:
/runempty, sockets absent, interfaces[lo], outbound TCP refused,DOCKER_*unset, and 9 binaries masked, including the absolute path. Sandbox exit was 0 with empty stderr. The retained G roots and the registry capture were mounted read-only.bad-profilerefusal lines, whose message now lists the six new profiles. The two diff lines are shown in the output.604de2f0/628102249d93) and a read-only consumer mount;ADMIT, including "retained consumer … exact and read-only" for B against the real retained roots;REFUSE;Disclosure: the fake daemon prints the held Composer's wording and a B verdict shape. It cannot execute PHP or real Composer resolution, so
check-admission.phpand the real advisory output are first exercised by a selected cell.Proposed invocation (separate effect selections)
sh launch239h.sh <profile> <sel-id> <sel-sha> <start-by>, one invocation per profile with no retry. The same wrapper as G: fresh roots, held admission within 60 s,env -i, 1 MiB cap,timeout 480+ KILL 180, report by T0+720.Controller diff G → H (20aa983b → 567d0e49)
Admission diff 239g → 239h (90aa19e4 → 07e2775a)
Launcher diff 239g → 239h (c4a5867f → ea8541e4)
Held check
check-admission.php(57971106)Controls output (753d0b79)
rmcdaniel commentedon Nov 8, 2026
SOURCE and inert EFFECT review PASS for Graph H. One invocation for each of the two B admission profiles is selected, owned by sdk-php. R's Composer-resolution profiles are not selected by this decision.
Bound packet 6719980562: 52,066 B / SHA-256
99643ee8f8aa1e72e1039d6ebb4b7c4193b196b23fdf8ba94e4ed14969d4743a.567d0e4917ab0d00e45a4a49a150cb224483ec1bd0997e9ff123c3bdfd8773a0.07e2775af837e8eaf68ae68a038c8a2d837c1106482f13aa63101bc381e457bc.ea8541e41693b3479f754529d966a0f78b1462b25edc8c5790f7483785cc5795.579711063da8bb80d635db58256202e868a4976c02d83e06129d41f9a93279a7.I read the new controller branches, admission, launcher and PHP check. I independently replayed the hard-isolated controls with all real Docker-like binaries masked and sockets/network unavailable: exit 0, empty stderr, output 18,871 B /
753d0b7907312aa0a914034f1361124b4811b37ee09c759cd54e987623b95ba4, byte-identical to the packet. Carried outcomes, R cause refusals, B verdict failures and B preflight refusals behave as declared. This fake replay supplies no actual PHP or Composer evidence.I also recomputed the retained G vendor/archive inventories and readonly state. The actual B inputs are:
604de2f05cb011fa5b4acc65d1a3bc5beda2c82038ca3e3df3537a745fe71eac07bd4bd68527feb2e69c2086bcb296319a86356dad45c14d52295d19998bcd4e7c091235628102249d9386ddee9439774495886211631f8482d31395fd1f5313386f4b84285433b2f7a142f1022ce0803aa4ff2b08b65951b15d2d42db7fc327156907ef766752c2b2faBoth contain published SDK 3.10.0 at
4e6c6b7b, all 470 SDK files at inventoryc562d378…, and the accepted Workflow 2.21.1 graph. Before each B effect, retain a fresh host-computed canonical vendor inventory matching the table, in addition to H's lock/permissions checks; any drift refuses. Recheck those inputs after the cell. No retained root may be modified.Re-read this raw decision and the packet. Use the held H launcher once per profile, fresh roots, exact nine held hashes, strict name absence, exact cached image IDs, 0 running/owned containers and no competing local slot. Admission must exit 0 within 60 seconds, end exactly ADMIT, contain no FAIL and have empty stderr. Start profile 1 by 10:25Z; profile 2 may start only after profile 1 PASS plus proven cleanup, by 10:37Z. No retry or fallback; a NONPASS stops the sequence. Authority ends 11:00Z and each terminal report is due by T0+720 seconds.
Keep the launcher's env-i/private HOME/DOCKER_CONFIG, 1 MiB file-size cap and 480 + KILL 180 outer bound. Each B effect is one read-only, network-none check container using H's init, UID 1000, cap-drop ALL/no-new-privileges, 2 CPU / 2 GiB / 256 PIDs recipe. No install, pull or networked container. Require the actual interpreter, all 13 explicitly synthetic predicate inputs with exact messages/outcomes, real-metadata provider registration, controller exit 0 and no warning line. Preserve each verdict, streams, markers and executed bytes.
Cleanup must prove both requested names absent, no run/owner residue and no running container before releasing the slot. Retain inputs/images and evidence through 23:30Z Phase F. No shared cleanup, release, portal, production or Server effect is authorized. B proves the installed predicate and supported provider registration; it does not boot a real Laravel 10/11 application or override Composer metadata. #239 remains open for the R evidence and final reconciliation.
rmcdaniel commentedon Nov 8, 2026
Graph H B cell 1/2
239-adm-p82: PASS under selection 6720197374 (3,916 B /afe934f4). T0 was 10:11:47.226Z and t1 was 10:11:48.421Z; controller exit 0, driver stderr empty, no retry.Before the cell (host-computed with
CompletionPollSubject::inventory's exact canonical form, read-only), retainedrun239-l12-p82-root/consumer:5cb011fa…bd4bd6;8527feb2…c091235;c562d378;This matched the carry. I also re-read packet 6719980562 (52,066 B /
99643ee8), and the held hashes matched: controller567d0e49, admission07e2775a, launcherea8541e4, check57971106.Admission (started 10:11:46.556Z):
ADMIT, noFAIL, empty stderr;49c9e0fc,80a91784and604de2f0exact;4e6c6b7b;Effect: one
--network noneread-only check on604de2f0. Verdict (one line, no warnings;admission.loge4b687ad):.0form) andnullrefuse;12.69.0.0(ServiceConfigurationbound).After the cell:
sdk-php-graph-239-adm-p82-install/-checkboth strict-absent;These synthetic inputs prove the installed predicate; they are not a Laravel 10/11 boot. Next: cell 2,
239-adm-p83, start-by 10:37Z.rmcdaniel commentedon Nov 8, 2026
Graph H B cell 2/2
239-adm-p83: PASS. Run after cell 1's PASS and proven cleanup; T0 was 10:12:20.082Z and t1 was 10:12:21.256Z. Controller exit 0, driver stderr empty, no retry.Before the cell, retained
run239-l13-p83-root/consumer:86ddee94…b2f7a1;42f1022c…52b2fa;c562d378;This matched the carry.
Admission (10:12:19.412Z): exit 0,
ADMIT, empty stderr; image628102249d93exact; names strict-absent; retained consumer exact and read-only; 9 held files.Effect: one
--network noneread-only check on628102249d93. Verdict (one line, no warnings;admission.log66c56ac9):13.30.0.0.After the cell:
Graph H B selection: both cells PASS (
239-adm-p82on PHP 8.2.35,239-adm-p83on PHP 8.3.36). Each was an offline, read-only check against an unchanged accepted consumer, and each started well before its start-by.null, and Laravel 13 on PHP 8.2, each with the exact message. Supported provider registration succeeds on the real installed frameworks.run239-adm-p82-*andrun239-adm-p83-*, and thebinv/before/after inventories.rmcdaniel commentedon Nov 8, 2026
B captured audit PASS; both offline admission cells are accepted and their slot is released. I verified the selection/executed/controller/check hashes, admissions, exact one-line PHP verdicts and all 13 outcomes per interpreter, including exact-message flags and real provider registration. The PHP 8.2 cell ran 10:11:47.226–10:11:48.421Z; the PHP 8.3 cell 10:12:20.082–10:12:21.256Z. Both outer exits are 0 with empty stderr. Logs are
e4b687ad1db09cc377f091949f87702f8c9949b05acb0886ff949dc7a18e27c3and66c56ac9ed50bf2101d8edcb3815bf9585c08066d7bd3b42a472a31c6df4c839. Audit record: 5,780 B /247076bd1be35c6f6f585236e1c9672a30bd85816338b1e1029ccabdc6263651.I independently recomputed the retained G vendor/archive/SDK inventories after B: byte-identical to the pre-B audit, zero writable entries. Fresh daemon reads prove all four B names absent and zero containers in total. B proves the installed predicate with synthetic version inputs and supported provider registration; it does not boot Laravel 10/11.
Now select one invocation per R profile, owned by sdk-php, in this order:
Every graph also pins SDK 3.10.0. Workflow is omitted, as its own floor would create a separate conflict. These are resolution targets in composer.json, not claims of running the old frameworks.
Bound H packet 6719980562, raw 52,066 B /
99643ee8f8aa1e72e1039d6ebb4b7c4193b196b23fdf8ba94e4ed14969d4743a. Controller567d0e4917ab0d00e45a4a49a150cb224483ec1bd0997e9ff123c3bdfd8773a0; admission07e2775af837e8eaf68ae68a038c8a2d837c1106482f13aa63101bc381e457bc; launcherea8541e41693b3479f754529d966a0f78b1462b25edc8c5790f7483785cc5795; the same nine held files and trust bytes as reviewed. General's isolated H replay passed with exact output753d0b79…and empty stderr.Before each effect, re-read this raw decision and packet; require fresh absent roots/names, exact cached installer/runner identities, nine held hashes and trust, 0 running/owned containers, and a fresh admission that exits 0 within 60 seconds, ends ADMIT, has no FAIL and empty stderr. Use H's held launcher, env-i/private HOME/DOCKER_CONFIG, 1 MiB file cap, outer 480 + KILL 180 and the unchanged read-only UID1000/cap-drop/NNP/2CPU/2GiB/256PID recipe. Each profile runs one installer container on the ordinary bridge network, with no check container. No egress allowlist is claimed.
Start profile 1 by 10:30Z. Each later start requires the preceding profile PASS plus proven cleanup, with start-by times 10:42, 10:54 and 11:06Z respectively. Any NONPASS stops the sequence. No retry, fallback or source change. Authority ends 11:30Z; each report is due by T0+720.
PASS requires Composer exit 2, the verified trust-before-install receipt and no audit-after-install receipt, no lock/vendor, exactly one resolution problem and the exact root Laravel advisory cause. The reported advisory identities must equal the frozen set, without any extra advisory or transport/platform/lock/acquisition cause. A successful install or any other failure is NONPASS. Do not ignore an advisory or weaken normal blocking. Retain the exact log, manifest, verdict, streams, markers and executed bytes.
Require strict name absence and empty run/owner/running lists after each cell. Retain all roots/images/evidence through 23:30Z Phase F. No pull, shared cleanup, SDK release, portal or production effect is selected. #239 remains open for the captured R audit and acceptance reconciliation; prior NONPASSs remain attributed. Server's local stop remains in force.
rmcdaniel commentedon Nov 8, 2026
Graph H R cell 1/4
239-l10-refuse: PASS under selection 6720235778 (4,099 B /53ae6fff). T0 was 10:15:19.074Z and t1 was 10:15:24.193Z; controller exit 0, driver stderr empty, no retry.Before the cell:
99643ee8);567d0e49, admission07e2775a, launcherea8541e4;Admission (10:15:18.458Z): exit 0,
ADMIT, noFAIL, empty stderr.Effect: one installer container on the ordinary bridge network (
49c9e0fc, held trust and Composer 2.10.3). The declared graph was SDK 3.10.0 +laravel/framework10.50.4, target PHP 8.2.35.Verdict:
trust-before-install.jsonpresent, notrust-before-audit.json;composer.json, read-only;Problem 1:Root composer.json requires laravel/framework 10.50.4 … found laravel/framework[v10.50.4] but these were not loaded, because they are affected by security advisories ("PKSA-b41t-wbzk-9q51", "PKSA-d5tc-s1qs-h781", "PKSA-m5cs-t1y6-qpcs", "PKSA-3r5d-mb8f-1qw9", "PKSA-mdq4-51ck-6kdq");install.log1,145 B /1e160f892b2069f2dc3696aa7ce707bb13c54b84d82d2add7c85f9f5f06a5b7f.Real Composer also prints two informational lines that are not causes: "No composer.lock file present…" and "Running update with --no-dev…".
Cleanup: both names strict-absent; 0 containers in total, 0 running, 0 owned, 0 run-labelled.
Next:
239-l11-refuse, start-by 10:42Z.rmcdaniel commentedon Nov 8, 2026
Graph H R cell 2/4
239-l11-refuse: PASS. Run after cell 1's PASS and cleanup. T0 was 10:15:46.318Z and t1 was 10:15:51.297Z; controller exit 0, stderr empty, no retry.Admission (10:15:45.683Z): exit 0,
ADMIT, noFAIL, empty stderr.Effect: one bridge-network installer container. The declared graph was SDK 3.10.0 +
laravel/framework11.57.1, target PHP 8.2.35.Verdict:
laravel/framework 11.57.1requirement blocked by advisories exactly equal to the frozen five (PKSA-3r5d-mb8f-1qw9,PKSA-b41t-wbzk-9q51,PKSA-d5tc-s1qs-h781,PKSA-m5cs-t1y6-qpcs,PKSA-mdq4-51ck-6kdq), with no other cause;install.log1,145 B /9ffcd4441c92ed5d211555054e1d2d537de6f538b700ee57367b7de36e6bc26a.Cleanup: both names strict-absent; 0 containers, owned or labelled.
Next:
239-l12-below, start-by 10:54Z.rmcdaniel commentedon Nov 8, 2026
Graph H R cell 3/4
239-l12-below: PASS. Run after cell 2's PASS and cleanup. T0 was 10:16:04.163Z and t1 was 10:16:08.994Z; controller exit 0, stderr empty, no retry.Admission (10:16:03.533Z): exit 0,
ADMIT, noFAIL, empty stderr.Effect: one bridge-network installer container. The declared graph was SDK 3.10.0 +
laravel/framework12.68.0 (below the 12.69.0 floor), target PHP 8.2.35.Verdict:
Root composer.json requires laravel/framework 12.68.0 … found laravel/framework[v12.68.0] but these were not loaded, because they are affected by security advisories ("PKSA-d5tc-s1qs-h781"). That is exactly the frozen floor advisory, with no other cause;install.log1,053 B /b860a13259a98550c4c954717a5431448fdc5d22ba207bf0066d2cc88ba74724.Cleanup: both names strict-absent; 0 containers, owned or labelled.
Next:
239-l13-below, start-by 11:06Z.rmcdaniel commentedon Nov 8, 2026
Graph H R cell 4/4
239-l13-below: PASS. Run after cell 3's PASS and cleanup. T0 was 10:16:20.980Z and t1 was 10:16:25.852Z; controller exit 0, stderr empty, no retry.Admission (10:16:20.324Z): exit 0,
ADMIT, noFAIL, empty stderr.Effect: one bridge-network installer container. The declared graph was SDK 3.10.0 +
laravel/framework13.29.0 (below the 13.30.0 floor), target PHP 8.3.36.Verdict:
Root composer.json requires laravel/framework 13.29.0 … found laravel/framework[v13.29.0] but these were not loaded, because they are affected by security advisories ("PKSA-d5tc-s1qs-h781"). That is exactly the frozen floor advisory, with no other cause;install.log1,053 B /438aca1eec9ea48c7a9cddce5765054e0f1ec3d002cbfaf92b8a48f78a2199b5.Cleanup: both names strict-absent; 0 containers, owned or labelled.
Graph H R selection 6720235778: all four cells PASS, in order, each well before its start-by, each after the previous PASS plus proven cleanup:
239-l10-refuse1e160f89239-l11-refuse9ffcd444239-l12-belowPKSA-d5tc-s1qs-h781b860a132239-l13-belowPKSA-d5tc-s1qs-h781438aca1e567d0e49, admission07e2775a; each selection re-read at53ae6fff.composer.json), verdicts (refusal-check.json), streams, markers and executed bytes inrun239-l1*-refuse-*andrun239-l1*-below-*.What #239 now has, together with B:
Next: General's captured audit, then #239 acceptance reconciliation. The local slot can be released on your confirmation.
rmcdaniel commentedon Nov 8, 2026
Captured audit PASS: the four Graph H R Composer-refusal cells are accepted. The local slot is released.
I checked the selection and executed controller identities, admissions, exact Composer logs and verdicts, trust verification before resolution, absent lock/vendor state, and cleanup. Each controller exited 0 with empty stderr; Composer exited 2 for exactly one root Laravel advisory cause. Laravel 10.50.4 and 11.57.1 reported the frozen five advisory IDs; 12.68.0 and 13.29.0 reported only PKSA-d5tc-s1qs-h781. The two informational Composer notes are not additional causes. All eight names were strictly absent and no containers remained.
The captured audit is 3,235 B /
867d9a4a3bafee4961532275b6510d222ca8fa224e755f2886a51a278a79c093. The four receipts are L10, L11, L12 below floor, and L13 below floor.Together with the accepted five installed Laravel 12/13 graph cells and both offline admission cells, this completes the selected support-transition evidence. The live Laravel guide was re-read at 10:28 UTC: HTTP 200, SDK 3.10, Laravel ^12.69.0|^13.30.0, PHP 8.2/8.3 floors, and the Laravel 10/11 transition are present.
Limits remain explicit: R proves Composer resolution refusal, not an installed Laravel 10/11 boot; B uses synthetic version inputs against the installed predicate and a real-metadata provider check; the bridge cells do not qualify console-worker pcntl behavior. All earlier NONPASSs retain their original attribution. No audit-ignore, package install, retry, pull, or SDK 3.11 acceptance is implied.
Owner sdk-php: reconcile #239's current status and Done-when gates against the source, publication, guide and accepted installed/refusal receipts; preserve the historical record and these limits, then close as completed. Retain evidence, consumers and owned images through the existing 23:30 UTC Phase F manifest. No cleanup is selected here.
rmcdaniel commentedon Nov 8, 2026
Reconciled and closing as completed per 6720364756.
The issue body now records:
4e6c6b7b), the live guide re-read at 10:28 UTC, the five installed supported graph cells (PHP 8.4 / 8.2 / 8.3 audits), and R and B refusal (audits 6720364756 and 6720235778);The original text is kept, collapsed as historical, and earlier NONPASS attributions are unchanged.
Evidence, consumers and owned images are retained through the 23:30 UTC Phase F manifest. No cleanup or new effect.
rmcdaniel commentedon Nov 8, 2026
Phase F resource disposition is complete. The eight task-owned qualification images and 22 completed dependency/archive-cache copies were retired by exact identity. Their source and receipt inventories remain, along with the old SDK baseline and normal published 3.11 consumer needed for the remaining #269 checks. Two pre-existing/shared images and all WIP source were preserved. No global prune or registry cleanup ran.
Earlier admission and partial NONPASS results remain attributed. This closes temporary-resource custody only and adds no installed-runtime qualification claim.