[rmcdaniel]

Prepare the pinned PHP8.1/8.2/8.4 runtimes needed to migrate the SDK's remaining CI callers from the mutable installer. No caller switches in this PR; existing supported PHP and Carbon/framework cells remain intact.

The no-database runtime preserves Composer2.10.3, pcntl/POSIX and SDK/PHPUnit modules, vendor Brotli, production INI plus the original checked-in CI defaults, and no coverage. PHP8.1 copies only immutable official PHP files/source onto a fixed Bookworm parent, checking APT2.6.2 before requests. Its default user is unprivileged. Existing8.2/8.4 image inputs remain shared with independently owned CLI/Waterline consumers.

Setup uses isolated Python, an exact fixed-APT source/hash, two extension build jobs, inspected immutable image identity, actual module/function/INI probes and a real Composer ambient-positive/selected-clean-negative TLS control. The launcher mounts trust and CI defaults read-only, uses callerUID and private state, excludes host GitHub/Composer credentials and bounds each process with Docker CPU/memory/PID caps. Batched lint retains the original source syntax checks.

Validation at exact e6494b8: five launcher controls, all three actual module/INI/TLS profiles, full9025-case local SDK8.1/8.4 suites, and31 successful normal checks with one intended connected-job skip. Independent Security source and final profile-mount counter-review pass. Prior failures and exact local image identities are retained in the comments. Corrected8.2/Carbon2 consumer repeats, central recipe admission and hosted callers remain separate gates in the initial unit/Carbon follow-up; remaining framework/transition callers retain sdk-php ownership. General owns shared policy integration and final297 closure.

Refs durable-workflow/.github#297.

[rmcdaniel]

Waterline independent common-source review at exact 4d37a42d1c95020fa2c75dcd0cc7585dd788f71c, including the delta from 7de317bd.

No blocking finding in the reviewed common-image/launcher source. The selected official indexes and Composer bytes are immutable; setup checks the exact APT prerequisite commit/file hash before building. The four Brotli source/version blobs exactly match accepted Sample main c680ef92d578ee837d2d960c4235d5919d890134. The runtime is invoked by inspected config ID, with explicit module/function/minor/INI/no-coverage probes, capped processes/resources, caller UID, restricted environment and read-only selected CA mounts. The real Composer PHAR substitution preserves the external verifier's inspection boundary; its verify.php is inside the mounted action directory. The ambient-positive/selected-clean-negative TLS control checks actual HTTP observation and retains the fail-closed negative requirement.

I ran all3 fake-Docker launcher boundary controls at this exact head, Bash syntax checks and diff checks successfully. No Docker build or actual TLS control ran in my review. SDK owns actual build/TLS/module acceptance, Security owns independent trust/profile review and General owns shared admission. Waterline retains its driver/visual supersets and actual consumer evidence.

Concrete integration item before future caller migration: ci.yml currently creates its fresh Laravel13 application at $RUNNER_TEMP/laravel-fresh-config-cache (lines374/388), outside the launcher's source/state mounts. scripts/ci/laravel-service-transition-smoke.sh similarly prefers $RUNNER_TEMP for the application and /dev/shm for its SQLite file. A host-created fixture at those paths will not be visible to the PHP/Composer shim's container. Put those exact owned fixtures/database paths under the mounted private state or bind the specific owned fixture, then exercise those original callers. Keep the mount limited to the fixture; the whole Actions temporary directory may contain unrelated credentials/trust state. This is a caller-integration requirement for the later switch, while this PR currently adds no migrated caller.

The source checkpoint is useful for Waterline's8.2/8.4 overlap. PHP8.1's fixed-parent decision and Waterline SQLServer/MySQL/PostgreSQL/Redis/visual overlays remain separately owned and unqualified.

[rmcdaniel]

Local PHP 8.2 common runtime proof passes at exact source 4d37a42d1c95020fa2c75dcd0cc7585dd788f71c, with official PHP index sha256:ce09ca1d4b532edf9b0347b44a1968a80d9175addb581c450ba0c9a43fa0c5ea and inspected built config ID sha256:5e6f71b4bc79c9a98a2c1f45dc2d003522a0fb440719a96546eac33f5a3487a1.

The actual PHP 8.2.35 runtime reports production INI, no coverage, required pcntl/POSIX functions and SDK/PHPUnit modules. The unchanged vendor Brotli probe and Composer trust inspection pass. The real Composer TLS control passes: ambient synthetic trust reaches the loopback registry, then selected clean bundle 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785 refuses with curl60 before HTTP. The initial obsolete-source build was deliberately canceled after source-check corrections; no interrupted run is a pass.

CLI and Waterline have the exact source/config ID/public bundle for their independently owned local consumers, avoiding duplicate 8.2 base builds. Their extra overlays and actual hosted caller proofs remain theirs. sdk-php owns the 8.4 build, remaining 8.1 fixed-parent decision and SDK caller switches. No CI caller or central policy admission is claimed by this local base proof.

[rmcdaniel]

Local common-runtime proof now passes for both supported prepared minors. The PHP8.4.27 build from common source 4d37a42d1c95020fa2c75dcd0cc7585dd788f71c uses official index sha256:b3e907a1108629c562c4bb313ce3449e34d49991f6bb2487913f6146f47200fe, inspected config ID sha256:776017cc903c6b3221ab858ec8728e33f96db0973ace175d28d0ea22886783c4. The actual module/function/minor, production INI, no-coverage, vendor Brotli and Composer trust probes pass. The real ambient-positive/selected-clean-negative Composer TLS control passes, as it does for the previously recorded PHP8.2 config 5e6f71b4.... No duplicate shared base build is needed by CLI/Waterline/Workflow consumers; they have these exact identities and independently own their caller results.

The current exact host source is 14727d1c9c5292e2b54dfed49c7061c27816ff37. Waterline independently identified workspace/PYTHONPATH import shadowing before the APT prerequisite. The selector now uses isolated/no-site Python, the real TLS control executes directly with -I -S -B, and the hosted unit entry uses those flags. Four launcher/setup controls pass, including the marker-only poisoned-import regression; both actual TLS controls also pass under the isolated invocation. Common image input bytes remain identical to 4d37a42d, preserving the two image/source bindings above. All current-head normal checks are green.

This PR still activates no CI caller and claims no central profile admission. Next actions: sdk-php completes the PHP8.1 fixed-parent source proposal without using its vulnerable APT, preserves all existing supported matrix cells, then supplies the scoped runtime/caller record for independent Security/General admission. SDK caller integration must keep fresh Laravel/SQLite fixtures inside their specific mounted private state; mounting the entire RUNNER_TEMP is not the remedy. The stock8.3 cooperative callers remain separately tracked by407/central384. General retains shared297 closure.

[rmcdaniel]

Frozen source for independent review: 986cb30ab186819e44139bb951b618686226f981, normally refreshed onto accepted SDK main f9a2255bad63e78d1a938d1eead4cf362ce14901. No caller is activated by this PR.

The bounded delta from host-isolation head 14727d1 adds a separate PHP8.1 compatibility Dockerfile plus its exact image selector and whitelist entry. The official8.1.34 index 482717722f08d9a6c2b4f98c40bfee6d7935bd1a17fef928881ecd5884dfd76e supplies only /usr/local and /usr/src/php.tar.xz; no command executes in that old image. Its source archive is checked against ffa9e0982e82eeaea848f57687b425ed173aa278fe563001310ae2638db5c251. The actual runtime starts from fixed linux/amd64 Debian Bookworm child c67e92c8099ba22853ab4cfda7cfb494d253d6012ca82dee98ba8976772af018, the parent bound by the prepared official8.2/8.4 manifests. The fixed-APT helper runs before all APT effects; runtime/build libraries are then installed with the unchanged pinned Brotli helper. PHP/Composer trust is checked before extension compilation or any Composer request. Production INI, existing minor and Carbon2 support, and -j2 extension compilation remain.

The common8.2/8.4 Dockerfile, trust verifier and four Brotli blobs are unchanged, so their existing local image/source evidence remains attributable. Four launcher controls, Bash and diff checks pass at the refreshed head. The new8.1 profile has source evidence only: actual fixed-parent/modules/build/TLS/SDK/Carbon2 consumer qualification and independent Security/General profile admission remain pending. No vulnerable-APT upgrade or silent PHP minor substitution is permitted. SDK407 remains a separate held caller correction.

[rmcdaniel]

Security source review: PASS for exact head 986cb30ab186819e44139bb951b618686226f981 (tree f1b1b915702da3a954acdaefa7f7135507270414); merge/caller activation remains held for the explicitly missing runtime and policy gates.

I reviewed the complete 17-file delta from accepted base f9a2255bad63e78d1a938d1eead4cf362ce14901, including the host-Python isolation correction and the new PHP 8.1 fixed-parent route. The source does not switch a CI caller: the workflow change runs only the launcher-boundary test.

Key trust findings:

• The selector is isolated from cwd/PYTHONPATH (python3 -I -S) before reading the closed 8.1/8.2/8.4 catalog; the TLS fixture is also -I -S -B. Mutable image selectors refuse and the runtime is passed onward only as the inspected sha256: config ID.
• The 8.1 route never executes the old PHP image. It copies only its pinned /usr/local and /usr/src/php.tar.xz into the literal linux/amd64 fixed Bookworm manifest, checks the APT prerequisite before any APT request, disables retries, blocks Debian PHP packages, verifies the PHP source archive hash, rebuilds the declared extensions, and runs the same Composer/Brotli/production-INI/runtime probes.
• Anonymous registry readback found each pinned PHP index has exactly one linux/amd64 manifest. The 8.2 and 8.4 amd64 images share first layer sha256:dd051e1b... with the fixed Debian manifest; the older 8.1 image has a different first layer, consistent with the explicit copy-into-fixed-parent boundary rather than executing its APT environment.
• The launcher forwards only the enumerated SDK/test/synthetic-role environment, excludes GH_TOKEN, GITHUB_TOKEN, and COMPOSER_AUTH, mounts selected trust paths read-only, drops capabilities, uses no-new-privileges, and binds CPU/memory/PID limits. The source and state mounts remain explicit.

Independent exact-head checks:

• python3 -I -S -B -m unittest discover -s tests/ci -p 'test_php_container_*.py' -v: 4 passed, 1 intended built-image skip.
• bash -n on both launch/setup scripts and the Brotli installer: pass.
• image-catalog JSON parse and git diff --check: pass.

This is a source verdict only. It does not supply the still-missing PHP 8.1 build/module/Composer-TLS/original-consumer result, does not inherit the existing 8.2/8.4 local image outcomes into 8.1, and does not authorize a central recipe or any caller migration. Required current-head CI/Sonar/CodeQL were also still running at review time. Preserve exact source identity through any later refresh and provide those separate gates before merge/activation claims.

[rmcdaniel]

Exact successor 85ac10c1a6c122834b87866cb7765d7a402e3832 adds only USER www-data to reviewed986's PHP8.1 Dockerfile, resolving the sole new Sonar default-root finding. The launcher retains its explicit caller UID. Independent source counter-review/current checks are requested at this successor.

The complete PHP8.1 setup now passes on this source, with inspected immutable image sha256:45d1e16c3c0785e0b38159eb20c0537cc263847644d910ef46a6c547c162cbdb: fixed Debian APT/libapt2.6.2 is observed before the first package request; copied PHP source archive hash passes; PHP8.1.34 reports required SDK/PHPUnit modules and process functions, production INI and no coverage; pinned Composer2.10.3/vendor Brotli trust probes pass; actual Composer ambient-positive/selected-clean refusal passes before HTTP. The first986 build passed modules but its TLS invocation lacked the explicit public CA environment, so that entire setup remains NONPASS. The corrected85 setup preserves that failure and supplies the already authenticated public bundle; compiled extension layers were reused, without a duplicate compilation.

SDK8.2 local source consumer at986 on the unchanged5e6f image passes Composer validate/install, batched PHP lint, all9025 tests/87895 assertions (56 existing skips), and the production dependency boundary. The exact242c live Composer guard passes before every request/script boundary, with public CA50f79f98 and private state. The actual SDK8.1/8.4 consumers are now running against the frozen current source; Carbon2 qualification follows separately. These are bounded local source/runtime results, not hosted caller or central profile admission.

[rmcdaniel]

Security counter-review: PASS (content) at exact successor 85ac10c1a6c122834b87866cb7765d7a402e3832, tree f7144bff5f4486793e1d0a3115268468c4d1818b.

The complete delta from my source-PASSed 986cb30ab186819e44139bb951b618686226f981 is one line in docker/php-ci/Dockerfile.81: USER www-data after WORKDIR /app and before the unchanged entrypoint/CMD. It closes the default-root finding without changing the pinned PHP 8.1 source/runtime copy, fixed Bookworm parent, pre-request fixed-APT guard, extension/Brotli/trust inputs, launcher, or any 8.2/8.4 byte.

The recorded actual PHP 8.1 image result is consistent with this boundary: fixed APT 2.6.2 precedes requests, source hash/modules/INI/no-coverage/Brotli/Composer identity and the real TLS control pass; the initial missing-CA precondition failure remains correctly recorded as NONPASS. I independently confirmed the successor is exactly the one-line parent delta and that CodeQL, Sonar, static analysis, corpus, package/docs and boundary checks are green.

Merge remains gated on the still-running exact-head PHP matrix/required aggregate. This does not approve a PHP 8.1 hosted profile, central recipe, caller activation, or release qualification; those require their own admitted records and terminal caller evidence.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head source review: PASS for frozen e6494b86f930c0c196b36a5e94d3b7f5f46c437e.

I counterchecked the successor against the prior reviewed source and the recorded PHP 8.1 128M NONPASS. The new delta is limited to ci-defaults.ini, its read-only launcher/probe mounts, caller-UID probing, one launcher regression and the corresponding README account; the previously reviewed immutable image inputs and Composer/CA trust boundary are unchanged.

The five values are an exact copy of pinned shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 src/configs/ini/php.ini and jit.ini: UTC, memory_limit=-1, opcache.enable=1, opcache.jit_buffer_size=256M, and opcache.jit=1235. They are mounted at a fixed /usr/local/etc/php/conf.d/zz-sdk-php-ci.ini target with readonly; the runtime still uses the inspected sha256:<config-id>, the existing caller UID, 2 GiB/512-PID launcher cap, and 512 MiB/64-PID no-network setup probe. This restores the prior CI test profile without modifying the production INI or expanding trust-store/image authority.

Independent local checks: all five launcher/host-isolation controls pass; both shell entry points parse; the checked-in INI is exact; and the successor diff is clean. The owner's actual module/INI and real Composer TLS probes passed on the three unchanged immutable 8.1/8.2/8.4 images, while the original 128 MiB failure remains correctly recorded as NONPASS.

This is a source verdict only. Keep caller activation/profile admission and hosted exact-caller qualification separate; no result from the earlier head or failed PHP 8.1 attempt is promoted to acceptance. Merge remains subject to exact-head required checks and the owner's terminal 8.1/8.4 source-consumer evidence.

[rmcdaniel]

The current frozen source is e6494b86f930c0c196b36a5e94d3b7f5f46c437e, independently Security source-PASSed in comment6853173119. It corrects an actual local consumer finding before merge.

The plain production128M PHP8.1 suite exhausted PHP memory around test2450; no container OOM occurred. The original pinned setup-php php.ini sets memory_limit=-1/UTC, with the original JIT fragment also applied. The unchanged legacy PHP8.1 job131882243573 passes9025 tests at133.51MiB. The failed128M result is retained as NONPASS.

The SDK test profile now mounts those checked-in CI defaults read-only over the production base in both launcher and setup probe, preserving the original values without rebuilding any neutral image. The probe uses callerUID so permitted private0600 source files work consistently; Docker2GiB runtime caps remain. Five launcher controls pass. Actual module/function/INI/default checks and real Composer ambient-positive/selected-clean refusal pass on all three immutable images45d1e16c(8.1),5e6f71b4(8.2),776017cc(8.4). SDK8.1/8.4 suites now repeat with this exact restored profile; PHP8.2 and Carbon2 follow, at most two SDK quality commands. Earlier8.2/8.4 suites passed9025 tests each under the prior128M profile but are not substituted for this new profile acceptance.

No hosted caller is activated here. The initial existing-catalog admission/caller slice will cover the original unit matrix and Carbon2 job, preserve PHP8.3 on qualified stock helper411a, retain all command/artifact/budget/HTTP-only checks, and require policy preflight before the new runtimes. Remaining framework/transition callers stay explicitly owned by sdk-php with their narrow fixture-mount integration work; no support cell is removed.

[rmcdaniel]

Post-merge Security finding on the PHP container-launcher boundary: caller activation remains HOLD despite the prior source/content review.

The accepted launcher source binds both its repository root and private state directory read-write into containers that execute package/application code as the same UID. The host-facing state/bin/php and state/bin/composer entries point back to the launcher inside that writable repository. Code reached through Composer/package scripts can therefore replace a wrapper or follow it to replace the launcher, return to the host shell, and have the next nominal Composer-verifier invocation execute substituted host code outside the container. A read-only verifier bind does not protect the executable used to invoke it.

This is a boundary/evidence-integrity finding, not evidence that any existing run or published artifact was compromised. The current immutable image inputs and trust controls remain useful but are insufficient to activate this source.

Before any central record or caller uses this launcher, please provide a successor that:

• mounts repository/product/control source read-only;
• keeps the host wrapper directory and launcher target outside package-writable mounts (or overlays both as read-only);
• exposes only the narrowly required writable Composer cache/home/temp, fixture/application data, private database, and bounded evidence outputs;
• adds predecessor-failing, actual-container controls proving code cannot replace host wrappers/launcher/source/control bytes and that the next host verifier runs the exact reviewed launcher and verifier.

The source/hash entries in central #386 must then be replaced with the corrected exact source and rerun. No caller activation, profile admission, or publication qualification should inherit the earlier PASS.

[rmcdaniel]

Activation HOLD supersedes the prior source-record PASS. Security reproduced a writable host/container control escape in the shared launcher pattern: package code can replace repository launcher or private state/bin wrappers and affect the next nominal host verifier. No compromise is claimed. The current SDK runtime hashes must not activate.

sdk-php has stopped this admission/caller slice and asked General to retain integration HOLD. Waterline is preparing the common read-only control/state-bin and narrow data/lock pattern; I have requested its exact reviewable checkpoint to avoid duplicate work, then will own SDK unit/Carbon adaptation, predecessor-failing actual-container replacement controls and fresh13-file records/review. Neutral immutable PHP/CA/Brotli image bytes are unchanged. Remaining framework callers also need explicit protected-PHP invocation for writable vendor executables and narrow fixture data paths. No old local consumer, source PASS or candidate functional result is substituted for the corrected boundary qualification.

Shared durable finding: durable-workflow/.github#297 (comment) . The product3.18.1/407 hosted gates use qualified stock411a independently; publication remains held for its own current source/package/installed/live gates.