[rmcdaniel]

The two PHP8.3 Laravel compatibility cells still invoke the unqualified setup-php installer. Move those two exact entries to a fixed8.3 job using accepted stock Ubuntu24/PHP8.3 helper411a, explicit actual-version/module assertions, private Composer state, current242c trust controls and no persisted checkout credentials. The six other cells remain in their existing job for separate profile migration.

All eight framework/minor/version entries remain byte-identical and occur exactly once. Original consumer, version-pinning, role-isolation, static-analysis and tracing commands are copied unchanged, apart from the intended verifier pin in the stock job. The required aggregate now requires both framework jobs.

The first conditional-in-one-job attempt was correctly refused by central policy because setup trust must be unconditional. This successor preserves that policy and separates the fixed8.3 job; no central parser/admission change is proposed. Local full policy validation passes against the accepted central386 policy, plus matrix/command parity and diff/secret-pattern checks. Actual hosted all-eight qualification, independent Security review and main readback remain required.

Refs shared#297. Owner: sdk-php. #415's immutable3.18.2 release/installed acceptance stays separate; this branch changes no SDK runtime/package identity.

[rmcdaniel]

The fixed-8.3 split passed central policy and its actual framework callers, but the full suite correctly caught an ordering assumption in LaravelAdoptionContractTest: the complete five Laravel cells now appear in two groups, so literal list order differs although all entries remain exact and unique. No runtime/product failure or missing cell was inferred.

The successor compares the complete cell set in canonical major/minor order, retains exact count/value matching, requires both owned framework job blocks, and checks minimum-install/version assertions within each job. A new negative control mutates the stock8.3 job's install to a caret range and must refuse it. Focused actual PHP run passes14 cases/85 assertions. All existing counterfactuals still pass. Earlier suite failures remain NONPASS; fresh current-head normal checks are required.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Current exact head 0326a460d4f6a2c12145bf68bdbcf04fca1976d2 is terminal green:32 SUCCESS/one intended skip/zero failures or pending. Normal CI43458500686 passes, including all eight original framework cells. Both new stock8.3 Laravel12/13 jobs ran the qualified profile, actual module checks and unchanged consumer/version-pinning/analysis/tracing commands successfully; the six other cells retain their original installer and remain explicitly unmigrated.

The full PHP support/Carbon suites also pass with the corrected complete-cell and per-job adoption checks. The new stock83-only caret mutation refuses, and all pre-existing counterfactuals remain. Local full central policy validation passed without changing its unconditional-setup rule. Initial conditional-policy and row-order suite failures remain NONPASS.

Owner: sdk-php. Next: independent exact source/trust review, normal merge/tree/topic cleanup and actual-main caller qualification. A matching PHP8.3 embedded-v2 transition slice is prepared separately; it preserves Laravel ^12.0/Workflow ^2.21, not a Laravel13 upgrade. Remaining container-minor/transition profiles and all product acceptance gates stay separate.

[rmcdaniel]

Security exact-head review: PASS for SDK PHP #416 at 0326a460d4f6a2c12145bf68bdbcf04fca1976d2.

I reviewed the complete two-file diff. The original eight framework cells remain present exactly once: the six non-8.3 cells stay in the existing job with their setup and consumer command bodies unchanged, while only Laravel 12/PHP 8.3 and Laravel 13/PHP 8.3 move to the new fixed framework-compat83 job.

The new job is an unconditional, closed profile rather than a matrix-conditional setup:

• it needs the central action-policy job, uses checkout without persisted credentials, selects isolated system Python 3.12, and creates private Composer home/cache/tmp directories;
• every setup/trust pin is the reviewed 411a14ac… stock PHP action or 242c2a7f… clean-trust action;
• PHP is fixed to 8.3 with production INI and Composer 2.10.3, and the job explicitly requires PHP 8.3 plus curl/mbstring/PDO-SQLite/SQLite/XML;
• the original consumer commands are byte-identical: each cell installs its exact published Laravel floor, asserts it before and after SDK installation, then runs the same diagnostics, integration, static-credential, and PHPStan checks;
• the target-branch aggregate now requires both framework jobs and refuses a non-success result from either.

The final guard change is also sound: it canonicalizes the complete cell set rather than relying on source order, requires both named job blocks, validates the exact-minimum install/assertion sequence in each, and contains a dedicated mutation proving that a caret install in the stock-8.3 job is refused.

Independent checks:

• git diff --check f9483bb2...0326a460 — PASS;
• LaravelAdoptionContractTest under immutable PHP 8.4.27 — 14 tests / 85 assertions PASS with the source mounted read-only and no network;
• all current checks are terminal (32 success, 1 intended skip, 0 failure/pending);
• in hosted run 43458500686, the two exact-head stock jobs (131999019158 and 131999018755) both passed setup, module, trust, install, and consumer steps; their logs show PHP 8.3.36 and exact Laravel 12.69.0 / 13.30.0 retained before and after installing the SDK.

This verdict is scoped to the framework-matrix workflow migration and its aggregate/guard. It does not qualify #417's separate embedded-transition caller, publish a package, or broaden any policy/parser/profile authority.

[rmcdaniel]

Delivered through normal integration: merge0f45771bf68238dfe9086e4a67783da2a8d5bbea has treea5f38784a983c6c5b03e34d282f2c8e3b21511c8, equal to Security-reviewed0326a460. The dependent417 PR was retargeted before deleting the old416 topic; GitHub404 verified. All four actual-main workflows are green, including CI43461121144.

Both fixed stock8.3 Laravel12/13 callers passed qualified411a setup, actual PHP8.3.36/module checks and the original minimum-version/consumer/tracing/analysis paths. All eight framework tuples remain exactly present; the required aggregate includes both jobs. Complete-set/per-job adoption guards and the stock83-only caret-mutation refusal pass. Initial conditional-policy and ordering-assumption failures remain NONPASS.

Owner: sdk-php. This completes the two matching stock8.3 framework cells. Six non8.3 framework cells remain for separate reviewed container recipes and actual callers; no PHP minor or framework support was removed, and no runtime/release authority is inferred.