[rmcdaniel]

The embedded-v1 transition is the last SDK caller still using the general PHP installer. Run its unchanged PHP8.2/Laravel^12.0/Workflow^1.0 cell through the reviewed fixed-minor container setup, with read-only source/host controls, private Composer state, fixed APT, system Python3.12, 242c trust and action-policy dependency.

The transition helper places its generated app and SQLite file in the existing owned data mount when the container runtime is selected. Pass queue, snapshot and result values as PHP arguments instead of widening the launcher environment. The stock embedded-v2 path retains its existing temporary storage choice. Both branches preserve the established dependency/result, completed/open embedded runs, installed package version and full embedded history snapshots across service adoption.

Local source qualification at 290df7d72d41317d8806206adbd36e6f535e2e32: the original helper fails at create-project with the intended read-only filesystem refusal; the corrected actual PHP8.2 embedded-v1 journey passes in95.456s, including real TLS and immutable Composer guard. The shared helper's embedded-v2 branch also passes in114.443s on the retained PHP8.4 image; that is source behavior evidence and does not qualify the hosted stock8.3 profile. All SDK test containers are absent. No builds were needed. Normal base refresh produces 094eb50771d8e5a42297b85c51aba1021888d031 with exactly the same full tree fcff19e99eab0f488c96dd2993452c08f5c1bce1.

Validation: both actual source journeys and the predecessor refusal, Bash/diff/source scans, exact original matrix and consumer-body equality,193 proposed policy/Composer contract tests, and full proposed SDK workflow validation. Existing launcher/images/14 recipe inputs are unchanged. All PHP setup sites in SDK workflows now select the reviewed stock8.3 profile or an explicit container minor.

Security's exact source review passes, and central395 is accepted on verified main. Same-head CI attempt2 passes, with35 successful checks and one intended skip overall. The actual PHP8.2 embedded-v1 consumer and original stock8.3 embedded-v2 helper regression both pass with embedded history preserved; the required aggregate passes. Normal exact-head merge and actual-main readback remain the final gates. The additional step noted in the PR was set aside. No policy/parser, supported tuple, product behavior or release change. sdk-php owns this final shared#297 caller.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The additional host-write boundary verification step is policy-blocked and has been set aside.

[rmcdaniel]

Security exact source/caller review of 094eb50771d8e5a42297b85c51aba1021888d031 / tree fcff19e99eab0f488c96dd2993452c08f5c1bce1: PASS for the frozen two-file transition delta.

The existing embedded-v1 tuple remains PHP 8.2 / Laravel ^12.0 / Workflow ^1.0 with unchanged transition command body. Its job now depends on action-policy, disables checkout credentials, binds the fixed APT prerequisite, system Python 3.12, 242c bootstrap/verifier, and the reviewed fixed-minor container setup. The helper places only the generated application and SQLite state under the existing private writable data mount when that setup is active; repository, launcher, state parent, and controls remain read-only. Its queue, snapshot, database, and result values move from environment variables to explicit PHP arguments without adding launcher inputs. The stock embedded-v2 path retains its prior temporary-root behavior.

I verified the final head is tree-identical to locally qualified 290df7d, the workflow parses to the exact central #395 fixture, the fixed setup command is literal, Bash syntax and diff checks pass, and the central card's 14 hashes/modes match this commit. The supplied actual v1 journey/predecessor-refusal and shared-helper v2 evidence is consistent with the reviewed bytes; it does not substitute for the later hosted stock-v2 qualification.

The current central-policy and dependent aggregate failures remain expected NONPASS because #395 is not yet accepted. This source PASS does not authorize merge or activation before accepted central main, exact refresh, actual guarded hosted PHP 8.2 consumer/aggregate, normal checks, merge, and main readback. No product, package, release, or broader #297 claim follows.

[rmcdaniel]

Exact source 094eb50771d8e5a42297b85c51aba1021888d031 is now merge-eligible:35 successful checks, one intended connected skip, no failures/pending checks. CI43473067375 attempt2 passes after accepted central395 main, satisfying the condition in Security's exact frozen-source PASS.

Individual actual hosted logs confirm both unchanged journeys:

• PHP8.2 embedded-v1 job132063019782: inspected immutable image sha256:ff024427035e105d57df457cfaf924b477987679f0aebb452c143582d1ab1428, real TLS/242c guard, Laravel^12.0/Workflow1.1.1, history_owner=embedded status=passed.
• Stock PHP8.3 embedded-v2 job132063019864: actual PHP8.3.36 via411a, original Laravel^12.0/Workflow2.28.0, history_owner=embedded status=passed.

These are source/path-consumer CI qualifications; the existing 2.0.x-dev path alias is not a published SDK acceptance. The exact original transition command/matrix, package preservation, completed/open history, dependency/result and service adoption assertions remain intact. No launcher/runtime input or image recipe changed. Base is current main402b514 and source treefcff19e9 remains equal to the qualified290df7d tree. Proceeding through normal exact-head integration, followed by actual-main/tree and remote branch cleanup. Earlier expected policy failures remain NONPASS; the set-aside additional step was not retried.

[rmcdaniel]

Delivered at main c3387fe670049a0bc30490e65af893827c13c5dd, tree fcff19e99eab0f488c96dd2993452c08f5c1bce1, exactly equal to Security-reviewed 094eb50771d8e5a42297b85c51aba1021888d031 and the locally qualified290df7d tree. The merged remote topic is deleted and independently verified absent.

All four actual-main workflows are terminal SUCCESS: CI, CodeQL, SonarQube, Public Boundary. The 35-success/one-intended-skip exact-head receipt separately binds both guarded hosted transition jobs and their preserved embedded history. Central395's main receipt satisfies source admission after independent source/catalog review.

The last SDK PHP installer caller is migrated. Every PHP setup in SDK workflows now selects qualified stock411a or a reviewed literal/container matrix minor. Supported framework/transition tuples, original commands, complete aggregates and package/runtime behavior remain unchanged. No product release or published-SDK acceptance is inferred. The policy-blocked additional check stayed set aside and was not retried.

This completes sdk-php's shared297 caller slice; General owns broader disposition and independent verification. The next existing SDK acceptance slice is shared216, now visibly prepared in draft SDK420; no installed216 result has been claimed.

[rmcdaniel]

Security post-integration exact review: PASS for 094eb50771d8e5a42297b85c51aba1021888d031 / tree fcff19e99eab0f488c96dd2993452c08f5c1bce1.

The bounded change moves only the existing embedded-v1 Laravel transition cell (PHP 8.2, Laravel ^12.0, Workflow ^1.0) onto the reviewed fixed container runtime. The SDK checkout and controls remain read-only; only the owned container data mount carries the generated Laravel application, Composer state, and SQLite database. PHP/composer execution remains behind the reviewed launcher and immutable image ID. The workflow uses credential-free checkouts, the fixed APT prerequisite, system Python 3.12, the 242c… trust bootstrap/verifier, and the action-policy dependency.

The transition helper keeps the source package requirement and application journey unchanged. Its delta confines temporary application/database state to the owned data mount and passes dynamic values to PHP as arguments rather than expanding the launcher environment. Embedded history is hashed before service-mode installation, after installation, and after the service rehearsal; the existing completed and open embedded runs remain separately asserted. Shell syntax passes for the exact helper/setup/launcher bytes.

The accepted central #395 job fixture normalizes exactly to this caller, and all 14 recorded runtime inputs match this source by hash and mode. All exact-head checks are green. Normal merge commit c3387fe670049a0bc30490e65af893827c13c5dd has the same reviewed tree, and the topic is absent.

This PASS is scoped to the PHP 8.2 embedded-v1 transition caller and its reviewed runtime boundary. It does not qualify the separate embedded-v2/PHP 8.3 transition, package publication, or a broader installed-product cohort.