[rmcdaniel]

The existing Laravel matrix installs the SDK from a checkout. Add two opt-in registry consumers to the maintained published-worker workflow so #421 can verify customer-installable SDK 3.18.3 with Laravel 12.72.0 and 13.41.0.

Each cell uses the qualified stock PHP 8.3 profile, an exact SDK version and source reference, a main-branch dispatch and an empty candidate selector. A clean Composer manifest selects normal registries. The unchanged trust guard precedes installation and the locked audit. Controls independently compare root requirements, lock and installed version/source/ZIP references, require distribution installation, reject duplicate metadata and repository overrides, and check the installed SDK product train. Existing bridge and cached-role controls execute through the registry consumer's autoloader. Tuple, audit and graph artifacts have 14-day retention.

Validation: the three new metadata tests cover independent installed version/source/dist mutations, source fallback, duplicates and repository overrides. Five existing native tuple/pipeline controls also pass. YAML, action pins and diff checks pass. All 36 exact-head checks succeeded, with two declared skips. Independent source/workflow PASS binds e22122a. Normal merge 92053fc has the same tree; the merged remote branch is absent.

All 467 package files and modes remain identical to published SDK 3.18.3 at 32cc885. This CI-only follow-through changes no runtime, package version, tag, installer/profile, catalog or native tuple. It needs no additional SDK release.

All five actual-main workflows passed at 92053fc, including CI 43557689196 and ordinary installed-worker run 43557689200. Registry dispatch now remains held only for normal P2 propagation. Packagist's package page/API expose 3.18.3, and its update feed records publication, but independent ordinary P2 reads still return 3.18.2. Current propagation observation. SDK owns the two actual registry cells and artifact review after those gates, followed by #421's portal and downstream handoff. No #419/#420 step or held counter-review is resumed.

Refs #421.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security source/workflow PASS for exact e22122afd9a2cdf35ed24c0693e6364ba4377185 / tree 73e8f683f6591b63bd66276704ef4c716e89dc05.

The opt-in job is correctly separated from ordinary PR/push execution and refuses anything except an explicit main-branch workflow dispatch with laravel_bridges=true, an exact stable SDK version, an exact 40-hex expected source reference and an empty candidate selector before checkout. It creates a clean consumer with exact SDK/Laravel requirements and no repository override, applies the existing 242c Composer trust boundary before registry installation and again before the locked audit, and uses the existing stock 411a PHP 8.3 profile. Installation disables scripts/plugins and prefers dist.

The new checker independently validates root requirements, lock metadata and installed metadata for both the SDK and framework, including exact version, source reference, ZIP dist reference/type and installation-source=dist; duplicates and repository overrides refuse. The installed SDK manifest must also report the selected product train. The two Laravel source/dist references match current normal Packagist metadata (12.72.0 at b089d302..., 13.41.0 at 95934d28...). Existing version checks additionally read Composer's normalized version and Laravel's own Application::VERSION. Both existing bridge/cached-role scripts receive only the registry consumer's autoloader, so the checkout supplies the test logic but not SDK runtime bytes. Retained artifacts contain tuple/audit/dependency metadata, not the synthetic role credentials.

I independently ran the three new metadata tests, the five existing tuple controls, YAML parsing and the exact diff check; all pass. The 3.18.3 annotated tag resolves to accepted commit 32cc885abb3bad914b3af098a5c908c7b5037ce0 and its GitHub Release is public.

The actual installed dispatch remains gated. At this review, normal Packagist P2 still lists 3.18.2 as latest and does not yet expose 3.18.3, so do not dispatch or classify a resolution failure until normal P2 propagation is positively read back. Required exact-head CI, normal integration/main readback, then the two registry-only Laravel cells and independent artifacts remain necessary. This source PASS changes no package/runtime/profile/catalog and grants no #419/#420 authority.

[rmcdaniel]

Independent normal-registry propagation readback at 2026-11-14 04:39:11 UTC:

• The ordinary Composer P2 endpoint https://repo.packagist.org/p2/durable-workflow/sdk.json returned HTTP 200 from BunnyCDN with cdn-cache: HIT, Last-Modified: Fri, 13 Nov 2026 15:52:45 GMT, and ETag "6af7324d-2f4b5".
• Its first package entry is still 3.18.2, source/dist reference f9483bb2b5b45f591a82d9e5419c5b60a6e967c6. It does not yet expose 3.18.3.
• The separate Packagist package API already exposes 3.18.3 at source/dist reference 32cc885abb3bad914b3af098a5c908c7b5037ce0, timestamp 2026-11-14T04:21:20+00:00.

This independently confirms propagation is incomplete specifically at the normal P2 consumer boundary; it does not indicate a tag/source mismatch. Keep both registry-only Laravel dispatches held until a fresh ordinary P2 read exposes exact 3.18.3 / 32cc885…. No repository override, cache substitution, or candidate source is accepted.