[rmcdaniel]

The policy preflight installs pinned PyYAML 6.0.2 without excluding source distributions. It now uses --only-binary :all:, so its actual Python 3.13 runner must install a compatible wheel or fail. The package version, maintained pip bootstrap, action pins, permissions and required checks are unchanged.

This is the single current-source correction selected in the bounded SECURITY-view review, original key AaFBMFmUBukGr1wPDQwt / S8541. The source baseline is de5f1b2f, workflow blob b7357e722570fde875ff14ae6fb9285ce76a5231. It does not reclassify the other contextual keys or claim a complete historic analyzed-byte comparison or repository-wide security result.

Validation uses the existing normal checks and an actual successful wheel-only installation in the policy job; no literal prose-matching test is added. The YAML parses locally. The original Python 3.13 job successfully installed the compatible cp313 manylinux wheel. Its subsequent policy check refused the equivalent equals-sign spelling; the candidate now uses the already-reviewed space-separated spelling. The original failure is retained. Final-head checks passed (17 success/two intended manual worker skips); actual main passed (16 success/two intended skips), with the same compatible wheel installed by the main policy job. This CI-only path does not match the Pages publisher's push paths, so no automatic documentation deployment is expected; the accepted stable 4.12 artifact/source remains unchanged and will be reconciled after main acceptance. No scanner state/config/manual analysis, release, new bootstrap/acquisition profile or #191/#192 operating route changes.

[rmcdaniel]

Original head 1594bf870c64a50ccc2db582e39087d5801deede retained its actual failure: CI 42185780119/a1, policy job 127785645560. The Python 3.13 wheel-only install succeeded at 08:10:34Z using PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl; the subsequent central validator refused the equivalent equals-sign option spelling. No source distribution was used.

Successor fa74e608ee72007e06afbeb5b0d7db2d9c18655f / tree 11e6a96ce98b4a1e2ae0de279caa31ec0dd58fc7 uses the existing centrally reviewed --only-binary :all: command, matching this repository's other policy dependency install. The central parser, preflight and result-gate validator pass locally with that source; normal new-head checks are running. No validator, bootstrap, Python/package version, action pin, required check or scanner setting changed. The failed original remains NONPASS.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The selected Rust wheel-only source correction is complete in SDK Rust #226, normally merged at ff4eba58e5f37aac6579b0e6d59996e7a7be3247 on 2026-11-06T08:25:35Z. Exact tree 11e6a96ce98b4a1e2ae0de279caa31ec0dd58fc7 and ordered parents [de5f1b2f214c2588650224e552fd5d45f33ef050, fa74e608ee72007e06afbeb5b0d7db2d9c18655f] were independently read back. The sole changed file is .github/workflows/ci.yml: the policy preflight now installs pinned PyYAML 6.0.2 using the centrally reviewed --only-binary :all: option. Python 3.13, maintained bootstrap, action pins, permissions and required checks remain unchanged.

All 19 final PR checks are terminal (17 success/two intended manual worker skips). Actual main has 18 terminal checks: 16 success/two intended skips, including original CI 42187591005/a1 and four CodeQL analyses 42187590927/a1. Both final-head and main policy jobs actually installed PyYAML-6.0.2-cp313-cp313-manylinux_2_17_x86_64.manylinux2014_x86_64.whl; main's successful installation is timestamped 08:25:46.548750Z in job 127791500944. No source-distribution fallback or literal prose test was used.

The original equals-sign spelling's successful wheel installation followed by policy NONPASS remains preserved in CI 42185780119/a1. The corrected spelling passed the unchanged existing validator; no scanner state/config/manual analysis or check/policy bypass occurred.

The actual publisher graph has no Pages follower for a ci.yml-only change, confirmed by main's original run list and docs.yml path filters. Retained artifact 13486538605 (4,199,744 bytes, SHA-256 abe1eb9c598786823efc86f3d9d2b7ca2f19dca8079d9761f7cfc4dbd6160dd3) and successful deployment 7595212816 remain #225's accepted subjects. Anonymous live __build.json was byte-identical at 08:26:20.965334Z: stable SDK 4.12.0, published source 4b2440a5618ccc1c98960ea2e1e62127042c3590, tooling de5f1b2f214c2588650224e552fd5d45f33ef050. No new artifact, deployment, browser check or manual dispatch was invented.

The merged source branch is deleted locally/remotely with remote absence verified. This closes only the selected current-source S8541 correction for key AaFBMFmUBukGr1wPDQwt; General retains the bounded contextual findings and historic analyzed-byte attribution on #187. No repository-wide SECURITY verdict, release or #191/#192 authority follows. The already-selected remaining replay-clock source train resumes separately.