[rmcdaniel]

Freeze one producer-owned legacy-key qualification manifest for the SDK/CLI #216 cohorts. It records the exact released reference source, canonical seed SQL/token constants, retained/readback/close/continuation/conflict/ambiguity expectations, and backend-specific case-collision outcomes.

Synthetic legacy-shape controls, an actual 3.8 image → current schema-upgrade rehearsal, and genuine postcommit response loss remain distinct cells. The manifest supplies the accepted source transformation and an actual-upgrade procedure; it is not a generated database, a native schema implementation or installed acceptance. Callers must use stopped disposable copies and real API receipts, verify preconditions/row counts and roll back failures.

Three focused controls pass for UTF-8 token constants, selected-row mutation/preservation plus rollback, and authority-scope distinctions. The CI preflight runs them; Shared Server fixture input selection includes the new authoritative vector and its regression guard. Node selection, whitespace, public-boundary and added-source credential-pattern checks pass. Exact Security review and normal checks remain gates before cohorts adopt the frozen source. Refs #934 and shared #216; no runtime or publication change.

[sonarqubecloud]

Quality Gate passed

Issues
3 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-head contract/source review: PASS for df8cbfb8e4a5024f5175b72de2feefefe1f757b4 (shared producer manifest only).

I compared the new vectors to the accepted native 3.9.1 command-key tests and schema migrations. The contract faithfully preserves the important authority boundaries:

• the synthetic transform is limited to a stopped, disposable copy of real API-admitted commands; it requires the selected command/run/type identities and single intent row before deleting that intent and restoring the raw request key in one all-or-nothing transaction;
• the signal/update token constants are the exact UTF-8 SHA-256 derivations from token-key;
• open, completed and continued legacy readbacks retain original command/run/update identities while explicitly reporting retained:true, intent_verified:false, zero writes, and completed-null update outcomes where applicable;
• changed name/explicit-run targets conflict without writes;
• the two-row, legacy-token and modern-raw collision shapes all refuse ambiguously without selecting a receipt, with retryable:false;
• the backend collation split is explicit: MySQL/MariaDB case-only collisions refuse, while SQLite/PostgreSQL binary comparison admits a distinct command and therefore makes no zero-write claim;
• the physical-upgrade cell is separately bound to the published 3.8.0 source/index and the actual backend schema transitions (SQLite 12→13, PostgreSQL/MariaDB 13→14, MySQL 14→15); and
• real post-commit response loss remains a separate proxy-proven admission cell. Neither the synthetic transform nor source ancestry can substitute for an installed upgrade or response-loss receipt.

The receipt requirements preserve exact fixture/package/Server/platform identities, cell labels, complete identities and zero-write snapshots, nonpasses and cleanup. The manifest is explicitly not a reusable database dump or installed-client PASS.

Independent local checks passed: all 3 Python fixture controls and all 88 Server parity path-selection/aggregate controls. git diff --check is clean, the fixture is selected by the shared Server workflow, and the targeted hosted fixture/repository/PHP feature checks are green.

This PASS does not qualify any SDK/CLI cohort, generate a legacy database seed, or close shared #216. Each consumer still owes its unchanged-fixture installed run; the producer still owns the real baseline-upgrade seed/cell; and response loss still owes the separately reviewed proxy proof. Merge remains subject to all required exact-head CI. At review time broad backend jobs were still running and Sonar reported three minor assertFalse style findings in the new Python test; any source edit to address them requires the usual exact-successor countercheck.

[rmcdaniel]

Accepted through the normal merge queue at d66e33bfb5c76f94c5b202f8c9f7a9e8cd75cf1c. All five fixture/selection files match Security-reviewed df8cbfb8e4a5024f5175b72de2feefefe1f757b4; all exact-head required checks passed before entry. The merged remote branch was deleted and absence verified.

The canonical public path is resources/platform-protocol-specs/command-key-legacy-v1-vectors.json at that accepted commit. CLI/Python/Rust owners have the pointer for separately labeled synthetic legacy shapes, actual 3.8 physical upgrade and real postcommit-loss cells. Server retains corrective runtime/release #1207, and client owners retain installed execution evidence. This source delivery does not close shared #216 or imply an upgrade rehearsal passed.