[rmcdaniel]

Several isolated conformance proxies constructed an upstream URL directly from the incoming request target. An absolute-form request target could therefore replace the configured origin in the observer, skew, and deadline-pressure fixtures. The skew proxy also followed redirects. Separately, Rust artifact provenance accepted any registry source containing the text crates.io.

This change centralizes proxy target construction, carries only the request path and query under an exact configured HTTP(S) origin, rejects upstream credentials and path prefixes, verifies the heartbeat relay origin at its fetch boundary, and disables automatic redirects. Cargo provenance now accepts only the supported exact crates.io registry spellings.

Validation:

• focused Node suites: 31 tests passed
• WorkflowLifecycleContractTest: 69 tests, 829 assertions passed on PHP 8.4.27
• JavaScript syntax and git diff checks passed

[rmcdaniel]

Maintainer review: the failed push boundary scan cannot inspect its previous-commit range. I read its actual failure; it does not report a source or commit-metadata violation. The separate pull-request boundary scan passes on the current source.

I dispatched the repository's existing Public Boundary workflow on the unchanged current branch, using its supported current-head mode. It still scans tracked files, commit metadata, workflow isolation and the scanner's own failure controls. The original failed run remains failed. No source, rule, permission or full matrix changed. Other normal checks and exact-head review remain required before merge.

[rmcdaniel]

Security qualification update for exact head b176e58:

• The shared transport now receives a validated configured HTTP(S) origin separately from the normalized inbound path/query, refuses destination-override options, and does not follow redirects.
• The adversarial local transport test proves an absolute attacker-controlled request target still connects only to the configured origin and proves destination overrides are rejected.
• Directly affected Node suites pass 26/26; the PHP relay contract passes 22 tests / 264 assertions with its 7 environment skips.
• Fresh JavaScript CodeQL analysis on this exact head reports 0 results across 87 rules, and the PR-ref open-alert inventory is empty. The earlier five request-forgery findings and incidental test-only reflection were removed without dismissal or suppression.
• Both public-boundary scans pass.

The broad Shared Server fixture failures are not introduced by this change: they reproduce on the earlier unchanged baseline and occur in the initial three-runtime/codec comparison before the later proxy-dependent checks, which pass. One concrete recurring failure is timestamp precision representation (.022Z versus .022000Z). I am keeping that evidence separate rather than weakening or masking the security gate.

Remaining language and normal repository checks are still running. After #598 lands, I will refresh this branch from current main once and require the same exact-head evidence before merge.

[rmcdaniel]

Security qualification update for final merged head bef7f19:

• Current main f8e0385 was merged without conflict; the branch is clean and pushed.
• The directly affected Node 22.23.3 suites pass 19/19, covering configured-origin pinning, absolute/network-path targets, request-option override refusal, no redirects, exact crates.io provenance, and shared relay behavior.
• HeartbeatConformanceRunnerContractTest passes 22/22 with 291 assertions on PHP 8.4.27 and Node 22.23.3. Syntax checks for every changed module also pass.
• The broader local 205-test run had two unrelated observations: a 6001 ms heartbeat cleanup deadline that passed on immediate exact rerun, and a lifecycle matrix assertion that reproduces unchanged on exact current main. The latter sees only the three SDK shards under PHPUnit, while the same exact current-main runner emits all 12 required scenarios directly under both APP_ENV=testing and APP_ENV=production. No lifecycle source is changed by this PR.
• Task-owned dependency and runtime caches were removed after qualification.

Fresh exact-head Actions, CodeQL, Sonar, public-boundary, and shared-fixture checks remain authoritative. Auto-merge remains enabled; no failed check will be bypassed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final default-branch disposition: CodeQL JavaScript/TypeScript analysis passed on main merge commit fbef609625a0c2eedfd2bc0ab03e3a966a79c2dc in run 39699439627. Alerts #15-#19 and #21-#26 changed automatically to fixed at 2026-10-22T00:42:56Z; none was dismissed. Alert #20 remains the separately documented false-positive dismissal. The expanded Shared Server run 39696901874 is still active and currently has SQLite/MariaDB fixture failures, so no clean-matrix claim is made and logs are unavailable until that run completes. Those post-merge fixture cells do not alter the fresh CodeQL closure. No native rerun, remote artifact retrieval, or stopped observation path was resumed.