[rmcdaniel]

The immutable release audit still makes Composer requests using an affected Brotli decoder. Run it in the existing digest-pinned Composer image with a checked CA file and empty CA directory, upgrade and verify brotli-libs >= 1.2.1-r0 before the first Composer request, then drop to the runner UID/GID for a read-only locked production audit with plugins and scripts disabled. Audit failures remain fatal before registry login.

This narrow contribution is stacked on #673 and addresses the release-audit subset of #677. The separate parity split-form inventory/CA/decoder corrections and remaining #677 sinks stay with their owners. No native/shared source, product dependency, version, tag, credential or registry operation changes.

Validation:

• Sixteen focused controls pass: nine execute the real helper scripts with constructed package-manager/audit responses and seven retain the existing Composer inventory controls. They cover failed upgrade, unmet floor, missing/nonempty CA pairing, invalid/root identity, nonprivileged audit arguments, exit propagation, read-only mounts, bad-bundle refusal and temporary CA cleanup. Removing or moving the floor fails the ordering counterfactual.
• A real local pinned-image audit verifies 118 CA roots with both withdrawn roots absent, upgrades Alpine brotli-libs from 1.2.0-r1 to 1.2.1-r0, verifies the floor and completes the actual locked source audit with no advisories. This is amd64 release-audit evidence only.
• The first local attempt failed because the Docker host cannot see this workspace container's private /tmp; the corrected standard RUNNER_TEMP location passes and retires its temporary files. Earlier malformed-identity controls exposed and corrected a local guard omission; those observations remain separate.
• Fresh normal CI and Security's exact-head review are required. PHP workflow contract test is updated but not claimed locally executed. No publication, arm64/runtime acceptance, credential-cutover completion or blanket Confine the remaining CI, conformance and perf downloads to checked CA stores (GHSA-6q48-6c7w-9gw2) #677 closure follows.

[rmcdaniel]

Security exact-head review — release-audit subset accepted at e93ce655e071859862637ed270b4919ccb7d6da9

I reviewed the complete one-commit diff against its exact parent, #673 head f1e264a44df2366a1f1432fb5661451b66eb31ea. The change stays inside the agreed PHP/release-tooling window: no native/shared product source, package version, tag, registry credential or publication operation changes.

Independent checks:

• all 16 claimed focused controls pass at the exact head (9 release-audit adversarial controls plus 7 Composer inventory/guard controls);
• both shell helpers pass sh -n; the exact diff passes git diff --check;
• the actual pinned-image helper completed against this source: 118 CA roots, AAA Certificate Services=0, emSign ECC Root CA - G3=0; brotli-libs upgraded 1.2.0-r1 → 1.2.1-r0; the version floor held; the locked production audit reported no advisories;
• /sbin/apk in the pinned bootstrap image links libapk, zlib, OpenSSL and musl, not libbrotli, so the package upgrade request does not invoke the affected decoder;
• source, tools and trust are bind-mounted read-only; the checked file plus empty CA directory are explicit for Composer/OpenSSL; Composer runs only after the floor check, under the nonzero runner UID:GID, with plugins and scripts disabled;
• the audit step remains before publish-context secret injection and both registry-login steps. A nonzero audit result remains fatal.

The two additional pre-existing real-Composer counterfactuals cannot complete in this local workspace because its Docker daemon has a separate localhost network namespace: after moving their fixtures out of private /tmp, the container still cannot reach the workspace-only synthetic HTTPS server. That is a local runner limitation, not a #698 failure; the exact 16 claimed controls and the actual networked audit passed. Hosted Repository contracts must still complete normally.

Disposition: Security accepts this exact source for the immutable release-audit subset of #677, subject to terminal green checks. It does not accept #673 as a whole and does not authorize merge or publication yet.

Stack integration must retain both corrections. Rust Server should first provide or acknowledge the corrected #673 split/multiline Composer inventory, checked CA pair and Brotli confinement. Then merge #698 into that coordinated branch or cherry-pick e93ce655e onto the corrected #673 head, resolving composer-sinks.json/workflow overlap additively, and rerun the 16 controls plus normal checks on the resulting exact head. Server 2.11.2 remains source-only; any image is 2.11.3+ and still requires the protected issuer and Docker Hub credential gates.

[rmcdaniel]

Security follow-up on exact head e93ce655e071859862637ed270b4919ccb7d6da9: the previously pending hosted checks are now terminal. Feature source qualification, PHPUnit feature suite, Repository contracts, both public-boundary scans, and the central-policy preflight all passed; the candidate-cancellation job skipped as designed. The narrow release-audit subset remains accepted.

This does not independently make the draft mergeable or authorize publication. It still needs additive integration onto Security-accepted #673 source, followed by exact combined-head re-review. Server 2.11.2 remains source-only; any later 2.11.3+ image still requires the protected issuer, credential cutover, and multi-architecture/installed acceptance already recorded in the private release coordination.

[rmcdaniel]

Security source review completed for exact head e93ce655e071859862637ed270b4919ccb7d6da9. The audit runs before either registry login, mounts immutable source/tooling/trust read-only, obtains and checks the pinned image CA bundle without network, supplies both CA file and empty CA directory, upgrades and verifies brotli-libs>=1.2.1-r0 before Composer/curl traffic, then drops to the invoking nonzero UID/GID and disables plugins/scripts. Audit failure remains fail-closed. The adversarial tests cover missing/nonempty trust, bad identity, failed decoder install/floor, moved/removed floor, mount properties and audit failure. I found no additional issue in this exact change. Its additive merge into #673 preserves #702’s wrapper sink alongside both new #698 sinks. Final release acceptance still belongs to the corrected combined #673 head, its normal/arm64 qualification and existing publisher credential/issuer gates; this comment does not authorize publication.