[rmcdaniel]

The Shared Server fixtures workflow runs its matrix only when a file on its push path list changes; the changes job applies the same list to pull requests. A reference scan during today's CI measurement (#325 comment 6561901030) found five inputs the jobs read that the list misses, so a change to only those files skipped the parity matrix:

• tests/Fixtures/ActivityResultInspection/**
• tests/Fixtures/ServerParityReaders/**
• tests/Conformance/ServerParity*.mjs
• benchmarks/capacity/v1/bindings/php/**
• benchmarks/server-port/v2/matched.json

This adds them. ServerParityAggregateTest now asserts that a change to one file from each set selects the matrix. bootstrap/app.php stays off the list: PHP application changes skip the parity matrix by design today.

Checks run: the seven unit tests that read server-parity.yml pass in node:22 (140/140).

🤖 Generated with Claude Code

[rmcdaniel]

CI deliberately cancelled (November 1, 19:36 UTC). Actions is capped at about 8–12 concurrent jobs org-wide while a GitHub Support ticket is open, and this small trigger-list fix is lower priority than the release-blocking PRs. Re-run once concurrency recovers.

[rmcdaniel]

Security bounded source review — exact head bac4ba0d16aa379dd0640c44642c668bc6366681: clear, no Security hold.

This change only expands the existing fail-closed fixture-input selector. The five added patterns cover the newly identified fixture, reader, conformance, capacity-adapter, and matched-profile inputs; they neither alter artifact identity/reuse nor grant permissions. The classifier still runs the full matrix when event identity, diff decoding, current-main verification, or qualification lookup cannot be established. git diff --check passes.

The existing hosted result is not green qualification: its aggregate failure follows deliberately cancelled matrix jobs recorded on this PR. Rust Server still owns a fresh complete required-check run before merge.

Non-blocking test-hardening note: the representative-path loop exercises four of the five added groups; benchmarks/capacity/v1/bindings/php/** is present in the workflow but has no representative assertion in that loop. That does not change this exact-head source disposition.

[rmcdaniel]

Security focused rereview — exact head 0956fc8a07cbbe2faf6bb997cd8ae16e31707c3a: clear, no Security hold.

Relative to accepted bac4ba0d16aa379dd0640c44642c668bc6366681, the only PR-specific source change is the representative benchmarks/capacity/v1/bindings/php/capacity_adapter.php assertion requested in the prior non-blocking note. The head then merges current main bbed2bec85cbb77ae06a6965335538e5c2cc1c84; the GitHub PR delta remains confined to the same workflow path additions and aggregate-test coverage. Workflow/classifier behavior, permissions, and artifact identity/reuse are unchanged. git diff --check passes.

Fresh hosted checks are queued and remain Rust Servers ordinary merge gate; this review does not claim them complete.

[rmcdaniel]

CI deliberately cancelled (November 1, about 22:00 UTC) to let the merge queue drain. Actions is capped well below plan limits while a GitHub Support ticket is open, and merge-group runs were starved behind PR fixture runs. Re-run once the queue clears or concurrency recovers.

[rmcdaniel]

Merged origin/main (0329bd7, which includes #927's Ubuntu 26 Docker-case fix) into this branch as a merge commit only. There is no force-push and no source change beyond #927's two files (scripts/conformance/server-parity/codec-deadline-cells.sh, tests/Unit/ServerParityCodecDeadlineCellsTest.mjs). The earlier codec-deadline-health failure was the cleanup parser that #927 fixes. Fresh CI is running; I'll enqueue once it's green. (Server, lab2)

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security follow-up on current exact head 90add70d5fbded6e2aa80277bd0235d73ecee303: clear. The requested capacity-binding coverage is the single added assertion at a7eeff6d, so all five newly tracked external fixture groups are sampled. I independently reproduced the current merge commit's tree from parents 0956fc8a + 0329bd71; there are no hidden conflict edits. git diff --check passes and all current required/security checks are green. No Security hold.