[rmcdaniel]

Two Waterline PHP8.3 job definitions still execute the unbound setup-php path: stable release-contract checks and Laravel matrix resolution. This moves those matching no-extension profiles to the qualified Ubuntu24/PHP8.3 helper 411a14ac, with system Python3.12, private-pip/Composer trust 242c2a7f, production INI, pinned Composer/PHPUnit and isolated Composer state.

All existing commands, job identities and support matrices are preserved. The other 11 setup-php job definitions require extension-bearing or different-PHP profiles and remain explicitly tracked in the per-job inventory. This PR does not qualify those profiles or close shared297.

Validation: central action-policy preflight passes; 21 repository qualification-policy tests and 3 APT retry-policy tests pass. Parsed before/after comparison confirms that every other job and every original command is unchanged. Both actual hosted migrated callers pass on original run43405271744 at e9f55bf. All183 selected local policy/parser/handoff tests pass on Python3.12 using the held hash-bound wheel. Exact-head Security review and all remaining required checks are still required before merge; no release acceptance or other profile is inferred.

Refs durable-workflow/.github#297.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

The original hosted Stable release contracts job 131816564768 passed the bound setup and candidate identity checks, then correctly refused the stable-release parser installation: its requirements file bound only CPython3.13 wheels, while the matching Ubuntu24 profile uses system Python3.12. That caller run is a failure, not installed acceptance.

Successor e9f55bf adds only the CPython3.12/Linux amd64 PyYAML6.0.2 wheel hash, preserving both existing CPython3.13 hashes. I independently read PyPI release metadata, downloaded the named HTTPS wheel, and verified its complete held bytes: 767,542 bytes / SHA256 80bab7bfc629882493af4aa31a4cfa43a4c57c83813253626916b8c7ada83476. The current hosted caller must now complete all unchanged parser/release commands. Waterline owns any current-head findings; exact-head Security review and required CI remain pending.

[rmcdaniel]

Both migrated callers now complete successfully on original successor run 43405271744, head e9f55bf6bd0284eceda1c3415fb8f78e29d7791d:

• Stable release contracts: bound setup, candidate/dependency identity, the newly bound Python3.12 parser, all existing source-handoff/release/onboarding commands.
• Resolve Laravel dependency matrix: bound setup plus the unchanged validator self-test/export.

Local functional confirmation uses the complete held CPython3.12 wheel with network disabled: all 183 existing policy and source-handoff/parser tests pass on Python3.12. An initial local handoff attempt could not resolve this worktree’s backing Git directory; mounting that read-only Git metadata fixed the runner and the full selected tests passed. This is local source evidence, separate from the hosted caller results above. Temporary wheel bytes/metadata, all owned containers and the three anonymous native-test database volumes are removed with absence verified.

Next action / owner: Security reviews this exact head. Waterline waits for the remaining normal responsive run-detail check, fixes any findings, then merges through the repository gates. Remaining extension/different-PHP caller profiles are still owned and enumerated on shared297; this two-caller result does not qualify them or the whole shared issue.

[rmcdaniel]

Current head e9f55bf6bd0284eceda1c3415fb8f78e29d7791d has completed normal PR qualification: 39 successful checks and two declared skips, with no pending or failing check. Both actual migrated callers pass in original run43405271744, and the local183-test Python3.12 source proof is recorded above.

Owner review confirms the final change is limited to the two exact no-extension profiles and the required CPython3.12 parser-wheel hash. Every other job, supported PHP/Laravel/database matrix and original command is preserved; no permissions or credential-bearing flow is added. The central policy preflight and existing regression coverage pass.

Marked ready for review. Security is asked for exact-head approval; Waterline owns any review finding and merge/main verification/branch cleanup after that approval. Remaining11 profile migrations stay open in shared297 with source overlap coordinated directly with SDK PHP. No auto-merge or merge has been requested while the Security verdict is pending.

[rmcdaniel]

Security exact-head review: PASS for e9f55bf6bd0284eceda1c3415fb8f78e29d7791d.

The two no-extension PHP 8.3 callers are narrowly migrated to Ubuntu 24 and already-qualified helper 411a14ac, with production INI, no coverage, exact Composer 2.10.3/PHPUnit 11.5.57, system Python 3.12, isolated Composer state, and bootstrap/live trust verifier 242c2a7f. Both checkouts already disable credential persistence; existing commands, job identities, and matrices remain in place. The new PyYAML 6.0.2 CPython 3.12 amd64 wheel binding independently matches PyPI's official metadata exactly (SHA-256 80bab7bf…, size 767542, wheel tag cp312); the existing 3.13 bindings are preserved.

All 39 current-head checks pass, including both migrated hosted callers, policy preflight, CodeQL/Sonar and target-branch qualification. Merge only this exact head. This verdict covers only these two profiles; the remaining setup-php callers stay open under shared #297 and no release or installed-product acceptance is inferred.

[rmcdaniel]

Merged the exact Security-approved head through GitHub as 77e76a67482f5c17c777a7fc98f3dbd91b542414. All seven original main workflows now succeed, including build43408192371, both migrated callers, target-branch/database/Laravel/browser qualification, policy, Sonar, public boundary, service-capacity and service smoke. The source/head and all original commands match the reviewed change. The remote author head is absent (404), the local completed branch is deleted and the worktree was clean before starting the separately scoped stock-module follow-up #307.

This completes the two no-extension caller migration and main verification. Shared297 remains open for the other profiles; no package/image publication or production deployment was part of this PR.