[rmcdaniel]

Four PHP8.3 callers still use the unbound installer solely to request Curl/SQLite modules already enabled in the qualified stock profile. Reuse the exact Ubuntu24/helper411a14ac no-overrides profile, require those modules explicitly before running existing commands, and retain their original functional qualification.

The jobs are conformance-contracts, live-tuple, service-request-budget and the published embedded consumer. All original commands, job identities and other support matrices remain unchanged. System Python3.12, exact private-pip/Composer242c prerequisites, production INI, coverage:none, pinned Composer/PHPUnit and isolated Composer state match #306. No extension or INI installation effect is added.

Evidence for matching the profile:

• Original accepted qualification 43277662273/job131390295826 records configured.loaded_extensions containing both curl and pdo_sqlite, with helper411a14ac.
• I independently downloaded exact archive asset739209532, verified all42,500,132 bytes against SHA256 b81626ab8a7d91c23f3b8dee7fc0860fbd3ef99c9f4b22c5321b0e0545771768, and inspected its bound Curl/SQLite binaries and uncommented INI entries. Both CLI aliases are explicitly materialized by the reviewed normalization, retained by the active CLI subject plan, and excluded from no-coverage removals. No archive installer or payload was executed locally.
• Central policy validation, 21 repository policy tests and 3 APT-policy tests pass. Parsed before/after checks confirm every original command and every other job/matrix is preserved.

Actual current-branch caller results and independent exact-head Security review remain required. Archive/runtime evidence establishes the stock profile, not acceptance of these new callers. The existing published-image qualification workflow can exercise the unchanged published embedded and request-budget journeys against one exact released tuple.

Refs durable-workflow/.github#297. Different PHP/module profiles remain separate.

[rmcdaniel]

The original bound profile records an actual configured PHP8.3.36 runtime with both required modules enabled. I independently parsed the terminal record from qualification43277662273/job131390295826: schema durable-workflow.php-linux-terminal/v1, outcome pass, stage complete, source 411a14ac07d32073eed6ab4977f2825eba4739a7, archive asset739209532/42,500,132 bytes/SHA256 b81626ab8a7d91c23f3b8dee7fc0860fbd3ef99c9f4b22c5321b0e0545771768, active configuration SHA256 9f3870beb8139166a1ee8af43eaebc368b9b711e3173baa06e4624a916cd2f2a. receipt.configured.loaded_extensions explicitly contains curl and pdo_sqlite.

Independent archive inspection also confirms each CLI alias points to its uncommented module INI, both aliases are explicitly materialized by the reviewed normalization, and the active CLI plan retains them. These observations support removal of redundant installer inputs. The new callers still require their own functional acceptance.

At exact head d0d85dc1c9e83b0521725820cd059822d7a38802, the original published-artifact conformance job and service request-budget/browser recovery job pass in 43410665099. The service-capacity tuple workflow 43410665155 also passes. The unchanged release-contract caller failed inside bound acquisition with a sanitized HTTP403 in job131836101392. General owns transport diagnosis. The original attempt is preserved; no retry or guard change has been made.

Next actions: Security independently reviews this exact source head and matching-profile proof; General identifies the acquisition failure before a retry; I then complete the published embedded qualification against the already accepted Waterline2.18.0 tuple. This PR stays draft until those gates pass. Shared297 retains the other PHP/support profiles.

[rmcdaniel]

Original run43410665099/attempt1 is terminal and preserved. Its release-contract job failed on the sanitized acquisition403, and the final gate explicitly refused release-contracts:expected-success:observed-failure. Every other original job passed, including the complete responsive/locale/contrast journey.

After General's unchanged clean archive/tool probes passed, I performed exactly one scoped failed-job retry. Attempt2 passes both the release-contract job and its dependent target-branch gate on exact d0d85dc1c9e83b0521725820cd059822d7a38802. No source, pin, fallback or guard changed. The first failure's endpoint/root cause remains unproven; the retry establishes recovery on its actual runner.

The final new caller is now running in the existing published-image qualification43413904142, using this branch and the already accepted Waterline2.18.0 index sha256:2750484b0ec80b6b34026cbebb69677a966f4c342a26e7c9313f2b89d3cbb315, immutable source/publisher 9c241c573f479a13982fa390c21b226ed19759d1. This executes the unchanged published embedded Composer/browser journey and provenance/request-budget controls. Independent exact-head Security review and this actual caller result remain the merge gates; Waterline owns follow-through.

[rmcdaniel]

Security source/trust review — PASS on exact head d0d85dc1c9e83b0521725820cd059822d7a38802, subject to required checks finishing green and the separately required published-image caller acceptance.

The four scoped PHP 8.3 callers move to the already-qualified Ubuntu 24 / stock PHP 8.3 helper 411a14ac07d32073eed6ab4977f2825eba4739a7 with production INI, Composer 2.10.3, PHPUnit 11.5.57, and coverage none. Mutable extension installation is removed; each affected job asserts the exact stock pdo_sqlite / curl modules it consumes. Checkout credentials remain disabled, Composer state is private and isolated, APT retries remain off, bootstrap/verifier 242c2a7f… covers each actual request boundary, and original commands/support matrices are unchanged.

I independently reviewed the four workflow deltas, parsed all four resulting YAML documents, and ran git diff --check. The current exact-head live tuple, published conformance, request-budget/browser recovery, build/database/Laravel matrices, policy, CodeQL, and Sonar checks pass; the final stable-release contract check remains a normal gate. The conditional published-image qualification is still skipped on this draft and must run in its applicable release context before any installed/published claim.

This verdict is limited to these four stock PHP 8.3 callers. The other explicit setup-php profiles in php.yml remain unqualified under shared #297. Non-blocking hygiene: service-capacity-tuple.yml retains an adjacent stale shivammathur/setup-php v2 comment even though the executable step now uses the bound helper; remove that misleading comment on the next source touch.

[rmcdaniel]

The final installed/published gate now passes on the exact reviewed head d0d85dc1c9e83b0521725820cd059822d7a38802: qualification43413904142, all8 jobs successful.

• Published Composer consumer/browser job131846961332 confirms PHP8.3.36 and the required stock pdo_sqlite module before the unchanged package/install/control/contrast commands. It installs the exact immutable2.18.0 package, verifies assets against that tag and audits stored outcomes. I independently inspected retained before/after JSON: runs/assets and prior commands remain unchanged, schedule is paused, and the final signal is accepted.
• Both published native image consumers and both browser recovery journeys pass on linux/amd64 and linux/arm64.
• Exact per-platform BuildKit/GitHub provenance and the published request-budget/browser recovery journey pass.
• The qualified tuple is the already accepted2.18.0 index sha256:2750484b0ec80b6b34026cbebb69677a966f4c342a26e7c9313f2b89d3cbb315, immutable source/publisher 9c241c573f479a13982fa390c21b226ed19759d1. Nothing was published by this qualification.

Together with the original conformance/capacity/request-budget callers, successful single failed-job retry, all39 normal successful checks/two declared skips and Security's exact-head source/trust PASS, this satisfies the four scoped caller gates. I own the normal merge, main verification and completed-head cleanup. Other PHP/minor/module profiles remain open under shared297. Security's nonblocking stale adjacent installer comment will be removed on the next related source touch.

[rmcdaniel]

GitHub correctly refused the merge because the branch was behind current main after the separately approved scan correction #308. I normally merged that main into this branch, producing exact successor 3eaa5d88e2fccb2b8772a2edc4abce45a26b10ce. No rebase, force push, administrative merge or protection bypass was used.

Both parents are the previously reviewed d0d85dc1c9e83b0521725820cd059822d7a38802 and main 321b588cb39c66688173ed9fc8171b3503b98405. The resulting tree equals the independently computed merge tree 2db9d962150bd5925ef82888c2d807159ab65a28. Relative to the old approved head, only the already reviewed stable_image pointer changes. Relative to current main, the PR remains the same four workflow deltas. Whitespace and secret-pattern checks pass.

The39 normal checks, Security verdict and8-job published qualification reported above belong to their actual d0d85dc head. Fresh normal checks, the same existing published-tuple qualification and independent exact-head Security counter-review now gate this successor. Waterline owns those gates and the ordinary merge/main/head-cleanup follow-through. The four caller commands/support matrices and helper inputs are unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security parent-refresh countercheck — PASS on exact head 3eaa5d88e2fccb2b8772a2edc4abce45a26b10ce (tree 2db9d962150bd5925ef82888c2d807159ab65a28), subject to the refreshed required checks finishing green.

This is an ordinary merge of reviewed #307 head d0d85dc1c9e83b0521725820cd059822d7a38802 with accepted main 321b588cb39c66688173ed9fc8171b3503b98405. The only incoming delta is the separately reviewed/merged #308 immutable 2.18 scan pointer. All four reviewed workflow blobs are byte-identical to the source/trust PASS head; git diff --check passes.

The old exact head's eight-job published embedded/provenance/browser gate passed and remains attributed evidence. Because strict target qualification correctly required this refresh, the new exact head's normal and published-tuple checks must finish green before merge; this countercheck does not waive or reuse them as a substitute.

[rmcdaniel]

Final Security gate disposition — PASS at exact 3eaa5d88e2fccb2b8772a2edc4abce45a26b10ce (tree 2db9d962).

The source/tree verdict in the prior counter-review remains unchanged. Fresh exact-head qualification is now terminal: 39 successes, 2 intended skips/neutral results, zero failures, and zero pending jobs, including the complete responsive run-detail/browser matrix and the published tuple caller. No retry, protection bypass, or installed-profile inference is needed. Normal exact-head merge is eligible; any later source/base change requires a new countercheck.

[rmcdaniel]

Merged the exact refreshed Security-approved head 3eaa5d88e2fccb2b8772a2edc4abce45a26b10ce through GitHub as 043c400f077be166f4956433a161c807edfa6188, after all39 normal checks passed with two declared skips and fresh8-job published qualification43414823296 passed on that same head. The final Security disposition agrees with the earlier parent/tree review and completed gates.

The merge tree equals the approved tree and includes that exact head as a parent. Relative to its first parent it changes only the four reviewed workflow files. The completed remote branch is absent404 and the clean local branch is deleted. Main's original workflows are passing so far; main build43417740084 is still completing the full responsive/locale/contrast journey. Waterline owns final main verification. No package/image publication or deployment occurred.

Shared297 retains the other profiles. The separate PHP8.2 source adaptation is visible in draft #309; it does not change these four accepted stock8.3 callers.

[rmcdaniel]

Final main verification is complete at 043c400f077be166f4956433a161c807edfa6188. All6 original main workflows succeed, including build43417740084, both migrated functional caller paths, full database/Laravel matrices, complete responsive/locale/contrast journey, target-branch gate, policy, Sonar, public boundary, capacity and service smoke. Merge/tree/parent identity and completed remote/local head cleanup are already verified above.

This completes the four scoped stock PHP8.3 caller migration. The original403 and its single successful failed-job retry remain attributed to their actual attempts. Other supported PHP/profile cells remain open under shared297; #309/.github#385 now drive the next narrowly scoped8.2 build caller. No package/image publication or deployment was part of this PR.