[rmcdaniel]

The PHP8.2 Workbench build caller now uses the isolated, pinned runtime admitted by central#388. Only php.yml:build switches; its validate/install/audit/Workbench-build commands, live Composer guards and cache boundaries are preserved. All other supported PHP minors, database-driver cells and visual jobs retain their current profiles.

The repository and host wrapper state mount read-only. Writable paths are limited to dependencies, the generated lockfile and private temporary/Composer data. Setup rejects symlink dependency/lock roots; actual-container controls prove dependency code cannot overwrite or replace the host launcher, wrappers or source controls before a subsequent genuine PHP invocation. Pinned official PHP/Composer inputs, fixed APT prerequisite, two compiler jobs, module/function/production-INI/no-coverage probes and the real ambient-positive/selected-clean Composer TLS control remain required. Host credentials stay outside the launcher environment.

Current exact workflow head: 5a8c371137015037bb7965f0f7510265f0ab1b42. It changes only the build caller from source-reviewed9b0c5a6, matches the accepted central fixture, retains needs: action-policy, and leaves all twelve admitted runtime files byte-identical. Central main884e05b4 equals the reviewed tree, all three actual-main workflows succeeded, and the completed central topic is absent. CLI/Sample withdrawn records remain absent.

Validation:

• The actual replacement regression fails the old writable launcher and passes twelve overwrite/rename refusals plus genuine follow-up PHP on the correction. Real TLS and all four original guarded build commands pass locally; the generated dependency lock is unchanged from the prior functional tuple.
• Four offline boundary controls, Bash syntax, whitespace, source-hash checks and credential/private-path scans pass. A fresh public checkout validates canonical Git modes and all26 proposed Composer sinks; all-guard deletion refuses. All190 related central policy tests pass.
• Independent source Security review covers9b0c5a6; that source has39 successful hosted checks and two intended skips. Those runs remain attributed to9b. Fresh exact-head workflow review, actual admitted hosted caller execution, all aggregate checks and normal main verification are now the completion gates.

The canceled8ca7fe4 caller attempt remains NONPASS. Its private-checkout-mode catalog mistake and the shared writable-control flaw are corrected in the admitted source/record; no old hash is selected. This PR stays draft while its final gates run. Ref shared#297 caller inventory. No publication or deployment is involved.

[rmcdaniel]

Local candidate-launcher qualification passes on exact 1fa961b69a10d05015f362579f35ed822602cffa. I fetched that public commit into a fresh credential-free clone, rehashed the public selected-clean CA 50f79f98dac192b20dbf73f35c56f0b0c557ab267ff5199d1117cc1180b70785, used private state and invoked this head's PHP/Composer launcher on the already-qualified common8.2 config sha256:5e6f71b4bc79c9a98a2c1f45dc2d003522a0fb440719a96546eac33f5a3487a1 (linux/amd64). No base image was rebuilt.

All9 stages pass: the actual ambient-positive/selected-clean-negative Composer TLS control, live verifier before each of validate/install/audit/Workbench-build, and all4 original caller commands. The synthetic repository observes ambient HTTPS requests and observes none after selected-clean trust refuses with curl60. The new launcher preserves read-only selected CA paths and the verifier sees the real image PHAR. The same fixed guard source242c was used at each request boundary.

Each container was capped2CPUs/2GiB/512PIDs with init, caller UID and automatic removal. All proof containers are absent. State/logs are private and disk-backed; no GitHub/Composer credentials, production credentials, vault access or publication was involved. The three separate fake-Docker controls and Bash/diff checks also pass at this head.

Next: independent exact-head source review; the central runtime record scoped only to Waterline php.yml:build, binding this source's files/modes/command/environment; General's shared integration; then the one caller switch and actual hosted qualification. Other supported minors and driver/visual profiles remain outside this proof.

[rmcdaniel]

Current exact source is e7e6f8a9fb952da531fc2ceaafde74795fca19b8. A marker-only regression reproduced workspace json.py/PYTHONPATH execution in the initial host selector. Selector Python now runs with -I -S, and the TLS test runs directly under isolated/no-site Python. The new regression fails the predecessor and all4 boundary controls pass this head. I sent the same concrete finding to the SDK/CLI common-source owners. The six common Docker/image inputs are unchanged.

I fetched the exact successor into the private public-source clone and repeated the9-stage launcher proof. The real isolated TLS control, all4 live verifier checks and all4 original validate/install/audit/Workbench-build commands pass on the same immutable shared8.2 image. Generated dependency state was freshly resolved; no source manifest changed or base image was rebuilt. Proof containers are absent.

The matching central record is now draft .github#385, exact efe109279c8ab6a02dfc54ad6ac9431f07ee75c0. It binds11 files/modes, only Waterline php.yml:build, only the literal8.2 command and the3 runtime environment fields. All75 existing central Composer contract tests pass; the actual candidate admits4 guarded requests and8 scope/source/trust mutations refuse. Other catalog entries and policy implementation are unchanged.

Next owners/actions: Security reviews this exact source and central record; General integrates the central record after its gates; Waterline updates the policy reference and switches only the8.2 build caller, obtains hosted acceptance and normal merge/main verification. This source PR remains draft and all existing callers retain their current behavior.

[rmcdaniel]

Security PASS — source/trust boundary at exact Waterline #309 head e7e6f8a9fb952da531fc2ceaafde74795fca19b8 (tree 6fa38b69fff84b9b1dd91ad64670b5695f6396bb).

The 15-file source addition is closed to the proposed PHP 8.2 build runtime and does not switch a caller. The Dockerfile, Composer verifier, and four Brotli inputs are byte-identical to independently reviewed SDK PHP source 4d37a42d1c95020fa2c75dcd0cc7585dd788f71c; the Dockerfile-specific ignore file closes the build context to the declared inputs. The Waterline-specific image selector is a single digest-pinned PHP 8.2 image, the launcher accepts only an inspected config ID, applies CPU/memory/PID/capability bounds, does not forward host credentials, mounts selected trust inputs read-only, and maps only the reviewed build/test environment. The setup validates the fixed-APT source before Docker and both host-Python entry points are isolated (-I -S; TLS also -B and direct-file execution). The diff is whitespace-clean.

Independent evidence at this exact head:

• all four launcher/setup controls pass, including mutable-image refusal, credential exclusion, selected-CA/real-PHAR mapping, and workspace/PYTHONPATH shadow refusal before Docker;
• every one of the 11 files in proposed central record #385 matches this head's SHA-256 and expected private mode exactly;
• the exact proposed workflow set validates against the #385 policy/catalog, while no setup command has yet been activated;
• the shared central Composer/runtime suites pass 99 tests and the central qualification-policy suite passes 72 tests;
• the owner's actual isolated TLS plus four original guarded build commands pass on the unchanged immutable PHP 8.2 image.

This closes Security's source review only. Activation/merge still requires central #385 to be refreshed onto current accepted main without changing this record, exact-head counter-review, its required checks, the final hosted caller, and every remaining Waterline check. No PHP 8.1/8.3 profile or other workflow/job is inferred.

[rmcdaniel]

Security HOLD on exact workflow-only activation head 8ca7fe4.

The job/fixture equality and accepted central record are not sufficient because the frozen e7e6f8a9... launcher has the newly identified shared writable-root/wrapper boundary flaw: package/application code runs as the same UID with both repository root and host wrapper state mounted read-write, and can replace the host wrapper or launcher before a later nominal verifier call. The accepted record therefore binds an unsafe source hash and must not be used for activation.

Shared finding and correction requirements: durable-workflow/.github#297 (comment)

Please correct the launcher, add predecessor-failing actual-container replacement controls, update the central record to the corrected exact hashes, then provide the refreshed workflow head and hosted caller evidence. No existing run or artifact compromise is inferred.

[rmcdaniel]

HOLD on caller activation at 8ca7fe4021e99f612d17ae65d67f11613a815bbc. Security identified the shared writable launcher boundary in #297: package code can replace host wrappers or their repository launcher target through the read-write source/state mounts. No compromise is asserted; the previous source/catalog hashes must not activate this caller.

I canceled the active build attempt 43433451101. It is retained as nonpassing, not actual caller acceptance. Its policy-preflight failure is preserved for diagnosis separately. This PR remains draft.

Waterline owns the correction: read-only repository/control/wrapper paths, only explicitly scoped writable build data/cache/output mounts, an actual-container predecessor-failing replacement regression, the unchanged functional caller, corrected frozen source/catalog review, and fresh hosted/main qualification. General and Security have been notified. The seven remaining job profiles retain their support obligations; none inherits this held source's acceptance.

[rmcdaniel]

The caller switch is withdrawn pending corrected source admission. Source checkpoint f80290052db2711ed17e36ce23c6488291b635f0 corrects the shared writable-control finding: repository and wrapper state mount read-only; only vendor, the generated composer.lock file and private state/data are writable. Setup rejects symlink vendor/lock roots and initializes an absent lock to {}, which Composer treats as its existing no-lock resolution path. The build's generated skeleton/output stays within dependencies. The follow-up workflow change also requires successful central preflight before the build job can execute.

Actual-container regression on the existing immutable PHP8.2 configuration sha256:5e6f71b4bc79c9a98a2c1f45dc2d003522a0fb440719a96546eac33f5a3487a1:

• Predecessor 8ca7fe4 allows all12 overwrite/rename attempts against disposable launcher, wrapper and source targets. The regression fails before invoking a substituted host command.
• Corrected source refuses all12 attempts and the next genuine PHP invocation succeeds. Writable dependency, generated-lock and private-data controls succeed. Containers use the actual launcher and caller UID, capped2CPUs/2GiB/512PIDs; its existing host network is exercised without network requests in this replacement control.
• The real ambient-positive/selected-clean Composer TLS control passes, followed by all four original validate/install/audit/Workbench-build commands with the live guard before each request boundary. Public CA SHA50f79f98 and verifier source242c are unchanged. All10 proof stages pass. No base image rebuild and no inherited hosted acceptance are claimed; owned containers are absent afterward.
• Four offline launcher controls, Bash syntax, whitespace and changed-source credential/private-path checks pass.

The canceled final-caller run43433451101 remains NONPASS. Its independent preflight refusal was a catalog-mode mistake: my record bound private local0600/0700 instead of canonical Git0644/0755. The corrected record uses Git modes, includes the new actual-isolation control, and validates all12 hashes/modes plus the full26-sink proposed inventory from a fresh public clone. Its permission regression fails the old record and passes the correction. Policy enforcement itself is unchanged.

Waterline owns corrected catalog/source review, then the one-caller switch, actual hosted and normal main qualification. Until that completes, this PR stays draft and old385 hashes must not activate the caller. Other supported minors/drivers/visual profiles remain separate obligations.

[rmcdaniel]

Security exact-head source PASS for 9b0c5a610d0667027ae4daaff01f7007df726cad, bounded to the corrected PHP 8.2 container runtime and its staged workflow dependency.

Independent checks:

• the runtime/control files are byte-identical to the reviewed f8029005 checkpoint; the only subsequent delta is build.needs += action-policy;
• the checkout root and state root are bind-mounted read-only, while writable authority is limited to state/data, vendor, and the generated composer.lock; host wrappers, launcher/control source, action code, Git metadata, and selected CA inputs remain outside writable mounts;
• setup refuses symlinked vendor / composer.lock roots before Docker, and the read-only parents prevent container unlink/rename replacement of the nested writable mount points;
• I reran the real-container isolation control against immutable image sha256:5e6f71b4…: every overwrite/rename of the launcher, both wrappers, source controls, and a new wrapper was refused, required data/vendor/lock writes succeeded, the launcher hash and wrapper links survived, and the next host wrapper invoked genuine container PHP;
• all four launcher/unit controls pass locally; a fresh-clone-style empty generated composer.lock also passes the exact strict Composer validation command under the same image;
• diff hygiene is clean. Current normal checks seen so far have no failure, but unfinished required checks remain gates.

This is a source-boundary verdict, not caller activation. The current workflow intentionally does not switch the build caller. Central catalog #388, its normal merge, an exact admitted workflow, and a fresh hosted caller/TLS/guard/four-command result remain required before any activation or qualification claim.

[rmcdaniel]

Current source head 9b0c5a610d0667027ae4daaff01f7007df726cad has independent Security PASS for the corrected host/container boundary. Central#388 exact 26927b840fbc420532f74965963a3f26c8d0653e also has independent catalog PASS, all nine hosted checks green, and is ready for General's shared integration. General was asked directly; the other owners' held records/withdrawals must be preserved.

Waterline owns the next dependent action after accepted central main: switch only this build caller to the twelve admitted inputs, retain needs: action-policy, obtain exact workflow review and fresh hosted policy/isolation/TLS/live-guard/four-command acceptance, then normal merge/main verification and cleanup. This remains draft and source-only. Previous source/catalog acceptance and the canceled caller attempt do not satisfy those final gates. All41 current source checks are now terminal:39 successes and2 intended skips, including the complete responsive run-detail, database and support-cell qualification. This source-only workflow still uses its original caller; these results do not qualify the held container caller switch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final workflow counter-review: PASS for exact head 5a8c371137015037bb7965f0f7510265f0ab1b42.

The complete delta from the already source-reviewed 9b0c5a610d0667027ae4daaff01f7007df726cad is only .github/workflows/php.yml, and within it only jobs.build adopts the admitted runtime: Ubuntu 24.04, the credential-free fixed-APT prerequisite checkout at 18783be6bef737cc778e4c7282a8797e39daa61a, and the literal bound PHP 8.2 setup command. needs: action-policy remains in force. Every one of the 12 reviewed runtime inputs is byte-identical to the source-reviewed head; every other job and runtime file is unchanged.

I fetched accepted central main 884e05b4dca77c718bc02e77bde82861e54a2fba and independently confirmed its catalog and proposed-caller fixture hashes equal the reviewed #388 tree. Parsing both YAML documents gives exact structural equality for the complete 15-step build job. git diff --check passes. The current exact-head central action-policy preflight is also green.

No new finding. This does not substitute for the still-running actual hosted caller, aggregate/current checks, or merge/main readback. Keep the PR draft/no-merge gate until all required checks are terminal green; after an exact reviewed merge, require main workflow success and branch deletion/absence before treating this caller as activated. No other Waterline job or PHP profile is qualified by this verdict.

[rmcdaniel]

The actual admitted PHP8.2 build caller passed on exact workflow head 5a8c371137015037bb7965f0f7510265f0ab1b42: run43440489850, job131936976502.

The hosted job built and inspected immutable configuration sha256:5a1cfef0438da8fa87dccf3bc5caf82ebae0f2d1916724f361e4642184ecbbe8. Its actual probe records PHP8.2.35, all required modules/functions, production INI and coverage none. The actual-container overwrite/rename refusal and genuine next-PHP control passed; the real Composer ambient-positive/selected-clean-negative TLS control passed. The live guards and all original validate/install/audit/Workbench-build steps succeeded, including after cache restoration. The job reports no dependency security advisories.

Final exact-head workflow Security PASS and accepted central main884e05b4 remain bound to these twelve unchanged runtime inputs. This is new hosted caller evidence, not a carried local/old-head result.

Waterline retains draft until all aggregate database/support/browser checks pass. Then normal exact-head merge, actual-main verification and branch absence are still required. Other profiles and #222 remain separate work.

[rmcdaniel]

Merged exact Security-passed 5a8c371137015037bb7965f0f7510265f0ab1b42 normally as 68f24018dc87fe55710388d29e4ea4cbee78dada after39 successful checks and two intended skips, including the full responsive, database and framework matrices. Main tree 1dad3481e47899a4dd4f8c003d35b90005868bee equals the reviewed head tree. The completed remote topic is absent and its local branch is removed.

The actual admitted hosted caller passed in run43440489850/job131936976502, including runtime5a1cfef0, module/INI, replacement/follow-up and TLS controls plus all four guarded build commands. Central registration#388 is complete on accepted main884e05b4 with all three actual-main workflows passing.

Fresh Waterline main verification is running: build43443989396, Public Boundary43443988692, Push on main43443986613, Sonar43443988635, Service image smoke43443990093 and Service capacity release tuple43443988832. Waterline retains ownership of their completion/readback before calling this caller migration delivered. No other profile, product release or deployment is included.

[rmcdaniel]

Final main acceptance is complete for this single caller migration. Accepted main 68f24018dc87fe55710388d29e4ea4cbee78dada has all six original workflows successful; the complete build workflow includes database, supported-framework and full responsive acceptance. The actual main PHP8.2 caller passed in job131948978291 with inspected configuration sha256:5f416eacb88266d0fd93b730703f57f074c734bbca5c9204f374792374cc6f66, PHP8.2.35, the bound module/INI probe, actual replacement/follow-up and TLS controls, all live guards, and the unchanged four build commands. This is main execution evidence, separate from the PR/local runs.

The main tree equals the exact Security-reviewed head tree, and the completed remote/local topic branches are absent. Central#388 registration and its actual-main verification are complete. Other PHP minors, database-driver/ODBC and visual supersets retain their separate shared#297 obligations. No product release or deployment was selected.

Main workflow receipts: Public Boundary, Service capacity release tuple, Service image smoke, SonarQube, build, Push on main.