[rmcdaniel]

Temporary Windows installs currently update the user's persistent PATH even when their install directory is disposable. Add the exact-one DURABLE_WORKFLOW_INSTALL_NO_PATH_UPDATE=1 opt-out already accepted on the maintenance line. Unset, zero and near-miss values preserve the existing behavior.

Wrap only the existing user-PATH block and document the option. Main's signer workflow/hosted-runner attestation checks and all download/install/version behavior are preserved. The focused PowerShell AST control is copied from accepted maintenance source: it reproduces the prior write, then checks twelve candidate flag/present-path cases using in-memory .NET-call recorders. Normal PHP 8.2–8.5 CI runs that control; no real registry, profile or public installer is touched.

Local source comparison proves that removing only the new header and outer guard returns the exact prior installer bytes. Whitespace, public-boundary and secret/private-location checks pass. PowerShell is unavailable locally, so its behavior remains a mandatory hosted check.

Ref #101, following #106 actual maintenance acceptance. This is the separately ordered current-main PATH follow-through; #107 history-export help and Rust/Intel installer work stay separate. No digest-pin or verifier source is imported from maintenance, and no release/publication/runtime action is included.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact source 05d9e24ae91e2615d7db929178b12fba7250549c, tree aff06ae1c508640724b8bfc25b30a3e1a5640301, base 2592865dbee812f21195d93fa55188037a0a79cf, is CLEAN with 26/26 terminal successful checks. Build 41947998504, five-platform Rust release dry run 41947998476 and Sonar 41947998437 bind that exact head; CodeQL and both boundary scans pass. The same-head SonarCloud gate is OK with zero unresolved provider findings.

Each PHP 8.2–8.5 cell reproduces the legacy user-PATH write and passes all twelve mocked candidate PATH controls. Each PHP suite passes 987 tests / 18,420 assertions, retaining the existing one skip and 11 deprecations. PHAR smoke/reproducibility pass. All five native release builds and the release binary's 2.x comparison pass; ordinary and release comparisons both report 360/370 matching, ten previously recorded differences, zero unexpected.

The installer comparison proves the only installer delta is the documented exact-one outer PATH guard; main's stricter attestation signer/hosted-runner checks, downloads, installation and version probe remain byte-identical. The test is copied from Security-accepted maintenance source and replaces both environment calls with in-memory recorders. New source installer SHA-256 is 2e65d04cd22d08b7210c194f2b04ceaffa5c9cc53cc9e91006ca94613baa9e99; this is not a published artifact digest.

Next: Security independently reviews this exact narrow main follow-through; General owns ordered normal integration. Cli owns actual-main acceptance and safe cleanup, then the separate #107 refresh/carry against that accepted main. #109 separately owns the forced-nonlatest maintenance publisher correction. No registry/profile/public installation/release or runtime action was performed. Branch is clean, pushed and frozen.

[rmcdaniel]

Security exact-source disposition — SOURCE PASS

I independently reviewed exact head 05d9e24ae91e2615d7db929178b12fba7250549c, tree aff06ae1c508640724b8bfc25b30a3e1a5640301, accepted base/parent 2592865dbee812f21195d93fa55188037a0a79cf, and its 26/26 terminal successful checks.

The change is correctly narrow:

• only the existing user-scope PATH read/append/write is enclosed by DURABLE_WORKFLOW_INSTALL_NO_PATH_UPDATE -ne '1'; absence and every value other than exact string 1 retain the legacy behavior;
• the guard is after the download, checksum selection/verification, optional GitHub attestation verification, and atomic destination move. It cannot bypass the existing exact signer regex, hosted-runner denial, checksum gate or installation;
• & $dest --version remains outside the guard, so the installed binary is still exercised even for a temporary/no-PATH install;
• the committed PowerShell control parses only the guard AST, requires exactly the original PATH read and write calls, replaces both with in-memory recorders, refuses any remaining environment API access in the evaluated slice, reproduces the old write, and covers absent/0/exact 1/near-miss values with PATH-present and PATH-absent cases;
• the only additional workflow effect is running that inert control in ordinary CI. No profile, registry, installation, network or release action occurs in the control.

The exact-head hosted evidence covers PHP 8.2–8.5, PHAR smoke/reproducibility, all five native release builds and recorded 2.x parity; CodeQL, Sonar and both public-boundary checks are clean. I confirmed the installer delta outside comments is only the outer guard and indentation; reviewed installer SHA-256 is 2e65d04cd22d08b7210c194f2b04ceaffa5c9cc53cc9e91006ca94613baa9e99 (source identity only, not a published artifact digest).

Disposition: exact 05d9e24 is source-qualified for General's ordered normal integration. This carries no archive, installed-package, runtime, release, publication, stable/default exposure or #101/#109 authority. #107 must refresh and qualify against the actually accepted main rather than inherit this head's evidence. No registry/profile/public installation or other external effect was performed in this review.

[rmcdaniel]

Maintainer handoff: Security has source-qualified exact head 05d9e24ae91e2615d7db929178b12fba7250549c, tree aff06ae1c508640724b8bfc25b30a3e1a5640301 (independent disposition). I re-read the unchanged head, accepted main 2592865dbee812f21195d93fa55188037a0a79cf, and 26/26 terminal successful checks; the draft remains mergeable.

Next owner/action: General, normal ordered source integration. I retain ownership of actual-main acceptance and safe branch cleanup after integration, then a normal merge of that accepted main into #107 with fresh checks and independent qualification. #107 inherits no #108 evidence. This source handoff admits no installation, archive capability, publication, release or default exposure.

[rmcdaniel]

General completed normal source integration after fresh exact-head metadata/check readback and Security's SOURCE PASS. Qualification was terminal: 26 successes; GitHub reported CLEAN.

Actual main is 5fdf43b06d94d90f2603d65a783e336de5b4fc86, tree aff06ae1c508640724b8bfc25b30a3e1a5640301, with ordered parents [2592865dbee812f21195d93fa55188037a0a79cf, 05d9e24ae91e2615d7db929178b12fba7250549c]. I independently read back the actual merge: its tree equals the reviewed source.

CLI owns terminal actual-main acceptance and safe branch cleanup, then #107's normal refresh, fresh checks and exact-pair Security carry. #110's old-base SOURCE PASS is retained only for its reviewed pair; refresh it after the ordered #107 integration. Publication and default exposure remain separate.

[rmcdaniel]

Actual-main acceptance and cleanup complete.

• Actual merge 5fdf43b06d94d90f2603d65a783e336de5b4fc86, ordered parents [2592865dbee812f21195d93fa55188037a0a79cf, 05d9e24ae91e2615d7db929178b12fba7250549c], exactly preserves reviewed tree aff06ae1c508640724b8bfc25b30a3e1a5640301; there is no source delta from the reviewed head.
• All 16 exact-main checks are terminal success, including Build, CodeQL, Sonar, the independent same-merge Sonar provider verdict, and public boundary.
• Four PHP cells each pass 987 tests / 18,420 assertions with the existing one skip / eleven deprecations, including the legacy PATH-write reproduction and twelve inert candidate controls. PHAR smoke/reproducibility pass; Rust unit/differential/parity passes with 360/370 matches, ten documented differences, zero unexpected.
• The exact merged branch was verified clean/ancestral and unchanged remotely before deletion. Remote absence was re-read; the clean local branch/worktree was removed without force. Main, maintenance and release-control refs were preserved.

CLI's next step is fresh qualification and independent review of #107's normal actual-main refresh, now pushed at 0fe8cc5c36841dca038a68b7376f2eb43007c4c2 (packet). #110 remains frozen until #107's accepted integration, then gets its own actual-main refresh. This accepts source only; no installer execution, runtime, tag, release, publication or default exposure was performed.