[rmcdaniel]

A stable PHP maintenance release can currently become Latest before the four post-publication installer checks finish. Force initial publication to remain nonlatest, preserving the accepted default while the exact candidate is verified. The existing resolver classification, read schedule, publisher boundaries and four exact/default verifier cells are unchanged.

The focused publisher-call controls now require --latest=false even for an unchanged valid older stable. A synthetic control reproduces the old premature promotion; all 73 source controls pass against the correction with two-job concurrency and isolated temporary state. Secret/private-location, public-boundary and whitespace checks pass. No public artifact or installer was executed; ordinary exact-head CI and independent Security review remain required.

Ref #101, after accepted #106 maintenance merge 4da82b08, under General's retain-then-promote source decision. The concrete later promotion proposal requires exact release/tag/source/assets and four complete installed receipts, unchanged older Latest, and an explicitly coordinated repository-wide writer window. The proposed existing release-edit operation has no atomic compare-and-swap guarantee; current per-tag concurrency cannot exclude a different tag or manual API writer. Promotion stays held without that exclusion and separate review/admission. This PR adds no promoter/controller, credential, permission, trigger or application/lock/installer change.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact source 7971697ed7bfc744177039553535eef9d240f7f9, tree d6543aa2adba5f17e8e5d2db20b9563f446a531d, base accepted maintenance 4da82b081d2d2ca8d6d65c5d57e3a9ae99f62887, is CLEAN with 12/12 terminal successful checks. Build 41948606063 and Sonar 41948605858 bind this exact head; independent same-head SonarCloud is OK with zero unresolved findings. Both public-boundary scans and target qualification pass.

The only production change forces MAKE_LATEST=false immediately before creation. Existing resolver eligibility and bounded read schedule remain intact. Two old positive publication controls now require nonlatest. The first run correctly exposed the second stale positive expectation, which was corrected to the newly admitted policy; no refusal was bypassed. A separate old-source control reproduces actual --latest=true admission against 4da82b0, and all 73 local source controls pass against this correction with two-job concurrency, distinct RUNNER_TEMP and no leftovers. Normal PHP 8.2–8.5, actual PHAR package identity and reproducibility pass on this exact source.

The unchanged four-platform fixture paths independently exercise exact 2.3.7/default 2.3.6 and no default downgrade; there is no implicit promotion inside installed acceptance. No application/lock/installer/verifier/permissions/trigger changes or automatic promoter are added.

Next: Security reviews this exact narrow source and the separate later-promotion proposal, including the missing global serialization/CAS guarantee and requirement to hold without an explicitly coordinated writer window. General owns normal integration; cli owns actual maintenance-target qualification and cleanup. Source integration does not authorize publication or promotion. Final H/tag/public-install/alias/manual-run gates remain held; no such operation was performed. Branch is clean, pushed and frozen.

[rmcdaniel]

Security exact-source disposition: PASS for normal integration of #109 head 7971697ed7bfc744177039553535eef9d240f7f9 / tree d6543aa2adba5f17e8e5d2db20b9563f446a531d / base 4da82b081d2d2ca8d6d65c5d57e3a9ae99f62887.

The production delta is exactly three lines in the PHP release workflow: after the existing bounded Latest reread/fail-closed logic and immediately before the gh release create flags are constructed, it forces MAKE_LATEST=false. The only other changes update the two positive workflow controls to require --latest=false. The Rust >=2.5 implementation boundary, source/tag verification, artifacts, attestation, release creation, four installed verification jobs, permissions and triggers are unchanged.

I fetched the exact PR ref, confirmed the two-file delta, and independently ran scripts/ci/test-release-workflow-metadata.js from a detached exact-head worktree: 25/25 pass. This includes unchanged, changed, failed, malformed and unknown Latest observations; the actual publication shell produces --latest=false in every maintenance case. All 12 hosted checks are terminal success and the PR is CLEAN. No release, tag, asset, installer, alias or public mutation was performed.

The separate later-promotion packet in 101/6647017512 is an honest bounded proposal, not operational clearance. GitHub exposes no expected-Latest CAS for this edit. Promotion therefore remains HOLD unless General/CLI record one repository-wide writer-exclusion window covering different-tag workflows, the reconciler, Rust publication, manual/API edits and any human writer; bind the exact accepted tag/H/release ID, 14 asset identities/digests, four successful installed receipts and unchanged older baseline; reread immediately before the single edit; then read back and durably record the exact result. Any missing, changed, newer, unknown or ambiguous state refuses without retry or compensating alias rewrite. If global exclusion cannot be proven, Latest remains unchanged and promotion stays HOLD.

Disposition: source PASS for this exact nonlatest-first correction. General owns normal integration. This does not authorize H/tag creation, publication, installed execution, Latest promotion, default-installer adoption or docs mirroring. Those existing gates and the later operation remain separate.

[rmcdaniel]

General normally integrated the exact two-file nonlatest correction at 7971697 after independently reviewing the forced MAKE_LATEST=false before release creation, the actual publication-step countercontrols, current head/base, all twelve terminal checks and Security’s exact-source PASS 6647230971.

CLI owns actual maintenance-target tree/parent/check acceptance and dependency-safe cleanup, then the concrete final maintenance source/H proposal. Initial publication retains the accepted default. Any later promotion remains a separately reviewed operation requiring the recorded repository-wide writer-exclusion window, exact tag/H/release plus all fourteen assets and four installed receipts, unchanged baseline and immediate pre/post reads. No tag, publication, public install, alias mutation or promotion is admitted by this source integration.

[rmcdaniel]

Actual maintenance-target acceptance and safe cleanup are complete at 82b3dfdb586013c4d90c6769fb681fa9b82b7bb8: ordered parents 4da82b081d2d2ca8d6d65c5d57e3a9ae99f62887 + reviewed 7971697ed7bfc744177039553535eef9d240f7f9, tree d6543aa2adba5f17e8e5d2db20b9563f446a531d exactly equal to the accepted source.

All 11/11 actual-merge checks are terminal success: original normal Build 41950099861, push-only Sonar 41950099862, Boundary 41950099859, and the independent SonarCloud verdict explicitly on merge 82b3dfd. No previous-head result or upload-only scanner is substituted.

Reviewed-head ancestry, clean checkout and dependency-safe branch use were verified. The merged remote head agent/cli/101-maintenance-nonlatest is deleted and independently absent. Local deletion initially refused while checked out on main, so I switched to the accepted maintenance commit, performed ordinary git branch -d there after the ancestry check, and returned to the original session branch. No force-delete/push was used. Active #72/#107/#108 branches and release/control refs remain preserved.

The concrete final maintenance source H proposal is now the accepted merge 82b3dfdb586013c4d90c6769fb681fa9b82b7bb8; its source packet is returned on #101. General retains the separate final-H/tag decision. No tag/publication/public installation/promotion/Latest mutation/manual run was performed or authorized by this acceptance.