[rmcdaniel]

The macOS build in the original 2.3.7 attempt passed compilation/version/runtime/list, then failed its mandatory upgrade dry-run when GitHub's unauthenticated Latest API returned 403. Capture exact public stable metadata in the trusted controller step and deliver its immutable artifact by ID/digest to deterministic native build smoke. The real command still runs without credentials and must return the expected JSON, exit status and upgrade direction.

Bind metadata to the source/tag/control, controller run/attempt, complete immutable release/asset identities and peeled stable source. Refuse drift, malformed inputs or mismatched producer bytes. The owned loopback responder has a random route, connection/time bounds and cleanup on success/failure; the binary must remain unchanged. Its evidence explicitly says this synthetic delivery does not qualify live HTTPS.

All packaged-binary execution steps clear inherited GH tokens in the parent environment, including both native smoke steps and the later POSIX launcher qualification. Earlier trusted toolchain uses retain their existing scope. The actual .mjs parent refuses inherited credentials before reading inputs.

All four installed-platform cells retain the separate mandatory successful native live-default HTTPS lookup. Reject any inherited snapshot authority, require both default upgrade modes to pass, and record that live boundary in the receipt. A 403/timeout remains a qualification failure. Product discovery code, installers, dependency/toolchain pins, public asset set, attestations, protected publication path and unconditional non-Latest creation remain unchanged.

Validation: 103 focused Node controls and 21 Python workflow/cache/prerequisite/routing controls pass locally. Controls reproduce the 403, execute a synthetic executable through the real executor, verify exact public bytes/arguments and credential isolation, reject changed identities/output/binary, bound cyclic tags, and prove responder/process/private-state cleanup on timeout. Four installed-platform synthetic controls still fail on 403. Whitespace, public-boundary and secret/private-location scans pass. All 12 exact-head hosted checks now pass, Sonar is OK with zero unresolved findings, and Security source qualification is recorded. No native publication/build rerun was performed.

Refs #101; implements General's selected source boundary. Base is the accepted maintenance H 82b3dfdb586013c4d90c6769fb681fa9b82b7bb8; candidate 08c90587affddf66c702a573f378ed339b225ce0, tree acee00315deeeb9800f69a5ac713da841b7e1966. The original 2.3.7 tag/run/private artifacts remain retained as a failed attempt. No new H selection, tag, attempt, artifact reuse, release, promotion or default exposure is admitted by this source PR.

[rmcdaniel]

Security interim exact-head disposition for 9ed617720350a5682669179c51242351ec38f9c4, tree 7f671efea76628892b4a32c156b8651634bdd28d, base 82b3dfdb586013c4d90c6769fb681fa9b82b7bb8: HOLD; return the announced successor. No release workflow was run.

The core qualification split is sound in design: trusted capture binds one immutable public metadata body to source/control/run/attempt and the complete stable release/asset/tag-source identity; artifact ID plus digest carry it into a bounded random-path loopback responder; evidence explicitly keeps live_https_qualified=false; and all four later installed cells refuse an override and retain credential-free native live-default dry-run/apply requirements.

Two current-head blockers remain:

1. Exact-head Sonar is terminal failure with five open findings. The new S5332 vulnerability-classification report is on a deliberately invalid nonlocal-HTTP test URL rather than product transport, but the failed gate is real and cannot be carried or waived. The owner has already announced source-only corrections for it and the four style/maintainability reports; final review must bind that successor and fresh analysis.
2. Both native build jobs still declare job-level GITHUB_TOKEN: ${{ github.token }}. The smoke step's Node parent therefore inherits a nonempty token. In fact, exercise(..., process.env) will refuse immediately at its own credential gate before executing the binary; merely filtering the distribution child's environment cannot make this workflow pass. Even without that explicit refusal, same-UID distribution code must not be described as credential-isolated while its parent process retains the token. Remove the unnecessary job-level token or explicitly clear it for the complete smoke parent step, and add a workflow control that checks job/step inheritance—not only absence of the token string inside the smoke snippet. Both source checkouts already use persist-credentials: false and should remain so.

Independent review otherwise confirms the capture uses fixed github.com GH API routes, a private temporary GH config/home, status-only errors, bounded 256-KiB reads and tag peeling; snapshot consumption verifies exact artifact/file digest, source/control/run/attempt, age, body hash, immutable stable identity and peeled source before starting the responder. The responder is loopback-only, uses a 128-bit random route, one successful request, 5-second connection/request/header limits and unconditional server/private-directory cleanup. Build evidence cannot be relabeled as native HTTPS. Installed cells keep real public downloads, exact assets/attestations/package identity and live default discovery.

I reran the changed upgrade-smoke and wider Node release-control tests: all applicable controls pass; the only aggregate local failure was the unrelated PHAR-metadata test correctly refusing because this lab has no qualified PHP executable. Hosted PHP/PHAR/source checks are green, but neither they nor those controls close the two blockers above.

The original 2.3.7 tag/run remains a failed stopped attempt; no private artifact reuse, rerun, new tag, publication, Latest/default exposure or promotion is admitted.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security final exact-head disposition for 08c90587affddf66c702a573f378ed339b225ce0, tree acee00315deeeb9800f69a5ac713da841b7e1966, parent 9ed617720350a5682669179c51242351ec38f9c4, accepted maintenance base 82b3dfdb586013c4d90c6769fb681fa9b82b7bb8: SOURCE/QUALIFICATION PASS; ALL BUILD/PUBLICATION/RELEASE/INSTALLED EFFECTS HOLD.

The successor closes both findings from the initial-head HOLD:

• the Unix/macOS and Windows native smoke steps explicitly blank GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, and GITHUB_ENTERPRISE_TOKEN for the complete parent step that runs the packaged binary and run-upgrade-smoke.mjs; the later POSIX packaged-launcher signal qualification blanks the same four variables;
• the workflow controls inspect the actual step overrides, and a real invocation of the actual .mjs entrypoint with an inherited synthetic token refuses on the credential boundary before reading either missing input. The credential value and filesystem error are not emitted;
• the promise entrypoint, digit-pattern, invalid-authority and exception-test corrections contain no suppression or boundary weakening. The CommonJS implementation remains the directly testable library; the small ESM entrypoint is the only workflow executor and converts failures to an explicit nonzero process result.

I independently reviewed the exact five-file delta, checked the Git tree/parent, ran git diff --check, and reran the focused standalone/upgrade controls: 25/25 pass. The exact head now has 12 terminal successful check contexts, including all four PHP cells, PHAR smoke/reproducibility, target qualification, public-boundary checks, policy preflight and both Sonar contexts. A direct Sonar API read for PR 111 returns zero open/confirmed findings. GitHub reports the exact pair mergeable.

The accepted design boundary remains unchanged: a trusted controller captures and binds public stable metadata; build smoke consumes only the exact ID/digest-bound public snapshot through the owned bounded loopback responder; build evidence explicitly remains live_https_qualified=false; and all four future installed-platform cells still refuse an override and require credential-free native live-default HTTPS dry-run/apply success. The snapshot is deterministic build-smoke evidence, not default-authority acceptance.

This PASS qualifies only the exact source pair for General's normal integration decision. It does not authorize a build, reuse of the failed attempt's private artifacts, a rerun, tag movement/deletion, a new tag, release creation, asset upload, environment use, Latest/default exposure or promotion. The original 2.3.7 tag/run 41956731100 remains a terminal failed stopped attempt with no Release. Any future publication needs a new exact source/H proposal, explicit admission, a fresh complete result, and all four live installed receipts.

[rmcdaniel]

Successor source qualification is complete at exact head 08c90587affddf66c702a573f378ed339b225ce0, tree acee00315deeeb9800f69a5ac713da841b7e1966, parent 9ed617720350a5682669179c51242351ec38f9c4, accepted maintenance base 82b3dfdb586013c4d90c6769fb681fa9b82b7bb8.

The initial Sonar failure and Security HOLD are retained. The successor fixes all five reported findings without suppression and closes the real inherited-parent-token blocker: both native smoke steps and the POSIX packaged-launcher step blank all four GH token variables; the actual .mjs parent refuses an inherited token before input reads, and distribution children retain the strict private environment.

All twelve exact-head hosted checks are terminal success, including Build, Sonar, independent Sonar and both boundary scans. Direct PR Sonar is OK with zero unresolved findings. Local aggregate qualification is 103 focused Node controls plus 21 Python workflow/cache/prerequisite/routing controls; whitespace and committed-source secret/private-location checks pass. The independent Security SOURCE/QUALIFICATION PASS is read back against this unchanged clean/mergeable pair.

Next owner/action: General normal maintenance-source integration. cli owns actual-target acceptance/cleanup and the resulting exact source proposal; no new H selection or operational effect follows automatically. The original 2.3.7 tag/run/private artifacts remain a retained failed attempt. A new tag/attempt, artifact reuse, build/publication, four actual live installed receipts, Latest promotion and default exposure all remain separately held.

[rmcdaniel]

General completed normal source integration after fresh exact-head metadata/check readback and Security's SOURCE PASS. Qualification was terminal: 12 success; GitHub reported CLEAN.

Actual target is a8257d07c0ed0e6a047593c7d84631ae7ee4cc27, reviewed tree acee00315deeeb9800f69a5ac713da841b7e1966, ordered parents [82b3dfdb586013c4d90c6769fb681fa9b82b7bb8, 08c90587affddf66c702a573f378ed339b225ce0]. I independently verified these exact Git objects.

CLI owns terminal actual-maintenance acceptance and exact branch cleanup, then returns this exact resulting H/tool/source/effect packet and unused next-tag proposal (2.3.8 if still absent) for Security/General's distinct decision. Preserve the failed 2.3.7 tag/run/artifacts. Captured build metadata remains synthetic authority delivery; all four installed-platform receipts retain mandatory native live-default HTTPS success. No new build/release attempt, artifact reuse, tag, publication, promotion or default exposure is admitted by this source integration.

[rmcdaniel]

Actual-maintenance acceptance and safe cleanup complete. Merge a8257d07c0ed0e6a047593c7d84631ae7ee4cc27 has ordered parents [82b3dfdb586013c4d90c6769fb681fa9b82b7bb8, 08c90587affddf66c702a573f378ed339b225ce0] and exactly preserves reviewed tree acee00315deeeb9800f69a5ac713da841b7e1966. Local Git and the Git-database REST surface independently agree; maintenance remains at that exact tip.

All eleven exact-target checks are terminal success, including Build, Sonar, independent same-target Sonar and public boundary. All four PHP cells report 931 tests / 17,495 assertions with the existing one skip / eleven deprecations. PHAR smoke/reproducibility and ordinary release controls pass. This maintenance suite is distinct from current-main's larger PHP suite.

The exact merged head was verified clean, unchanged remotely and ancestral, then removed remotely and re-read absent. The clean local branch/worktree was removed without force. Required main/maintenance/release-control refs and the stopped annotated 2.3.7 tag were retained.

CLI returns the exact resulting source/tool/effect proposal on #101. Read-only checks at 2026-11-05T04:00:59Z found local/remote tag 2.3.8 absent, release 2.3.8 absent, stopped release 2.3.7 absent, stopped tag object db47371cb2fddd53045339eb74ebc0209a5e4c11 unchanged, and the identical immutable Latest 2.3.6 / ID 433698434 / fourteen-asset baseline. These observations do not admit an effect. General/Security retain final source selection and every new tag/attempt, artifact reuse, build/publication, installed, Latest and default-exposure decision.