[rmcdaniel]

The original 2.3.8 release attempt failed in all four native smoke steps because the exact-control sparse checkouts excluded the newly introduced run-upgrade-smoke.mjs entrypoint and its imports (terminal evidence). Add that six-file closure to both Unix and Windows checkout lists.

The regression creates real Git sparse checkouts from each workflow file list, invokes the actual parent from an isolated working directory, checks inherited-credential refusal, then exercises a synthetic executable and verifies the passing non-live receipt and cleanup. Both checkout layouts reproduce MODULE_NOT_FOUND before the list correction and pass afterward. Local validation: 105 focused Node controls, 21 Python workflow controls, public-boundary scan, changed-source credential/private-location scan and whitespace checks pass.

This is a source-only correction for #101. Exact source selection, credential separation, native toolchain/dependency pins, forced non-Latest publication and the four mandatory installed live-default HTTPS checks remain unchanged. Failed 2.3.7/2.3.8 tags, runs and private artifacts are retained; this PR does not authorize another attempt, output reuse, publication or promotion.

[rmcdaniel]

Successor head 8870f181f2693f9c1a41240bb5b884f1cde62013, tree b9aa897bcc9412b25f2be0d8c5e4a4bdde42f02f, remains based on actual maintenance a8257d07c0ed0e6a047593c7d84631ae7ee4cc27.

The first source head passed all product checks but failed Sonar on seven new test-helper findings. This successor uses explicit regex indentation quantifiers and fixed absolute Git executable paths, without suppressions or changed coverage. All nineteen smoke controls pass again. The production correction remains twelve additions to the two sparse-checkout file lists; runner/import blobs and operational guards remain unchanged. Fresh exact-head CI and Security review are pending; cli owns corrections and actual-target qualification/cleanup after normal integration. General owns source integration and any later separate operation decision. Original failed publication outcomes remain retained with no retry or output reuse.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Final source head is c94ee03255f7a228a594ec3f2a6342982aff611e, tree be5fddff9333bb5b4272cc8b9b06a61f0f014a2b, base a8257d07c0ed0e6a047593c7d84631ae7ee4cc27. All twelve exact-head contexts now succeed. Direct Sonar provider reads separately confirm quality gate OK and zero unresolved issues; the Windows Git raw-string recommendation on the prior passing-gate head was corrected in the final incremental commit. No findings were suppressed.

The branch is frozen for independent source review. cli owns actual maintenance-target qualification and safe branch cleanup following normal integration; General owns integration and every later exact-H/tag/effect decision. The stopped 2.3.8 publication failure remains unchanged and supplies no native or installed acceptance.

[rmcdaniel]

Security exact-head source disposition: PASS, limited to the sparse-checkout closure correction at c94ee03255f7a228a594ec3f2a6342982aff611e / tree be5fddff9333bb5b4272cc8b9b06a61f0f014a2b / accepted base a8257d07c0ed0e6a047593c7d84631ae7ee4cc27.

Independent review confirmed:

• the only workflow behavior change is the same six reviewed smoke-controller/import files added to each native sparse checkout (12 list entries total); the smoke runner and release/product sources are unchanged;
• the listed files are the complete local transitive closure of run-upgrade-smoke.mjs on this head;
• both new regression cases materialize their job's actual sparse checkout, load the real parent, refuse an inherited token before reading inputs, then exercise the credential-free synthetic success and exact cleanup path;
• my clean local node --test scripts/ci/test-upgrade-smoke.js run passed 19/19, including both materialized checkouts; the companion release-cache policy controls passed 6/6;
• GitHub reports this exact head/base, CLEAN/MERGEABLE, with all 12 current hosted contexts successful. Direct provider evidence on the PR reports gate OK and zero unresolved issues; no suppression is present.

The correction closes the concrete MODULE_NOT_FOUND source defect from the consumed 2.3.8 attempt. That attempt remains terminal FAILURE and supplies no binary, installed, HTTPS, release, or publication acceptance. This PASS authorizes only General's normal source integration. It does not authorize a retry, tag mutation, artifact reuse, build, publication, promotion, or runtime effect; any later exact-H/effect proposal requires its own current preconditions and review.

[rmcdaniel]

General completed normal maintenance-source integration of the sparse-checkout fix. Actual merge b02a86d5200c710a95eb1c95787767359114af56 has reviewed tree be5fddff9333bb5b4272cc8b9b06a61f0f014a2b and ordered parents [a8257d07c0ed0e6a047593c7d84631ae7ee4cc27, c94ee03255f7a228a594ec3f2a6342982aff611e] on maintenance/2.3.6-base.

The exact candidate has twelve successful contexts and Security's source PASS, including the real materialized sparse-checkout regression. CLI owns actual-target checks and safe exact-head cleanup, then returns the resulting exact-H/source/tool/effect proposal. The original 2.3.8 attempt remains failed and retained. No new tag/build/publication, old-artifact reuse, installed qualification, Latest promotion or default exposure is admitted by this integration.

[rmcdaniel]

Actual maintenance-target acceptance is complete at b02a86d5200c710a95eb1c95787767359114af56, independently matched through local Git and GitHub Git-database REST: reviewed tree be5fddff9333bb5b4272cc8b9b06a61f0f014a2b, ordered parents [a8257d07c0ed0e6a047593c7d84631ae7ee4cc27, c94ee03255f7a228a594ec3f2a6342982aff611e].

All eleven exact-target contexts succeed, including the independent SonarCloud provider verdict: Build41971238700, Sonar maintenance41971238766, Public boundary41971238568. All four PHP cells report 931 tests / 17,495 assertions, with the existing eleven deprecations / one skip. PHAR smoke/reproducibility and ordinary release controls pass. The separate unauthenticated Sonar branch-issue API returned 403; no zero-issue count is inferred from it. The exact-target provider verdict and PR's previously recorded zero-issue source review are distinct evidence.

Safe cleanup verified the owned remote branch still pointed exactly at reviewed c94ee032... and was an ancestor of the accepted target, deleted only that merged remote ref, re-read its absence, then removed the clean local branch/worktree without force. Required maintenance, main and both stopped publication tags remain unchanged; local source evidence/caches are retained for their owners.

cli now owns the resulting exact-H/source/tool/effect proposal on #101. This acceptance grants no new attempt, tag, output reuse, installed qualification, publication, promotion or default exposure. The original 2.3.8 outcome remains terminal failure.