[rmcdaniel]

Published native 3.2 qualification currently starts an unused mutable privileged Buildx helper and uses a mutable MySQL image. This change removes Buildx from manual qualification, pins the actual MySQL and QEMU subjects, and records their observed image configuration and owned resource identities.

The v2 evidence model binds the separate runner to the unchanged 3.2.0 producer (3c6f1eda, index sha256:6916f6f3…). Admission requires the exact subject file, reviewed runner ref, protected-main ancestry and the closed ten-file runner delta. Native runtime, protocol, corpus fixtures and publication source remain frozen. The v1 runner/producer equality rule remains intact.

Compose receipts bind the actual MySQL container and image configuration, the QEMU image used for arm64 emulation, the run/attempt/job scope, and verified cleanup. Both qualification workflows admit these inputs before dependency execution. The existing five-receipt graph retains provider job, workflow, artifact and end-of-run checks.

Validation on this exact preparation: 17 evidence controls, 31 qualification controls and 84 isolation controls passed, along with repository isolation and native tag/release guards. The controls exercise real producer/consumer helper paths with inert providers, including v1 refusals and malformed dependencies. Fresh ordinary PR/main qualification and finite review remain required.

Refs #325. This source change prepares the successor to effect HOLD6705813732; actual parity and Compose dispatch still require the separately reviewed packet and selection. No qualifier result, alias promotion or tag move is claimed.

[rmcdaniel]

Exact successor 462ca242be0c45534702bc40989fa01786d1d5e7, tree 7bb180730749b01fc2b7073704e8c7fba317d346, addresses the original Sonar findings without changing the selected producer, dependencies or receipt schema.

• Git object-ID calculation explicitly uses the legacy Git object format (usedforsecurity=False). Selected source, protected-main ancestry, closed source delta and typed subject checks remain required. This does not replace an artifact digest or signature check.
• Receipt verification is a separate function. Existing source/provider/job/artifact/cleanup checks and the final mutable-authority rereads remain intact.
• New test assertions follow the existing expected-first convention. The closed cleanup model's helper digest is updated to these exact bytes.

Local controls on this successor: 17 evidence, 31 qualification and 84 isolation tests pass, plus actual repository isolation and native release/tag guards. The unchanged consumer against predecessor and successor produces identical complete proofs and final provider-read counts for both v1 and v2 fixtures.

Original 1a546205 remains NONPASS: Sonar run 42378878576 failed. Its promotion contracts, four Compose source cells and boundary checks passed, but no previous result is carried to this successor. To avoid wasting runner time after the concrete source failure, I cancelled only its still-live source workflows (42378878566, 42378878574, 42378878717, 42378875287) once each, verified all original workflows terminal, and then pushed this substantive correction. No workflow was rerun. Fresh normal current-head checks are now required.

The complete producer-to-runner delta remains the same closed ten paths and two substantive commits. Rust, protocol and publication workflow trees still equal frozen 3c6f1eda. The active runner branch remains retained. Finite independent source review and later effect review/selection remain separate; no qualification dispatch has occurred.

[rmcdaniel]

Read-only SDK-release dependency diagnosis for exact head 1a5462058ac7c2c7008c372292a50b3580d3b3c7: Sonar original42378878576 fails its quality gate. Its scanner log binds that exact SCM revision. The provider gate API reports only new_security_rating failing: actual4 against maximum1. Reliability, maintainability, duplication (0.0%) and hotspot-review conditions pass.

The one unresolved vulnerability is AaG2SlgxXlHnIK2WkL9M, rule python:S4790, CRITICAL, at native_alias_evidence.py:204, blob d7692c69db9114006d43e1d0432774181531d6ba, SHA256 a8a8e9112413545446277bec9e7c5c8d35c4b785352d9094b4be80a2e8ef4eec. The operation recomputes the required Git blob SHA-1 identity for the fetched qualification subject; adjacent guards bind the provider path/encoding/size, selected blob, release and source ancestry/delta. This is a concrete hashing-purpose review, rather than a coverage failure.

Server/Security own the disposition. Preserve the Git identity algorithm/bytes and all digest-mismatch refusals. If the reviewed role is solely Git-object consistency under the other source-authentication guards, Python's explicit usedforsecurity=False can express that purpose, and SonarSource's release notes document S4790 support for that argument (SONARPY-2038). Python's hashlib documentation defines the flag for non-security uses. Whether that description is valid here must be established by the source/security review; this diagnostic does not select an issue dismissal or a weakened authenticity check. Any Source correction must retain the controls, update affected cleanup-source hash witnesses, and obtain fresh ordinary current-head qualification.

I read provider metadata, exact source and the original formatted log only. No Server implementation, rerun, dispatch, project/account/policy change or SDK/runtime operation occurred. The old exact-head result remains NONPASS; the SDK published/installed gate remains held.

[rmcdaniel]

SECURITY CLASSIFICATION — S4790 CORRECTION ACCEPTED; OLD HEAD REMAINS NONPASS

I independently reviewed the sole original Sonar vulnerability on 1a5462058ac7c2c7008c372292a50b3580d3b3c7: issue AaG2SlgxXlHnIK2WkL9M, rule python:S4790, at scripts/ci/native_alias_evidence.py:204. The captured quality gate is otherwise green and fails only new_security_rating=4.

The SHA-1 operation is the exact Git blob object-ID calculation over b"blob " + decimal_length + NUL + data. Git fixes that algorithm; it is not a selectable password, signature, MAC, token, or standalone artifact-authentication primitive. Authority remains supplied by the exact provider path/encoding/size and selected blob, the selected source commit, protected-main ancestry, closed runner delta, release binding, and the existing digest-mismatch refusal. Consequently, Python hashlib.sha1(..., usedforsecurity=False) is the correct explicit classification for this calculation.

Successor 462ca242be0c45534702bc40989fa01786d1d5e7 preserves those bytes and the equality check exactly, gives the result a purpose-specific object_id name, documents the Git requirement, uses the same explicit flag in the test fixture, and updates the cleanup-source SHA-256 witness. This resolves the security-purpose ambiguity without weakening or removing the Git identity check. No provider issue dismissal or quality-gate waiver is appropriate.

This classification does not carry the failed original result and is not a full successor Source PASS. The old Sonar run 42378878576 remains NONPASS. The current successor also contains a receipt-verification refactor and assertion-order changes; those retain their own review and fresh current-head CI/Sonar requirements. No qualifier dispatch, publication, installed-runtime acceptance, or release effect is selected here.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

SECURITY DELTA PASS — FULL PR QUALIFICATION STILL PENDING

I reviewed exact successor 462ca242be0c45534702bc40989fa01786d1d5e7 against failed predecessor 1a5462058ac7c2c7008c372292a50b3580d3b3c7.

The Git object calculation preserves the exact object bytes and equality refusal, adds only the purpose-explicit usedforsecurity=False classification, and updates the closed cleanup-source witness. The extracted qualification_receipts() retains the prior ordering: required jobs and steps are bound, each artifact is fetched and bound, artifact IDs and check tuples are retained, and the existing final mutable run and artifact rereads still execute before success. The full ten-path allowlist is admitted with <= len(RUNNER_PATHS); foreign, renamed, deleted, or over-limit paths remain refused.

Independent read-only controls on the exact head pass: 17 evidence tests and 31 qualification tests, with git diff 1a546..462ca --check clean. Fresh Sonar is terminal PASS with zero new issues.

This is a narrow delta and security review only. The broader current-head database, corpus, PHPUnit, and CodeQL checks were still live at review time, so no full Source, qualifier-effect, publication, installed-runtime, or release acceptance is inferred. The original Sonar run remains NONPASS.

[rmcdaniel]

SECURITY SOURCE PASS — EXACT HEAD; EFFECT AND RELEASE REMAIN SEPARATE

I independently accept exact draft head 462ca242be0c45534702bc40989fa01786d1d5e7, tree 7bb180730749b01fc2b7073704e8c7fba317d346, for Source and trigger scope.

The published producer source 3c6f1eda9c6d2ebc0ee5bec8ccf431900052be9e is the exact merge base and ancestor. Its complete delta is exactly the ten closed qualification paths: three qualification workflows, the subject JSON, evidence and qualification libraries, isolation witness, two focused test files, and README. No Rust runtime, protocol/schema, application, dependency lock, release publisher, alias mover, or product path changes.

The v2 authority chain is fail-closed:

• the requested published release, index, release run, MySQL image, and QEMU image are immutable digest-bound subjects;
• runner source must be the selected commit on the fixed branch, an ancestor of protected main, and differ from the producer only inside the ten-path allowlist;
• workflow run/head/ref/blob, complete jobs and critical steps, artifacts, receipts, actual dependency images, resource scope, observations, and exact cleanup are bound;
• v1 cannot consume a v2 runner or receipt, and v2 preserves the producer source in image identity;
• mutable workflow runs, runner ancestry/subject, and artifact metadata are re-read before success;
• the Git SHA-1 calculation is correctly limited to the mandated Git blob object ID with usedforsecurity=False; all surrounding source/blob/ancestry and mismatch refusals remain.

Independent exact-head controls pass: 17 evidence tests, 31 qualification tests, Docker workflow isolation, native registry subjects with 12 zero-write refusals, and native release/tag guards. The full hosted set is terminal: 68 SUCCESS and one intended skip, with Sonar, CodeQL, public boundary, repository contracts, PHPUnit, native corpus, MySQL/MariaDB/PostgreSQL matrices, deadline health, and production image checks all non-failing.

This Source PASS does not merge the draft, qualify protected main, dispatch either qualification workflow, accept any receipt, move an alias, publish a release, or accept installed/runtime behavior. Preserve the active runner branch until an exact protected-main carry and separately reviewed qualifier effect/terminal cleanup complete. The failed original 1a546205 and its Sonar result remain NONPASS.

[rmcdaniel]

Owner current-head Source acceptance: 462ca242be0c45534702bc40989fa01786d1d5e7, tree 7bb180730749b01fc2b7073704e8c7fba317d346.

All 69 PR contexts are terminal: 68 success and one declared prepared-local skip. Original Shared 42379588369/a1 passed all 48 jobs. Feature 42379588358, native image parity 42379588354, four-cell published Compose source smoke 42379588386, promotion contracts 42379588365, Sonar 42379588424, both Boundary runs and CodeQL are successful. Sonar reports zero unresolved/new issues. Independent security classification and delta review are 6707916086 and 6708028047.

I reviewed the complete ten-path producer-to-runner delta and successor refactor, verified frozen Rust/protocol/publication workflow identities, and retained exact 17/31/84 local controls plus unchanged v1/v2 proof and final-provider-read results. The original failed 1a546205 and its cancelled source continuations remain NONPASS. No original was rerun and none of its green checks qualifies these changed bytes.

Proceeding through the normal exact-head merge queue. The active runner ref and checkout are retained for the later qualification lifecycle. PR parity/Compose source checks do not substitute for the separately selected actual 3.2/index6916 originals. The #325 effect HOLD remains until the accepted-main successor and complete packet receive their required review/selection. No dispatch, tag movement, alias, installed-runtime or SDK acceptance is claimed.

[rmcdaniel]

Server executed normal merge-queue enrollment for exact head 462ca242be0c45534702bc40989fa01786d1d5e7. The current queue entry is position 1 / AWAITING_CHECKS, queue commit 35d595eb67e43202bdfcc55b040bb0bc1525bfea, tree a3bc9ad4bb6e5eb0e3450596397fc3e6bed85224, ordered parents dc2a9d10 and 462ca242.

The actual queue originals are Shared 42381384246/a1 and Feature 42381384201/a1; they are live, while both queue Boundary checks have passed. Server retains merge/main and active-runner-ref ownership through terminal checks and protected-main acceptance. GitHub reports autoMergeRequest: null for this merge-queue path; the GraphQL mergeQueueEntry confirms enrollment. No additional merge action or executor handoff is pending.

The frozen runner branch stays at the selected head. Qualifier dispatch remains unselected. The refreshed complete effect packet follows accepted protected-main integration.

[rmcdaniel]

Normally merged at 2026-11-07T14:44:33Z as 35d595eb67e43202bdfcc55b040bb0bc1525bfea, tree a3bc9ad4bb6e5eb0e3450596397fc3e6bed85224. Ordered parents are dc2a9d10 and accepted runner 462ca242. GitHub signature, ancestry and equality of all ten accepted path blobs are independently read back locally. The queue original Shared 42381384246/a1 passed all 48 jobs; Feature 42381384201/a1 and both Boundary originals passed.

Actual-main acceptance is in progress: Shared 42383011443, Feature 42383011470, Sonar 42383011464, Boundary 42383011478 and CodeQL 42383011324. These current results are not carried from the PR or guessed from merge status.

The clean active runner checkout and remote branch are retained at 462ca242 for qualification, as required by the active-follow-up exception. Its complete Rust tree still equals frozen producer 3c6f1eda. Main's later runtime is not substituted for the runner. Server owns the remaining main acceptance and complete refreshed effect packet; qualifier dispatch and all downstream effects remain unselected.

[rmcdaniel]

PASS — protected-main Source/custody carry for PR1089. Protected main is signed merge 35d595e, tree a3bc9ad4bb6e5eb0e3450596397fc3e6bed85224, with ordered parents dc2a9d1 and reviewed head 462ca24. The first-parent delta is the reviewed ten-path Source subject; the merge tree and changed blobs carry the accepted PR bytes without a post-review Source change.

All protected-main workflows for this merge are terminal with successful required results and only intended skips: CodeQL run42383011324, Shared run42383011443, Sonar run42383011464 plus successful external main analysis, Feature run42383011470, and Public Boundary run42383011478. Main currently resolves to 35d595e. The dedicated qualification runner ref remains present at exact reviewed head462ca242, as required for the later separately admitted receipts.

This accepts only protected-main Source and current-main check custody. It does not accept the published Native3.2 image, the known containerd-store observer assumption, any corpus/Compose receipt, alias promotion, tag, release, SDK installed/runtime result, or qualifier effect. The observer correction recorded at Server325/6708520022 and a newly reviewed finite qualifier subject remain prerequisites; no dispatch is authorized by this carry.

[rmcdaniel]

Owner protected-main acceptance is complete for 35d595eb67e43202bdfcc55b040bb0bc1525bfea, tree a3bc9ad4bb6e5eb0e3450596397fc3e6bed85224. The signed merge has accepted runner 462ca242 as its second parent, and all ten accepted path blobs match that head.

All five actual-main workflows are terminal successful, with 15 successful jobs and six declared skips: Shared 42383011443 (4 success / 5 skip), Feature 42383011470 (5 success / 1 skip), Sonar 42383011464, Boundary 42383011478, and four-language CodeQL 42383011324. The exact queue original previously passed all 48 Shared jobs. Main's existing reuse policy does not claim another 48-job execution.

The active runner ref is intentionally retained at 462ca242 under the release/follow-up exception. Frozen native 3.2.0 producer 3c6f1eda / index 6916f6f3 is unchanged. Current private observer work does not change that accepted ref or main result.

A concrete pre-dispatch Docker 29/containerd identity gap is now recorded on #325/6708520022. Server owns the small observer/model/control successor, normal source qualification, and refreshed finite packet. The existing qualifier effect HOLD remains. No manual qualifier original, tag move, alias, installed SDK or release acceptance is inferred from this source completion.