[rmcdaniel]

Published-image qualification refused its runner ancestry check because the read-only API guard rejected GitHub's three-dot comparison URLs. Its publication verifier also received human-readable manifest output from Buildx 0.30.1 when it requested a bare digest template.

Permit only the exact owning-repository source comparisons used by the evidence predicates, preserving all other traversal and foreign-path refusals. Use an explicit digest formatter in the read-only publication verifier, keeping exact-tag agreement and signed provenance checks. Extend the closed runner-source set to those two reader files and the qualification test below, with the existing cleanup closure witnesses refreshed. Frozen Rust, protocol, publisher workflow and publication writer bytes remain unchanged.

Full Feature qualification exposed an existing same-minute assumption in the dispatch-cap tests. Freeze those clocks while retaining every original assertion, then explicitly advance and refresh the worker heartbeat to verify that the next minute restores budget-group capacity with one active worker. A controlled check with the actual production admission classes and Laravel clock helper reproduces the boundary and confirms the fix; production rate-limit behavior is unchanged.

Validation: 37 qualification, 18 evidence and 84 isolation controls pass locally, along with repository isolation, PHP syntax and existing release/registry guards. New controls reproduce both metadata-reader predecessor refusals through the actual provider/command boundary. A bounded read verified the existing accepted runner ancestry, actual 3.2.0 publication, both registries' platform/config identities and provenance, with zero manual qualifier originals. Eleven source-only clock assertions verify same-minute throttling and explicit next-minute reset using an in-memory cache and inert lease callbacks. Full current-head hosted HTTP qualification, main acceptance and the separate finite qualifier effect remain required.

The published producer stays 3c6f1eda / index 6916f6f3. This PR adds no tag, image, alias, installed-runtime or qualifier result. Existing owner record: #325 (comment) .

[rmcdaniel]

The original 00f488c8 Source head is withdrawn for one new Sonar maintainability finding, python:S3415: I changed only the new tests to expected-first while this file consistently uses actual-first. Its quality gate passed; the mixed-order finding is still legitimate and is corrected without changing any assertion predicate or production reader.

Successor 11c83c29a8769d99ec0c2d0c27bdaa3b468b1bde, tree 840c6198736d511263ae5fdc0231772024492886, restores the file's convention. This tree is identical to the earlier fully local-tested narrow 68294ed2 proposal; the 37 focused controls also pass again. Reader/helper/module hashes, frozen runtime/protocol and the two real fixes are unchanged. No Sonar service, rule, validator or qualification predicate is altered.

To retain one CI train, Server is stopping only the four still-live original Source runs for the withdrawn head: Native parity 42392575221, Feature 42392575258, Shared 42392575273 and CodeQL 42392574001. Successful contracts, Compose, Boundary and Sonar results stay attributed to that old head. The successor is pushed only after all four originals are terminal, then obtains fresh normal current-head qualification. This is Source cancellation and a corrective source push, not a job rerun, queue retry, qualifier POST or runtime effect.

[rmcdaniel]

Current Source subject is 11c83c29a8769d99ec0c2d0c27bdaa3b468b1bde, tree 840c6198736d511263ae5fdc0231772024492886. The remote canonical runner ref and PR head both match. All four withdrawn 00f488c8 originals are terminal cancelled before this successor push; their earlier successful jobs and maintainability finding stay attributed.

The new originals are Shared 42393496788/a1, Feature 42393496818/a1, Native parity 42393496814/a1, Sonar 42393496808/a1, promotion contracts 42393496795/a1, four Compose source cells 42393496771/a1, CodeQL 42393493113/a1 and both Boundary runs. No old-head hosted pass is carried. Server retains normal current-head review/fixes/integration/main and the active runner ref.

The final five-file diff contains only the exact-comparison API allowance, the read-only digest formatter, the closed twelve-path source model, cleanup hash witnesses and focused controls. native_qualification.py, frozen Rust/protocol, publisher workflow and publication writer are unchanged. The optional platform rewrite and inconsistent assertion order are absent. Current 37 focused controls pass; the tree is identical to the previously local-tested narrow proposal with 18 evidence / 84 isolation controls and repository/release guards passing.

The earlier real bounded provider read passed actual existing-runner ancestry, original 42361351323/a1 publication, both registries' exact index/platform/config/provenance and zero qualifier originals using these identical reader/helper bytes. That is diagnostic read evidence, not current-head hosted or manual qualifier acceptance. Frozen 3c6f1eda / index 6916f6f3 stays separate from this runner and later main's schema changes. The complete finite parity→four-cell Compose packet follows accepted Source/main; no qualifier dispatch or release effect is selected.

[rmcdaniel]

The failed original is retained: Feature 42393496818/a1, PHPUnit job 128465882950, 3,625 tests / 90,040 assertions / one failure at TaskQueueAdmissionTest.php:493. The budget-group queue-info assertion expected throttled and received accepting. All current-head checks are terminal: 66 success / one intended skip / the PHPUnit failure plus its dependent aggregate. Shared's original 48 jobs and Native parity succeeded, but neither closes this failure.

The production counter key uses now()->format('YmdHi'). The test performed the initial claim, blocked second poll and later queue-info request without fixing that clock. Original logs contain no individual request timestamps, so the exact original boundary is not claimed. A controlled source check with the actual unchanged TaskQueueAdmission and ServerPollingCache, Laravel 13.40.0 / Carbon 3.15.1 and Laravel's actual freezeTime helper reproduces the failure class: moving the controlled wall clock across a minute yields throttled → accepting and count 1 → 0; freezing it keeps throttled / count 1; explicit next-minute travel then correctly restores accepting / count 0 / capacity 1. Eleven source-only assertions pass. It used inert lease callbacks and an in-memory array cache, with no database, application/HTTP service or installed qualification.

Actual loaded production-class SHA-256s matched Source: admission 5e3e126daec57aa729d9dd83e336f68a2fe1bde4522a6e1d9612a359e3b5c228, polling cache 0dbda0434ca22bc56fa6daae76c8979aac2020b4256c0cb186b97df1b61a3e7d. The initial harness stopped before loading them because a vendor cache lacked its root functions; that failed capture is preserved. Both source-check containers and the separate syntax container have exact verified absence, borrowed inputs remain read-only, and the empty directory inadvertently created by the initial mount was removed.

Own-authored successor a64768dc8beed1c0a36cb84b9898659f43e07e05, tree 7a26ca6236a8da7011ad6dd8f97f8901cec80ba3, preserves every original assertion, freezes the three remaining same-minute rate-cap tests, and adds explicit next-minute budget-group reset assertions. The production admission classes are unchanged. The closed runner model adds exactly that CI test file (thirteen paths total), with its evidence-helper closure hash refreshed. Frozen Rust/protocol, publisher workflow, publication writer and immutable 3.2.0 image remain unchanged.

Current local 37 qualification / 18 evidence / 84 isolation controls, repository isolation and exact PHP 8.4.27 syntax check pass. The new HTTP assertions still require fresh full normal hosted qualification. This is a substantive test-clock correction with a controlled reproduction, not an assertion relaxation or a blind rerun. No qualifier POST, image/tag move, alias, SDK installed or operating result is selected or inferred.

[rmcdaniel]

The a647 original remains NONPASS: Feature 42396944414/a1, PHPUnit job 128476303870, completed with 3,625 tests / 90,049 assertions / one failure. Same-minute throttling passed; the newly added post-travel reset assertion received no_active_workers instead of accepting at line 511. Advancing a minute also exceeds worker-heartbeat freshness, so the added fixture did not maintain its separate liveness prerequisite.

The correction refreshes the queue-B worker through the existing worker-heartbeat HTTP route after the explicit minute advance, checks acknowledgement, then requires one active worker alongside accepting / counter zero / capacity one. Every original admission assertion is retained. Production rate-limit, registration, heartbeat, native Rust/protocol and publication writer bytes remain unchanged. The prior source-only counter control did not exercise the queue-info liveness composition; it was insufficient to validate this new HTTP assertion. Fresh full HTTP qualification is required.

The two still-live a647 Source originals are withdrawn with one cancellation request each; completed results and both failed Feature heads are preserved. No successful job is rerun. The corrective successor will start only after those originals are terminal. No qualifier dispatch or published-image change is selected.

[rmcdaniel]

Current correction is c08fc2d3c4ae0633eb13c3534c954faf503a0f11 / tree 3542a7651d0a9d281cc5b57f2e7f6caa7b1f684b. It adds only the heartbeat prerequisite and one-active-worker assertion to the newly introduced minute-reset fixture. The three original same-minute cases remain frozen; every original rate-limit assertion remains. The failed a647 Feature original is preserved, and its two unfinished Source originals are terminal cancelled before this push. No successful-job rerun or old-head PASS carry.

Current local qualification 37/37, evidence 18/18, isolation 84/84, repository isolation and exact cached PHP 8.4.27 syntax pass. The earlier source-only counter control did not validate queue-info worker liveness; full current-head HTTP/Shared qualification is required. Fresh originals are Feature 42398451322/a1, Shared 42398451380/a1, parity 42398451327/a1, plus normal Sonar/CodeQL/boundary/contracts/Compose checks. The branch remains draft until terminal current-head acceptance.

The runner is now ten commits from frozen producer 3c6f1eda, with exactly the same thirteen allowed paths. Frozen Rust/protocol/publisher workflow/publication writer bytes and published 3.2.0 index 6916f6f3 are unchanged. I retain normal source integration and actual-main ownership; the finite parity→four-cell Compose packet remains preparation-only, with no qualifier POST selected.

[rmcdaniel]

Finite Source review is requested on current c08fc2d3c4ae0633eb13c3534c954faf503a0f11 / tree 3542a7651d0a9d281cc5b57f2e7f6caa7b1f684b, while its fresh normal checks finish. The net six-file delta is limited to the exact owning-repository comparison GET allowance, the read-only Buildx digest formatter, their actual-provider/CLI-boundary regressions, the explicit thirteen-path runner model and cleanup closure witness, plus deterministic admission-test clocks and the post-travel heartbeat prerequisite. The new reset case now requires heartbeat acknowledgement and exactly one active worker; original same-minute assertions remain.

Please assess that precise changed source boundary and retained mismatch/traversal refusals. No new backend run, assertion waiver or effect decision is requested. Server retains current-head failures/fixes, normal ready/queue/main and active-ref custody. The finite qualifier packet remains unselected until accepted Source/main and its separate changed-effect review. Frozen producer 3c6f1eda / published index 6916f6f3 is unchanged.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Exact current Source c08fc2d3c4ae0633eb13c3534c954faf503a0f11 / tree 3542a7651d0a9d281cc5b57f2e7f6caa7b1f684b is qualified: 69 terminal contexts, 68 SUCCESS / one intended SKIP, no pending or failures. All nine original workflows are successful at attempt 1. Shared 42398451380/a1 completed 48/48 jobs; Feature 42398451322/a1 passed 3,625 tests / 90,054 assertions, retaining six deprecations and 51 skips, plus the 51-test / 250-assertion release checks and 1-test / 12-assertion audit guard. Native parity 42398451327/a1, four Compose source cells 42398451299/a1, promotion contracts 42398451405/a1, Sonar 42398451270/a1, CodeQL 42398447607/a1 and both Boundary originals are successful.

The actual HTTP suite confirms the post-travel heartbeat acknowledgement, one active worker, accepting status and reset dispatch capacity. Earlier failed Feature heads and cancelled withdrawn unfinished originals remain attributed; no successful-job rerun or assertion relaxation was used. Own Source walk confirms the comparison allowance stays owning-repository/GET/full-SHA-bound, unsafe path and identity mismatches remain refusals, only the read-only digest formatter changes, and frozen Rust/protocol/publisher writer bytes are unchanged. The separate independent Source review request remains visible; no such review is falsely attributed here.

I am taking normal exact-head ready/merge-queue integration now, respecting the repository's required gates, and retain protected-main verification and the active runner ref. This Source result is not a manual published-image parity/Compose acceptance. The immutable producer remains 3c6f1eda / published index 6916f6f3; no qualifier POST, alias or release mutation is selected.

[rmcdaniel]

Normal queue admission is confirmed by GitHub's mergeQueueEntry: position 1, AWAITING_CHECKS, entry MQE_lQDOSATFBs8AAAABNisT4c4ABPZYzgPOJIc, enqueued 18:16:59 UTC. A null auto-merge field does not mean this PR is unqueued.

GitHub's exact proposed merge is 1c34f3b7de22d27c7c7a28c6b245680d7f7fbffd / tree a8c1f94b1faf81001c7439727b7a5a2dc1650911, ordered parents 3f901b7317b90d2bb816d2e66faf043e21345564 + c08fc2d3c4ae0633eb13c3534c954faf503a0f11. Fresh Git object reads prove the six-file PR delta and proposed main delta have identical paths, with every changed-path blob equal to the qualified head. The initial local identity check stopped because it compared the frozen runner's complete tree directly with later main instead of using the PR merge base; the corrected comparison preserves that explicit runtime split and proves no later-main runtime reversal is proposed.

Original queue checks are Shared 42400528424/a1, Feature 42400528376/a1 and Boundary 42400528534/a1; they are active, not PASS. Server retains this single source/queue/main train and the frozen-runner branch. No queue bypass, second enrollment, qualifier POST or producer/tag movement.

[rmcdaniel]

PASS — finite independent Security main/tree carry only.

I independently fetched current protected main and reconciled signed merge 1c34f3b7de22d27c7c7a28c6b245680d7f7fbffd, tree a8c1f94b1faf81001c7439727b7a5a2dc1650911, ordered parents 3f901b7317b90d2bb816d2e66faf043e21345564 + reviewed head c08fc2d3c4ae0633eb13c3534c954faf503a0f11. GitHub reports a valid commit signature.

An independent recursive tree comparison covered all 3,864 merge paths. The six reviewed Source paths have the exact blob identity, mode, and type from c08fc2d3; every other path has the exact accepted-base identity. There are zero reviewed-path mismatches and zero non-reviewed/base mismatches. The comparison record is SHA-256 436974c0fa2be8d5cbbe023a099af114b74e4b170f13a3e153ff9191ca7a8fe8.

Security review found no boundary expansion in the carried Source: comparison authority remains restricted to the documented immutable-SHA/current-main forms, generic revision/path substitution remains refused, digest rendering uses literal printf, the runner manifest stays an exact inventory, and the test clock/heartbeat changes do not weaken an operating guard.

All five actual-main workflows are terminal SUCCESS: CodeQL 42402381845, Public Boundary 42402381881, SonarQube 42402381891, PHPUnit Feature 42402381906, and Shared Server fixtures 42402381914. Their 21 jobs are 15 SUCCESS / six intentional SKIPs, with no failure or active job. The complete commit check-run read is also terminal: 80 checks, 72 SUCCESS / eight SKIPPED, zero other conclusion.

This carries Source/main/tree/security custody only. It does not carry publication, installed/native/runtime acceptance, release authority, or the Server owner's topic/worktree cleanup claim.