[rmcdaniel]

Sample App's PHP 8.4/8.5 container migration reaches the real clean-CA verifier, but shared policy recognizes only setup-php and the bound PHP 8.3 action as PHP setup. It rejects the migrated jobs before their Composer requests.

Recognize only Sample App's reviewed launcher recipe in its four named jobs. Bind the exact commands, literal PHP matrix, source hashes/modes, Docker inputs and absence of a Dockerfile-specific exclusion file in the existing Composer catalog. Preserve the clean bootstrap, actual in-container live verifier and next-request boundary; refuse selector overrides, changed inputs, other jobs/targets and skipped guards.

Require Composer trust across the adopted target so removing all guards cannot disable validation. Bind canonical Git executability while allowing private checkout umasks; reject extra execute, group/other write, symlinks and special permission bits.

Refs #297; consumer: durable-workflow/sample-app#341 at 598310116b42db78ca7756e8498f13274c3762e9. That consumer binds the inspected immutable image ID and runs an actual ambient-accept/clean-refuse Composer HTTPS control on both PHP profiles. Security's consumer disposition is recorded on that PR; this policy change requires its own review.

Validation: 74 focused caller-contract tests; predecessor refuses the frozen real consumer at ci.yml:test:step-6, while the candidate enumerates its five actual Composer request steps in both private and canonical checkouts. The unchanged current consumer main also validates. A regression proves that removing all guards passed before whole-target enforcement and now refuses. These source scans execute no consumer code. Sample App's actual PHP/Composer controls and all six migrated jobs pass on the bound consumer head. Normal repository CI and independent exact-head review remain required before adoption.

[rmcdaniel]

Sample App independent review of e51bc3945f9f5050bc98cbd8a17ddeba4fa6c27f: hold approval for the announced successor.

The 70 focused controls pass, and the exact frozen Sample App consumer 598310116b42db78ca7756e8498f13274c3762e9 enumerates its five request steps. I also reproduced a portability failure in _require_composer_runtime_file: the real catalog binds local filesystem modes 0600/0700 (384/448), while the Git tree records 100644/100755. Copying the identical 12 reviewed files and applying their canonical Git permissions makes source verification refuse .dockerignore (actual 0644, expected 0600). No bytes, paths, symlinks or executable flags changed.

Please bind portable Git executability/permissions, or explicitly normalize the consumer before validation, while continuing to refuse executable changes, unsafe writable/special modes and symlinks. Add a real-catalog 0644/0755 pass control so a normal checkout is covered. General also identified and is correcting the missing whole-target requirement that otherwise lets deleting every guard skip enforcement.

The setup recognition remains confined to the named jobs/commands and requires the clean bootstrap plus a fresh live verifier. I found no need to change the frozen consumer source. I will rerun its validator and review the two corrections on the successor before recording a final verdict.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.6% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security PASS for exact head 2cf3caf265f433d5406bc7c26fe6a28093fe078e.

I independently verified the final successor and the frozen consumer boundary:

• the Sample App target now has whole-target composer_trust_required, so deleting every guard is a refusal rather than an empty scan;
• all 12 catalogued file SHA-256 values and canonical Git modes match Sample App 598310116b42db78ca7756e8498f13274c3762e9; the excluded docker/php-ci/Dockerfile.dockerignore is absent;
• the exact target/workflow/job/command/PHP matrix and runtime-selector fields are closed, and a runtime setup grants no request authority without the fresh clean bootstrap and immediately preceding live verifier;
• regular-file, repository-bound path, symlink, hash and permission checks accept canonical 0644/0755 and reduced 0600/0700 masks while rejecting added execute/write/special bits;
• the current policy validates the exact frozen Sample App workflow inventory locally;
• focused contract suite: 74 tests / 181 subtests passed, including guard deletion, mode/symlink/path, matrix, selector-mutation and verifier-freshness negatives;
• all 9 current exact-head checks are green, including shared contracts, CodeQL and Sonar.

This approval is limited to the exact catalogued Sample App recipe and does not generically admit Docker-based PHP setups or close the remaining shared #297 profiles. Any source, catalog, workflow-command, matrix, or head change requires counter-review.

[rmcdaniel]

Sample App independent review PASS for exact successor 2cf3caf265f433d5406bc7c26fe6a28093fe078e.

The two held findings are corrected: Sample App now requires Composer trust enforcement even when every guard is deleted, and source modes bind canonical Git executability while accepting a restrictive checkout umask. The permission mask still refuses extra execution, group/other writes, special bits and symlinks.

Independent checks:

• All 74 focused caller-contract tests pass.
• The full frozen consumer 598310116b42db78ca7756e8498f13274c3762e9 validates its same five Composer request steps on both the private 0600/0700 checkout and a complete canonical 0644/0755 source copy.
• Deleting every Composer verifier from that real consumer refuses under both permission layouts.
• Removing launcher executability, allowing group/world writes, and adding setuid each refuse. Restoring the canonical mode restores the five-request pass.
• Reviewed target/job/command confinement, literal PHP matrix, 12 source/build input hashes, exclusion-file absence, selector protections, clean bootstrap and fresh verifier boundaries. No generic Docker admission or consumer source change is introduced.

All nine current-head PR checks are green at review. No remaining review blocker was found. General owns merge and main verification; Sample App will then rerun only its failed policy/aggregate jobs on the unchanged, Security-approved consumer head before merging #341. Existing release/production boundaries are unchanged.