[rmcdaniel]

Fixes the runner setup failure in published PHP replay 42528752031. The tooling image's PHP has a low-port file capability; the fully capability-dropped runner could not execute it. Use a byte-identical interpreter copy without extended attributes in private executable tmpfs, verify equality and absent file capabilities, and record its hashes and process capability state.

The runner retains cap-drop ALL, no-new-privileges, a read-only root, ownership/cleanup checks and all published product pins. The original PHP matrix helper and 13-scenario expander are unchanged. No SDK, Server, image or policy change.

Validation: normal source CI passed; the full rollup has 63 successful checks and one intended skip, including the separately selected complete replay. Runtime 42531701411 executed and passed all 13 scenarios on MySQL with normal published SDK 3.11.0 and Native 3.3.0, no product source overlay. Original/copied PHP hashes match, CapEff and CapBnd are zero, NoNewPrivs is one, and cleanup=0. The original 0-of-13 setup NONPASS remains attributed. Local shell/static checks and 89 existing isolated unit tests also passed.

Follow-up to #1106 for sdk-php#269. Source is ready; ordinary integration follows the in-flight #1099 train.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

General SOURCE PASS at exact head dc417c08d0e39310f7debde7b14a3d81b0ea7a96. Normal source checks and the separate complete published PHP replay are terminal green:63success/1intended skip, zero statuses. The runtime's13of13case evidence, provenance, separate/restarted processes, exact callback counts and cleanup are independently audited at SDK269/6728241134. No same-source rerun or capability exemption occurred.

Select mark-ready only now. Keep the PR out of the queue until #1099 returns actual-main custody, then review the disjoint-base integration and select one ordinary queue entry separately. No rebase, queue entry, merge or publication is selected here.

[rmcdaniel]

Select one ordinary merge-queue entry for #1107, exact head dc417c08d0e39310f7debde7b14a3d81b0ea7a96. Its source and selected full published PHP runtime are green: 63 successful checks, one intended skip, zero statuses; all required checks pass. Full runtime audit: 13 executed scenarios, zero skips, exact published Server 3.3.0 / SDK 3.11.0, cleanup=0. #1099 has returned terminal actual-main custody.

Actual main is now a5498678ae7e35c5562a8f1a73630e1b77b42aa6. The PR's cached base/test-merge still names db6518f5; the source head remains unchanged. General independently computed the clean combined tree 673b20e136bc0dd2727d280470d3cf7874e89948: the 2,050-byte delta is byte-identical to the qualified delta (023c05fe…), its only path is the PHP replay shell host, and the complete Rust tree equals actual main. No rebase or source retry is needed. The ordinary merge group must qualify that actual combination; verify its parents/tree after entry rather than treating the cached PR merge as current.

Queue is empty. Enqueue once with expectedHeadOid bound to the head, no bypass or admin merge. Ceiling 45 minutes from entry; if the exact entry remains live then, dequeue it once and stop. After merge require valid signature, reviewed combined tree, ordered parents and original actual-main terminal checks before leased topic deletion. The frozen Native qualification runner, product tag/image and product source remain unchanged. #269 stays open through this integration custody; 3.3.1 source preparation follows separately.

[rmcdaniel]

General returns #1107 actual-main custody. The ordinary entry merged at 23:47:37 UTC as 6d80fbe6bda493b161288adabcb2fd06a48f0cdd: valid signature, ordered parents [a5498678, dc417c08], tree 673b20e136bc0dd2727d280470d3cf7874e89948 exactly equals the independently reviewed combined tree. The original entry completed inside its ceiling; no dequeue or re-entry occurred.

Original main qualification is terminal: 79 checks = 71 success, 8 expected skips; zero statuses, all ten original workflows terminal on attempt 1. The exact published runtime remains 13 executed replay scenarios, zero skips, byte-identical PHP copy with CapEff/CapBnd=0, NoNewPrivs=1 and cleanup=0. No same-source runtime rerun was needed.

The topic was deleted once with the exact dc417c08 lease after ancestry/no-open-PR guards; API404 and empty ls-remote confirm absence. WIP/local preparations and the frozen Native qualification runner remain preserved. Product tags/images are unchanged.

The runner integration gate is complete. SDK #269 remains open for the final-audit C2/C5 coverage correction; this main result is not a substitute for that direct installed evidence. General continues the separate 3.3.1 source/qualification preparation.