Repository navigation
PHPStan: refresh Core-first Level 6–8 sizing and Booster profile inventory #145
Description
Completed — 10 October 2026
The sizing and applicability assessment is complete. Core's production, development and integration profiles enforce Level 8 through PR296, with successful exact-main Quality. Cohorts #146–152 and Starter PR35 are delivered; exact sizing, locked tools, reviewed exceptions and delivery evidence remain in their issues/PRs.
Embedded/generated PHP is explicitly resolved:
- Starter PR35 covers 44 maintained PHP files and four isolated snippets; post-main Quality passed.
- Support PR52, main
1515d9df29734a1c7da145a6f37fcbfb13a19666, moves six executed Bash/Node PHP invocations into four ordinary helpers selected by Level 8 (2 production/10 maintained). Malformed fixtures remain data; its finite invocation guard is not a general shell interpreter. Post-main CI passed. - Bootstrap PR27, main
beeef233dc8291902c54240653851744831f34e2, directly analyzes the exact shipped archive-inspector heredoc and recursively discovered maintained PHP using pinned PHPStan 2.2.8, Level 8/PHP 7.4 semantics/PHPDoc trust false. Node/pnpm remains the producer tooling; no Composer scaffolding or analyzer ships to consumers. Post-main Quality passed.
The inspector shipped in immutable Bootstrap 0.3.1; actual released-byte Provider readback is recorded. Runtime pack discovery requires no direct Core Composer pack pin. Generated copies remain maintainer-owned; installed/UI acceptance stays #81/#85.
No further Level 5–8 sizing or implementation is assigned here. Final ecosystem reconciliation is #127/#65, with existing controllers unchanged. No Level 9/10 expansion or Plugin Library reactivation.
Activity
bnjmnrsh commentedon Oct 8, 2026
Ben authorized starting Core's PHPStan Level8 work on 8 October at12:22BST. Claiming Core sizing and coordinated implementation under #145/#146/#147, starting from main42ff73f8cb15ee6e39ab0130c384d5e5e35fefcc (no open Core PRs). Production, development and integration remain Level5 today. Bounded agents will measure same-scope levels5–8 and group findings before allocating non-overlapping fixes; root retains shared contracts, configuration/gate promotion and integration. No baseline, broad ignores, scope narrowing, dependency changes or merge/publication authority. Branch installed proofs remain with their separate owner; Migrator CI is explicitly deferred until substantial work there warrants it. Existing UI/manual holds remain.
bnjmnrsh commentedon Oct 8, 2026
Core production sizing complete at42ff73f8cb15ee6e39ab0130c384d5e5e35fefcc: Level5=0; Level6=212 in49files; Level7=418 in64; Level8=492 in72. These are cumulative totals, not additive bug counts. Level6 consists entirely of missing iterable/property/parameter/return/generic types. Level7 adds206 occurrences; Level8 nets74 further occurrences, with some earlier diagnostics replaced by more precise nullable diagnostics. No global/internal errors. PHP8.3.6, locked PHPStan2.2.16, WordPress extension2.0.4, composer.lock SHA2566c3b450eab16ade6c3dfd2a624885d1a31a2b38f3fbcde81e5fb297be7bb5342. Actual production profile and roots/exclusions/PHPDoc trust unchanged; CLI --level only. Development/integration complete sizing still running.
First source cohort in progress under#146 is PHPDoc-only release-management/Secrets records plus shared RepositoryReleaseWorkflowStatus declaration repair. Next larger production groups should keep legacy Plugin/Theme/PackageModel/repositories together and separately coordinate generic database seams; real standalone doubles prevent simply declaring every database object wpdb. Preserve dynamic host contracts, validation and existing malformed-input tests. Findings do not establish492 runtime bugs or authorize type-driven architecture changes.
bnjmnrsh commentedon Oct 8, 2026
Core sizing now complete on exact42ff73f8cb15ee6e39ab0130c384d5e5e35fefcc with PHP8.3.6/PHPStan2.2.16 and unchanged locked dependencies, coverage and PHPDoc trust.
Totals are cumulative per level and are not independent defect counts. Development/integration used actual runner discovery and partition:363files,162 compatible batch,121 isolated development plus80 isolated integration (202 analyzer invocations per level), at most4 concurrent. Diagnostic driver scheduling was continuous rather than canonical waves; no CI performance claim. No global/internal errors or diagnostics outside selected maintained files. Private temporary level changes restored; diagnostic source worktrees clean.
Suggested later cohorts: legacy Plugin/Theme/PackageModel/repository contracts; database adapter seams preserving real standalone doubles; fixture type declarations; integration array shapes; then nullable guards and union-safe operations grouped by behavior. Negative-contract tests need explicit intent review, not blanket ignores. First PHPDoc-only release-management/secrets cohort is undergoing full canonical checks under#146. All blocking levels remain5 until clean scope-wide qualification and owner-approved promotion.
bnjmnrsh commentedon Oct 8, 2026
Branch sizing completed at mainb0104de6eba4b175b396e05780c37b3bdb5b0176 after PR81 delivery, using locked PHPStan2.2.13 on PHP8.3.6; profiles/roots/exclusions/trust unchanged, CLI --level only. Production L6=17/7files, L7=23/8, L8=28/10. Maintained (includes production) L6=31/13, L7=53/14, L8=58/16. All L6 findings are missing iterable value types; no global/internal errors. Totals cumulative, not independent bug counts. Ben selected Branch#149 as the next slice. Taking a repository-wide coherent missing-type/shape tranche, tracing producers/callers and preserving executable behavior; later nullable/native-boundary findings remain explicit. No blocking-level promotion in this slice.
bnjmnrsh commentedon Oct 8, 2026
Fresh Core sizing and attribution completed for PR272. Values below are cumulative diagnostic counts per profile/level, not additive bug counts.
Post269 exact782c692dfb3374557a5a083238af9ebea49eec97; current base37f2577bd2ea0a7770d7bcb93910eecde57fc4a8; candidate e579d15f6910b88d6e04543706be13d27a7f40bf, tree9c788706ce2a18a8d7b59d9f2ec35f8a3e731b55. #269 removes44/51/51 production findings; other profiles unchanged. #270 then removes one production and two development missing iterable-value return findings at each level through Branch beta.9's inherited baseline_now contract (AdmittedBranchHostAdapter, BoundaryAdmittedHost, ParityAdmittedHost); no additions. Its new installed proof adds one integration file with no diagnostics at6–8.
PR272 removes46 production missing-type findings and28 inherited development findings, with zero additions atL6. ProductionL7 additionally exposes one external get_plugins return-shape limitation; L8 also exposes five nullable repository hydration preconditions. These remain visible under#147: net production reductions45/40 atL7/L8, not a zero-new-diagnostic claim. Integration unchanged.
Locked PHP8.3.6/PHPStan2.2.16/phpstan-wordpress2.0.4/WordPress stubs7.0.1. Current lock SHA256 a454259dc18b9cfde3ba92cf939101466a4a9db937cfca57def78e8a7020b614. Installed dependency identities verified against each snapshot's lock. Each unchanged profile was run with CLI --level6/7/8 and --error-format=json. Canonical scripts/analyze-development.php --list and --list-batch supply all283 development files (162 compatible batch +121 isolated) and81 isolated integration files; post269 had80 integration. Four bounded concurrent invocations with distinct fixture worlds; no roots/exclusions/trust edits. All expected invocations completed with zero global/infrastructure errors. Counts are source-typing measurements, not CI performance claims.
Final-head local composer check and pinned pnpm check pass; exact-PR review clear. Hosted CI37834504073 still completing; final qualification tracked on272. All committed blocking levels remain5. No gate promotion, merge, release or ecosystem-wide acceptance.
bnjmnrsh commentedon Oct 8, 2026
Final qualification update: Core PR #272 is ready and unmerged at head e579d15f6910b88d6e04543706be13d27a7f40bf / base 37f2577bd2ea0a7770d7bcb93910eecde57fc4a8. Complete local composer/pnpm checks, independent exact-head review and native Quality 37834504073 all pass, including every installed WordPress/database lane. Previously reported counts and retained diagnostic dispositions are unchanged. The PR body now contains final evidence and remaining work; all enforcement remains Level 5 and merge/release/UI/manual holds remain.
bnjmnrsh commentedon Oct 8, 2026
Core PR #274, based on Ben's merged #272, is qualified locally at base
f79170f1ee9712dd93c113e66f5c9546e93b6641, headcb188294204d8a90e205bb42fa34c71edc5e073d.The admin/dashboard tranche removes 72 production Level 6 findings: Dashboard 22, provider/admin 24, package/webhook presentation 26. It changes 13 PHPDoc-only files (+174/-30) and generated POT references (+406/-406), with zero executable token changes, new types, public seams or persistent state. No tests, dependencies or shared configuration change.
Cumulative production diagnostics move 121/321/400 → 49/241/320 at Levels 6/7/8; development 126/288/318 → 120/282/312; integration remains 36/99/129. Level 7 and 8 each remove 82 and expose two truthful consumer-versus-broad-producer findings, independently dispositioned under #147. Counts are not additive bug totals.
The remaining production Level 6 inventory has 49 findings, led by Booster (14), CoreContainer (six), logging (four), repository release workflow preview (three) and local troubleshooting (three). Use this inventory to bound the next cohort; do not combine unrelated runtime correctness changes merely to chase counts. Canonical composer/pnpm checks and independent exact-PR source review pass; final hosted repository-quality job is pending, with runtime archive and all four installed matrix jobs green. Level 5 enforcement and all release/UI/manual holds remain.
bnjmnrsh commentedon Oct 8, 2026
Final qualification update: Core PR #274 is now ready for review, unmerged. Exact head
cb188294204d8a90e205bb42fa34c71edc5e073dand basef79170f1ee9712dd93c113e66f5c9546e93b6641are unchanged. Hosted Quality 37838715525 completed successfully, including repository quality, runtime archive and all four installed matrix jobs; GitGuardian also passed. Independent actual-PR review and both diagnostic supplements leave no outstanding source blocker. The PR contains the full counts, exact-head local checks and retained #147 follow-ups. Level 5 enforcement and all ownership/release/UI/manual holds remain; merge awaits Ben's explicit decision.bnjmnrsh commentedon Oct 8, 2026
Final qualification: Core PR #275 is ready and unmerged at head
f1ce34e16dbd00aedb389b201860af8ab799ed5c, based585719e600daeeb7cc66bdcb91d2123445ee044. Full local composer/pnpm checks, native Quality 37849026437, GitGuardian and renewed independent reviews 5463235672/5463282255 pass. All installed matrix jobs passed. PR #274 was squash-merged as explicitly authorized; its post-main Quality37847806722 also passed. No new merge or release has occurred; enforcement remains Level 5 and existing holds remain.Complete cumulative counts: production 49/241/320 → 2/192/306; development 120/282/312 → 120/283/313; integration unchanged 36/99/129. Production L6 removes 47 with none added; L7 removes 52/adds three; L8 removes 52/adds 38. The development addition appears at L7/L8. All higher-level additions are explicitly retained and independently dispositioned under #147; counts are not additive defects.
Nineteen production PHPDoc files (+125/-14), POT source references (+62/-62), zero executable line/type/seam/state growth. The two remaining production Level 6 cases are activation return flow and the PluginRepository/generic-Package fixture return contract. The next substantial sizing opportunity is development fixture contracts: StorageTestEnvironment 16, WebhookControllerTestEnvironment 11, AdminViewWordPressFunctions seven, PackageMagicReadTest six; all 120 development and 36 integration Level 6 findings remain. Preserve each incompatible fixture world and do not assume database objects are wpdb. Higher-level initialization, snapshot and reflection boundaries require focused evidence rather than a bulk suppression pass.
bnjmnrsh commentedon Oct 9, 2026
Fresh #151 Bitbucket sizing: main16627c927d45e3f83c06df721cb06367e63575d9, PHP8.3.6, locked PHPStan2.2.8, certified Core beta31 commit8a3ed5a8acdb3875f498e2f44bf9eba89fddbbaf with only locked production dependencies. Same development profile/coverage: cumulative L5=0,L6=10,L7=26,L8=27; no global analysis errors. Totals are cumulative diagnostics, not additive bug counts. Implementation batches:10 traced missing iterable/fixture PHPDoc contracts; remaining script DOM/file failure handling and fixture assertion narrowing; finally blocking8 plus real nullable/downgrade controls after qualification. Production gate8, runtime/public contracts/pins and actual-bootstrap controls remain untouched. Release Updater all-isolated measurements running; full population/lock identities and final qualification follow on#151. No merge/publication authority.
bnjmnrsh commentedon Oct 9, 2026
Fresh #151 baseline and first batches (9 October):
Counts cumulative per profile/level, not additive bugs. Both use PHP8.3.6/Composer2.10.3. Bitbucket locked PHPStan2.2.8, certified Core8a3ed5a8acdb3875f498e2f44bf9eba89fddbbaf with only its locked production dependencies. Release locked PHPStan2.2.13, WordPress-extension2.0.4,stubs7.1.0,PHPUnit11.5.56,coding-standard1.0.0; production36/tools3 stay8. Same coverage, configurations and trust settings; levels overridden only for measurement. No global errors.
One implementation agent per isolated repository branch; independent review agents retain no write ownership. Bitbucket first batch10 traced iterable/fixture declarations; remaining17 concern script DOM/file failure paths and genuine fixture assertion narrowing. Release first98 cover iterable/resource contracts and existing combined PHPDoc-tag formatting; preserve intentionally malformed inputs and all incompatible synthetic worlds. Later union/null findings remain diagnostics, not assumed runtime defects. Promote complete profiles to blocking8 with matching coverage-floor/downgrade guards and real Level8-specific error probes only after clean qualification.
No overlap found in recent#65/#127/#155/#156 comments or retained remote-branch handoffs; prior analysis branches remain untouched. PR113 merged on current Release main; post-main37759637366 attempt2 SUCCESS. Its discovery,1/2/4 bounds,child draining and failure propagation are preserved. Core/shared/Starter/Provider148/Migrator/UI/Plugin Library remain excluded; no production/API/pin change needed so far. No merge/publication/hold removal. Final canonical/host/native and actual-PR independent review pending. #151 remains open; parent#127,coordination#65,sizing#145.
bnjmnrsh commentedon Oct 9, 2026
Ben's authorized #275 squash merge is complete at
1004e217038959b5a9e4df28d27b2ca4a89ef62f; post-merge Quality 37855703153 passed.The next tranche is Core PR #276, base
1004e217038959b5a9e4df28d27b2ca4a89ef62f, headab66092f4643d6a8ea32235bf7e5cb7d66fef758, tree4d2bd73ea8483b71eabf9992d9c7ec476508e357.All 158 remaining Level 6 findings are removed with none added. Counts are cumulative, not additive defects. At each higher level production removes two, development 132, and integration 37 while exposing five pre-existing union boundaries; precise dispositions remain under #147.
Final-head
composer checkpassed (2,711 tests / 44,784 assertions);pnpm checkpassed (193 tests); focused production regressions passed (126 / 679). Hosted Quality 37906314102 passed all archive, repository and four installed WordPress/database jobs. GitGuardian passed. Independent actual-PR source review 5467781397 is clear.Three reviewable commits: production three PHP files (+10/-2), development 50 files (+239/-21), integration 12 files (+60/-7), POT source references (+46/-46). Only executable delta is one explicit successful null return; all fixture/test edits are PHPDoc-only. Zero new types, public seams or persistent state. Full automatic population and fixture isolation, non-wpdb doubles, dependencies, shared configuration and Level 5 enforcement are preserved.
PR #276 remains unmerged. No release or broader ecosystem acceptance is claimed; UI/manual/release holds and separate Branch Updater #149 ownership remain. Ben's PR-specific decision is required for an ordinary squash merge.
Independent diagnostic supplement 5467990854 independently parsed all 1,224 raw outputs, verified complete populations/source hashes and all nine comparisons, and confirmed the five retained integration findings. No outstanding source or diagnostic review blockers.
PR #276 is now ready for Ben's review.
Sizing checkpoint: Level 6 completion is now proposed in one qualified PR. Next implementation should be a bounded Level 7–8 correctness cohort, prioritizing existing producer/guard/initialization contracts; refresh after any merge. This does not authorize enforcement promotion.
bnjmnrsh commentedon Oct 9, 2026
Assessment only: Ben requested a bounded read-only Levels8/9/10 comparison. Fresh detached checkpoint main
3a9bea6aca32ebcef267e0fa0813b7055b304edb(merged PR276), tree4d2bd73ea8483b71eabf9992d9c7ec476508e357, identical to qualified PR headab66092f4643d6a8ea32235bf7e5cb7d66fef758/ Quality37906314102. No post-merge workflow was returned at inspection; qualification is the exact-tree PR evidence. No Core implementation ownership, branch/CI disturbance, fixes, gates, suppressions, PR or release. Preserve automatic populations and isolation; locked dependencies only. Environment initially lacks PHP/Composer; checking runtime availability and will explicitly report incomplete evidence. Results provisional while separately owned Level8 remediation continues.bnjmnrsh commentedon Oct 9, 2026
Completed Level9/10 diagnostic sizing — priorities, not implementation authorization
Full report, exact tool/lock tuple, qualification, population and evidence hashes.
Measured Core commit:
1004e217038959b5a9e4df28d27b2ca4a89ef62f. This corrects the prospective3a9bea6checkpoint announced in the assessment-start note. PR276 was merged, but its post-main Quality was observed in progress at completed-sweep selection; prior main1004e217 had successful post-main Quality37855703153. These are historical fixed-checkpoint measurements, not current main or PR278 counts.Exact multiset comparison removes zero prior findings. All612 outputs complete; no checker-global errors; unchanged345 production,283 development and81 integration direct files, with162 compatible development files batched and the remainder isolated. PHP8.3.6/PHPStan2.2.16, existing trust/exclusions/occurrence ignores retained. Independent review checked totals, deltas and711 source hashes.
Recommended order if further work is authorized after Level8
Recommendation: finish the existing Level8 programme, then measure one bounded producer-contract cohort before deciding on expansion. Level10 remains advisory/diagnostic. Counts are cumulative diagnostics, not bugs or work estimates; multiple consumers repeat one producer's uncertainty. No individual finding disposition or guaranteed reduction is claimed.
Current Core Level8 implementation/PR278 remains with its owner under #147. These recommendations create no implementation reservation, new programme, enforced level, baseline, exclusion, dependency change or release gate. Refresh live source/locks before taking any cohort. Full raw evidence and reproducible runner are identified by hashes in the linked primary report.
bnjmnrsh commentedon Oct 9, 2026
Ben-authorized #276 squash merge is delivered as
3a9bea6aca32ebcef267e0fa0813b7055b304edb, tree4d2bd73ea8483b71eabf9992d9c7ec476508e357, identical to its reviewed candidate. Post-main Quality 37909105367 passed.The next checkpoint, Core PR #278, is qualified at base
3a9bea6aca32ebcef267e0fa0813b7055b304edb, head6e55bf80f31ee34554b1719d195f55922617d220, treee377bcd7dee3a5ba85ac2e1ed052e50276dfd662.No findings added anywhere. Production removes 15 Level 7 and 37 Level 8 findings (cumulative, not additive bugs). The latter comprise eight provider producer/outcome contracts, twelve release control return/null relationships and seventeen display helper/null relationships. Three production files +38/-13, POT source references +57/-57; zero net executable lines, new types, public seams or state. No test, dependency or configuration changes.
Canonical
composer checkpassed (2,711 tests / 44,784 assertions);pnpm checkpassed (193 tests). Hosted Quality 37909823948, all four installed WordPress/database jobs and GitGuardian passed. Independent actual-PR source review 5468126623 is clear. Full final recount covers all 612 invocations with unchanged canonical populations and source hashes.Public duck-typed package contracts and unrelated/non-wpdb test doubles remain honest. Broader initialization, database/hydration, snapshot, reflection and duck-method follow-ups remain under #147, including prior integration stream/CLI boundaries. Automatic coverage, fixture isolation and Level 5 enforcement are preserved. Core #277 frontend adoption, satellite #151 and independent Level 9–10 assessment remain separate. Release/UI/manual holds remain; no release or broader acceptance claimed.
PR #278 remains unmerged and awaits Ben's specific decision; ordinary squash is the applicable merge method.
Independent final diagnostic supplement 5468371905 independently recomputed all 1,224 baseline/candidate raw outputs, verified populations and exact-commit source hashes, and confirmed all nine counts and zero additions. No outstanding review blockers.
PR #278 is now ready for Ben's review.
Sizing: the next production cohort should be selected from the remaining 175 Level 7 / 267 Level 8 findings, with database and duck-typed boundaries investigated before narrowing. Do not combine unrelated runtime changes simply to chase counts.
28 remaining items
bnjmnrsh commentedon Oct 9, 2026
The next Core checkpoint is PR285, fully qualified and unmerged:
9c91cef963d683d25933379f2947ba8e01466af9.4a291035d1555514c75f2ae4f586ebf54fad8613.33c55294672ab035d02053cad02039a794b16929.27 Level 7 findings and 85 cumulative Level 8 findings removed; zero additions. The counts are cumulative, not separate bug totals. All 618 candidate analysis groups completed with no global/invalid results and unchanged source hashes. Baseline reuse was verified against main's exact #283 tree and all 711 PHP blobs. Both new regression files entered isolated integration analysis automatically: 713 candidate PHP files, 283 development files (162 batched/121 isolated), 83 integration files. Baseline had 612 groups; no coverage configuration changed.
34 files +470/-221: production PHPDoc +35/-5; development +121/-44; integration/tests +149/-7; generated POT references +165/-165 with identical non-reference content. Complete webhook panel contracts, explicit fixture success assertions and truthful raw-row/variadic types preserve production execution. Magic-property tests retain all nine fields and 27 probes with exact diagnostic exceptions. Three regressions cover failed command reads, failed mysqli initialization without connection, and boolean CLI input rejection while preserving valid JSON execution.
Final-head composer check passes 2,719 tests/46,904 assertions, 36 characterizations and 206 analysis groups. pnpm check passes 193 tests and frontend gates. Quality37973638648, all four installed lanes, runtime archive and GitGuardian pass. Independent source review5473917761 is clear. Independent final evidence review5474099076 verifies all 1,230 raw baseline/candidate results, statuses, commands, source hashes, expanded populations and live qualification; no blockers.
Remaining: 136 Level 7 (132/1/3), 207 cumulative Level 8 (201/3/3). Non-production retains the deliberately malformed numeric-key webhook fixture, two nullable repository assignments, the historical beta27 constructor mismatch and two arbitrary transient-object property findings. The historical installed launcher/worker was not executed; no broader acceptance is claimed.
Production structural database/package objects, dynamic callbacks and container resolution need the next deliberate contract work. Valid non-wpdb doubles prepare array tokens, so blanket nominal annotations would be false. A genuine connection interface would change injection/error behavior and is a separate contract decision, not a typing-only claim.
Level 6 stays enforced; Level 7 promotion waits for all profiles to clear and separate gate qualification. #146 remains complete; #147 and #145/#127 remain open. Ben's specific approval is required to squash-merge PR285. Provider adoption, #149/#277, other repositories and release/UI/manual holds remain separate. PR284 was immediately closed following an older branch-name collision; its branch was preserved.
bnjmnrsh commentedon Oct 9, 2026
PR285 delivery verified: Ben squash-merged it as
dd02ba6e7e05fb685d41d7b2e2e7bc240f79cd75, whose sole parent is9c91cef963d683d25933379f2947ba8e01466af9and tree33c55294672ab035d02053cad02039a794b16929exactly matches the qualified candidate4a291035d1555514c75f2ae4f586ebf54fad8613. Post-main Quality37986100727 is now successful, including repository quality, runtime archive and all four installed lanes; release-candidate install readback was correctly skipped.The exact-tree qualified baseline is adopted: cumulative L6/L7/L8 production 0/132/201, development 0/1/3, integration 0/3/3. Remaining 136 Level7 / 207 cumulative Level8. Automatic coverage remains 713 PHP files, 283 development (162 batched/121 isolated), 83 integration, 206 groups per level. PR285's canonical checks and independent reviews5473917761/5474099076 apply to the identical tree. Earlier unmerged and post-main-pending statements are superseded.
Core-only follow-up continues under the new controller from this main commit, with separate source/evidence review. Level6 stays enforced and #146 stays complete. Provider adoption, other owners, held release PR271, UI and manual acceptance remain separate. No release or future merge authorized.
bnjmnrsh commentedon Oct 9, 2026
Updater Support PR52 is repaired, qualified and ready for Ben's specific merge decision, unmerged. This supersedes every earlier ready-at-af585fa claim: automated review4233493720 exposed a valid finite-guard gap after the previous review.
Final base
dc49b7e452edc3727218d53da50741330abc1389; headfd67d0d126add2abb30c83a9ff1bb6c3d07fa809; tree684b6340daf7c32ce312f6669d9d7434f64e6cc9. Published through the existing branch with expected-head lease against af585fa; tree matches locally qualified commit049e4bbce65d3299e337300647072d0e3e0fd48f (metadata differs). Repair changes only the two coverage-test files; full PR remains nine files +206/-26, tests/guidance only.The guard now catches command substitutions, subshells and literal environment assignments. Nine added rejection variants and eight acceptance variants run in both profiles; inert quoted fixtures and explicit analyzed helpers receiving stdin DATA remain accepted. Independent actual-checker reproduction passes36/36: reported forms pass the old guard and fail the repair. Finite literal checking is still documented honestly; no interpreter, per-file registry, baseline, new PHPStan suppression or blanket exemption.
Full canonical composer check passes with PHP8.4.26/Composer2.10.3/Node24.21.0/lockedPHPStan2.2.13: strict validation, syntax, WPCS, automatic2production/10maintained atLevel8, real coverage/failure controls, runtime contracts and13+2Node tests. Lock SHA256 remains d73f6db6ab264b223fe2a9a8cc9fb813aafc864a55d5aca0675911dc927e2101. Native CI37987528586 passes PHP8.2 floor, PHP8.5 compatibility and terminal quality on the exact head. Independent final-base/head COMMENT review5475075236 is clear. The automated review thread is addressed with exact evidence and resolved; PR body refreshed.
PR52 is a ready proposal, not main delivery or publication. Ben retains specific merge/release decisions. Previously delivered satellite work is not reopened; Core/consumer adoption and bootstrap producer #55/#56 remain separately owned. No release/manual/UI hold changed.
bnjmnrsh commentedon Oct 9, 2026
Core controller qualification: PR286 is ready for Ben's review and unmerged.
PR285 is delivered by squash at
dd02ba6e7e05fb685d41d7b2e2e7bc240f79cd75, exact qualified tree33c55294672ab035d02053cad02039a794b16929; post-main Quality37986100727 passed. PR286 base is that commit; headc709cf08ae2ebde92673b9768b4adbdf594a3afa, treed8ab98df00a486d61a592ce79debeb234854cb6d.Bounded nullable-boundary work removes 41 cumulative L8 findings, zero additions: production L6/L7/L8 0/132/162, development 0/1/1, integration 0/3/3. Remaining total 136 L7 / 166 cumulative L8. These are candidate totals until merged; main remains 136 L7 / 207 L8. Level6 enforcement is preserved; #146 remains complete and Level7 promotion is not ready.
Fresh baseline/candidate: all 1,236 raw groups independently audited, same 713 tracked PHP files, automatic discovery, isolated fixture worlds, four-process maximum and two exact exemptions preserved. Full
composer checkpassed (2,728 tests/47,187 assertions,36 characterization checks,206 analysis groups);pnpm checkpassed (193 tests). Native Quality37987786623, runtime archive, all four installed lanes and GitGuardian passed. Release-candidate readback skipped. Independent actual-PR source review5475094291 and final evidence review5475243160: no blockers.The PR records exact deltas/budget, raw comparison, environment repair limitation and remaining contracts. Structural database/package objects and dynamic container/callback contracts remain; malformed webhook and arbitrary transient-object fixtures are preserved. Historical phase4.4 installation was not executed. Provider beta.15, satellites and #149/#277 remain separate. All release/UI/manual holds remain; no broader acceptance, future merge or release is authorized.
bnjmnrsh commentedon Oct 9, 2026
Updater Support PR52 is now merged and post-main verified, superseding earlier unmerged/ready reports.
Ben-authorized squash merge is delivered as
1515d9df29734a1c7da145a6f37fcbfb13a19666, sole parentdc49b7e452edc3727218d53da50741330abc1389. Tree684b6340daf7c32ce312f6669d9d7434f64e6cc9exactly matches reviewed headfd67d0d126add2abb30c83a9ff1bb6c3d07fa809. Post-main CI37995241110 passed PHP 8.2 floor, PHP 8.5 compatibility and terminal quality. Main now delivers the automatic 2 production/10 maintained Level 8 coverage and repaired finite invocation guard. No release published; consumer adoption and existing holds remain separate.Ben asked to identify the next substantial tranche. Recommended candidate: the bootstrap producer's shipped RAN_ARCHIVE_INSPECTOR under the existing single-owner #55/#56 boundary. Refreshed main remains9913ffd0dc07ed973048dbc570c140bd74b39fd4, with no open producer PRs; extracted6147-byte SHA2566b35bf2f96a1a6e4f52658cd4f202b1efc4df1f0aa0ff45bbf2a337ff6a99b17 matches the assessment in #56 comment6086819242. Prior advisory L6/L7/L8 counts12/24/24 therefore remain applicable to that unchanged source; these are not24 established runtime/security defects.
Proposed outcome: truthful parameter/return contracts and explicit native failure boundaries, qualified against PHP7.4 semantics through Level8, preserving API3 and hostile ZIP defenses. Use the existing producer owner and settle an externally pinned analyzer route before permanent pnpm check enforcement; no artificial Composer scaffolding or executable package dependencies. Require full plugin/theme rendering, focused native-failure and hostile-ZIP regressions, twice-built identical pack and independent exact-generated-output review. This turn identifies the candidate only: no producer implementation claim, new gate, release or consumer/Core adoption.
bnjmnrsh commentedon Oct 9, 2026
Core delivery and qualification update:
5339db1a162f356830577721097f37e3f064ca93; treed8ab98df00a486d61a592ce79debeb234854cb6dmatches the qualified candidate. Post-main Quality 37995278735 passed on attempt 3. Docker Hub initialization failures and the failed-only retry's old-attempt archive rejection were resolved by rerunning the archive producer with dependents, with no gate change.fd64f8b37f5122c52eb823606d594434355a2eb9, tree937e2dab13f572fc090b52cfe3acc9f44008351f. It fixes failure state being erased by empty translations (11 regression cases) and preserves immutable repository-ID types. Production executable net growth is zero.Level 6 remains enforced; #146 stays complete; Level 7 promotion remains pending. Provider beta.15, satellites/#149/#277, historical phase 4.4 installation and release/UI/manual acceptance remain separate. No future merge, release or broader acceptance authorized.
bnjmnrsh commentedon Oct 9, 2026
Bootstrap inspector tranche: PR27 is implemented and independently qualified, unmerged/unpublished.
Final head f8bec3d3574f7fd4125204c6a1e94487887ecd5e / base9913ffd0dc07ed973048dbc570c140bd74b39fd4 / tree ed997ef684a823824e7e73714e133d73a469ea58 supersedes earlier b93f18a identity. Final delta is README-only accuracy correction; all executable/test blobs unchanged. Locked external PHPStan2.2.8 now enforces Level8 on exact shipped inspector + maintained fixture through pnpm check (baseline L6/7/8=12/24/24 → Level8 clean). PHP7.4 stdin diagnostic failure repaired. No Composer scaffolding, package/workflow dependencies, weakened ZIP controls or API3 changes.
Canonical check passed; full runtime suites passed PHP7.4.33/8.4.26/8.5.11. Final native Quality37998340020 passed. Two exact-head packs match SHA2561612742409f42ac3ea4a84a68404102e2dee9df0fd66d9fb4c6684a27d0b087e. Downloaded artifact11648406018 matches pack and all ten plugin/theme renders. Independent exact-head source/security/generated review5475863411 clear, including real ignored/extensionless PHP failure propagation. Automatic code review completed with no inline findings; automatic security review still running on preceding identical executable tree at latest refresh, not claimed clear.
Ben retains specific merge/publication decisions. Existing releases unchanged. Producer #55/#56 remains the single boundary; consumer/Core/Provider adoption, UI/manual acceptance and existing release holds remain separate. No main delivery or publication is claimed for this tranche.
bnjmnrsh commentedon Oct 9, 2026
Ben squash-merged bootstrap PR27. Verified main commit
beeef233dc8291902c54240653851744831f34e2, sole parent9913ffd0dc07ed973048dbc570c140bd74b39fd4, preserves reviewed treeed997ef684a823824e7e73714e133d73a469ea58. Post-main Quality37999825530 passed. Earlier unmerged/pending delivery statements are superseded. Automatic code/security reviews have completed on b93f18a; final README-only delta was independently reviewed at f8bec3d. Exact-head independent source/generated-output qualification remains applicable to the identical merged tree.Release Please PR28 — 0.3.1 is open, not merged/published by this controller. Main-source delivery is distinct from a released pack and actual consumer adoption.
Ben requested identification of the next substantial cut. Recommendation: bounded producer-to-Provider API3 artifact qualification under existing #81/#55/#56 ownership. Exercise the exact new pack through the current actual Provider parser/renderer, compare all ten generated outputs, execute plugin/theme generated build+verify paths in disposable local repositories, retain malformed archive/identity/conflict controls, and hand the exact tuple to the integration owner. First refresh Provider/Core composition and owner claims; do not infer acceptance from producer tests. Release28 qualification is a separate immediate prerequisite for publication. No new Provider/Core edits, site/UI operations, publication or competing owner are claimed by this recommendation. Known satellite Level8 source batches are delivered; Core remaining typing, shared caching and installed/manual acceptance retain their owners. #55/#56 remain open for their broader acceptance.
bnjmnrsh commentedon Oct 9, 2026
PR287 delivered: Ben squash-merged to
e247d4106e918d48fdb10e92beacc9862c8a30b1(parent5339db1a162f356830577721097f37e3f064ca93). Merged tree937e2dab13f572fc090b52cfe3acc9f44008351fexactly matches qualified headfd64f8b37f5122c52eb823606d594434355a2eb9; qualified evidence therefore carries forward by tree identity. Baseline: production L6/L7/L8 0/132/157, development 0/1/1, integration 0/3/3; totals 136 L7 / 161 cumulative L8. Post-main Quality run 37999672455 is still in progress on that exact merge commit: https://github.com/RocketsAreNostalgic/ran-booster/actions/runs/37999672455Next recommended substantial Core tranche: storage connection contracts across Database, CredentialUsageReader, RepositorySourceGuard, DeploymentAttemptRepository and ManagedReleaseStore. Target cohort is 62 L7 / 64 cumulative L8 findings, not a promised reduction. Independent read-only challenge supports this scope. Before implementation, settle supported injected-object and failure-timing contracts: valid array-token source-guard fixtures and deliberately partial probe fixtures prohibit a blanket wpdb annotation or an assumed universal interface. Record the exact production-line/type/seam/state budget before production additions. This is a proposal, not an approved interface design or implementation claim.
Level 6 remains enforced; #146 remains complete. No Level 7 promotion, provider beta.15 integration, satellite/Branch Updater work, release publication or broader UI/manual acceptance is included. All existing holds remain.
bnjmnrsh commentedon Oct 9, 2026
PR28 prepublication pack-to-consumer qualification is complete and independently clear at head
13d30cb4e899499316a5f906f5831154e3c30c4b, basebeeef233dc8291902c54240653851744831f34e2. Independent exact-head review5476084274 contains the full tuple and evidence.Native candidate Quality37999949006 passed all4jobs; canonical local pnpm check passed. Downloaded artifact11648219990/attempt1 matches two independent exact-head builds: 10243-byte ZIP SHA256
c12c26aa245e928c8c35e0b1b73abcda9090a347a83284cdb056abc4ec0ed330.Actual Provider beta14
a3ab400b5014735a8c0d3eb3862e27a6e93f8794and beta1585f41be3b9cbd8ec97bcccb262c48a599522ed35consumed those exact candidate bytes against both certified Core8a3ed5a8acdb3875f498e2f44bf9eba89fddbbafand current Coree247d4106e918d48fdb10e92beacc9862c8a30b1. Beta14 passed177tests/1557assertions per host; beta15 passed178/1646 per host. All10 renders match producer bytes/digests; plugin/theme generated build+verify executes twice with identical resulting archives. Hostile archive, identity and conflict suites remain unchanged. Full unchanged beta15 composer check/check:host passed including452tests/4036assertions, Level8 and coverage negative controls. No source defect/change needed; temporary candidate overlays independently reviewed and both Provider checkouts restored clean.Current Core actually bundles beta14; beta15/current-Core is prospective composition evidence only. Synthetic fixture release/asset IDs are not publication discovery. No Core adoption, certification pin change, installed-site/UI proof, remote target write, merge or release performed. Existing owners/holds remain. Automatic code/security review was separately requested on PR28; code review was still running and no security completion was recorded at this refresh, so neither is claimed cleared here.
Next owner decision after review disposition: approve PR28 merge AND its automatic0.3.1 publication consequence. Corrected custody sequence: merging creates a new source SHA, therefore fresh main Quality creates a different manifest/archive hash; the publisher promotes those exact tested bytes. After approved publication, verify real tag/release/asset immutability/digests, template/render parity with the qualified candidate and actual released-pack consumer readback. No premerge/postmerge ZIP-equality promise. Installed/manual #81/#85 acceptance remains separate; these broader issues are not closed.
bnjmnrsh commentedon Oct 10, 2026
Authorized merge stack is delivered and post-main verified. PR289 frontend squash78bf140ad41bc199a098ea5be22c521fa1bdc69d (Quality38011919120 success); PR290 published Provider beta.15 squash429f1566ff99dfc0a449e311df9f26ba8e7bc03a (Quality38012734657 success); PR291 collapsed into PR288, then squash db6478d2c52500803fca797f3e47a61b5a6e25bc. Its tree a7706eefd3456a775b4c6e3bcfb655fd9703cf72 exactly matches the combined qualified candidate; post-main Quality38013802508 is now SUCCESS, including archive and all four installed lanes. Release-candidate readback skipped for source work.
Current verified main advisory baseline: production0/36/59, development0/1/1, integration0/3/3 (L6/L7/L8), totals40L7/63 cumulativeL8. Full621-group candidate vs621-group PR291 audit found zero changes; canonical2760tests/47570assertions,36characterization,207analysis groups; frontend193tests; independent actual-tuple reviews5476851262/5476900587 clear.
Next Core contracts tranche PR292 is open at d96268d3e556477e3f19d7dbd4d1816536e11deb over db6478d2; full qualification and independent actual-PR review running. It has no merge authorization. Level6 remains enforced; #146 remains complete, Level7 promotion separate after all profiles clear.
bnjmnrsh commentedon Oct 10, 2026
PR292 is qualified at base db6478d2c52500803fca797f3e47a61b5a6e25bc / head d96268d3e556477e3f19d7dbd4d1816536e11deb / tree32d8fe93d687159f1c790030b9fe04797ece23e1. Removed4L7/18cumulativeL8, ZERO additions. Candidate production0/32/41, development0/1/1, integration0/3/3; remaining36L7/45cumulativeL8. Independent1242raw-result audit passed;719→720PHP automatically covered (prod351/dev283/int84/exact2protectedexemptions), source immutable, no invalid/global errors. Canonical composer passed2764tests/47540assertions/36characterization/207groups; frontend193tests. Same-source follow-up JUnit passed2764/47625,2759paired existingcases zero assertion decreases; original aggregate variance disclosed in PR, not attributed speculatively. Native38014420866 archive/repository/all4installed and GitGuardian green. Source review6092340264 clear; final evidence audit clear.
PR remains OPEN awaiting Ben's specific merge decision. No Level7 promotion, release publication or UI/manual/Migrator/historical acceptance. Earlier authorized PR289/290/291/288 stack is delivered; main db6478d2 postQuality38013802508 SUCCESS. Remaining work is bounded production database/nullable/dynamic contracts plus1development/3integration diagnostics. CodingStandards1.0.3 separate dev-lock adoption remains Core-owned/tooling-only; Providerbeta15 and frontend7fa candidate adopted/verified.
bnjmnrsh commentedon Oct 10, 2026
Core final qualification checkpoint: #147 (comment) .
PR293 (38cbf615ad018e79c1e231ef14f9b235fb3ea285 → f75b5c648d09b737ddc92d49f6b9497750cf7ceb) removes 33 Level 7 / 42 cumulative Level 8 diagnostics, zero additions. Separate stacked PR294 (→ dc79be9958d2f50477d30cc33a9b6ffca54a339b) promotes canonical Level 7 with three explicit arbitrary-transient property exceptions: all maintained profiles now report zero L7/L8 on that candidate. Lower-L6 advisory reports three unmatched-ignore diagnostics, explicitly disclosed; unmatched reporting remains enabled. L8 enforcement is separate.
724 PHP population, automatic discovery/isolation/exact two protected exemptions preserved. Both exact heads pass composer check (2,786 tests, 36 characterization checks, 210 groups), pnpm check (193 tests), native Quality38034064172/38034131222 and GitGuardian. Actual-PR source and final evidence reviews clear; 1,881 unique raw results audited. PRs remain OPEN, unmerged, awaiting Ben's specific approval. Main remains38cbf615ad018e79c1e231ef14f9b235fb3ea285 with PR292 post-main CI green. Combined-main/post-merge CI and adjacent integration reconciliation follow approved landing before RC; no release readback/acceptance inferred. Provider beta.15/frontend adopted; Standards1.0.3 acknowledged, separate tooling-only dev-lock adoption intentionally deferred. UI/manual/Migrator/historical holds preserved.
bnjmnrsh commentedon Oct 10, 2026
Completed — 10 October 2026
The sizing and applicability assessment is complete. Core's production, development and integration profiles enforce Level 8 through PR296, with successful exact-main Quality. Cohorts #146–152 and Starter PR35 are delivered; exact sizing, locked tools, reviewed exceptions and delivery evidence remain in their issues/PRs.
Embedded/generated PHP is explicitly resolved:
1515d9df29734a1c7da145a6f37fcbfb13a19666, moves six executed Bash/Node PHP invocations into four ordinary helpers selected by Level 8 (2 production/10 maintained). Malformed fixtures remain data; its finite invocation guard is not a general shell interpreter. Post-main CI passed.beeef233dc8291902c54240653851744831f34e2, directly analyzes the exact shipped archive-inspector heredoc and recursively discovered maintained PHP using pinned PHPStan 2.2.8, Level 8/PHP 7.4 semantics/PHPDoc trust false. Node/pnpm remains the producer tooling; no Composer scaffolding or analyzer ships to consumers. Post-main Quality passed.The inspector shipped in immutable Bootstrap 0.3.1; actual released-byte Provider readback is recorded. Runtime pack discovery requires no direct Core Composer pack pin. Generated copies remain maintainer-owned; installed/UI acceptance stays #81/#85.
No further Level 5–8 sizing or implementation is assigned here. Final ecosystem reconciliation is #127/#65, with existing controllers unchanged. No Level 9/10 expansion or Plugin Library reactivation.