fix: propagate PHP syntax discovery failures

[bnjmnrsh]

The shared PHP-library floor/current and WordPress-plugin syntax steps read find through Bash process substitution. An error from find can therefore leave the step green, even after emitting a partial file list. This repairs the focused finding recorded in #65 comment6041408184.

Write the existing NUL-separated selection to a temporary file in a checked command before parsing it; clean the inventory on exit. Existing discovery scope, support ranges, gates and workflow activation remain unchanged.

A focused contract exercises all three actual YAML run blocks: empty/partial discovery failures, first/middle parser failures, missing interpreter, failed temporary-file creation, normal paths including spaces/newlines, and existing exclusions. The dedicated read-only native test follows the repository's contract-workflow pattern; no general test entrypoint exists outside release-specific suites.

Base70df865a00734542e6bb663e684d86b8b4757b8e; head19311b758c3ca0180f7deaf21befcdfe720c9b45; tree4d98f1c0161f661fdfe29aad069dd15f4cf4b155, equal local6149dcd. Local24 controls, Profile A/B and22 liveness controls pass. Independent review/native CI qualification pending. No overlap with documentation142.

This repository uses merge commits so exact reviewed provider commits remain reachable. Await Ben's specific merge decision; consumer pin adoption remains separate.

[bnjmnrsh]

Independent exact-candidate review: no blocking findings. Fetched published head 19311b7, confirmed sole parent/base 70df865 and tree 4d98f1c0161f661fdfe29aad069dd15f4cf4b155, byte-identical to independently tested local candidate 6149dcd217c4f5b8ca9546098786e6ccf307f3dc.

Reviewed all four changed files. The three actual reusable-workflow lint blocks now complete a separately status-checked NUL inventory before invoking PHP; a partial failing producer cannot look like complete discovery. Existing PHP suffix selection and root vendor/node_modules pruning remain unchanged. The small dedicated native workflow follows the repository's existing contract-workflow pattern with immutable checkout and disabled persisted credentials.

Independent reproduction extracted the original minimum-library lint block: a find replacement emitted one valid PHP path then exited 23, while the old block incorrectly exited 0. Independent execution of the candidate's actual-block contract passed all 24 controls across all three blocks: normal paths including spaces/newlines and nested vendor, empty inventory, discovery failure with no/partial output, parser failure at first/middle entries, missing interpreter, and temporary-file creation failure. Exact statuses, no lint after incomplete discovery, stop-on-first-parser-error, and temporary inventory cleanup are asserted.

No workflow execution or PHP syntax bypasses, dependency/runtime changes, or broadened exclusion policy were found. Root retains native qualification and the owner's merge decision; .github's documented merge-only method remains applicable.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-07T18:03:46.030392Z	19311b7	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-07T18:05:00.041503Z	19311b7	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[bnjmnrsh]

Final source qualification at19311b758c3ca0180f7deaf21befcdfe720c9b45/base70df865a00734542e6bb663e684d86b8b4757b8e/tree4d98f1c0161f661fdfe29aad069dd15f4cf4b155: local actual-block24 controls, Profile A/B and22 liveness controls pass. Independent exact-published review5446305968 found no blockers and reproduced the original partial-find failure. Native PHP syntax contract and GitGuardian pass; unrelated reusable/required provider jobs are intentionally skipped for this central-repository PR. No unresolved review threads at refresh. Ready for Ben's merge-commit decision. Exact consumer pins do not adopt this fix until separately updated after delivery.

[bnjmnrsh]

Current-main requalification: .github main advanced through142/144 to222e4e0de644cd7954d75351797e4425a3e54f3a. Refreshed this working branch with a non-force merge of current main, preserving reviewed provider19311b758c3ca0180f7deaf21befcdfe720c9b45. New head87e0b380092e0780861a5d9f6690a07f9d3dd0ac/treefd0783349b6c189122765c4c625bbaedb34e815c matches independently composed/tested content. Against current main the same four-file +137/-3 repair remains, with no overlap with intervening main changes. Local syntax24, Profile A/B and liveness22 controls pass. Fresh native CI and published-head independent review are required and underway. This is candidate preparation only; no merge into main, release, pin adoption or owner authorization implied.

[bnjmnrsh]

Independent current-base requalification: no blocking findings on published head 87e0b38 against current main 222e4e0.

Independently fetched the published commit through GitHub and verified tree fd0783349b6c189122765c4c625bbaedb34e815c and parents 19311b7 plus 222e4e0. The tree is identical to my separately composed and tested current-main candidate. GitHub comparison confirms current main is an ancestor and the complete base-to-head change remains exactly the four intended files, +137/-3. Intervening documentation and profile changes are preserved; no source scope expansion or merge conflict was introduced.

Independent local verification on that exact tree passed all 24 actual PHP syntax-step controls with PHP 8.3.6, the Profile A contract, the Profile B contract, all 22 release-liveness controls, and git diff --check. The three lint blocks still complete checked NUL-separated discovery before parsing and retain the existing selection and exclusions. The original reviewed provider commit remains reachable.

This COMMENT records technical requalification of the refreshed candidate only. The coordinator retains exact-head native CI verification; Ben's specific merge decision and subsequent consumer pin adoption remain separate gates. No merge or publication authorization is implied.