fix(quality): enforce PHPStan Level 8 across maintained PHP

[bnjmnrsh]

The complete maintained PHP profile still enforces Level 5. This raises it to Level 8 after resolving the same-scope findings, while preserving PHP 8.0 support, resource bytes and consumer synchronization contracts.

• Add accurate producer/consumer PHPDoc and check native file/XML results in tools and tests.
• Treat an unsuccessful resource/provenance hash as failed verification. A real CLI regression proves exit 1 and unchanged consumer bytes.
• Enforce Level 8 in configuration and the independent coverage guard. New controls reject a Level 7 downgrade and exercise Level 8-only nullable errors through the real Composer runner in every maintained role.

Baseline a78c337d6e841f73fabd2a811963eb529eed43a0: 16 maintained/direct entrypoints; cumulative L5/L6/L7/L8 counts 0/73/121/124. Candidate Level 8 is clean with the same population. Locked PHPStan 2.2.16; PHP 8.3.6 local; PHP 8.0/8.5 native qualification passed.

Published head 79d1b1006ea519adb79e37ecd178f10f6e7de7e3, tree 1ccea4b6183237b7bb3b447bafc624cceb088c96, matches local 7ad26ddf30b9be293e96ba0040b211817f1af446. Independent actual-PR COMMENT review5471136203 is clear. Native Quality37941416068 passed all four jobs: PHP8.0 floor, PHP8.5 compatibility, frontend and terminal quality. Focused hash/nullable/downgrade controls pass 3 tests/42 assertions; independent render/sync proof passes 10/43. Frozen Node 24.21.0/pnpm 11.13.1 install and full pnpm check pass. Full committed-HEAD composer check passed 56 tests/873 assertions, including real archive export/install/sync/immutable-provenance/no-dev-removal proof. Both native PHP lanes also passed 56/873. The task-local Composer executable-path issue was corrected without repository changes; its earlier failed run is superseded.

Resource PHP/CSS, locks, support floor, malformed fixtures, accepted narrow exceptions and automatic discovery remain unchanged. No baseline/ignore, PHPDoc-trust relaxation, shared policy change, consumer pin update or publication. Package release and consumer adoption remain separate decisions.

Scope: RocketsAreNostalgic/.github#152; programme #127, sizing #145, coordination #65. Merged under Ben's authorization as 496a7d9802bf504d081532ed161f3c8b8ee9ac85, preserving the reviewed tree. Post-main Quality37957229369 passed PHP 8.0/8.5, frontend and terminal quality. Level 8 enforcement is delivered; #152 is closed. Package publication and consumer adoption remain separate.

[bnjmnrsh]

Independent review of actual base a78c337 → head 79d1b10: no blocking findings. API-confirmed tree 1ccea4b6183237b7bb3b447bafc624cceb088c96 matches the frozen local candidate reviewed in a separate worktree; no existing review threads were present.

Producer/consumer PHPDoc describes validated configuration and generated resource/provenance metadata without asserting a prevalidated foreign lock schema. Malformed renderer inputs remain mixed; native reads are refined at their producers. The bounded unsuccessful-hash correction preserves destination/link short circuits, source/destination evaluation order, immutable metadata sequencing and exact JSON/newline bytes, and reports drift through the actual CLI. Resource PHP/CSS, manifests, locks, support floor, coverage and narrow exceptions remain unchanged; no broad ignores or PHPDoc trust relaxation.

Independent checks on the identical tree: maintained/direct coverage 16/16; hash-failure CLI, real Composer nullable controls in five roles (Level 8 failure/Level 7 success), and downgrade guard pass 3 tests/42 assertions; render/sync contracts pass 10 tests/43 assertions. These focused checks overlap on the hash test. Complete committed-HEAD Composer/archive-consumer qualification and native PHP 8.0/8.5 CI remain controller responsibilities and are not claimed complete by this review.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T14:11:36.616312Z	79d1b10	Draft marked ready
🔒 Security Review	✅ Completed 2026-10-09T14:10:57.240479Z	79d1b10	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.