[megyptm]

Closes #65. Refs #37 (RELEASE BLOCKED tracker; this PR does not change that). Related, out of scope: #69.

Base / Head / Tree

• Base: origin/main = 5a3399ae9b4efe8ec141f3745dca39d82d19a9d3 (tree 18e492f87a3a009a8479d78ad2e5226a0159caa1)
• HEAD: 5fda52071101a864abf109722c471df1ad7276c7
• Tree: be13452ad666ee07eaa94e5897c42f465d0ef94d
• 2 commits (a3eee58 initial, 5fda520 review fixes F72-01..04), 3 files (CONTRIBUTING.md, SECURITY.md, composer.json), +68/-3. No src/, tests, workflows, dependencies, constraints, pinned standards, version, composer.lock, Tag or Release.

Compliance matrix

ID	Requirement	Resolution	Evidence
F4-11	Explicit policy for advisories, abandoned, vulnerable direct, vulnerable transitive (CI §9)	Fixed: new "Dependency Audit Policy" in SECURITY.md: enforcement, 4-case table, runtime vs dev impact assessment, 6-step remediation incl. no-safe-version path, no exception mechanism	SECURITY.md
F4-11	Linked to real local and CI commands	Fixed: "Dependency audit" section in CONTRIBUTING.md; policy lists the CI jobs that audit (Quality, Unit/Regression, Integration, Lowest dependencies via check:lowest)	CONTRIBUTING.md, ci.yml unchanged
F4-11	Gate stays fail-closed	Unchanged: composer audit --no-interaction --abandoned=fail; no ignores, no waivers invented	workflow untouched
F4-05 / §9.3	16 keywords, recommended 6-15	Fixed: 15. Removed sort-order, a pure synonym of display-order (and of ordering) with no extra discovery value; php, maatify, persistence retained. GitHub Topics still contain sort-order (allowed by §9.3)	composer.json
F4-05 / §11.2	support.security	Fixed: https://github.com/Maatify/persistence/security/policy (GitHub's stable URL for the root SECURITY.md)	composer.json
F4-05 / §8, §27	description vs GitHub description	Fixed: now identical to the GitHub description ("...ordering, transaction, savepoint, and pagination utilities for PHP/MySQL applications."). Savepoint runner is in released v1.4.0. Unreleased features (deadlock-retry runners, getNextPositionForUpdate()) are not claimed	gh repo view

Gate results (local: PHP 8.4.4, Composer 2.8.6, MySQL 8.4.10 container, log_bin_trust_function_creators=1)

Gate	Result
composer validate --strict	pass
composer update, check-platform-reqs, dump-autoload --optimize --strict-psr	pass
composer audit --no-interaction --abandoned=fail (latest resolution)	pass: no advisories
composer analyse	pass, no errors
test:unit / test:regression	383 tests / 97 tests, OK
php-cs-fixer --dry-run --diff	0 of 103 files
check:syntax, check:whitespace	pass (118 files)
test:consumer (real MySQL, 2 runs)	pass
test:integration x2 (real MySQL)	223 tests OK, both runs
check:residue	pass, no residue
composer check:lowest (local)	exit 1: audit reports 2 advisories (see below; not caused by this change; tracked in #69)

CI: 10/10 completed SUCCESS on final HEAD 5fda52071101a864abf109722c471df1ad7276c7 — GitHub Actions run #39839472279, attempt 2, including Unit/Regression PHP 8.2–8.5, real MySQL 8.4.10 Integration PHP 8.2/8.5 twice each, Lowest Dependencies, Workflow lint, Quality and CI Gate. The original attempt had a PHP 8.3 job whose steps passed but whose conclusion remained in_progress; the Lead retried through GitHub without any code change, and attempt 2 finished 10/10. Tracked and reconciled under Issue #73 (closed).

Lowest-dependencies audit difference (recorded for #69; not addressed here)

Local composer check:lowest on PHP 8.4.4 / Composer 2.8.6 resolved and audited:

• phpunit/phpunit 11.5.0 (direct, require-dev), CVE-2026-24765 / GHSA-vvj3-c3rp-c85p, high, affected >=11.0.0,<11.5.50
• symfony/process v5.4.47 (transitive via friendsofphp/php-cs-fixer, dev-only), CVE-2026-24739 / GHSA-r39x-jcww-82v6, medium, affected <5.4.51

Both are development-only. Latest resolution audits clean (phpunit/phpunit 11.5.57). The CI Lowest dependencies job (PHP 8.2, Composer 2.10.2 per #69) was reported green; I did not reproduce its resolution, so I make no claim on why they differ and do not call either result a false positive. Constraints, dependencies and CI were deliberately not changed. After the run composer update was used to restore vendor/.

Boundaries respected

No change to src/, Public API, dependencies, constraints, workflows or pinned standards. composer.lock stays untracked (gitignored); no version, Tag or Release.

Follow Chart — Technical Lead

flowchart TD
  A[WU-3 Issue 65 and pinned compliance rules] --> B[Composer metadata and dependency policy]
  B --> C[Classify advisory or abandonment by path and runtime/dev]
  C --> D{Any affected or abandoned dependency?}
  D -->|Yes| E[Fail audit; preserve private reports]
  E --> F[Assess remediation and lower-bound implications]
  F --> G[Revalidate latest and lowest resolutions]
  D -->|No| G
  G --> H[Required local checks and full GitHub CI]
  H --> I[Independent full PR review]
  I --> J{Findings resolved and all jobs conclusive?}
  J -->|No| K[Correct documented defect or diagnose CI state]
  K --> H
  J -->|Yes| L[Owner-authorized merge only]
  L --> M[Reconcile merged tree and main CI; release tracker still blocked]

Loading

Review round 1 (F72-01..04), commit 5fda520, SECURITY.md only

ID	Fix
F72-01	Step 5 is private-first: undisclosed/sensitive details go through the private Reporting a Vulnerability channel; a public tracking issue only for already-public advisory metadata, no exploitable details
F72-02	Step 3 requires latest and lowest resolutions to audit clean; a vulnerable allowed lower bound is handled by a separate reviewed dependency change (not made here); #69 remains the separate root-cause investigation
F72-03	No repository-level waiver can be granted while pinned CI_WORKFLOW_STANDARD §9 applies; no owner-approved local relaxation; incompatible proposals need standards-governance resolution first
F72-04	maatify/exceptions and its transitive packages are runtime; ext-pdo/php are a separate platform-requirement class checked by check-platform-reqs, secured by PHP/host patching

Gates re-run locally on the new tree: validate --strict, audit (latest), PHPStan, unit 383, regression 97, cs-fixer, syntax, whitespace, consumer, integration x2 (223 each), residue: all pass. No src/, constraints, workflow, dependency or standards change.

Cumulative diff origin/main..HEAD

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index c60caf2..3362e98 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -86,6 +86,16 @@ anything and ignores all other objects. A unit test fails when tests or examples
 use a `maa_` name outside those prefixes. Run it after the integration and
 consumer runs, against the dedicated test database only.
 
+### Dependency audit
+
+Dependency security is governed by the [Dependency Audit Policy](SECURITY.md#dependency-audit-policy) in `SECURITY.md`. The enforcing command is the same locally and in CI, and it is fail-closed:
+
+```bash
+composer audit --no-interaction --abandoned=fail
+```
+
+Run it after dependency resolution (`composer install` or `composer update`). Any advisory or abandoned package, direct or transitive, runtime or development, fails the command and the CI job. Do not add `audit` ignores, `--no-audit`, `continue-on-error` or shell fallbacks, and do not weaken the CI workflow to get past a finding; follow the remediation steps in the policy instead. If your local result differs from CI (for example because of a different PHP or Composer version), record the exact versions and advisory IDs in the pull request rather than treating the difference as a false positive.
+
 ### Integration Testing
 
 Integration tests require a real MySQL database. SQLite is explicitly **not** supported as a substitute for these tests.
diff --git a/SECURITY.md b/SECURITY.md
index 675062f..6ba165d 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -54,6 +54,61 @@ The following areas are explicitly out of scope for this package's security poli
 * Misuse of the package that contradicts the documented contracts and intended usage.
 * External schema modifications or data corruption not caused by the package itself.
 
+## Dependency Audit Policy
+
+This policy applies [CI Workflow Standard §9](docs/php-engineering-standards/standards/packages/CI_WORKFLOW_STANDARD.md) (Composer Security Audit) to this repository. It covers security advisories, abandoned packages, vulnerable direct dependencies and vulnerable transitive dependencies. The audit gate is fail-closed and this policy does not weaken it.
+
+### Enforcement
+
+The audit runs after dependency resolution, with the same command locally and in CI:
+
+```bash
+composer audit --no-interaction --abandoned=fail
+```
+
+* Locally it is part of the verification sequence in [CONTRIBUTING.md](CONTRIBUTING.md#local-verification).
+* In CI ([`.github/workflows/ci.yml`](.github/workflows/ci.yml)) it runs in the `Quality`, `Unit/Regression` and `Integration` jobs after `composer update` and `composer check-platform-reqs`, and in the `Lowest dependencies` job through `composer check:lowest` (`scripts/resolve-lowest-dependencies.sh`).
+* A non-zero exit fails the job and therefore the `CI Gate`. The audit step is never `continue-on-error`, never followed by a shell fallback, and no `audit` ignore, `ignore-severity` or `--no-audit` option is configured or used.
+* `composer.lock` is not tracked, so the audit covers whatever versions the constraints in `composer.json` resolve to on the day it runs. A green audit is a statement about that resolution and that day's advisory data, not a permanent guarantee.
+
+### Cases covered
+
+| Case | Meaning | Gate result |
+| --- | --- | --- |
+| Security advisory | Composer reports an advisory for a resolved package version. | Fails. |
+| Abandoned package | A resolved package is marked abandoned. `--abandoned=fail` makes this an error. | Fails. |
+| Vulnerable direct dependency | The affected package is named in `require` or `require-dev` of `composer.json`. | Fails. |
+| Vulnerable transitive dependency | The affected package is only pulled in by another package. | Fails. |
+
+Every case fails the gate regardless of severity, and regardless of whether the affected code path is believed to be reachable. Impact assessment (below) decides how urgent and how broad the response is; it never decides that a finding may be ignored.
+
+### Assessing impact: runtime versus development
+
+Record, for each finding, the package, resolved version, advisory ID, severity, and which of these applies:
+
+* **Runtime** (Composer packages in `require`, currently `maatify/exceptions`, and the packages it pulls in): installed by every consumer, so it can affect consumers of this package. Treat it as in scope of this document's [Security Scope](#security-scope), prepare a fix with priority, and handle it under the [Disclosure Policy](#disclosure-policy) when it affects a published version.
+* **PHP platform requirement** (`ext-pdo`, and `php`): not a Composer-installed package, so `composer audit` does not report advisories against it. It is checked by `composer check-platform-reqs`; its security depends on PHP and host patching by the consuming environment.
+* **Development** (`require-dev`: PHPUnit, PHPStan, PHP-CS-Fixer and their dependencies): not installed for consumers and not shipped in the package, but it runs on contributor machines and in CI with repository access. It still blocks the gate and must be resolved, but it does not by itself imply a vulnerability in a published release.
+* **Both or unclear**: assess it as runtime until the dependency path is shown otherwise (`composer why <package>`, `composer why-not <package> <version>`).
+
+A finding is never described as a false positive without evidence that the advisory does not apply to the resolved version. Findings that differ between environments are recorded with exact versions (PHP, Composer, package and advisory IDs) and investigated separately; a difference is not, by itself, proof of either an exposure or a false positive.
+
+### Remediation
+
+1. Reproduce with the command above and capture `composer audit --format=json --abandoned=fail`, `composer show --tree` for the affected package, and the PHP and Composer versions.
+2. Establish the dependency path and whether the package is runtime or development.
+3. If a patched version exists within the current constraints, update to it (`composer update <package> --with-dependencies`). If it only exists outside the constraints, widen or raise the constraint in a reviewed pull request that states the compatibility impact.
+   * Updating a local `vendor/` does not remove an affected version that the declared constraints still allow. Because `composer.lock` is not tracked and the `Lowest dependencies` job resolves with `--prefer-lowest`, check that every supported resolution (latest and lowest) audits clean. If any of them can select an advisory-affected version, investigate and raise or narrow the relevant allowed lower bound in a separate reviewed dependency change, subject to compatibility review and the owner's governance, then re-run the latest and lowest audits and the tests. Differences between environments are investigated separately (Issue #69), not suppressed.
+4. For a transitive dependency, update the direct parent that requires it; if no parent release allows a safe version, report it to that package's maintainers and handle it as step 5 below. Do not patch files in `vendor/`.
+5. When no safe version is available yet, or an abandoned package has no replacement:
+   * The gate stays failing. Do not merge unrelated work over a failing audit, and do not add an ignore, skip, baseline or severity filter to make it pass.
+   * Handle it privately first. When the vulnerability details are undisclosed or sensitive, do not open a public issue or pull request for them; use the private channel in [Reporting a Vulnerability](#reporting-a-vulnerability) and record the dependency path, classification and upstream status there. A public tracking issue is acceptable only for already-public advisory or abandonment metadata (advisory ID, package, affected and fixed versions, upstream status), with no exploitable details and no private report content.
+   * Evaluate removing or replacing the dependency, or constraining the version range to exclude the affected versions, in a separate reviewed pull request.
+   * For a runtime finding that affects a published release, follow the [Disclosure Policy](#disclosure-policy).
+6. Verify the fix by re-running the full audit locally and in CI, including the `Lowest dependencies` job, and by recording the results in the pull request.
+
+This policy defines no exception or waiver mechanism, and none can be granted at repository level while the pinned CI Workflow Standard §9 applies: it forbids ignoring vulnerabilities and abandoned packages and requires the audit to stay fail-closed. No ignore, severity skip, baseline or owner-approved local relaxation is available. A proposal incompatible with the standard would first need its own authoritative standards-governance resolution; only after that could any downstream policy or workflow change be considered.
+
 ## Disclosure Policy
 
 Once a security vulnerability is reported via `[email protected]`, the Maatify team will:
diff --git a/composer.json b/composer.json
index 286c188..e00b07d 100644
--- a/composer.json
+++ b/composer.json
@@ -1,6 +1,6 @@
 {
   "name": "maatify/persistence",
-  "description": "Standalone, framework-agnostic PDO ordering, transaction, and pagination utilities for Maatify projects.",
+  "description": "Standalone, framework-agnostic PDO ordering, transaction, savepoint, and pagination utilities for PHP/MySQL applications.",
   "keywords": [
     "persistence",
     "pdo",
@@ -9,7 +9,6 @@
     "scoped-ordering",
     "global-ordering",
     "display-order",
-    "sort-order",
     "pagination",
     "pdo-pagination",
     "offset-pagination",
@@ -31,7 +30,8 @@
   ],
   "support": {
     "issues": "https://github.com/Maatify/persistence/issues",
-    "source": "https://github.com/Maatify/persistence"
+    "source": "https://github.com/Maatify/persistence",
+    "security": "https://github.com/Maatify/persistence/security/policy"
   },
   "autoload": {
     "psr-4": {

🤖 Generated with Claude Code

[megyptm]

Independent Full PR Review — WU-3 / PR #72 — CHANGES REQUIRED (MERGE NO-GO)

راجعت كامل التغيير التراكمي في SECURITY.md وCONTRIBUTING.md وcomposer.json، مع سياق الملفات والعقود السابقة وAGENTS.md وSTANDARDS_MANIFEST.md والمعايير المثبتة، ثم قارنت السياسة فعليًا مع .github/workflows/ci.yml وscripts/resolve-lowest-dependencies.sh وSECURITY.md وCONTRIBUTING.md الحاليين. الملاحظات أدناه مجموعة في جولة مراجعة واحدة.

Identity verified

• Base = merge base = current main: 5a3399ae9b4efe8ec141f3745dca39d82d19a9d3
• HEAD: a3eee589c2c68354427423a3eacc6b4bcde08849
• HEAD Tree: 429f0413e709ecb1ea0af5bbea1364edb959fd6b
• 1 commit, 3 changed files, +66/−3. Draft, open; not merged.

Required findings — consolidate corrections in one new commit

F72-01 — BLOCKER: public tracking instruction conflicts with private vulnerability reporting.

• SECURITY.md:101-105 instructs to “Open or update a tracking issue with the advisory ... evidence” whenever no safe version is available; the same file SECURITY.md:17-21 forbids public disclosure of exploitable details, and CONTRIBUTING.md:195-196 explicitly says do NOT open public issues or PRs for security vulnerabilities.
• Why material: an unqualified “open tracking issue with evidence” can cause private or not-yet-disclosed vulnerability and exploit details to be exposed in the public repository.
• Fix: explicitly require private-first intake/handling under the existing security channel when vulnerability details are undisclosed or sensitive. Public tracking, where suitable, may use already-public CVE/advisory metadata only, with no exploitable details or private security reports. Make steps 4–5 and the policy's links consistent; do not open a public security ticket as part of this correction.

F72-02 — REQUIRED: remediation policy misses vulnerable allowed lower bounds.

• SECURITY.md:97-106 says a patched version within current constraints should be handled by composer update <package> --with-dependencies, reserving constraint changes for patched versions outside constraints. But composer.lock is intentionally untracked, and the repository explicitly runs composer update --prefer-lowest in scripts/resolve-lowest-dependencies.sh:9-19.
• Why material: merely updating local vendor/ to a safe latest version does not exclude a vulnerable version still permitted at the declared lower bound. On the next lowest resolution, the audit can fail again; investigation(composer): reconcile lowest-deps audit differences across local and CI environments #69 reports this exact class of local vs CI behavior, without independently settling its cause.
• Fix: add an explicit branch: when any required supported resolution (especially Lowest Dependencies) can select an advisory-affected allowed version, investigate and raise/narrow the relevant allowed lower bound in a separate reviewed dependency change, subject to compatibility/owner governance, then re-run latest + lowest audit/tests. This WU must not change composer.json constraints. Preserve investigation(composer): reconcile lowest-deps audit differences across local and CI environments #69 as the separate root-cause investigation.

F72-03 — REQUIRED: do not imply repository-owner-only audit relaxation is policy-compliant.

• SECURITY.md:108: “Any change that relaxes the audit gate requires an explicit, separate change to this policy and to the CI workflow, reviewed and approved by the repository owner”. Read beside the no-waiver sentence, this leaves ambiguous whether a local Owner-approved weakening is an available exception.
• The currently pinned CI_WORKFLOW_STANDARD §9 expressly forbids ignoring vulnerabilities and abandoned packages and requires fail-closed audit.
• Fix: make explicit that no per-repository waiver/ignore/severity skip can be granted while the pinned standard applies. An incompatible policy proposal would require its own authoritative standards-governance resolution before any downstream change; do not suggest that merely editing local policy/workflow with owner approval is sufficient. No standard, audit gate or workflow change in this PR.

F72-04 — REQUIRED ACCURACY: distinguish Composer runtime packages from platform requirements.

• SECURITY.md:89 groups ext-pdo and maatify/exceptions as runtime dependencies “installed by every consumer”. ext-pdo is a PHP platform extension requirement, not a Composer-installed package version which composer audit discovers advisories against.
• Fix: describe maatify/exceptions and its Composer transitive dependencies as runtime packages; identify ext-pdo separately as a PHP platform requirement checked by platform validation, with its security supported by PHP/host patching rather than Composer package audit. Keep runtime/dev classification for Composer findings precise.

Reviewed and accepted without requiring change

• F4-05: composer.json keywords 16 → 15 by removing the synonym sort-order; php, maatify, persistence remain, and GitHub Topics need not be identical.
• support.security points to the repo security-policy entry; composer validate --strict passed.
• description is byte-for-byte identical to current GitHub repository description; published v1.4.0 contains PdoSavepointTransactionRunner, and no new unreleased class is named.
• F4-11 structure covers four audit categories, distinguishes runtime/dev and transitive/direct, preserves composer audit --no-interaction --abandoned=fail with no suppression. Its factual mapping to Quality, Unit/Regression, Integration and Lowest CI is accurate.
• No runtime/API/dependency constraint/workflow/pin changes; no lock or version committed.
• Exact-HEAD GitHub CI 39836419105: 10/10 SUCCESS. Lowest PHP8.2 clean audit, Unit 383, Regression 97, Integration 223 twice and residue; Integration PHP8.2 and PHP8.5: 223 twice per job, two clean consumer runs, no residue; Quality PHPStan clean; Workflow lint and CI Gate pass.
• Local PHP8.4.4/Composer2.8.6 lowest audit report is documented by executor (specific dev advisory packages and IDs); no determination of root cause or false-positive claim. Investigation is investigation(composer): reconcile lowest-deps audit differences across local and CI environments #69, not permission to suppress advisories here.

Required next delivery

Address F72-01..04 together in the narrowly scoped SECURITY.md (+ CONTRIBUTING.md only if needed), one new commit, no amend/force push, no src/, constraints, workflow, dependency or pinned-standard modifications. Update the PR body to the final HEAD/Tree and evidence, verify the policy has no contradictory private-reporting or waiver path, rerun relevant documentation/Composer validations and full CI 10/10. Do not merge or release. I will perform a Fresh Full Re-Review on the final aggregate tree. This review is MERGE NO-GO, not a declaration of runtime insecurity or a release decision.

[megyptm]

Independent Fresh Full Re-Review — WU-3 / PR #72 — MERGE GO (Owner authorization required)

Reviewed final immutable candidate: Base/main 5a3399ae9b4efe8ec141f3745dca39d82d19a9d3; HEAD 5fda52071101a864abf109722c471df1ad7276c7; Tree be13452ad666ee07eaa94e5897c42f465d0ef94d; two additive commits; total 3 files, +68/−3 (SECURITY.md, CONTRIBUTING.md, composer.json). I inspected the complete aggregate PR diff and actual entire final files, not only the correction commit; compared old and new policy wording against AGENTS.md, the VALID Pinned Adoption / Manifest, CI_WORKFLOW_STANDARD §9, COMPOSER_PACKAGE_STANDARD §§8,9,11.2,27, SECURITY.md existing private reporting and CONTRIBUTING.md, scripts/resolve-lowest-dependencies.sh and real workflow steps. Verified the Git tree and full CI checks independently; updated the PR description with accurate CI evidence and the English Technical Lead-owned Follow Chart. No code change by the reviewer.

All round-1 findings resolved — full acceptance matrix

Requirement / prior finding	Independent judgment and evidence
F72-01 confidential disclosure	PASS — SECURITY.md step 5 now explicitly requires private handling of sensitive/undisclosed vulnerabilities, in harmony with Reporting a Vulnerability and CONTRIBUTING.md prohibition. Public tracking is restricted to already-public, non-exploitable advisory/abandonment metadata.
F72-02 vulnerable permitted lower bounds	PASS — step 3 differentiates a local vendor/ upgrade from ensuring composer.json permits no vulnerable lower bound in the latest/lowest supported resolutions. It directs necessary constraint remediation through a separate reviewed dependency change, preserving #69's independent investigation; no constraints were changed here.
F72-03 no local waiver	PASS — step 6 conclusion expressly rejects all per-repository waivers, including Owner-approved local relaxations, while the pinned fail-closed Standard applies. Any incompatible future proposal belongs in authoritative standards governance first, not an implicit local exception.
F72-04 platform vs Composer runtime	PASS — maatify/exceptions and Composer transitive packages are correctly separated from platform requirements php/ext-pdo; their checks and patch ownership are described accurately.
F4-11 CI §9 audit policy	PASS — covers advisories, abandoned, direct and transitive vulnerable packages; classification of runtime/dev; explicit fail-closed command; handling of no-fix paths. Local↔CI command mapping correctly follows .github/workflows/ci.yml and scripts/resolve-lowest-dependencies.sh.
F4-05 Composer metadata	PASS — 15 accurate keywords (sort-order removed), required php, maatify, persistence retained; stable security-policy support URL; description semantically and literally synchronized with the actual repository description, and savepoint exists in released v1.4.0, without claiming new unreleased runner names.
Scope/public contract	PASS — no src/, tests, CI/workflow, dependency versions/constraints, schemas, pinned standards, public API or release controls changed. composer.lock untracked; no version, Tag or Release.

Required GitHub CI — confirmed 10/10 SUCCESS

Verified directly on exact HEAD: run #39839472279, attempt 2: all ten Check Runs completed / success, including the CI Gate.

• Unit/Regression PHP 8.2, 8.3, 8.4, 8.5: PASS (PHP 8.3 log proves 383 tests / 2688 assertions, 97 / 1085 and clean audit).
• Lowest PHP 8.2 / MySQL 8.4.10: clean audit, PHPStan no errors, Unit 383, Regression 97, real MySQL Integration 223 twice (1701 / 1694 assertions), no residue.
• Integration PHP 8.2 / 8.5 and real MySQL: 223 twice per job (PHP8.2: 1683 / 1682; PHP8.5: 1688 / 1688 assertions); two-run Consumer Verification Harness PASS for each, no DB residue.
• Quality, Workflow lint, Composer validation/audit, syntax/style/whitespace and CI Gate: PASS.

CI reporting anomaly reconciled, not masked: attempt 1's workflow and CI Gate showed SUCCESS while PHP 8.3 lacked a terminal conclusion despite all successful steps. I invoked GitHub's rerun-job for that job, without any repository commit, force-push, workflow or source modification. Attempt 2 genuinely completed 10/10. Tracked with factual evidence and closed investigation #73.

Distinct #69 advisory discrepancy: executor reported two dev-only local PHP8.4/Composer2.8.6 lowest-resolution advisories (PHPUnit and symfony/process; IDs recorded in PR description), while required GitHub PHP8.2/Composer2.10.2 Lowest full gate passes. The underlying environment-dependent root cause is not independently established or waived and stays owned by #69. No ignore or advisory relaxation was introduced.

Decision

WU-3 / #65: MERGE GO on exact HEAD 5fda52071101a864abf109722c471df1ad7276c7 and Tree be13452ad666ee07eaa94e5897c42f465d0ef94d. No unresolved WU-3 review findings, all CI jobs conclusive and green. This is Technical Lead acceptance, not an actual merge or approval of any Tag/Release. PR remains Draft until Owner authorizes merging. After merge: verify squash main commit Tree equals reviewed Tree, new main CI, #65 closure, #37 tracker reconciliation; keep #66 / #69 separate. #37 remains RELEASE BLOCKED; full Step 4/5 final repository compliance and release decisions are not implied by this PR.