[rmcdaniel]

Updating or reopening a PR could leave duplicate PHPUnit cycles consuming runners. Job-level always() also kept an older job alive after cancellation was requested. Give each PR one native concurrency group and allow its feature/final qualification jobs to stop when cancelled, while continuing to report dependency failures.

Main and manual qualifications have independent run IDs. All test, coverage, action-policy and cleanup commands are preserved; cleanup steps still run unconditionally. Actionlint1.7.7 and the current central action policy pass locally. Hosted cancellation and full current-head qualification are in progress; the earlier policy-contract failure is preserved as failed, with its fail-closed behavior verified.

Refs #750. GitHub documents why a bare job-level always() resists cancellation. The temporary base probe did not trigger PHPUnit and is removed; the PR is back on main. Native fixture execution/source and publisher workflows are unchanged.

[rmcdaniel]

Security review of exact head d5bf1d0 (tree e9ffdf4ba73542970616743b97f8b3f833da6d6e): no blocking finding. The change is limited to phpunit-feature.yml. Its concurrency key uses event plus PR number so only a newer cycle for the same pull request is superseded; main and manual runs use unique run IDs, and cancel-in-progress is false outside pull_request. Both feature and final qualification retain always() failure reporting while adding !cancelled(), so policy/test failures remain visible and a superseded run can terminate. Workflow permissions, action pins, test/coverage commands, policy gates and cleanup steps are unchanged. Hosted predecessor 40138507216 proves automatic cancellation of the live feature job while cleanup completed; its final-gate failure is preserved evidence for the qualification guard added by this exact head. Central policy, actionlint and repository contracts pass. Merge remains gated on terminal checks for this exact head. The shared maintainer account cannot formally approve its own pull request, so this comment records the independent Security review.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Hosted cancellation proof for current d5bf1d0addb07cab002ce58398376ca5e86bc84b:

• The new cycle40138591249 was created22:26:49UTC. Its live predecessor 40138507216 automatically cancelled the running feature job at22:27:24: 35seconds, then completed cancellation at22:27:29. No cancel API or UI action was used on that predecessor.
• This reproduces and corrects the job-level always() problem seen in the earlier probe. Cleanup completed during cancellation; the old final qualification's failure is retained as evidence for the cancellation-aware final guard now in this exact head.
• Current action-policy and repository-contract checks pass. Actionlint1.7.7 and the existing central policy also pass locally. The earlier plain !cancelled() policy-contract failure remains failed; both downstream required gates correctly refused that failed policy result.
• Independent Security review accepted this exact head. The final full feature/CodeQL checks are still live; merge waits for their terminal result.

The source commands, checks and cleanup remain intact, and main/manual cycles use independent run identities. The temporary same-commit base probe did not trigger PHPUnit and was removed; the PR targetsmain. Retargeting alone was not the #745 duplicate trigger: its owner confirmed that a close/reopen after retargeting created the extra run.

[rmcdaniel]

PR #751 merged normally at dcb2d718085b8ae91ce7e58a0cf5e2b9a5daa176, preserving the exact reviewed/qualified tree e9ffdf4ba73542970616743b97f8b3f833da6d6e. All final-head PR checks passed, including full PHP qualification and CodeQL. Security review accepted the same head, and the merged remote branch is verified absent.

Automatic cancellation is measured: the superseded live feature job stopped35seconds after its successor was created; no manual cancel was used for that proof. All test/coverage/policy and cleanup commands remain intact. Main and manual runs have independent run IDs.

Independent main verification is now running at this exact merge: PHP qualification, CodeQL, Sonar, and the public-boundary workflow (already passed). Keep #750 open until this final verification is terminal; do not reinterpret the earlier failed policy-contract probe or cancelled predecessors as passing runs.