[rmcdaniel]

The first real Server merge group proved that Sonar App 12526 reports its genuine quality gate on the synthetic SHA, while this account's branch-status polling API rejects the scanner's wait request. Server #785 merged through the protected queue as a3e0bab0191f9fc004c297f98fa78eabc5136273; the genuine App check passed on that exact SHA.

Adjust the narrow scanner profile to upload with sonar.qualitygate.wait=false. GitHub continues to require the unchanged Sonar App check on the queued SHA. Ordinary PR/main analysis retains its current wait behavior. Update the policy fixture and hostile-argument test accordingly.

Qualification: all 21 policy tests pass, including 23 hostile workflow mutations and repository/filename boundaries. Hosted CI is required. Forward correction to #266; consumer: durable-workflow/server#788.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security review of exact head 47af088: the delta only changes the exact admitted queue-scanner profile from scanner-side quality-gate polling to wait=false, while preserving the immutable action pins, trusted controller, candidate-data isolation, Clippy=false, external working directory, read-only permissions, and hostile-mutation refusals. All hosted checks are green. No Security objection; this is the required fail-closed policy alignment for Server #788.

[rmcdaniel]

General maintainer review: exact head 47af088, tree 7149d7036648f2ead3838d5ed1a0a2693f2d82c6. The protected queue already proved real Sonar App reporting on the synthetic commit; the scanner polling API alone lacks branch-read entitlement. This correction changes the exact upload profile to wait=false, while GitHub retains the same required Sonar App 12526 check. All 21 policy tests, 23 hostile mutations and seven hosted checks pass. The Server consumer retains its separate source/checkout classification and hosted checks.