[rmcdaniel]

Part of #325. Serves caller-indexed Nexus operation reads like published Server 2.11.1, fixture first. These are read-only control-plane routes in the request's namespace.

Fixture first (01e803b26). The new nexus-operations fixture was recorded from published 2.11.1 three times, with identical results. It reads GET /api/workflows/{id}/nexus-operations and GET /api/workflows/{id}/runs/{runId}/nexus-operations: a workflow's and one run's outbound service calls in the request's namespace, with no existence check, and every form of the limit query.

Native (363a0edc4):

• Both routes list the namespace's service calls for that caller, newest first, in PHP's row shape.
• The limit follows PHP's (int) cast and is capped at the configured 200.
• Named namespaces may read them.
• Native holds no service-call rows yet (workflow_service_calls is written only by service endpoints, which are still unserved), so its lists are empty, as the fixture records.
• Unit tests cover PHP's limit cast and the re-encoding of decoded JSON columns.
• 894286739 adds an execution test that seeds workflow_service_calls rows. It checks the row shape (an empty map renders as [], attempt counting, ISO times), newest-first order, limit, the run-scoped form and namespace scoping. It passes on SQLite, PostgreSQL and MySQL.
• Two more published route methods are served: they leave unserved-php-routes.v2.11.1.txt, and native now serves 145 of the 175 published route methods with current main (Rust #325: serve workflow-task cancellation scopes (open, prepare, deliver) #771) merged in.

Qualification: head 5ba6f0135 (current main 5867f369 merged, which includes #771):

• SQLite, all targets: lib 310 and execution 520 pass.
• Native shared fixtures recorded over HTTP against a debug server: nexus-operations and cancellation-scopes pass on SQLite, PostgreSQL 17, MySQL 8 and MariaDB 10.11.
• PostgreSQL 17 and MySQL 8: execution nexus_operations and completion_budget pass, 11/11 on each.
• No PHP app/ source changes.

🤖 Generated with Claude Code

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Hosted CI on exact head 5ba6f0135c5996c7170256252ab172e2db17de1d (tree 72cb1dfb03993e7046fcc13874332de14089cb42) is terminal: 56 checks pass, 0 fail. One check is skipped by design: Candidate cancellation and prepared-local source qualification, which applies only to candidate-source runs. Runs: Shared Server fixtures 40271359651, PHPUnit Feature 40271359587, SonarQube 40271359586, Public Boundary 40271359591, PR #772 40271357303, all successful. The merge state is clean against main 5867f369. Security's source review passed (server-325 cursor 2039); merge is held for its final clearance on this head.

[rmcdaniel]

Security clearance received for exact head 5ba6f0135c5996c7170256252ab172e2db17de1d, tree 72cb1dfb03993e7046fcc13874332de14089cb42, and only that head. Source: sender security, session 01a16c9c-ac8d-7280-bed7-a647973bc7d1, server-325 chat cursor 2050, client message security-772-final-clearance-5ba6f013-20261026. The source review passed earlier (cursor 2039). Hosted evidence is terminal on the unchanged head: Shared Server fixtures 40271359651 succeeded (43/43 jobs), and the rollup is all success with one documented path-inapplicable skip, 0 fail or pending; merge state clean. Scope is the reviewed read-only caller-indexed Nexus operation routes only. This does not authorize deployment.

[rmcdaniel]

Merged as edc8036debe6113dbf82fb02eef8a0c9514a1e6c. Parents are 5867f369643c5a361739b4529e67528d085f2718 (main) and 5ba6f0135c5996c7170256252ab172e2db17de1d (the cleared head). The merge tree 72cb1dfb03993e7046fcc13874332de14089cb42 equals the Security-cleared tree. Branch and backup ref deleted. Next Rust activation: workflow stream writes, requalified on this main.