PHP Fleet Patch Ledger

**Synthetic demonstration:** evidence is recorded for shop-pool-a, while shop-pool-b still needs evidence. Neither result establishes that a host is secure or uncompromised. Complete helper output (exit 1, unresolved work remains): ```json { "schema_version": 3, "as_of": "2026-10-22", "incident": [ "CVE-2026-109618", "CVE-2026-109619" ], "inventory_evidence": "synthetic:host-inventory", "inventory_observed_at": "2026-10-22", "evidence_complete_for_declared_targets": false, "not_security_clearance": true, "results": [ { "target": "shop-pool-a", "status": "PATCH_EVIDENCE_RECORDED", "reasons": [], "evidence_ref": "synthetic:serving-build-a", "worker_evidence_ref": "synthetic:replacement-a", "observed_at": "2026-10-22T13:00:00+00:00", "patch_applied_at": "2026-10-22T11:00:00+00:00", "workers_replaced_at": "2026-10-22T12:00:00+00:00", "runtime_version": "8.3.36", "package_revision": null, "vendor_advisory": null, "vendor_match_evidence_ref": null }, { "target": "shop-pool-b", "status": "NEEDS_EVIDENCE", "reasons": [ "runtime_reference_missing_or_unsafe", "patch_applied_at_missing", "workers_replaced_at_missing", "observed_at_missing", "incident_fix_not_explicitly_established", "serving_runtime_not_established" ], "evidence_ref": null, "worker_evidence_ref": null, "observed_at": null, "patch_applied_at": null, "workers_replaced_at": null, "runtime_version": null, "package_revision": null, "vendor_advisory": null, "vendor_match_evidence_ref": null } ] } ``` Agent-style follow-up interpretation (prepared from the helper output, not emitted by the helper): | Target | Next action | | --- | --- | | shop-pool-a | Retain the supplied build and worker evidence; this is a conditional evidence record, not independent verification. | | shop-pool-b | Request dated serving-runtime and build evidence, explicit status for both incident CVEs, and patch/worker-replacement timestamps and references. | Draft provider request, not sent: Please provide the missing evidence for shop-pool-b, tied to that serving pool rather than CLI output alone. Include the observed running build, confirmation for both incident CVEs, patch and worker-replacement dates, and redacted evidence references. No provider contacted, no system scanned or patched, and no security clearance issued.