[coisa]

Closes #22. ECS previously stored different checkouts in the same physical
temporary cache directory; checking project B could invalidate and erase project
A's cached data. The default preset now selects a physical directory keyed by
the executing checkout's SHA-256 through native withCache(). Consumer overrides
still run last. Source and lock files remain unchanged in check mode.

The regression runs the actual CLI in two disposable Git checkouts and a private
TMPDIR, then checks that B's check/fix/check/fix preserves A's marker and both
source snapshots. It also exercises an explicit native cache override. The
original isolated reproduction confirms cross-project deletion, not the exact
timing-dependent DirectoryNotEmpty exception seen separately in the real pilot.
Same-checkout concurrent configurations remain outside this focused correction.

Validation: actual red test before fix; final green regression1 test/25 assertions;
full composer check26 tests/155 assertions and20 PHP syntax/ECS checks; strict
Composer validation, installed unmodified actionlint1.7.12 on all four workflows,
and git diff --check passed. Independent read-only review approved the four-file
delta over base6e8b4f79b4384f9805e90f9d57e619623ad44ab5, digest
792120c1fdb88660f6259d136e78c95cc60208319a55bfaa7346f56e3a47590f.

This PR targets the existing initial implementation branch (#7), not technical
main. It is independent of the unpublished native-provenance correction and does
not change workflows, validation tooling, permissions, hooks or consumers.
Actual final-HEAD hosted checks, Codex and CodeRabbit remain required before
merge. The existing stacked merge/downstack #7 gate still applies; no async
transaction may include an ineligible PR.

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 7 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c5b4df50-f7a0-4de2-8660-ab9f67205ac9

Commits

Reviewing files that changed from the base of the PR and between 6e8b4f7 and 8b46c13.

Files selected for processing: 4

• .changelog/checkout-cache-isolation.md
• README.md
• src/Config/ECSConfig.php
• tests/Integration/StandardsTest.php

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-24T12:13:29.823281Z	8b46c13	PR opened
🔒 Security Review	✅ Completed 2026-10-24T12:16:12.797943Z	8b46c13	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coisa]

@coderabbitai review

[coderabbitai]

⚠️ Action not completed

Review rate limited.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coisa]

Additional exact-HEAD evidence for8b46c13481d35a39e6c01ab13647509a15a274aa:
the native Composer archive was byte-checked against Git and installed in a
second isolated real error-handler worktree. Its actual installed vendor proxy
with ECS13.3.9 passes default check2/fix0/check0/fix0/check0 with no cache override.
All97prior package versions/source refs stay unchanged; the64formatted source
files match the previous pilot exactly, and repeated checks/fix preserve source
and lock. The original pilot remains untouched. Archive SHA256:
f6e0ffd6199c0801b1bd648bc5517cc5c37e20aeceec024d909805d4799bc397.

The local combined7+15+17+19+23 preview merges cleanly, full28tests269assertions
and21PHP style/syntax checks pass. Independent exact-tree review approved
53745fff0f63d3bd2871fe153afbd081aef1a739 / tree2f9b716da04835138cd443a29ec9cd7920726d84,
re-running2focusedtests129assertions. This is local candidate evidence, not a
remote merge, release or replacement for required bot reviews.

All three hosted PHP checks are terminal SUCCESS. Codex code and automatic
security reviews both completed without findings on8b46. Automatic CodeRabbit
review was skipped; one supported manual request6384142543 received
6384143496: “Review rate limited / Action not completed”, without a reset time.
No review is running or queued from that request. No duplicate request was made.

This PR targets initial branch7/6e8, so it is also stacked. Async merge would
include still-ineligible7, whose provenance finding remains unresolved. No merge
call, retarget workaround or indirect push was made. Both the actual CodeRabbit
review and eligible downstack are necessary before integration.