Label PR-added profiles as contributor-reported, maintainer-confirmed

Author: devploit

README.md

@@ -73,9 +73,11 @@ Independent re-verification on 2026-10-30 reproduced the command proof
 (`uid=33(www-data)`) for every RCE profile added by this branch: 8.4.10,
 8.4.11, 8.4.19, 8.4.20, 8.4.25 amd64 and all of 8.5.0–8.5.10 amd64 plus
 8.5.11 aarch64. The details are in
-[the verification log](docs/calibration-logs/verified-2026-10-30.md). The
-four profiles that already existed on `main` were verified before this branch
-and were not re-run during this review.
+[the verification log](docs/calibration-logs/verified-2026-10-30.md). Their
+`status` says `contributor-reported, maintainer-confirmed`: the contributor
+supplied the calibration and the maintainer reproduced it. The four profiles
+that already existed on `main` were verified before this branch and were not
+re-run during this review.
 
 `Heap leak` is stage 1, `libphp leak` is stage 2 and `RCE` is a real command
 proof on an isolated lab. `no` means not verified, not necessarily impossible;

docs/calibration-logs/verified-2026-10-30.md

@@ -1,7 +1,10 @@
 # Independent verification run — 2026-10-30
 
 These runs were made by the maintainer on local, disposable labs only
-(loopback), using the profiles and the dispatcher from this branch.
+(loopback), using the profiles and the dispatcher from this branch. The
+profiles therefore carry `contributor-reported, maintainer-confirmed` in their
+`status`: the contributor supplied the calibration, the maintainer reproduced
+it.
 
 Environment: Docker Desktop on macOS arm64; official `php:<version>-apache`
 images under `--platform linux/amd64` (except 8.5.11 aarch64), the lab

profiles/8.4.10-bookworm-amd64.json

@@ -59,5 +59,5 @@
     "chunk_base": "0x7f0493400000",
     "libphp_base": "0x7f04916f2000"
   },
-  "status": "RCE verified"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified"
 }

profiles/8.4.11-bookworm-amd64.json

@@ -59,5 +59,5 @@
     "chunk_base": "0x7f6d04200000",
     "libphp_base": "0x7f6d05f22000"
   },
-  "status": "RCE verified"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified"
 }

profiles/8.4.19-bookworm-amd64.json

@@ -59,5 +59,5 @@
     "chunk_base": "0x7f0039400000",
     "libphp_base": "0x7f003b09e000"
   },
-  "status": "RCE verified"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified"
 }

profiles/8.4.20-bookworm-amd64.json

@@ -59,5 +59,5 @@
     "chunk_base": "0x7fe078200000",
     "libphp_base": "0x7fe079e2f000"
   },
-  "status": "RCE verified"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified"
 }

profiles/8.4.25-bookworm-amd64.json

@@ -59,5 +59,5 @@
     "chunk_base": "0x7fd9a0400000",
     "libphp_base": "0x7fd9a2117000"
   },
-  "status": "RCE verified"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified"
 }

profiles/8.5.0-bookworm-amd64.json

@@ -50,5 +50,5 @@
     "chunk_base": "0x7f6fc0800000",
     "libphp_base": "0x7f6fbd200000"
   },
-  "status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified (vessel stage 3; uid=33 www-data proof)"
 }

profiles/8.5.1-bookworm-amd64.json

@@ -50,5 +50,5 @@
     "chunk_base": "0x7fa454800000",
     "libphp_base": "0x7fa456400000"
   },
-  "status": "RCE verified (vessel stage 3; uid=33 www-data proof)"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified (vessel stage 3; uid=33 www-data proof)"
 }

profiles/8.5.10-bookworm-amd64.json

@@ -59,5 +59,5 @@
     "chunk_base": "0x7f5973400000",
     "libphp_base": "0x7f596fe00000"
   },
-  "status": "RCE verified"
+  "status": "contributor-reported, maintainer-confirmed — RCE verified"
 }