Release 5.4.0

[armando-rodriguez-cko]

• Add InstrumentDocumentType with bank_statement for bank account payment instrument documents (feat: add InstrumentDocumentType with bank_statement #360)
• Model the onboarding bank_verification, articles_of_association and shareholder_structure documents as their own classes with their own type constants, instead of the generic Document whose docblock pointed at the identity DocumentType (feat: model the onboarding bank, articles and shareholder documents #361)

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:.github/workflows/build-master.yml
• security_sensitive_path:.github/workflows/build-pull-request.yml

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 4

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — .github/workflows/build-master.yml	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — .github/workflows/build-pull-request.yml	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔵 Advisory review: Sound, but needs your judgement

This PR needs a human approval. The code itself reads as correct; whether it should land depends on context I don't have.

This diff only bumps the version number from 5.3.0 to 5.4.0 in two places, but the PR description claims two substantive feature additions (InstrumentDocumentType with bank_statement, and new document model classes). None of that implementation code appears in the diff.

For you to decide

• The diff contains only version bumps; the actual feature code described (InstrumentDocumentType, bank_verification/articles_of_association/shareholder_structure document classes) is not visible — the diff may be incomplete or the implementation landed in a prior commit/branch.
• A human reviewer needs to confirm that the referenced changes (feat: add InstrumentDocumentType with bank_statement #360, feat: model the onboarding bank, articles and shareholder documents #361) are actually included in this release branch and are not missing from what is being merged.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:.github/workflows/build-master.yml
• security_sensitive_path:.github/workflows/build-pull-request.yml

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 4

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — .github/workflows/build-master.yml	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — .github/workflows/build-pull-request.yml	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:.github/workflows/build-master.yml
• security_sensitive_path:.github/workflows/build-pull-request.yml

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 4

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — .github/workflows/build-master.yml	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).
security_sensitive_path — .github/workflows/build-pull-request.yml	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🟡 Risk Classification: MINOR

Approval route: AI Review + Human Approval
Rollback controls: Staged rollout + rollback

Classification reasons

• no_low_class_matched
• prod_source_modified

Operational gates

• ✅ jira_ticket
• ✅ independent_review

Files analysed: 2

---

_{wall-e 2026.06.19-02 · policy 376219bc71e6…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
no_low_class_matched	informational	§2.2 (fall-through)	None of the deterministic Low classes (§2.2.3, §2.2.4, §2.2.7, docs-only) applied; classifier fell through to LLM evaluation.
prod_source_modified	informational	§2.1 M7 (informational)	At least one file is non-doc, non-test, non-IaC — i.e. application source code was modified.

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[armando-rodriguez-cko]

Rebuilt: this PR now touches only the version files, lib/Checkout/CheckoutUtils.php and version.json.

The workflow revert that was in here has been taken out. It was mine to begin with and it did not belong in a release PR: it is what pulled .github/workflows/ into the diff, which is what classified this MAJOR and what made SonarCloud fail the Quality Gate.

On the review points, for the record:

• composer update / dependencies not locked — that line is byte-identical to what is on master today, where it is not flagged. It only surfaced because reverting the file rewrote those lines and Sonar counts them as new code. It is also not actionable as written: composer.lock is deliberately not committed, as is normal for a library, so composer install would have nothing to install from.
• The diff does not contain the feat: add InstrumentDocumentType with bank_statement #360 / feat: model the onboarding bank, articles and shareholder documents #361 classes — correct, and expected. Both are already merged into master; a release PR only bumps the version and lists what the release contains.
• build-pull-request.yml installs PHP via apt, so the 8.1 / 8.4 matrix entries have no effect — true, and pre-existing on master. Left alone deliberately.
• The if on build-master.yml could misevaluate on non-push events — true in principle, moot in practice: that workflow only has a push trigger.

[armando-rodriguez-cko]

Closing this in favour of a clean release PR. This branch accumulated too much history to be a good release record: it carried a workflow revert that did not belong in a release, was force-pushed several times, and picked up a MAJOR classification and a failed Quality Gate along the way. None of that is useful to whoever reads the release later.

Replaced by a fresh branch cut from master, containing only the version bump.