[andregoepel]

Problem and result

Core's merged policy has an empty profile inventory, which correctly rejects central analysis before upload. This PR records the actual 27 dedicated Core Library 1.0.0 profile snapshots provisioned on the central service, including 121 C# rules and each profile's rule revision timestamp. The runbook records the completed project/access setup and the remaining activation steps.

The Sonar caller also needs a reachable merged runner reference. The first main Sonar trigger failed workflow validation before starting any job: GitHub reported that the reusable workflow at 64b791bc90feadfd21a8cc3cf73b14456172334b was not found. Both source commits have the identical tree 9d50d51b4e2fc7d0fefba61d746ab93720a54bef, and the workflow file has the same blob. This PR moves all three coupled references (caller, tool input and policy) to merged main revision f6c806d1060e390a24c1451e7486578c9bdbab23. This narrowly scoped Action change was explicitly approved. Hosted resolution still needs verification after merge; static validation alone does not prove it.

Three files change: the policy, runbook and the two SHA values in sonar-main.yml. All other Actions, the six gate conditions, null baseline and library/tests/dependencies remain unchanged.

Provisioned and verified

• Separate private core project, dedicated gate and independent copied profiles with no parent. Accepted CSharpier-compatible rules retained; default profiles and app-foundation's profiles/baseline unchanged.
• Small-change exemption disabled; no authored coverage exclusions.
• Separate scan-only project-analysis token and browse-only verification identity. Permitted requests succeeded; administration and cross-project access were denied. Credentials remain private.
• Core-only sonar-main environment: main branch only, André as required reviewer, self-approval allowed, administrator bypass disabled. Only the two Core Sonar secrets are stored there.
• Central health green. No analysis, baseline selection or readiness receipt is claimed.

Validation

• Post-merge Core main CI passed, attempt 1, revision e553968869d1e248b61fb1090cbfd69178460a88; publishing skipped.
• Post-merge Workflows validation and Windows/Linux runner checks passed, attempt 1, revision f6c806d1060e390a24c1451e7486578c9bdbab23.
• The actual pinned C# runner's configuration and live gate/profile/settings validators passed using Core's scoped credentials; this was read-only and submitted no analysis.
• Local locked restore, CSharpier, Release build and all six Core tests passed; zero build warnings/errors and no known package vulnerabilities. All other Action/source/dependency files match main; actionlint and agreement of the three approved SHA references passed.
• E2E and staging deployment are not applicable to this library. PR CI passed on attempt 1 at 3703d9d7b7e9dc08e97c2938634c74d711c664f3; GitHub reports the build-and-test check completed successfully and the PR is open for review.

Remaining rollout

SONAR_MAIN_ENABLED stays absent and baselineAnalysisId stays null. Review and merge this actual profile snapshot before controlled activation. The first exact-main analysis must then be reviewed as a baseline; its missing-baseline readiness failure is expected. Record the selected baseline through review, then collect two fresh exact-main CI/Sonar successes and capacity evidence under analysis load.

Refs #24 and andregoepel/app-foundation#238. Keep the rollout issues open. No merge, release tag, upload, publishing activation, deployment, other-repository source change or further Action change is part of this PR. Core's existing publisher remains outside these Sonar controls.