Does packages.drupal.org evaluate php compatibility using a module's info.yml php key value?

Problem/Motivation

Is it expected that packages.drupal.org to negotiate/evaluate php compatibility using a module's *.info.yml php key value without a module having a composer.json file to declare its php requirements?

I recently had an unexpected scenario described here > 📌 [PP-1] CDN 4.x requires PHP >=8.1 but composer does not respect it due to bug in d.o composer facade Needs review . This could be expected behavior, requiring a composer.json file to declare php requirements or a bug.

Steps to reproduce

• Within a php < 8.1 environment, use composer require drupal/cdn:^4.0
• Observe package is downloaded by composer even though it's not compatible

Proposed resolution

TBD

Remaining tasks

TBD

User interface changes

TBD

API changes

TBD

Data model changes

TBD

Release notes snippet

TBD