Clean Framework · DOCUMENTATION
Candidate module qualification profile
Candidate module qualification profile
Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.
Current profile through October 20
This current summary supersedes the dated October 17 narrative below. Candidate 0.2.0-rc.1 is locally committed through 84f415b, unpublished and not production-approved. The KB has not adopted it.
| Capability | Local implementation and proof | Remaining qualification |
|---|---|---|
| Atomic webhooks | Shared-connection receipt/outbox, queue handoff and SQL-only completion; INT-09/10 scoped PASS | Application schema/account/route, live provider, target host, external effects and independent review. Legacy split path stays non-atomic. |
| Module policy | JSON data, unique readiness identities, dependency health and explicit HTTP/CLI/worker/schedule guards | All service/entry-point adoption, dedicated queues, mandatory security and stop/drain/restart. No universal interceptor, dashboard or hot reload. |
| Audit search | Independent record/byte/result bounds and strict private Linux filesystem checks | Cooperating local writers, no immutable snapshot, loss anchor, chain, fsync, distributed or file-plus-SQL guarantee. |
| Native media | Authored local closed MP4 inspection/transformation and output checks | Broad hostile video, selected host and escaped-child outer lifecycle. Video qualification remains deferred. |
| Scanner/quarantine | Q03 source/private state checks, post-inspector/post-audit revalidation, no-replace and opt-in definition pins/window | Production feed/update/security, selected host, independent review and authorized manual uncertainty/retention procedures. |
| Monitoring/recovery | Idle pulses/watchdog ports, actual finite ENOSPC/refusal, SQL rollback, alert dedup and synthetic restores | Real notifications/human acknowledgement, target supervisor/host, off-host whole-app recovery and accepted SLOs. |
| Core SQL/HTTP/views | Native PHP, explicit injection, prepared values, MySQL 8.4.11 and bounded auth/CSRF/CSP mechanisms | Application object/tenant policy, MariaDB/HA, target host and human/accessibility proof. |
Use the checked wiring in atomic adoption, module activation, audit search, native operations and scanner/quarantine. Defaults remain OFF; credentials/executable presence are not readiness or permission. Keep canonical private local roots, independent security, lazy factories and UNKNOWN fences. Invalid JSON/private metadata/expired pins/integrity failures must deny safely, not become empty success.
Original acceptance remains 148 PASS / 15 TO VERIFY / four N/A. REL-02/PORT-03 exceptions are PENDING / NOT ACCEPTED. Per-topic source hashes and receipts are in the private October 20 coverage record. Old absences/assignments/dirty-source statements below are historical, not the current profile.
Historical October 17 source narrative
Minor stabilization update — 2026-10-17: PHP 8.5.11 verify/quality/Apache/ autoload and disposable MySQL database/webhook gates all pass again. Added six onboarding contracts and four original-criteria/source/documentation guards; these are not the absent genuine human walkthrough. Runtime, migrations, dependencies, routes and disabled module composition are unchanged. Pre-Minor save is 5af3471; later Minor changes are uncommitted. Matrix remains 148/15/4. DOC-01 and A11Y-01 recruitment/reviewer assignments remain OPEN/UNASSIGNED. Use current phase status and operator/UNKNOWN guidance. No release, external access or native/provider activation follows from these local checks.
Major stabilization update — 2026-10-17: all six approved cached local gates pass; 21 additional media/scanner/provider/legacy regressions pass, without closing external qualification. Native FFmpeg/ffprobe/scanner remain absent and OFF; actual browser/human, strict original legacy acceptance disposition, genuine consumer upgrade and selected deployment-host gates remain open. No live integration selected. See Major phase status, disabled media profile and integration limits.
The owner approved six narrow legacy fixes with exact archived originals; three new selected-model regressions pass. The52 active files are not all byte-identical originals; original REL-02 wording is not silently relabeled.
This is an explicit supported-pilot boundary, not permission to enable every class shipped in the repository. The default skeleton registers no live provider, paid AI, native video/scanner, webhook write path, alert destination, worker or scheduler daemon. Applications choose composition and must satisfy their own authorization/schema/deployment gates.
| Module | Local evidence/profile | Excluded until qualified |
|---|---|---|
| HTTP/routing/views/security | PHP 8.5.11 CLI and Apache 2.4.68/FPM; neutral tests | other handlers/hosts; actual app object/tenant policy |
| SQL/migrations | MySQL 8.4.11 strict InnoDB/REPEATABLE-READ disposable targets | MariaDB, HA/failover, target schema/application rollback |
| Queue/outbox/scheduler | real child signals/claim races, leases, local fake effects, DB advisory locks | installed cron/supervisor, distributed exactly-once |
| Provider HTTP | actual private loopback TLS trust/hostname, 429/5xx, size/timeout bounds | live services, complete DNS/egress enforcement, provider certification |
| OAuth | local encrypted store, key rotation/state/PKCE tests, two-process one-refresh proof | real provider registrations, distributed locks, refresh longer than lease |
| Provider circuits/AI quotas | new private file adapters plus real two-process contention | NFS/multiple hosts and power-loss guarantees; no paid provider bound |
| Revisions | file compare-and-append race, checksum/tamper, append-only restore and correlation | atomicity with an application's separate SQL domain writes |
| Webhooks | new opt-in same-Connection MySQL receipt/outbox; 22 real fault tests; one SQL effect | deployment/provider adoption; legacy split receiver; multi-host/power-loss/external exactly-once |
| Images/media | GD/source pixel bound and existing derivative tests; no-shell bounded runner | ffprobe/FFmpeg/scanner/native hostile-video qualification |
| AI/actions | typed fake generation, policy/schema/budget, server-scoped/single-use approvals, unknown reconciliation | paid API, browser automation and consequential external handlers |
| Operations | safe logs/readiness; SQL outbox critical-alert fake receipt; encrypted synthetic restore | off-host backups, actual on-call, full-disk/host recovery and production SLOs |
Local atomic webhook qualification: CF-INT-01
The existing WebhookReceiver persists a receipt and then calls a separate dispatcher. File receipt metadata and queue/outbox writes are not one shared database transaction. A duplicate receipt is not proof a required durable handoff exists. Do not enable a business-critical webhook write path on the strength of those fakes. The new optional DatabaseWebhookHandoff now proves receipt/outbox commit and reconciliation in the isolated MySQL fixture. INT-09/10 are scoped local PASS; this does not enable a deployed consequential write path. Adopt the new migration/adapter/workers/recovery explicitly using the adoption guide and qualify deployment/account policy/independent review first. Legacy APIs remain excluded. This program deliberately does not invent a provider-specific adapter or claim a consumer need that the owner has not selected.
Shared-state operating requirements
FileAiBudgetReservationStore and FileProviderCircuitStateStore use bounded AtomicJsonFile state under a stable sidecar lock and atomic rename. Bind the same private local directory for all participating processes. Never move the directory between live workers, delete lock records to bypass limits, or use NFS/containers with independent volumes as though they shared authority. File quota state admits worst-case request/token/cost before calling a provider; only verified successful usage settles once. Failed/unknown calls retain worst case. Expired windows/IDs are pruned on later admission, policy changes inside a live window and clock rollback fail closed. Capacity/storage errors deny work, not reset quota. Generate a new random reservation ID per logical request.
Provider circuit storage serializes counter mutations; half-open ownership uses a separate shared FileLeaseLockStore. Probes/refresh operations must finish within the configured ownership lease (currently 60 seconds); longer operations need a reviewed renewal/fencing design, not an assumed lock guarantee. Corrupt lock metadata now fails closed. Read and write circuit identities stay separate.
OriginAllowlistTransport is opt-in and exact-origin/HTTPS only. It rejects redirect/proxy/insecure expansion but does not resolve/validate every destination IP or prevent DNS rebinding. Bind deployment egress controls. CurlHttpTransport does not inherit environment proxy settings; use only reviewed explicit proxy config. A private CA path is trusted composition metadata, never HTTP input.
Unexecuted checks
Independent security review, real unfamiliar-developer walkthrough, browser/ screen-reader matrix, actual production telemetry/on-call and final-host qualification are open. Optional comparator benchmarks need separate comparator dependency authorization. No tag/publication/deployment is performed here.
Editorial provenance
Source: docs/next-generation/ENABLED_PROFILE.md. Source SHA-256: 69b128b61413cccb22dcad0b47aca415c1aff30c26912f55ba8550ff8cfd6509.
Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.