Testing

Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.

Next candidate: PHP >=8.5.11 <8.6.0. The current host's 8.2 baseline below is historical. New source-only checks run independently with php tests/runtime_policy.php, php tests/php85_source_review.php and php tests/disposable_database_policy.php; they do not establish target-runtime acceptance. composer verify deliberately fails on unsupported PHP instead of silently skipping runtime tests. See current program.

Approved isolated PHP 8.5.11 CLI/FPM and MySQL 8.4.11 tests have since passed; see the actual checkpoint and pinned tooling commands. The PHP 8.2/200-assertion descriptions below remain historical. Current FPM-only HTTP evidence is 112 assertions, not 200. SQL integration is opt-in and is not silently run by composer verify.

The framework uses a dependency-free deterministic runner so verification does not need an external test package:

composer test
composer verify

CF-G01 adds one PHP 8.2.x policy/metadata scenario (55 framework scenarios in total) and an explicit composer test:apache acceptance command. The latter uses disposable local Apache/module and FPM configurations, two neutral apps, verified private TLS and native session/CSRF tests; it is not implicitly run by the non-network verifier. Its 200 assertions include 12 separately labeled development-router checks. See scope and prerequisites.

Current tests cover:

• container transient/singleton/scoped lifetimes, aliasing, explicit overrides, cycles, provider order, graph freezing, and failure-safe scope reset;
• DEV/TEST/STAGE/PROD precedence, missing/invalid environments, schema constraints, configuration immutability, and secret redaction;
• request method override, base paths, raw/form/query/bounded JSON, line-aware headers, upload limits, namespaced attributes, malformed input, and trusted versus untrusted proxy forwarding;
• response headers, same-origin redirects, JSON failures, cookie invariants, test emitters, one-time sends, stream cleanup, contained files, downloads, and byte ranges;
• PHP-view containment, variable validation, nested partials, escaping, and output-buffer cleanup;
• routing precedence, required/optional/catch-all parameters, typed/regex constraints, deterministic duplicates, groups/defaults/metadata, base-path named URLs, invokable controllers, canonical aliases, HEAD/OPTIONS, 404/405;
• typed request-handler middleware order, callable compatibility, and pre-controller authentication denial;
• route-specific body ceilings, quality-aware response negotiation, exception translation, baseline security headers, and a complete isolated HTTP flow for form/JSON/multipart/protected-file/application-signed-webhook behavior;
• request-scope reset, accidental-output rejection, safe HTML/JSON exception negotiation (including wildcard Accept), bounded runtime context, and isolated termination hooks;
• replaceable/native session fixation, login CSRF rotation, remembered-token logout revocation, principal timestamps, and logout;
• password verification/rehash, digest-only single-use reset tokens, atomic selector/token remembered-login consumption and rotation;
• object/scope authorization denials, denial audit, separation-of-duty approvals, final recovery-holder policy, and lifecycle/scoped machine credentials;
• retention dry-run/hold/live approval behavior, transactional audit contract, secret-key audit rejection, fileinfo upload policy, protected ranges, and path traversal rejection;
• scoped administrative digest credentials and single-host file rate limiting;
• database value/result/error/health contracts, identifier allowlists, and transaction commit/rollback plus explicit nested behavior;
• migration fresh/target/latest application, no-op replay, complete ledger, checksum/orphan drift, lock denial, rollback, warnings, verification, and PROD backup-authorization behavior with fakes;
• asset path containment, canonical URLs, and PNG transforms when GD exists;
• CLI configuration checks and success/failure/unknown exit codes;
• typed CLI option/argument parsing, environment and mutation policy, runtime and batch bounds, lock denial/release, dry-run non-mutation, structured summaries, readiness aggregation, and secret-safe unexpected failures;
• required framework/skeleton directory structure and Codex instruction files.
• cache remember stampede control, delete/clear behavior, TTL lease takeover, stale-owner protection, idempotency conflict/replay/reconciliation, and composable feature health/disposition;
• queue priority, abandoned lease recovery, schema mismatch, bounded retry, exhausted dead letters, manual replay, and graceful stop-before-claim;
• outbox stable-key deduplication, participation in a caller-owned transaction, frozen unknown outcomes, and authoritative reconciliation before retry;
• scheduler overlap prevention, durable-history contract, successful cadence, and stale-schedule health projection.
• provider request serialization/response parsing, redacted error categories, normalized retry delay, replay-safe retries, read/write circuit isolation, half-open probe leasing, concurrency backpressure, and a sample adapter run entirely against FakeHttpTransport;
• OAuth browser-session state binding, S256 PKCE, tamper/reuse rejection, ciphertext-only persistence, wrong-key-version failure, key rotation, serialized refresh, required scopes, and DEV/STAGE/PROD record isolation;
• signed webhook timestamp/body verification, duplicate/conflicting event IDs, private payload references, durable receipt metadata, unknown-event retention, queue handoff, terminal lifecycle, metrics, and explicit replay.
• media signature/probe normalization, policy rejection before probe, detector/probe agreement, forward-only optimistic lifecycle transitions, and fail-closed/fake adapter behavior without native executables;
• revision checksum chains, stale-writer conflicts, single-host persistence, altered-content rejection, value-free field comparison, and restore-as-new-revision;
• low-cardinality metric validation, message/trace-free error grouping, liveness/readiness aggregation, safe health exceptions, and alert cooldown;
• administration declaration invariants, registry freezing, escaping, accessibility landmarks/current-page state, and default route absence.
• typed AI trusted/untrusted input separation, closed output schemas, prompt registry freezing, budget/quota admission and settlement, provider-response digesting, unknown-field rejection, and absence of automatic provider retry;
• Assisted Action allowlisting, source/target scope containment, schema binding, prohibited sensitive fields, risk-based recent authentication, independent action-bound approvals, optimistic conflicts, private file reload, stable handler idempotency, redacted audit, explicit unknown outcomes, expiry, and absence of automatic handler replay.
• unrelated reading-list composition with its own domain/repository/service/ controller/configuration/view layers, no legacy bridge, output-free boot, safe index/detail/not-found/health behavior, and contamination boundaries.

composer verify validates root, skeleton, optional-bridge, and portability- application Composer metadata; inventories local prerequisites; runs both test suites; lints package PHP; scans neutral runtime surfaces for contamination and high-confidence credential formats; and requires comments on every public framework and portability-application method. It also runs the local documentation gate for relative file links and behavioral summaries on a reviewed set of non-trivial APIs. Root regression tests cover broken/escaping links, summary-versus-annotation detection, and the corrected principal and OAuth session examples, including denial and replay. The verification report adds localhost smoke requests, source-integrity hashes, and explicit external gaps.

Run documentation checks independently with php bin/documentation-check. It does not execute every Markdown snippet, fetch external links, validate heading fragments, or prove that prose is semantically correct. Review those manually alongside behavioral tests; see API_GUIDE.md.

Run the local capability inventory independently with:

php bin/platform-check

Its optional-extension results are informational. Apache, databases, providers, native media tools, browsers, and other hosts remain TO VERIFY until exercised in separately authorized environments.

Skipped host integrations are not silently treated as passes. MySQL/MariaDB requires an isolated disposable database; Apache requires a real Apache vhost. Exact follow-up commands and criteria are in VERIFICATION_REPORT.md.

The Next Generation isolated profile supersedes the earlier unexecuted phase descriptions: real MySQL contention/rollback/migrations, SIGTERM/SIGKILL, local TLS/DNS/connect deadlines, shared single-host quota/circuit/OAuth/revision races, GD derivatives, synthetic alert delivery and encrypted row/private-object restore have now run. Source-hashed evidence and exact limitations are in the current program and pilot recipes.

Urgent local qualification additionally proves same-Connection webhook receipt/outbox atomicity through 22 real MySQL tests and the full sixteen-case acceptance map. See source-hashed U-020 evidence and adoption limitations. INT-09/10 are local PASS; legacy split APIs remain nonconsequential-only.

Still TO VERIFY: independent security review, real provider registration/sandbox, deployed consequential webhook qualification, distributed stores, native video/scanner hostile fixtures, deployed supervisor/cron/telemetry/on-call, full-disk and off-host whole-application restoration, real browsers/assistive technology and the final PHP 8.5 deployment host. The five-case fake external-text corpus proves server-side registry/scope/approval boundaries, not universal prompt safety or permission to enable paid models/external executors. See the enabled profile.

The gated MySQL follow-up is tests/mysql_integration.php. It refuses to run without an explicit mutation acknowledgement and a database name beginning with clean_framework_test; it must never be supplied production credentials.

Major local regressions — 2026-10-17

The approved offline verify gate additionally runs tests/major_media_assurance.php (six synthetic/parser/direct-PHP-child tests), tests/scanner_assurance.php (seven actual multipart-upload tests with simulated scanner outcomes), and tests/provider_recovery_assurance.php (five deterministic provider contracts). It also runs compatibility/prosperous-pairs-legacy/tests/original_archive.php (three owner-approved model/hash/archive/nonloading regressions). No actual FFmpeg/AV/provider/browser/human proof follows. Exact source/outputs, initial red filename regression and corrected PSR12 failure are preserved in STAB-M evidence; existing full cached MySQL/Apache/quality/autoload gates remain separate. Real scanner/quarantine/OS resource/assistive/consumer/host gates stay TO VERIFY. Run these scripts only in approved TEST fixtures, not on host8.2.

Editorial provenance

Source: docs/TESTING.md. Source SHA-256: 5e60af439b4aaadba5c906dd45f872c17d1f5b866260dc0c1661d41c19fed37a.

Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.