Clean Framework · DOCUMENTATION
Deferred neutralization and unproven components
Deferred neutralization and unproven components
Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.
Current deferred scope through October 20
The older inventory below is preserved as a dated scope record, not a current missing-code checklist. The candidate now supplies opt-in atomic webhook SQL, JSON module policy, bounded strict private audit search, closed native media, scanner/quarantine and idle-worker monitoring. See current profile and checkpoint.
| Topic | Current capability | Still deferred or unqualified |
|---|---|---|
| Webhooks | Atomic receipt/outbox/queue/SQL-only effect with local MySQL proof | Actual consumer/provider/host adoption and external effects. Legacy split path remains non-atomic. |
| Native media/scanner | Closed MP4 APIs, process runner, Q03 identity/revalidation/no-replace and optional definition profile | Broad hostile corpus, production feed, selected-host resources/outer escaped-child lifecycle and explicit enablement. |
| Audit/operations | Bounded private search, finite faults/quotas, SQL rollback, watchdog ports and named synthetic restores | Initialized-history/loss-anchor mode is future CF-B-F01 review; no chain/file-plus-SQL transaction; real alerts/on-call/off-host host qualification remain. |
| Module configuration | Data-only JSON and explicit guards | Real consumer migration, live admin, hot reload and universal interception. |
| Identity/shared state/integrations | Neutral auth/credential and selected SQL/local-file mechanisms | Actual account/SSO/recovery policy, distributed/NFS/power-loss qualification and live/paid providers/browser actions. |
| Human/governance | Review packets and named assignments | Eligible independent review, real browser/onboarding, exact owner release decision; REL-02/PORT-03 pending. |
| Future features | Native PHP, explicit SQL, bounded derivatives and unrouted admin presentation remain | Generic AJAX/SPA/live streaming, browser command console/developer panel, FrontBase, template/private HTML cache, CSS-inferred sizing and default ORM are not supplied by this work. |
| Legacy/products | Protected bridge and six approved fixes/archive model retained | No automatic removal/date; actual all-consumer migration and separately authorized product/data/host work. |
No original criterion is promoted by documentation. Runtime adoption and module activation remain separate. The following older claims about absent local tools/SQL proof are superseded by the current profile, while their actual historical provenance remains intact.
Historical scope inventory
The authoritative row-level decisions remain in EXTRACTION_SCOPE.md. Some original implementations are preserved in the optional compatibility/prosperous-pairs-legacy package, but preservation does not make them neutral, independently proven, or enabled by the default skeleton. This table tracks the remaining framework work.
| Component | Status | Why not yet a supported neutral capability | Future proof required |
|---|---|---|---|
| AJAX/no-refresh runtime | DEFERRED | Reuse matrix says reference pattern. | Separate approval and browser/fallback tests. |
| Distributed/object storage adapters | DEFERRED | Local protected storage is implemented; shared/cloud consistency and signed-delivery policy are deployment concerns. | Prove one adapter with containment, authorization, range, expiry, and concurrency tests. |
| Remembered-device deployment integration | IMPLEMENTED - UNVERIFIED | Neutral digest-only credentials, single-use consumption/rotation, expiry, revocation, and local file storage are implemented and exercised locally. Original product account/device policy is not a neutral default. | Verify application login/logout wiring, secure cookie delivery, recovery policy, and atomic shared-store consumption under concurrent replay before deployment. |
| Durable audit and targeted feature adapters | DEFERRED | Neutral events/gates exist; product schema, targeting, and retention are application policy. | Prove adapters with redaction, authorization, and concurrency tests. |
| Queue/outbox/scheduler deployment integration | IMPLEMENTED - UNVERIFIED | Neutral database adapters and runtimes pass deterministic state-machine tests, but no disposable real database or supervisor was used. | Concurrent connections, transaction rollback/commit, connection loss, signals, cron/supervisor, and provider reconciliation proof. |
| Provider/OAuth/webhook deployment integration | IMPLEMENTED - UNVERIFIED | Neutral transport, OAuth encryption, circuits, and webhook runtimes pass deterministic fake/single-host tests; no live provider, sandbox, or shared database adapter was used. | cURL/TLS/DNS, provider sandbox, registration/revoke/error semantics, shared concurrency/credential stores, and atomic database receipt/outbox proof. |
| AI/Assisted Action deployment portability | IMPLEMENTED - UNVERIFIED | Typed prompt/schema/budget/quota mechanics, deterministic provider/handler fakes, scoped stored proposals, approvals, step-up checks, audit, and local optimistic stores pass deterministic tests. No live model/provider, adversarial evaluation, shared store, external handler, or reconciliation job was used. | Verify an application provider in a sandbox; supply reviewed prompts/schemas/actions, atomic distributed quota/action stores, adversarial injection/output tests, durable audit, idempotent handlers, and unknown-outcome reconciliation. |
| Native/hostile media processing | IMPLEMENTED - UNVERIFIED | Neutral records/policy/probe/lifecycle contracts and fake tests exist, but no native tool or hostile fixture was executed. | Pin and sandbox ffprobe/transcoder/scanner; test malformed/large/decompression-bomb files and output validation. |
| Shared media and revision storage | DEFERRED | Included in-memory and file stores are process-local/single-host; distributed atomicity is deployment-specific. | Prove database/object-store adapters under concurrent writers and failure recovery. |
| Production observability and alert delivery | DEFERRED | Safe contracts/local sinks exist without a telemetry vendor, recipients, retention, or shared deduplication. | Prove backend adapters, cardinality/sampling, access/retention, retries, and delivery failure behavior. |
| Enabled administration application | DEFERRED | The registry/view starter is intentionally unrouted and performs no security enforcement. | Add app routes/controllers/middleware/services and run authorization, CSRF, approval, audit, and browser accessibility tests. |
| Legacy public uploads | TO VERIFY | Ownership and exposure are unaudited. | Audit in source application; never copy private data. |
| Independent portability proof | IMPLEMENTED - UNVERIFIED | The unrelated reading-list application passes deterministic and localhost checks without the legacy bridge, database, provider, credentials, or remote access. | Repeat on minimum PHP and target hosts; keep product composition migration separate. |
| Clean Inventory product | DEFERRED | Roadmap language did not authorize inventing this application, and the reading-list portability proof is intentionally unrelated. | Require separate product requirements, authorization, and acceptance criteria. |
| Template compilation cache | DEFERRED | Not approved/existing reusable behavior. | Benchmark and safe invalidation design; no eval. |
| CSS-driven automatic image sizing | DEFERRED | Build-tool concept, not extracted runtime behavior. | Static parser/build manifest and responsive-image policy. |
These omissions prevent a claim of production readiness or target-platform portability, but they do not invalidate the local second-application proof or prevent the approved neutral skeleton/core from booting.
Editorial provenance
Source: docs/DEFERRED_COMPONENTS.md. Source SHA-256: a81bd0d446cbdb37646dbb3657e43d9a4dd6ad705874019a515eb63f09bfb413.
Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.