Clean Framework · DOCUMENTATION
Reproducing the local development pilot
Reproducing the local development pilot
Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.
Prerequisites and separation
Use the independent framework root and its AGENTS.md. Require stable PHP >=8.5.11 <8.6.0, Composer, JSON/fileinfo and feature-specific extensions. The approved fixture has PHP 8.5.11 CLI/FPM, Apache 2.4.68, MySQL 8.4.11, cURL/GD/mysqli/sodium/pcntl/zip. Those exact results do not qualify other hosts. Do not modify a real app, copy its credentials, or connect to a live service. Use DEV for local UI and TEST for disposable tests; STAGE/PROD remain independent.
Executable recipes and expected failures
| Task | Exact starting recipe | Observed/expected result and safe failure |
|---|---|---|
| New app/composition | Walkthrough, copy skeleton using the documented local Composer path | public route 200; missing APP_ENV fails boot safely |
| Public/protected/JSON/form HTTP | composer test:apache -- --handler=fpm or the isolated apache gate below | two apps, native TLS/session/CSRF, anonymous deny, normal no-JS form/303 and JSON contracts; forged CSRF 419 |
| Framework/typed validation/view | composer verify | public/secure route, validation and safe view tests; malformed input 400/413/431, escaping/traversal denied |
| SQL migration | isolated database gate below; schema recipe | 53 expanded synthetic checks at current recovery checkpoint; changed applied checksum and unauthorised PROD mutation denied |
| Queued job/outbox/scheduler | same database gate, tests/durable_integration.php | 13 real-process/delivery scenarios; stale owner denied, unknown effect not blindly replayed |
| Provider fake/OAuth | isolated verify gate, tests/http_transport_integration.php and tests/module_integration.php | local TLS and shared-state tests; untrusted/wrong-name cert, quota overflow, stale revision denied |
| Private upload/audit/log | php tests/security_assurance.php and php tests/operations_assurance.php on supported PHP | private MIME/size/policy and metadata tests; wrong owner/traversal/MIME hint/PII key denied |
| Frontend/diagnostics | php tests/frontend_assurance.php and php tests/diagnostics_assurance.php | encoding/CSP/no-store and DEV/TEST metadata proof; executable URL and PROD debug denied |
| Static quality | isolated quality gate below | level-3 source scan, nine new classes PSR-12, deliberate bad type/style rejected; no ignore baseline |
| Artifact | php bin/build-candidate --epoch=1792195200 | JSON archive path/hash; repeated identical source yields same ZIP; invalid arguments refuse without release |
SQL/HTTP/process commands are intentionally not hidden inside the dependency-free composer verify. Actual integration runs require the approved isolated tooling runner. Do not run the destructive SQL tests with a real application connection.
# From the framework root. Uses cached approved images; never pulls automatically.
php bin/isolated-acceptance --socket=/Users/dan/.docker/run/docker.sock --image=sha256:508b0f20ac40e0fe2692d5dcbc4b94a488a967f6b3aee2b787b936b061e2e42a --gate=verify
php bin/isolated-acceptance --socket=/Users/dan/.docker/run/docker.sock --image=sha256:508b0f20ac40e0fe2692d5dcbc4b94a488a967f6b3aee2b787b936b061e2e42a --gate=apache
php bin/isolated-acceptance --socket=/Users/dan/.docker/run/docker.sock --image=sha256:508b0f20ac40e0fe2692d5dcbc4b94a488a967f6b3aee2b787b936b061e2e42a --gate=quality
php bin/isolated-acceptance --socket=/Users/dan/.docker/run/docker.sock --image=sha256:508b0f20ac40e0fe2692d5dcbc4b94a488a967f6b3aee2b787b936b061e2e42a --gate=autoload
php bin/isolated-acceptance --socket=/Users/dan/.docker/run/docker.sock --image=sha256:508b0f20ac40e0fe2692d5dcbc4b94a488a967f6b3aee2b787b936b061e2e42a --gate=database --mysql-image=mysql@sha256:24989179f58856db763f418010c1169fecc944e3ec1ea7e921572d83eb070f70These are owner-approved local tool paths, not a deployment script. On another machine explicitly review its local Docker socket and pin/build the documented image first. The runner accepts only a local user-owned socket and records source hashes, result and exact owned cleanup receipts under private temp.
Browser/accessibility and unfamiliar-developer acceptance: TO VERIFY
No automated browser tool or screen reader is installed/enabled by this source change. Do not reuse the sibling knowledge-base preview for framework testing. On an approved isolated starter preview, test current Chromium and WebKit/ Safari, mobile 320/375/768 widths and desktop, keyboard-only skip/navigation, visible focus, errors linked/announced/focused, zoom 200%, reduced motion, disabled JavaScript, native form/303, CSP console and screen-reader order. Run a reviewed pinned accessibility checker (for example axe-core) only after its dependency approval; record real versions/results and manual exceptions. Response/markup tests do not prove assistive-technology behavior.
Ask a real unfamiliar developer to build one protected, validated persistence flow from these recipes; record elapsed time, confusion, failures and corrections. No participant was available for this build, so DOC-05 remains explicitly open as an exercise, not agent-simulated human evidence.
Compiled/private HTML caches, CSS-inferred image sizing, SPA/AJAX runtime and Laravel/Symfony comparator benchmarks remain deferred/conditional. No identity- blind template cache or unmeasured optimization is enabled. Before STAGE use the module profile, security model, operations runbook and independent host approval.
Editorial provenance
Source: docs/next-generation/LOCAL_PILOT_GUIDE.md. Source SHA-256: a43255afd052a6de9c0ea05de3293c163fa8e54161b7981fa3927cdcde533d79.
Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.