Clean Framework · DOCUMENTATION
Platform and capability matrix
Platform and capability matrix
Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.
Current versus dated matrix: the introductory 145/18 snapshot and earlier absent-tool statements below are retained historical source. The actual original register through 84f415b is 148 PASS / 15 TO VERIFY / four N/A. Later isolated native tools, analyzers and scanner/Q03 checks exist; selected-host/video/feed/outer lifecycle, human and independent gates remain open. Use current checkpoint and native operations. No host or KB runtime was upgraded.
Current Next Generation source/qualification status is recorded in the final local report: 145 scoped PASS, 18 TO VERIFY and four optional benchmark N/A on the documented PHP 8.5 pilot profile. Older dated counts/roadmap statements below remain historical or broader host requirements; do not relabel them as current production proof.
This matrix separates the intended contract from evidence actually collected. php bin/platform-check inventories only the machine on which it runs. It does not connect to a server, database, provider, browser, or remote host.
Next candidate - 2026-10-16
VERSION is 0.2.0-rc.1, an unqualified local source candidate, not a release. Decision 0003 supersedes PHP 8.2 support. No host/runtime upgrade or consumer migration occurred. The owner approved isolated test-image downloads/builds and synthetic TEST provisioning.
| Surface | Current target and observation | Status |
|---|---|---|
| PHP policy | Stable >=8.5.11 <8.6.0; 35 boundary/metadata checks including RC/dev denial and actual old-host rejection | PASS scoped policy |
| PHP CLI / FPM | Approved PHP 8.5.11 Debian/amd64 image; host remains 8.2.11 | Actual local verifier/FPM PASS; other profiles TO VERIFY |
| Apache | Actual 2.4.68 / PHP 8.5.11 FPM: 112 assertions (100 Apache/12 dev), two apps | PASS isolated FPM; mod_php/final host TO VERIFY |
| Composer | Actual isolated 2.10.3; dependency-free offline install/validate, plugins/scripts disabled during install | PASS metadata/autoload; no online dependency/CVE audit |
| Database | MySQL 8.4.11 InnoDB, strict mode, REPEATABLE-READ; prepared values + 48 expanded process/migration/restore checks | PASS scoped engine; MariaDB/whole-app recovery TO VERIFY |
| Docker | Explicit local socket; pinned official images, owned labelled non-root workload/tmpfs SQL fixtures | Approved isolation exercised; existing services/volumes untouched |
| Extensions | PHP 8.5.11 json/fileinfo/mysqli/mysqlnd/curl/sodium/gd/pcntl/zip loaded; actual enabled core/image/SQL tests pass | Presence is not provider/media-worker qualification |
| Other tools | No supervisor, ffmpeg/ffprobe, scanner, analyzer or formatter found on PATH | Corresponding real gates TO VERIFY; optional modules not enabled |
| OS / host | Isolated Debian Bookworm x86_64, Docker LinuxKit 5.15.49 kernel; host Darwin unchanged | Local fixture only; final OS/security/TLS/proxy host TO VERIFY |
See the work/evidence register. L0 source reconciliation is complete. L1 local core evidence exists; L2 is scoped to tested SQL mechanics. Stronger OS autoload tracing and the full integration program remain open; L3/L4 are not established. See the current checkpoint.
Historical 0.1.0-rc.1 matrix (PHP 8.2 only)
| Surface | Intended contract | Current evidence | Status |
|---|---|---|---|
| PHP language | PHP 8.2.x only; patch updates allowed | PHP 8.2.11 CLI, apache2handler and fpm-fcgi exercised; other minor IDs rejected by policy tests | PASS LOCAL; current security patch/target host TO VERIFY; other minors unsupported |
| Composer | Composer 2 | Composer 2.4.3 validates all four manifests locally | PASS LOCAL |
| Core extensions | json, fileinfo | Both are loaded and platform check passes | PASS LOCAL |
| Password/random primitives | random_bytes, password_hash, password_verify, hash_equals | All available locally | PASS LOCAL |
| Temporary filesystem | create, write, and delete private temporary data | Local lifecycle probe passes | PASS LOCAL |
| MySQL adapter | mysqli plus authorized MySQL/MariaDB | Extension loaded; deterministic fakes pass; no database connection made | Extension PASS LOCAL; integration TO VERIFY |
| HTTP provider adapter | curl and approved endpoints | Extension loaded; fake transport passes; no endpoint contacted | Extension PASS LOCAL; integration TO VERIFY |
| OAuth encryption | sodium with deployment-owned keys | Extension loaded; deterministic encrypted-store tests pass | Primitive PASS LOCAL; key operations TO VERIFY |
| Image derivatives | gd for enabled image transforms | Extension loaded; bounded PNG test passes | PASS LOCAL; production image policy TO VERIFY |
| Worker signals | pcntl recommended | Extension loaded locally; no supervisor/signaling acceptance run | Capability present; operation TO VERIFY |
| Local development HTTP | PHP built-in server, loopback only | Skeleton and reading-list smoke requests pass | PASS LOCAL |
| Apache handler fixtures | Apache 2.4, required modules/overrides, sole app.php entry | Isolated Apache 2.4.57 with PHP 8.2.11 module/FPM, two neutral apps and verified local TLS | PASS LOCAL; final deployment/updated binaries TO VERIFY |
| Database behavior | Supported isolated MySQL/MariaDB version | No real server or credentials supplied | TO VERIFY |
| Native media | pinned/sandboxed probe, transcoder, and scanner | Contracts/fakes pass; no binary or hostile fixture run | TO VERIFY |
| Browsers/accessibility | supported application browser matrix | Semantic starter assertions only | TO VERIFY |
| Operating systems | deployment-owned supported matrix | macOS local development evidence only | Other targets TO VERIFY |
| Distributed/process behavior | application-owned shared stores and supervisor | Local/in-memory/single-host adapters only | TO VERIFY |
Local inventory command
The exact CF-G01 profile and repeatable explicit harness are documented in PHP 8.2 / Apache compatibility. PHP 8.2 security support ends 2026-12-31; the old local fixture patch is not a production recommendation. No Linux, alternate MPM, HTTP/2/3, shared proxy or other minor line is implied by the macOS result.
php bin/platform-checkThe command exits nonzero only when a required local prerequisite is absent. Optional adapters are reported as informational because an application may not enable them. Apache, databases, providers, and native tools are always reported as TO VERIFY; discovering an extension is not equivalent to exercising its external system.
Environment acceptance rule
Run the platform check independently in DEV, CI/TEST, STAGE, and the eventual production image or host. Record exact PHP/Composer versions and enabled extensions. Then run only the separately authorized external acceptance checks applicable to that environment. Do not copy DEV credentials into STAGE/PROD or reinterpret a local pass as hosted evidence.
Major stabilization qualification update — 2026-10-17
Repeated scoped cached PHP8.5.11 / Apache2.4.68-FPM / MySQL8.4.11 strict InnoDB REPEATABLE-READ, quality and autoload gates pass. Exact source/output and owned cleanup are in docs/evidence/STAB-M-038-2026-10-17.json. This does not select or qualify a deployment host, MariaDB, supervisor, off-host restore or another SAPI. No new platform installed. Native FFmpeg/scanner are absent/OFF; actual browser/ assistive profile, owner legacy decision and genuine consumer upgrades remain open. Read docs/stabilization/MAJOR_OWNER_AND_HOST_GATES.md before host work.
Editorial provenance
Source: docs/PLATFORM_MATRIX.md. Source SHA-256: 29280d01b4f02f0262b335b1bc057ffa0e663e0305b531b495053fa1574b6b92.
Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.