Release checklist

Clean Framework · DOCUMENTATION

Bounded candidate reference — 2026-10-20: 0.2.0-rc.1 is committed locally through 84f415b3098af5653577b2c65eea31fca21df79c, unpublished and not production-approved; stable PHP >=8.5.11 <8.6.0 is required. This is documentation, not adoption: this knowledge base retains its installed 0.1.0-rc.1 dependency and PHP 8.2.11 local profile. Dated PHP 8.2 evidence is historical; earlier dirty-source reports retain their original test provenance, not retroactive clean-commit proof. Candidate examples are illustrative: API signatures were reviewed, but candidate code was not executed by this editorial update. See current checkpoint, open criteria and adoption boundary.

Current checkpoint note: 84f415b is a clean locally committed checkpoint, not release approval. Older unchecked dirty/DOC-1 and PHP 8.2 rows describe their original checkpoint and are not the current support contract. Stable PHP >=8.5.11 <8.6.0 and the unchanged original 148/15/4 register govern this candidate; REL-02/PORT-03 exceptions remain PENDING / NOT ACCEPTED. See current status.

Next candidate 0.2.0-rc.1 - not qualified

[x] Owner-approved PHP >=8.5.11 <8.6.0 source policy and BC note recorded.
[x] Pre-change 8.2 baseline and dirty-tree hashes preserved.
[x] Actual PHP 8.5.11 CLI/deprecation/full local verifier passes.
[x] Actual PHP 8.5.11 Apache FPM independent skeleton/reading-list acceptance.
[x] MySQL 8.4.11 disposable DB/concurrent migrators/synthetic restore checks.
[x] Neutral OS autoload syscall trace with no network/process/write effect.
[x] Real queue/outbox/scheduler claim/signal/failure/reconciliation drills.
[x] Scoped local security/operations/shared-module/DX/frontend/artifact gates.
[x] Reconciled 167-case register: 148 scoped PASS / 15 TO VERIFY / four N/A.
[x] Owner-assigned maintenance/report/release roles and private contact recorded.
[ ] Actual independent security review and dated exact-candidate disposition.
[ ] Literal unchanged-bridge criterion reconciliation and real supported-release upgrade where available.
[x] Optional same-Connection webhook receipt/outbox atomicity: real disposable MySQL proof for INT-09/10; legacy split APIs are not qualified substitutes.
[ ] Actual host/account consequential webhook adoption; native media/scanner qualification if selected. All remain disabled in the default skeleton.
[ ] Real browser/human onboarding, deployed supervision/telemetry/on-call, full disk and off-host whole-application restoration; MariaDB if selected.
[x] Owner-requested pre-Minor local save 5af3471; clean before Minor edits.
[ ] Review and save later Minor changes; separately approve any release artifact/signoff.
[ ] Separately authorized final-host qualification and release decision.

Minor documentation/tests do not close the missing unfamiliar-human, accessibility, host or final-owner conditions. Recruitment tasks DOC-01 and A11Y-01 remain OPEN/UNASSIGNED. See current phase status and all original open-case dispositions. No release, sign/publish, deployment, consumer upgrade or further commit is authorized by this checklist.

See current program state. The checked items in the old list below are historical PHP 8.2 results, not current-candidate passes. Current scoped results and remaining problems are in the final local report.

Historical 0.1.0-rc.1 checklist

This checklist governs the 0.1.0-rc.1 local candidate. A checked local item does not satisfy an external acceptance item. Record command output and the exact environment whenever a future candidate advances.

Required local gates

[x] Framework version is recorded in VERSION.
[x] Root, skeleton, optional bridge, and portability-example Composer manifests validate strictly.
[x] Framework and portability application deterministic suites pass.
[x] CF-G01 owner decision locks all four manifests and the pure runtime guard to PHP 8.2.x; current local boundary/metadata tests pass.
[x] Isolated local Apache/module and Apache/FPM HTTPS checks pass for the neutral skeleton and reading-list example; see scope/evidence.
[x] All PHP files outside generated vendor trees pass syntax validation.
[x] Neutral runtime contamination and high-confidence credential scans pass.
[x] Every public framework and portability-application method has a docblock.
[x] Relative documentation file links and the reviewed behavioral-summary set pass php bin/documentation-check; corrected security examples have local regression coverage. Semantic review of changed prose remains required.
[x] The reading-list example depends on the neutral framework and does not load the optional historical bridge.
[x] Localhost-only index, detail, health, CSS, and not-found smoke behavior is recorded.
[x] Generated example dependencies, lock data, and response captures are removed before the checkpoint.
[x] Implementation, verification, testing, portability, matrix, changelog, and active-work records agree.
[ ] Current documentation edits have a reviewed clean Git checkpoint before any new release. Earlier Phase 9 clean-checkpoint evidence remains historical; DOC-1 edits are intentionally uncommitted while being verified and reviewed.

External acceptance before a production claim

[ ] Execute acceptance on the approved current PHP 8.2 security patch and final OS/Apache/handler/proxy target; local 8.2.11 is not patch approval.
[ ] Reproduce CF-G01 routing/static/auth/private/index/cookie/error checks on that exact updated target; scope does not extend automatically from local fixtures.
[ ] Approve a successor runtime/support decision before PHP 8.2 upstream security support ends 2026-12-31.
[ ] Run the guarded MySQL/MariaDB integration suite against an explicitly disposable database.
[ ] Upgrade a representative older application fixture and complete an isolated backup/restore drill.
[ ] Verify application session/cookie, protected-file, upload/scanner, and filesystem ownership policy on the deployment host.
[ ] Verify enabled queue/scheduler workers, database concurrency, locks, graceful signals, monitoring, and recovery with the selected supervisor.
[ ] Verify every enabled provider/OAuth/webhook adapter in an approved sandbox with environment-isolated credentials and revoke/rotation behavior.
[ ] Verify enabled media binaries against malformed and hostile fixtures in an isolated resource-bounded environment.
[ ] Run browser and assistive-technology checks for the consuming application's enabled views and administration routes.
[ ] Verify distributed adapters, telemetry, alert delivery, retention, and access policy when those optional capabilities are enabled.
[ ] Review application prompts, schemas, action handlers, authorization, adversarial cases, durable audit, idempotency, and reconciliation before enabling live AI or external actions.

Candidate checkpoint procedure

composer verify
git diff --check
git status --short

Review every path shown by Git. Never commit .env, credentials, generated dependencies, runtime storage, response captures, database material, uploads, or backups. Create the implementation checkpoint only after all local gates pass, then update docs/ACTIVE_WORK.md with that commit and make the separate documentation-close checkpoint. Do not tag or publish this candidate merely because the local checklist passes.

Editorial provenance

Source: docs/RELEASE_CHECKLIST.md. Source SHA-256: a9b8eb22f49c50d3de6ad14b7c9d0a68e54c7f87fe8657ed1315c125cf8b6b90.

Framework candidate reference; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.