Framework candidate checkpoint and adoption boundary

Current bounded source

This knowledge base is reconciled through commit 84f415b3098af5653577b2c65eea31fca21df79c, committed locally October 20, 2026 at 12:12 PM Eastern. Clean Framework remains proprietary reusable, application-neutral PHP MVC with explicit dependency injection and native PHP templates. Applications own controllers, domain rules, repositories, routes, schema, permissions, provider adapters and configuration.

Version 0.2.0-rc.1 is committed locally and unpublished, not production- approved or a signed supported release. Stable PHP >=8.5.11 <8.6.0 is the candidate requirement. Dated PHP 8.2 evidence describes older snapshots, not support for booting this candidate. Earlier reports correctly describe work as then-uncommitted; the later commit does not change their test provenance.

The KB still uses its independently installed 0.1.0-rc.1 dependency and existing local runtime. Its earlier disposable PHP 8.5/Apache/FPM comparison is qualification evidence, not adoption. This content update does not change Composer, vendor, runtime configuration, authentication or module activation.

Acceptance and unresolved decisions

The original 167-case register remains 148 scoped PASS, 15 TO VERIFY and four NOT APPLICABLE. INT-09/INT-10 gained scoped local atomic-webhook proof and REL-06 gained recorded governance after the October 17 editorial baseline. Later phase tasks, nested assertions and repeated runs are not additional acceptance rows and do not promote the remaining 15 criteria.

BENCH-01..04 remain optional N/A, not comparative wins. Named roles do not establish reviewer independence, unfamiliar-participant eligibility, backup-person redundancy, monitored support or human on-call performance.

Atomic webhook handoff now exists

The old statement that consequential atomicity is wholly unimplemented is superseded. DatabaseWebhookHandoff commits receipt and outbox intent on the same injected connection; the queue transport commits job and queued receipt state together. The optional SQL-only processor commits its domain effect and completion tombstone together. Application composition selects trusted account, environment, signature/extraction policy, dedicated connections, optional schema and private payload storage. Do not nest intake in an unrelated transaction.

Actual disposable MySQL 8.4.11 evidence includes 22 atomicity/process/failure groups, duplicates/conflicts, lost commit acknowledgement, lease fencing and UNKNOWN reconciliation. This is local SQL proof, not universal exactly-once effects, live-provider qualification, file-plus-SQL atomicity or automatic cutover. Legacy WebhookReceiver plus separate dispatch remains non-atomic and unsuitable for consequential writes. See atomic adoption for checked wiring, migrations, safe failures and recovery.

Central module activation and JSON migration

Applications may explicitly adopt config/modules.json for bounded preference data and trusted code for catalog/readiness composition. Requested ON, effective availability, health/readiness and user permission are distinct. Defaults are OFF; credentials do not activate modules. Mandatory security controls cannot become optional preferences.

The loader validates every JSON overlay, dependencies, conflicts and unique module/adapter readiness identities. No executable PHP fallback exists. Convert literal preferences manually; general app configuration, controllers and templates remain PHP. Direct typed HTTP guards conceal disabled routes before method negotiation. CLI, workers, schedules and services need explicit guards and lazy factories; dedicated queue mapping belongs to the app.

Each composition has a snapshot; long-running workers do not hot-reload edits. Stop intake, drain/persist/reconcile and restart a compatible code/schema/policy set. UNKNOWN always requires reconciliation. No universal service interceptor or live administration dashboard is supplied. See module activation.

Audit search and operations

FileAuditSink::search() reads one selected private audit file, not arbitrary project files or provider history. Each batch stops at 100,000 physical records or 64 MiB; a complete call stops at 1,000,000 records or 640 MiB. These are independent work budgets; 1,000 matching results is a separate maximum. The stream retains its position and starting-history boundary, releasing cooperative locks between batches. Further required work beyond the total limits throws a fixed error, not partial success or catch-to-empty.

The strict Linux profile requires canonical private paths, same service-UID ownership, 0700 immediate parent and regular single-link 0600 history. Unsafe aliases/modes/ownership and observed identity changes fail closed. Missing history retains compatible []; it does not prove history never existed or was not lost. Strict initialized-history detection is a future review, not an implemented flag. See audit search.

Local operations evidence includes real finite ENOSPC, retained partial audit bytes, permission/refusal paths, SQL rollback, readiness versus liveness, alert deduplication and UNKNOWN handling. Quota-unavailable branches refuse without falling back to unbounded disk. Failed runs and subsequent corrections remain recorded. No automatic history repair or production alert route follows.

These are predeclared fixture thresholds, not production SLOs or application promises. See operations/recovery.

Native media scanner and monitoring boundaries

Opt-in closed-profile MP4 inspection/transformation, private staging, same-session process-group cancellation, ClamAV scanning/quarantine and idle-worker pulses/watchdog mechanics now exist. Authored local media and finite process/resource controls do not qualify broad hostile video, an escaped child's forced outer teardown, production host/feed or real alerts. The outer supervisor/container owns hard lifecycle and resource isolation. No module is enabled by construction. See native operations.

CF-SEC-Q03 corrected seven reproduced defect cases: source inode identity, post-inspector mode/alias substitutions, quarantine state/lock hardlinks, colliding publication and mutation during the release-audit callback. Source identity/digest, private state/lock checks, revalidation and atomic no-replace publication now preserve conservative uncertainty fences.

New ClamAvDefinitionProfile and QualifiedClamAvMalwareScanner are opt-in: exact pins, private metadata, bounded streams and explicit qualification windows are checked before/after scans. No feed download/updater, automatic renewal or vendor-provenance guarantee is supplied. Existing constructors retain operator- owned freshness; arbitrary scanner ports remain trusted. SCANNING, RELEASING and DELETING ambiguity requires manual evidence-led reconciliation: no clean override, blind retry, distributed transaction or same-UID sandbox. See scanner/quarantine.

The exact Q03 receipt records 36 new focused scanner/quota groups plus seven existing HTTP groups, not a combined framework acceptance count. Final supported verifier cf-ng-1afb5c6119ab6081 exited 0 with 685 syntax files, 204 documents, 2,016 links and 1,954 commented methods. These are reviewed October 20 receipts, not tests rerun by this editorial update. Actual ClamAV controls used harmless authored definitions, not a production feed. Video qualification is expressly deferred; same-session timeout and finite-full-disk controls do not establish whole-host lifecycle/resource certification.

Compatibility and future work

The protected bridge remains: 46 byte-preserved active originals, six approved narrow PHP 8.5 nullable/comment fixes and six exact archived originals, plus protected artifacts. This is not literal unchanged-source acceptance. No automatic removal/date or genuine prior supported release is invented. Future retirement needs separately authorized consumer inventory, migration, recovery, review and exact removal scope after all conjunctive gates.

Console/developer-panel, browser command console, AJAX/live streaming and FrontBase plans remain proposals unless separately implemented and qualified. Native PHP, explicit injection/SQL and private PWA/search boundaries remain. Generic AJAX navigation, template/HTML caching and a default ORM were not added.

Source and chronology

The prior KB revision was imported October 17 at 10:51:06 AM Eastern. Its source hashes identify then-dirty material already covered. Later commits record Urgent/ Major/Minor stabilization, owner decisions, module/operations A–C, consolidated A–E, native additions and post-E/Q03 qualification. Commit time is not implementation time; original reports remain accurate historical snapshots.

Bounded evidence: CHANGELOG.md; docs/handoffs/CURRENT_STATUS.json; the original acceptance matrix; stabilization/module/consolidated reports; native developer guide; post-E B/C; Q03 README, completion, verification and source-transition manifests. Exact per-topic paths/hashes and actual KB checks are maintained privately in the October 20 editorial log and coverage map.

Editorial provenance

Source: resources/guides/candidate-checkpoint.md. Source SHA-256: b5d88a37c7bfce50310d4fc7983f9e724d315533f2b44180d9cc25d76f7eb8f0.

Knowledge-base application source; editorial checkpoint 2026-10-20. See candidate status and adoption boundary.