What version 0.10 establishes.
Implemented modules, measured behavior and the remaining work, stated separately.
Implemented in this continuation
Version 0.10 adds strict deployment settings, nonmutating configuration checks, consistent SQLite backup/verification, safe bounded-write rejection and reliable HTTP error/logging policies. Version 0.9 added private file storage and opt-in upload validation, explicit CORS, expiring signed URLs, immutable localization, strict validation rules, API resources/problem responses and OpenAPI tools. Version 0.8 added private operational snapshots/metrics, cache/migration readiness, coordinated shared-server migration locks and worker lease/memory bounds. Version 0.7 added explicit module dependencies, route groups, scaffolding, AST boundary checks, cursor pagination and a tenant-aware Catalog/Sales learning example. Version 0.6 added a PHP 8.4.1 dependency baseline, vendor-independent preflight, strict diagnostic verification, stable/candidate CI and a runtime-upgrade state fixture. PHP 8.6 beta is tested only in isolation. Version 0.5 added a transactional outbox, UTC scheduler and maintenance CLI pipeline. Version 0.4 added functional account screens and optional OIDC Authorization Code + S256 PKCE sign-in with explicit identity linking, token validation and local MFA. It retains v0.3 factors/recovery, audit and tenancy, plus routing, container, queues, events, Redis and ORM modules. A real provider must be configured before SSO is enabled.
Automated integration evidence
Version 0.10 is checked with full local SQLite/MariaDB/Redis/Doctrine integrations, an isolated PHP 8.6 beta, and both hosting PHP 8.4/8.5 runtimes with production dependencies. A disposable HTTPS backup/restore drill passed 73 checks covering exact table restoration, sessions, MFA/recovery codes and durable jobs. Real SAPI HTTP checks exercise signatures, errors, CORS and logger outages. See the verification report and immutable publication manifest for exact final counts, explicit skips and source digest.
Worker runtime evidence
Version 0.10 reran FrankenPHP 1.12.7 / PHP 8.5.10 and Swoole 6.2.2 / PHP 8.5.4 locally. Each passed 18 runtime checks across 1,200 request-marker probes and 180 mixed account requests, plus 38 actual signed URL checks covering GET/HEAD, tampering, error privacy and CORS. Worker recycling produced 31 and 24 distinct bootstrap IDs respectively. The adapter now avoids factory-generated duplicate Host headers and retains the authoritative SAPI HTTP_HOST when FrankenPHP omits Host from getallheaders. Actual duplicate incoming Host values remain untouched. These are short localhost regression workloads; production load, long soaks and comparative speed remain unmeasured.
What the live hosting runs
framework.icom.la continues to run PHP-FPM with private SQLite and file cache/limits. The Redis and Doctrine modules are optional application integrations; the documentation site does not require those external services. New schema migrations are additive, and release directories preserve a code rollback point. No default user, password or public administration panel is created.
Remaining priorities
Before enterprise adoption: onboard and verify an actual OIDC provider, implement SAML if required and establish an account-recovery delivery process; apply tenant/resource policies in your application and configure independent audit retention; deploy and test production SQL topology and a distributed environment; exercise runtime dependency outages, graceful drains and long-duration memory behavior; add tracing with a real collector; conduct an independent security assessment. Mail delivery, cloud object storage, remote brokers, distributed locks and tracing exporters remain separate integrations. Local upload validation does not certify files as malware-free.
The original comparison goal
This release advances the requested simplicity, modular architecture, worker compatibility and deployment goals. It does not prove superiority over Laravel 13 or Symfony 8.x, feature parity with their ecosystems, or enterprise certification. Such claims require equivalent working applications, independent review, production operation and reproducible comparative measurements.