# ICOM Framework 0.10.0 verification

Release date: 2026-09-10. Developer preview. This report records pre-publication evidence. Exact source ZIP, fresh-install, final HTTPS/browser and deployment-preservation results are published separately at `/downloads/icom-framework-0.10.0.verification.json`. Historical archives remain immutable; the preceding report is `VERIFICATION-0.9.md`.

## Problems reproduced and corrected

1. Invalid environments and boolean values previously bypassed intended deployment behavior. `APP_ENV=prod` could avoid production checks; quoted values could lose characters. The strict configuration parser and immutable deployment settings now reject unknown environments, invalid booleans, duplicate keys and unmatched leading quotes. Matching outer quotes are removed once, preserving interior content. Production/staging require debug disabled, HTTPS origin, canonical 32-byte key, exact allowed hosts and private environment/database/log locations. Redis settings validate without connecting.
2. `where(...)->limit(1)->update(...)` or `delete()` silently ignored limits/orders and could affect every matching row. Both SQLite and MariaDB now reject these mutation chains before SQL. Applications must select explicit identities and retain tenant/version/state predicates; simply removing the limit is unsafe.
3. A logger exception could discard an already-completed HTTP response or interrupt error handling. HTTP diagnostics now use a fixed fallback and preserve the original response/error. This does not guarantee log delivery or replace log-service monitoring.
4. CORS and signed-link privacy headers were lost when downstream code threw. The standard outer Errors middleware now renders the original error once and applies trusted response policies in middleware unwind order. CSRF/authentication remain enforced; failures occurring before a CORS middleware do not acquire its headers. The former inner-Errors workaround is unnecessary.
5. Real HTTP signed requests failed because the PSR factory generated a Host value before the SAPI creator appended the incoming Host. The shared creator removes only the factory value; actual headers remain authoritative. FrankenPHP omits Host from getallheaders, so Globals additionally uses actual SAPI HTTP_HOST only when no Host header exists. Swoole shares the creator. Actual duplicate/conflicting headers are not normalized into a valid signature; a hostless signed request still fails.
6. Caller-owned PHP references could change role/grant arrays after constructing Gate/Identity. Those bounded, validated scalar lists are now detached snapshots. This is a trusted in-process configuration defect, not evidence of remote privilege escalation.
7. Readiness wrongly required storage/logs even when logging to stderr. It now checks the configured file destination only for file logging, while retaining database/migration/cache/persistent-storage checks.
8. Plain SQLite file copying could miss committed WAL data. The new SQLite backup CLI uses VACUUM INTO, validates a standalone snapshot, synchronizes it and publishes without overwriting an existing destination. Verification uses read-only SQLite locking, integrity/foreign-key checks and stable-file/hash/schema checks without application bootstrap.

`docs/READINESS-REVIEW.md` contains the engineering findings. This was a targeted implementation/reliability review, not a formal exhaustive security audit.

## Automated runtime evidence

| PHP | Environment | Registered / executed | Assertions | Failures | Skips |
|---|---|---:|---:|---:|---:|
| 8.5.4 | Isolated full development/service integrations | 250 / 250 | 4,303 | 0 | 0 |
| 8.6.0beta2 | Isolated full development/service integrations | 250 / 248 | 4,274 | 0 | 2 |
| 8.4.23 | Hosting stage, production dependencies | 250 / 219 | 4,001 | 0 | 31 |
| 8.5.8 | Hosting stage, production dependencies | 250 / 219 | 4,001 | 0 | 31 |

Full local suites include actual SQLite, MariaDB 11.8.6, Redis 8.0.5, Doctrine and PHP-Parser. Both linted 175 PHP files with strict diagnostics; source fingerprints were identical before and after the final matrix. Framework diagnostic failures: zero. The isolated PHP 8.6 beta lacks fileinfo and explicitly skips two MIME tests; two optional POSIX FIFO assertions are also unavailable there. Hosting tests omit optional service/development dependencies, with each skip recorded in the publication manifest. Skips are not passes.

Composer strict validation and actual platform checks passed. Audit reported zero advisories and abandoned packages at the time checked; runtime dependencies are unchanged. Stable/candidate CI configuration now invokes the reproducible real-SAPI fixture and saves its report. YAML structure and that exact fixture command were verified locally; no remote GitHub workflow activation or execution is claimed.

## Actual HTTP and worker evidence

- `tests/runtime/http-reliability.py` passed 288 checks across 28 actual responses on each of PHP 8.5.4 and 8.6.0beta2. It covers logger failures, expected/unexpected errors, exact CORS policies, original-exception logging once, signed GET/HEAD privacy, hostless requests and CSRF/authentication denial. Private loopback fixtures are removed afterward.
- FrankenPHP 1.12.7 / PHP 8.5.10 and Swoole 6.2.2 / PHP 8.5.4 each passed 18 runtime checks over 1,200 marker probes and 180 mixed identity requests. Each additionally passed 38 actual signed URL HTTP checks for success, HEAD, tampering, generic errors and CORS/privacy. Recycling yielded 31 and 24 distinct bootstrap IDs respectively. These are short local regressions, not a performance comparison, long soak or production capacity result.
- Local site HTTP passed 122 checks: version/health/readiness, documented routes, private-path exclusion, CSRF/authentication boundaries, exact OpenAPI document and real response schemas. The official OpenAPI 3.1 structural schema validates the document; it does not enforce application authorization or every nested schema constraint at runtime.
- Desktop 1440×1000 and mobile 390×844 Chromium passed 134 browser checks: production runbook and feature chapters, exact code copying, English/Lao search, OpenAPI navigation, downloadable guide, actual playground GET/CSRF POST and account screen. No console/runtime or HTTP resource errors. Browser plugin unavailable; direct Playwright used. Other browsers were not tested.

## Practical backup/restore drill

An isolated production-configured app passed 73 checks using verified local HTTPS. The snapshot contained 16 tables / 5 migrations, a synthetic MFA-enabled account, encrypted factor, nine unused recovery codes, an active session and a durable job. After backup, the source account was disabled and the job consumed. A separate fresh app restored every table exactly to the snapshot before accepting requests, retained the same APP_KEY, successfully used the saved session/decrypted factor, rejected an already-consumed recovery code, accepted an unused code and rejected replay, then processed/acknowledged the restored job. The snapshot artifact remained unchanged; all test servers, keys, certificates and private data were removed.

Restoring a database also restores snapshot-time sessions, recovery codes and jobs. Reconcile later revocations and already-applied external effects before reopening traffic. This drill does not establish an RTO/RPO, offsite retention, provider recovery or complete disaster-recovery certification.

## Release and upgrade controls

No schema migration is added. Source packaging excludes private environment/state/vendor files and refuses an existing version archive. A fresh ZIP installation is checked separately before promotion. Hosting is staged outside current, tested on PHP 8.4.23 and 8.5.8, compared to the reviewed archive, then attached to existing private shared state. Before promotion, run configuration, migration status, API parity and operational checks. Preserve APP_KEY/config, cron, schema and account/MFA/identity records; retain release 20260910-09 for rollback. Atomic current-link replacement includes live version/readiness rollback guards. Final preservation and HTTPS publication results belong to the separate manifest, avoiding a source archive claiming its own not-yet-run publication checks.

The site continues on PHP-FPM 8.4.23, private SQLite and file cache/limits. No new account, public upload endpoint, external provider, cloud deployment, cron or PHP-handler change is introduced.

## Practical limits

Configuration validation is not service connectivity or business-flow validation. Strict environment parsing can reject formerly accepted inputs; review the production-use chapter before upgrading. APP_URL is an origin; OIDC clients must register the exact configured callback. Keep database/log/backup paths outside every actual document root, not only the packaged public directory.

SQLite backup/verification requires a trusted local POSIX filesystem with hard links/fsync, a private mode0700 parent and mode0600 snapshot. It covers a single file-backed main database and refuses attached databases, active outer transactions, existing destinations and WAL/sidecar artifacts. A directory-sync failure after publication can leave a valid destination: verify it before retrying under another name. Hashes do not authenticate the source. APP_KEY/configuration, uploaded objects and code release require separate protected backup. There is no automatic live restore or MySQL/cloud backup implementation.

HTTP log fallback preserves availability but may lose diagnostics. Role snapshots do not replace application resource/tenant policies. Signed links remain replayable until expiry, authenticate raw URI/method/origin/purpose, and do not bind arbitrary bodies or independently changed parsed queries. CORS is not authentication or a CSRF exemption.

External OIDC/mail/cloud integrations, production topology/failover, application load, long-running memory, trusted proxies, offsite restore and an independent security assessment still require deployment-specific work. Docker/Kubernetes references were not deployed to a cluster. PHP 8.6 remains experimental and future versions require revalidation. No feature-completeness, Laravel/ThinkPHP superiority, enterprise certification or production HA claim is made.

References: [SQLite VACUUM INTO](https://www.sqlite.org/lang_vacuum.html), [SQLite corruption/backup guidance](https://www.sqlite.org/howtocorrupt.html), [SQLite URI read-only mode](https://www.sqlite.org/uri.html), [PHP boolean filters](https://www.php.net/manual/en/filter.constants.php), [OpenAPI 3.1 schema](https://spec.openapis.org/oas/3.1/schema/2025-09-15).