greicodex/corephp-vm
Hardened PHP 8.4 runtime · 12-month roadmap

PHP that stops lying to you.

A drop-in production runtime for your existing app. Same code, no rewrite, no framework — the dangerous parts just stop failing silently.

Symfony Laravel CodeIgniter plain PHP
~/app · the same three lines, two runtimes
# Vanilla PHP — silent. the bug detonates somewhere else, later. $user = json_decode($body); // → null then $user->id 500s three files away $conf = file_get_contents($path); // → false concatenated into a path. silently wrong $qty = intval($input); // → 0 an order for zero units. shipped.
// with CorePHP
# CorePHP — loud, at the source, with a stack trace. JsonException: Syntax error ← thrown at the decode call FileReadException: /etc/app.conf ← caught · logged · traced CoercionException: "abc" is not int ← honest. debuggable. never silent.
How it protects you

Know before you ship. Safe if you missed one.

CorePHP guards your app at two moments, so nothing silent ever reaches production.

Compile time

corephp audit

static analysis · CI

Scans your existing code and reports every SAFE / SECURE / STABLE risk — unchecked json_decode, unserialize, request-scoped state that leaks in a long-running worker — with file, line, and fix. Framework-aware.

Runtime

hardened engine

while serving requests

Turns whatever slips through into a proper exception, contains memory leaks by recycling workers, and keeps one bad request from taking down the pool. Zero cold starts.

The promise

Safe. Secure. Stable.

Three guarantees, enforced underneath your app — not bolted on top of it.

🛡️

SAFE

No silent failures. No untraceable fatals.

Pure-PHP safe replacements (s_json, s_file, …) throw standard exceptions instead of returning null/false, and the boot error handler turns warnings into exceptions. Fatals become catchable, logged, and traced.

🔒

SECURE

No dangerous primitives reach production.

unserialize, eval, exec, system disabled at the engine level. Hardened php.ini. Fully auditable — no black boxes.

⚙️

STABLE

One bad request can't take down the app.

Persistent, supervised workers with automatic recycling. Per-request isolation. Memory leaks contained instead of accumulating. No cold starts.

The 12-month arc · themes, not deadlines

Release ladder

Open-source and community-first. Milestones ship when they're ready; each quarter has one clear job.

Q3 2026 · now
v1.0 GA
Make the headline true
DoneRoadRunner worker crash fixed — persistent request loop verified (/health → 200).
DoneDrop-in proof — same unmodified app: stock PHP silently ships a $0 order (200), CorePHP catches it at the exact line, traced (500), and keeps serving.
DoneHappy-path compatibility suite — every s_*() proven byte-identical to native PHP on valid input, enforced in CI.
DoneReproducible cold-start vs persistent benchmark — ~6× throughput (p50 3.8ms vs 24ms), one-command harness.
Donev1.0.0 released — multi-arch on Docker Hub: docker pull greicodex/corephp-vm:1.0.0.
DonePublic launch — announced on X. Q3 complete.
Q4 2026
v1.1 – 1.2
Know before you ship
Donecorephp audit (MVP) — compile-time SAFE/SECURE/STABLE readiness report, --json + CI exit code. Flags the demo's silent-failure lines before deploy.
PlannedExpand safe-override coverage across PHP's footgun surface — public "footgun catalog".
PlannedFatal → traceable exception + structured logs. Strictness / compat modes for gradual adoption.
PlannedCode coverage in-image · benchmarks vs PHP-FPM, FrankenPHP, Swoole.
Q1 2027
v1.3
Run your framework, unmodified
PlannedSymfony · Laravel · CodeIgniter — framework-aware audit rules + runtime adapters. Run as-is.
PlannedUnmodified compatibility matrix — publish exactly what happens to the silent errors.
Plannedcorephp/std on Packagist — safe stdlib in any project, no Docker required.
PlannedOne-command "wrap my existing app" scaffolder.
Q2 2027 · north star
v2.0
Enforce it & scale it
PlannedAudit → shippable PHPStan ruleset: enforce "no silent failures" at CI, inline in your IDE.
PlannedMemory-leak detection + auto-recycle · OpenTelemetry + health endpoints · circuit breakers.
PlannedPSL 5.x migration. (Multi-arch amd64+arm64 already shipped in v1.0.0.)