Audit released 3.x behavior, security and maintainability #124

Summary and intent

Audit the released 3.x library for reproducible bugs, security weaknesses and worthwhile incremental improvements. Convert verified findings into small, independently reviewable tasks rather than making speculative changes or repeating features already delivered by the major.

Baseline: 3.0.0, commit 500b49d6610c34e4b992592eb20260b60317c348. Release, Git tag and Packagist references have been verified against that commit. This investigation was requested by the maintainer after publication.

Scope

• Native lifecycle ownership, error/shutdown policy, reentrancy, reporter failures and aggregates.
• PSR-14 reporting, PSR-15 cleanup, PSR-17 rendering, request negotiation, public/debug output and optional integrations.
• Container/provider composition, cached services, fresh scopes and collaborator failure propagation.
• Meaningful unit/process coverage, supported dependency combinations, distribution, CI/release boundaries, guides, executable recipes and the bundled consumer skill.

Review tracked first-party content. Exclude generated dependencies, caches, local agent copies and unrelated host configuration. Use synthetic, bounded reproductions; no application credentials, production data or real servers.

Findings and follow-up policy

For each candidate, record expected versus observed behavior, the affected source/version, a minimal reproduction or concrete evidence, impact, existing-task search and acceptance criteria. Distinguish an ordinary defect, a documented limitation, a dependency-owned defect and a proposed improvement. Do not open a task merely to raise coverage or add abstractions.

Follow SECURITY.md: suspected vulnerabilities and sensitive reproduction details stay private until coordinated disclosure. Public issues must not expose them. An empty advisory report or passing tests is not proof that the repository has no vulnerabilities.

Confirmed public follow-up tasks

• 125: Correct the production guide — documentation patch for removed profile maps and the built-in Symfony/optional Whoops boundary.
• 126: Document structured event logging — a complete recipe using existing adapters, preserving the legacy listener policy and the original Throwable in PSR-3 context.

The functional review reproduced these bounded documentation/composition opportunities and did not identify another runtime defect. A suspected Symfony 7.1 compatibility problem was discarded after native execution succeeded. The source security scan has now completed and its canonical report is sealed: four independent reviews reported zero validated security findings across the same 188 first-party files. Overlapping inventories are not summed. Overall assurance remains partial for consuming deployments, conditional exposure, dependencies and external workflow enforcement; this is not a vulnerability-free certification. Detailed security records and unresolved hypotheses are retained privately under SECURITY.md. Both actionable follow-ups have now been delivered. The recorded assurance limits remain limits of the completed audit, rather than unimplemented repository changes.

Completion criteria

• Record reviewed areas and remaining coverage limits for the actual released baseline.
• Validate and deduplicate actionable findings before creating linked tasks.
• Give each ordinary bug or useful proposal its own bounded scope and acceptance criteria; record dependency ownership and blockers explicitly.
• Require implementation tasks to update relevant PHPDoc, meaningful tests, guides, executable examples/site excerpts, consumer skill and an independent changelog fragment together.
• Formalize API/behavior changes for maintainer review before implementation; prefer compatible patch/minor deliveries and separate PRs.
• Link final review evidence and all resulting public tasks, retaining security-sensitive evidence privately.

Verified closeout — 2026-10-28

The repository-wide source security review and functional/maintainability review are complete for the 3.0.0 baseline, with the limitations above. Both resulting tasks are now closed as completed through their delivering PRs:

• #125 / PR #127: merged as f743d89efd0832c3e6e7f729b286e8cc929f436c; the production guide now matches the single provider, built-in Symfony HTML and optional Whoops boundary.
• #126 / PR #128: merged as 3282d4f319a1256d27a84245fab0c6ef9f0ca5d3; the executable structured event-logging recipe, meaningful tests, cookbook/site and consumer skill are present on master, with no src/API/default changes. Its validation passed 495 tests / 3,027 assertions, maximum analysis/style, 28 bounded scenarios and all 14 native PHP CI jobs; the cookbook retains 19 complete recipes.

The owner's subsequent version PR #129 consolidated these two fragments. Published v3.0.1 targets master commit c0bd18543ad57e9baeb35aabb316d455e8645277 and includes both entries. The issue reconciliation did not merge a PR or publish a release.

No further validated implementation remains in this bounded audit. Closing it does not assert absence of vulnerabilities or extend its assurance to consuming deployments, dependencies or external workflow enforcement. Existing operational investigations #98 and #100 retain their independent evidence and closeout criteria; they are not unfinished audit implementation.