kumwe / approval

v0.1.2 2026-09-08 16:05 UTC

Requires

• php: ^8.5
• ext-mbstring: *
• kumwe/access-context: 0.1.2
• kumwe/access-control: 0.1.2
• kumwe/audit: 0.1.2
• kumwe/transaction: 0.1.2
• psr/clock: ^1.0
• psr/container: ^2.0
• ramsey/uuid: ^4.9

Requires (Dev)

• laminas/laminas-servicemanager: ^4.0
• phpstan/phpstan: ^2.1
• phpstan/phpstan-strict-rules: ^2.0
• phpunit/phpunit: ^12.0
• squizlabs/php_codesniffer: ^4.0

Apache-2.0

Published on Packagist.org on 2026-09-08 16:06 UTC

README

Portable maker-checker requests and state transitions under Kumwe\Approval. An approval binds actor, action, resource identity/version, scope, authority, payload and exclusive expiry. Core supplies trusted authority, persistence and the actual protected action.

Installation and use

Requires PHP 8.5 with mbstring. Install the published package with an exact pre-1.0 pin:

composer require kumwe/approval:0.1.2

<?php

require 'vendor/autoload.php';

use Kumwe\Approval\ApprovalBinding;

$binding = new ApprovalBinding(
    'maker', 'record.update', 'record', 'record-1', 7,
    'site', null, null, str_repeat('a', 64), hash('sha256', '{"approved":true}'),
);
assert($binding->resourceVersion() === 7);
assert(strlen($binding->digest()) === 64);

This value describes a binding; the host must supply trusted actor, authority and scope facts. To run the workflow, register ConfigProvider dependencies in the host composition root and supply every binding in the integration guide. The typed example verifies binding behavior.

Core integration

ApprovalService and ApprovalQueryService are stateless. Core provides repositories, membership and authorization, transaction-bound ownership/audit/replay operations, clock and UUID generation. The Core contract defines authority, transaction, lifecycle and test ownership. Consuming an approval does not execute a protected action.

The exact Kumwe dependency tuple is Access Context, Access Control, Audit and Transaction 0.1.2, resolved from Packagist. PSR Clock/Container and Ramsey UUID provide the remaining contracts. Public API, architecture, charter and release record describe the package.

Development and releases

composer install
composer check
composer examples

CI checks behavior, hostile inputs, API/manifests, configured services and a no-dev authoritative archive consumer. Published versions and CI status are linked above; Core validates its own retained integration suites. The release standard distinguishes publication identity checks from independent release evidence. Licensed under Apache-2.0.