Inspiration
I started JAS because PHP is easy to adopt but large PHP systems become difficult to govern. As teams and features grow, types become implicit, permission checks spread across controllers, domains reach into each other's data, and recovery depends too much on maintainers remembering unwritten rules.
JAS turns those rules into definitions that the runtime can enforce.
What I built
JAS — JAH Action Script PHP 2.0 is a typed, governed application layer implemented in pure PHP. It gives developers a consistent way to define types, domains, capabilities, actions and events, then routes execution through validation, authorization, persistence and audit boundaries.
Its main components are:
- strict typed contracts and organized domain definitions;
- capability-based authorization and institutional identity;
- governed actions, idempotency, audit and event evidence;
- secure server-rendered web primitives;
- persistent queues, workers and operational health tools;
- DataCore, the authoritative append-only persistence layer;
- encrypted, signed backups with verified empty-tree restoration;
- governed SQL migration and one-way read-only mirroring;
- a PHP Language Intelligence Engine plus an external standard-LSP bridge;
- C and C++ interoperability through authenticated JASB boundaries;
- a deployable eight-domain institutional reference portal.
The engine does not require JavaScript, Node, Composer, JSON services or an AI connection at runtime.
How it works
A request follows one explicit path:
input → typed validation → capability check → governed action → DataCore transaction → audit/event evidence → safe response
DataCore remains authoritative. SQL can be used as a governed migration source or a one-way mirror, but arbitrary SQL changes cannot flow back into DataCore. This prevents a compromised mirror from silently contaminating the primary data.
The reference portal demonstrates identity, users, publications, feeds, private messaging, moderation, notifications and audit. Its tests cover valid operations as well as invalid input, missing permissions, duplicate requests, concurrent writers, forced process termination, tampered backups and restoration.
The demo: Taquería Viva
To prove that JAS can support a real product instead of only framework tests, I used it to build Taquería Viva, a server-rendered management application for a Mexican taquería.
The public demo condenses a real 83-minute-and-49-second recording containing an 81-minute Codex build. It shows the requests and final responses for seven verified phases:
- catalog, ingredients and typed recipes;
- transactional orders and atomic inventory deduction;
- kitchen workflow, purchases, waste and stock alerts;
- shifts, payments, cancellations and reports;
- institutional login, roles and permissions;
- CSRF protection and secure HTTP headers;
- concurrency, duplicate-payment and encrypted backup/restore tests.
The video is public and runs for 2 minutes 53 seconds: https://youtu.be/r9wakYm8Y9Q
How I used Codex and GPT-5.6
I built and reviewed JAS during OpenAI Build Week in Codex with GPT-5.6 SOL and Medium reasoning effort.
Codex helped me inspect the inherited PHP prototype, maintain the phase plan, refactor duplicated runtime concepts, implement security and recovery paths, generate positive and adversarial tests, diagnose regressions and keep public documentation aligned with executable behavior.
The repository's AGENTS.md governed that work. It required Codex to inspect the installed JAS version and real APIs before coding, avoid invented commands, work in small verified increments, preserve DataCore's authority and report limitations honestly.
The biggest acceleration was not generating isolated files. It was reasoning across connected invariants: transaction visibility, recovery ordering, signed journals, index behavior, SQL isolation, backup integrity and negative authorization tests.
GPT-5.6 and Codex are development and review tools only. JAS makes no OpenAI API calls and applications continue to run locally with PHP.
Challenges and lessons
The hardest part was making strict security useful instead of frustrating. JAS originally rejected unsafe work correctly, but terse failures made both humans and coding agents spend time discovering the allowed correction. I added stable, secret-redacted diagnostics so failures explain the violated boundary and the permitted next step without weakening enforcement.
I also learned not to turn benchmarks into marketing claims. In the published local microbenchmark, SQLite is faster and smaller than the current DataCore implementation. JAS reports that result directly and documents where DataCore improved after profiling.
How judges can test it
Verified target: Linux x86-64 with PHP 8.2+, Sodium and PCNTL.
git clone https://github.com/esmeydub/JAS-JAH-Action-Script-PHP.git
cd JAS-JAH-Action-Script-PHP
cp .env.example .env
php bin/jas health
php bin/jas analyze examples/reference_portal
php tests/test_jas_reference_portal.php
php tests/run_all.php
The expected final line is:
JAS SUITE: PASS
The repository includes installation instructions, the reference application, test data created by the test harness, migration guidance, security boundaries and reproducible benchmarks. No account or hosted credential is required.
What is complete and what remains
JAS 2.0 has a frozen public API, an executable reference portal, an internal security/failure gate and reproducible tests. The external cryptographic review and penetration test are still pending. I do not present JAS as certified or claim that application-level controls can protect a compromised host.
Next, I plan to commission that independent review against a specific release and deployment environment, then use the findings to harden the next version.