PHPackages kumwe/extension-sdk - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. kumwe/extension-sdk ActiveLibrary kumwe/extension-sdk =================== The Kumwe extension SDK: the manifest contract, SPI interfaces, classification data and signed compatibility fixtures, plus the author toolchain - scaffold, deterministic build, sign, inspect and conformance-test - sharing one inspection implementation with Kumwe App's admission. v0.1.1(today)016↑2525%Apache-2.0PHPPHP ^8.5CI passing Since Aug 28Pushed todayCompare [ Source](https://github.com/kumwe/extension-sdk)[ Packagist](https://packagist.org/packages/kumwe/extension-sdk)[ Docs](https://github.com/kumwe/extension-sdk)[ RSS](/packages/kumwe-extension-sdk/feed)WikiDiscussions main Synced today READMEChangelog (2)DependenciesVersions (3)Used By (0) Kumwe extension SDK =================== [](#kumwe-extension-sdk) **The SDK builds, signs, verifies and reports. The App decides, trusts, activates and enforces.** `kumwe/extension-sdk` is the whole author-facing SDK for building [Kumwe App](https://github.com/kumwe/app) extensions. One package, two consumers: - **Extension authors** get the contract — the manifest schemas across all generations (currently six, each frozen forever once published), the SPI interfaces an extension implements, the classification data that says exactly which types are public and what you do with each, and the signed compatibility fixtures that pin the promised surface — plus the toolchain an author runs in CI: scaffold, deterministic package builder, signer, inspector/verifier, and the conformance runner. - **Kumwe App itself** consumes the same package and runs the same inspector at admission time. "The SDK and admission produce the same findings" is enforced by one shared implementation, not by keeping two copies in sync. What your CI proved is what admission finds. The boundary ------------ [](#the-boundary) The SDK carries the contract and the toolchain, and deliberately nothing else. Admission policy, trust registries and trust state, lifecycle activation, and capability gating are the App's: the App decides and enforces; the SDK verifies and reports. The SDK holds no authority, no storage, and no App domain imports. The full statement of scope — including the three never-clauses — is law in [`CHARTER.md`](CHARTER.md). The canonical names ------------------- [](#the-canonical-names) The extension API this SDK carries already ships inside Kumwe App, historically declared under `Kumwe\App\...` fully qualified class names. The canonical `Kumwe\Extension\...` names are the only names — no second namespace, no translation layer, ever: - canonical names live under `Kumwe\Extension\...` in this repository; - the App imports these names directly: its adoption change migrates every reference — imports, FQCN strings, docblocks, and its classification records — to canonical names and retires every historical `Kumwe\App\...` name; - the App's signed compatibility fixtures, across every manifest generation, remain frozen signed bytes, replayed as the proof that nothing observable changed. Retiring the historical names is legitimate because no third-party extension was ever published against them. The App becomes consumer #1 of this package, pinning it exactly; the agreement is recorded in [`docs/app-agreement.md`](docs/app-agreement.md). Status ------ [](#status) **Extracted and published, awaiting adoption** — the frozen contract artifacts are vendored and digest-verified under `resources/` (E-1); the portable public contract types live under `Kumwe\Extension\` with the generated migration map in [`docs/migration-map.json`](docs/migration-map.json) (E-2); the author toolchain — scaffold, deterministic build, sign, inspect, conformance — is extracted with byte-determinism and findings-equality proofs against the App's recorded builds and findings (E-3); the conformance runner is self-contained, requiring PHP and extensions only (E-4); and the package is live on Packagist with release automation (E-6). The remaining phase — the App consuming this package — is tracked in [`docs/roadmap.md`](docs/roadmap.md). Until it lands, Kumwe App's in-tree implementation remains the authority the App itself runs on. Checking your work ------------------ [](#checking-your-work) The lane is dependency-free and runs on a clean clone with no composer install: ``` composer check # lint + docs + contract + test, or run the four directly: php tools/lint.php php tools/check-docblocks.php php tools/verify-contract.php php tests/run.php ``` Every commit passes it. How the code is written — layers, documentation blocks, the real-outcomes testing standard — is stated in [`docs/engineering-standard.md`](docs/engineering-standard.md). License ------- [](#license) Apache License 2.0. See [`LICENSE`](LICENSE). ### Health Score 41 — FairBetter than 87% of packages Maintenance100 Actively maintained with recent releases Popularity8 Limited adoption so far Community6 Small or concentrated contributor base Maturity42 Maturing project, gaining track record Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Every ~0 days Total 2 Last Release 0d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/a25ae1ee33c121aba9fc335e04e80af2aeb4b3f415850d7170a98300b74bafc8?d=identicon)[llewellyn](/maintainers/llewellyn) --- Top Contributors [![Llewellynvdm](https://avatars.githubusercontent.com/u/5607939?v=4)](https://github.com/Llewellynvdm "Llewellynvdm (10 commits)") ### Embed Badge ![Health badge](/badges/kumwe-extension-sdk/health.svg) ``` [![Health](https://phpackages.com/badges/kumwe-extension-sdk/health.svg)](https://phpackages.com/packages/kumwe-extension-sdk) ``` PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)