Strict. Secure. Fast.

Waffle is a next-generation PHP framework for building secure, high-performance APIs and microservices. It is built on a Zero Trust architecture and enforces Strict Typing and Immutability by design.

Unlike traditional frameworks, Waffle refuses "magic." We prioritize explicit dependency injection, rigorous interface contracts, and the bleeding-edge features of PHP 8.5+ (Property Hooks, Asymmetric Visibility, Readonly Classes).

Everything you need to build, secure, and deploy Waffle applications.

1. 🛡️ Security First: Security is the foundation, not an addon. Fail-closed ABAC (a controller action with no #[Voter] is denied unless explicitly marked #[PublicAccess]), fail-closed universal authentication (JWT, OAuth2/OIDC, HMAC assertions, API keys, Basic), a stateless HMAC CSRF layer bound to the authenticated identity, internal SSRF protection (DNS-pinned, private-CIDR-blocked outbound calls), timing-safe secret comparison, trusted-host enforcement, baseline secure headers, native YAML parsing, and strict input validation — Waffle assumes the environment is hostile.

2. ⚡ Bleeding Edge Performance: Designed to run on FrankenPHP (Caddy) in Worker Mode. Long-lived workers, bounded memory, and a non-blocking outbound HTTP client deliver sub-millisecond response times.

3. 🧘 No Magic: No facades. No global state. No implicit logic. Waffle code is predictable, testable, and statically analyzable.

4. 🧹 Zero-Debt: Every component passes vendor/bin/mago fmt, lint, analyze, guard, and composer tests with 0 errors, 0 warnings. No baseline files exist anywhere in the tree.

5. 🐘 PHP 8.5 Strict: Property Hooks for DTO validation, Asymmetric Visibility (public private(set)) on framework state, typed constants for ecosystem-wide identifiers, final readonly value objects, #[\Override] on every interface implementation.

The waffle-commons organization is a modular monorepo of 21 fiercely independent framework components. Every component depends only on waffle-commons/contracts (plus waffle-commons/utils, the shared foundation — which itself requires only contracts) and its declared PSR dependencies — mago guard enforces this perimeter on every build.

The umbrella ships a Docker-native host helper, wfl, so contributors never run PHP on the host:

Run wfl help for the full command list.

Current Phase: 🟦 Beta 6 (Stabilization, Audit & Performance — Multi-engine security audit remediation, Diátaxis docs, EcoShield Gateway POC, K6 benchmarks)

Beta 6 stabilizes and audits the entire ecosystem: 17/17 security audit findings remediated natively with zero suppressions (AXE 2) across SQL injection, auth timing channels, voter subject resolution, HTML escaping, and AOT container state parity; a complete Diátaxis documentation overhaul (AXE 3, 331 verified links); the EcoShield Gateway reverse-proxy POC; and the scientific K6 benchmarking harness (AXE 5) proving 7.8× throughput of Symfony/PHP-FPM at 8.7× lower p50. It builds on Beta 5, which shipped the enterprise runtime additions (telemetry, telemetry-otel, async, AOT container/router compiler, DB connection pooling, WebAuthn/passkeys).

• ✅ Alpha 4: Pipeline & Hardening — native YAML config, PSR-15 pipeline, RFC 7807 error-handler.

• ✅ Alpha 5: Observability & Integration — PSR-3 log, PSR-14 event-dispatcher, attribute-based security.

• ✅ Alpha 6: Contracts freeze; DTO-validation groundwork.

• ✅ Beta 0: "Zero-Debt" — Mago Purge Protocol complete, new cache + console components.

• ✅ Beta 1: "EcoShield" — worker-native security hardening, new PSR-18 http-client, fail-closed ABAC, stateless CSRF, secure headers.

• ✅ Beta 2: HTTP correctness wave (405 / OPTIONS / HEAD / Allow) + developer experience + cognitive tooling.

• ✅ Beta 3: Data & Persistence (data, RFC-022) + Universal Auth Bridge (auth, RFC-021) + wfl igor worker-safety tooling.

• ✅ Beta 4: Security & stability hardening (SSRF, identity-bound CSRF, timing-safe comparisons) + DX tooling + the monorepo Academy.

• ✅ Beta 5: Enterprise Runtime — AOT container/router compiler, DB connection pooling, Fiber async finish-request deferral, contract-first telemetry & telemetry-otel bridge, WebAuthn/passkeys.

• 🟦 Beta 6 (current): Stabilization, Audit & Performance — multi-engine security audit remediation (17/17 fixed natively), Diátaxis docs overhaul, EcoShield Gateway POC, K6 benchmark suite (7.8× Symfony/FPM).

• 🎯 v1.0.0: Production Ready (Gold — December 2026), via Beta 7 (production surface — queue, OpenAPI, serializer, testing, resilience-net, K8s ops), Beta 8 (API freeze & consolidation), and 1.0.0-RC1.

We maintain a zero-tolerance policy for code quality. Before contributing, please ensure your environment meets the following:

• PHP: 8.5+ (strictly enforced; Property Hooks, Asymmetric Visibility, typed constants).

• Toolchain: Mago (formatter, linter, analyzer, guard) + the wfl igor worker-safety audit (igor-php 0.7, 0 KO) — every check must pass with zero baselines.

• Testing: PHPUnit 12.5+ (≥ 95 % coverage required for all components).

• Architectural perimeter: Your changes must respect the [guard.perimeter.rules] declared in the component's mago.toml. Cross-component coupling outside that perimeter is a build break.

Every framework component ships a Keep-a-Changelog CHANGELOG.md and a PR template listing the exact gates a contribution must clear. CI runs an incremental, per-component matrix (only changed submodules are audited) behind a single required umbrella-ci gate. Please read our Contribution Guidelines in the waffle repository.

Join the core team and contributors on Discord to shape the future of cloud-native PHP.

Maintained by the Waffle Framework Core Team. © 2026.