Audit fixes (2026-09)

.github/workflows/ci.yml

@@ -0,0 +1,37 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: PHPUnit (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        php: ['8.2', '8.3', '8.4']
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          coverage: none
+          tools: composer:v2
+
+      # The unit suite runs WITHOUT the native ePHPm engine: the Ephpm\Worker\*
+      # primitives are provided by test shims / the IDE stub, so `composer install`
+      # + phpunit is all that is needed.
+      - name: Install dependencies
+        run: composer install --prefer-dist --no-interaction --no-progress
+
+      - name: Run PHPUnit
+        run: vendor/bin/phpunit

README.md

@@ -29,8 +29,10 @@ tagged `v0.1.0`, so `^0.1` resolves:
 ## What worker mode is
 
 When the ePHPm server runs with `[php] mode = "worker"`, it keeps a pool of
-long-lived PHP worker processes alive and hands each HTTP request to a worker
-via **native** primitives registered by the engine:
+long-lived PHP worker **threads** alive and hands each HTTP request to a worker
+via **native** primitives registered by the engine. (ePHPm is a single process;
+each worker is a ZTS thread the engine owns — not a separate OS process — and the
+pool is sized by `[php] concurrency`.)
 
 ```php
 namespace Ephpm\Worker;
@@ -65,7 +67,7 @@ Contract notes:
   `bodyStream()` and PHP's POST reader — read it through only one of them.
   A stream stashed across requests returns EOF on the next request.
 - `parsedBody()`/`files()` are always `null`/empty: parse the body in your
-  adapter, or enable the `worker_populate_superglobals` config for PHP-native
+  adapter, or enable the `[php.worker] populate_superglobals` config for PHP-native
   `$_POST`/`$_FILES` population.
 - `exit()`/`die()` mid-request works — the engine synthesizes the response from
   SAPI headers plus captured echo output and recycles the worker — but pays a

stubs/ephpm-worker.stub.php

@@ -142,7 +142,7 @@ public function query(): array
     /**
      * Always returns `null`. Form/multipart parsing is an adapter concern —
      * parse {@see rawBody()}/{@see bodyStream()} yourself, or enable the
-     * `worker_populate_superglobals` config option for PHP-native
+     * `[php.worker] populate_superglobals` config option for PHP-native
      * `$_POST`/`$_FILES` population.
      *
      * @return array<string, mixed>|null always null
@@ -153,7 +153,7 @@ public function parsedBody(): ?array
 
     /**
      * Always returns an empty array. See {@see parsedBody()} — multipart
-     * parsing is an adapter concern (or the `worker_populate_superglobals`
+     * parsing is an adapter concern (or the `[php.worker] populate_superglobals`
      * config option).
      *
      * @return array<string, mixed> always empty