CPalius CMF

Solving the Chicken-and-Egg Problem

When Symfony boots, it reads config/bundles.php. At this stage the database connection, service container, and autoloader are not fully ready. Trying to read module status from the database would lock the system before it can boot.

Solution: When a module is activated or deactivated, CPalius generates a static, PHP opcache-friendly array file named active_modules.php. bundles.php only reads that file — it never touches the database.

// Core always stays up
$bundles = [
    FrameworkBundle::class => ['all' => true],
    TwigBundle::class      => ['all' => true],
    DoctrineBundle::class  => ['all' => true],
    CoreBundle::class      => ['all' => true],
];

// Load active modules from file
$activeModules = require 'active_modules.php';
foreach ($activeModules as $moduleClass) {
    if (class_exists($moduleClass)) {
        $bundles[$moduleClass] = ['all' => true];
    }
}

Runtime Isolation

A class existing on disk (class_exists) does not mean its code runs safely. A TypeError or RuntimeException thrown inside a module's boot() method can crash the entire system.

Solution: Kernel::boot() is overridden so every module-level boot process is wrapped in try/catch (\Throwable). Faulty modules are quarantined automatically while the core keeps running.

Compile-Time Lock Protection & Dry-Run

Invalid YAML syntax or a bad DI definition in a plugin can make the Symfony container uncompilable. In that state, even terminal commands fail.

Solution: Before activation, an isolated subprocess is started with symfony/process. It runs cache:clear → lint:yaml → lint:container. On failure, activation is cancelled and the module is permanently quarantined. Broken state is never written to disk.

Isolated Route Loader

In standard Symfony, a syntax error in a module's routes.yaml file crashes the entire system.

Solution: SafeModuleRouteLoader loads each module's routes inside an isolated try/catch block. The faulty module is skipped while the rest of the system stays 100% available.

foreach ($this->moduleRegistry->getHealthyModuleBundles() as $moduleClass) {
    try {
        $imported = $this->import($routesFile, 'yaml');
        $collection->addCollection($imported);
    } catch (\Throwable $e) {
        $this->logger?->error('Skipping broken module routes', [
            'module' => $moduleClass,
            'error' => $e->getMessage(),
        ]);
    }
}

Safe Mode & Recovery Console (/aacp/recovery)

The /aacp/recovery endpoint is intentionally left public (PUBLIC_ACCESS) in security.yaml; it authorizes itself by comparing the AACP_RECOVERY_TOKEN from .env with hash_equals() (timing-safe). It runs no Doctrine queries — it remains operational even when the database is completely down. If the token is empty, the door stays fully closed (fail-safe).

Live System Monitor (htop-style)

The /aacp/system and /aacp/system/metrics JSON endpoints report load average, memory, OPcache hit-rate, database connection status, and Messenger queue status live in an htop-like fashion. For components that are not installed, it honestly returns "not installed".

Quarantine Screen & Cache Rebuild Console

/aacp/quarantine — a read-only panel that reads and lists the module_quarantine.log file. /aacp/system/cache-rebuild/* triggers Symfony cache, OPcache reset, and Tailwind asset rebuild operations through three separate AJAX endpoints that share the same CSRF token.

Localization Panel & Performance Management

TranslationManager lets you edit core and module messages+intl-icu.{tr,en}.yaml files from the web with an atomic write guarantee (.tmp + rename()). A separate Performance Management screen runs live connection tests for Redis, Memcached, Varnish, and Nginx PageSpeed — the "active" flag is set only when the test succeeds.