[amasiye]

Applications serving verified production Web Component assets could not override automatic bundle emission and watcher polling without editing tracked assegai.json. Separately loaded configuration could also give document scripts and runtime emission different selection values. This change makes the application's request configuration the shared owner for both rendering paths.

Milestone

0.10.2

Type

Feature, bug fix, documentation, tests

Why this belongs in this milestone

Provides the supported Core configuration needed for deployments that select integrity-pinned browser assets while retaining the workspace development workflow.

What changed

• Adds validated application webComponents overrides with independent enabled and hotReload.enabled switches.
• Shares one lazy project-bound runtime snapshot across both rendering engines and public helpers, with cleanup on successful requests, request errors, and failed bootstrap.
• Adds AppConfig::current() and WebComponentSupport::getConfiguration() so request services can inspect the same configuration used for rendering without loading PHP fragments again.
• Uses that application snapshot for document scripts and defaults; escapes watcher URLs embedded in inline scripts.
• Includes the framework-positioning README and package-description update already on develop.

What did not change

Dependency versions, workspace build configuration, and development hot reload remain compatible. Integrity attributes use the existing document script renderer.

Verification

• Full Unit suite passed sequentially on macOS with PHP 8.4.21 and 8.5.11: 234 tests, 854 assertions, 5 existing skips and 1 existing incomplete test.
• Fourteen new regression tests cover both renderers, SRI emission, independent controls, fragment precedence, snapshot identity and refresh, project isolation, invalid configuration, watcher state, and lifecycle cleanup.
• PHPStan level 8 passed on PHP 8.4; Composer strict validation and diff checks passed.

User impact

Applications can suppress automatic bundle emission and polling through application configuration and supply verified scripts through app.bodyScriptUrls. Omitted runtime fields inherit workspace defaults; malformed explicit overrides fail.

This removes ambient Config::set('app', ...) and $_ENV['app'] precedence for document defaults inside App requests. Use application configuration or explicit render properties instead. Direct new View(...) calls with omitted properties now use configured defaults, matching view(...); explicit ViewProperties remain authoritative.

Release notes

Included in docs/releases/0.10.2-release-notes.md. The 0.10.2 release will be published by Andrew after merge.

Upgrade notes

Included in the release notes and Web Components guide. Set both suppression flags for verified production assets, read selection through AppConfig::current() during requests, and restart long-lived workers after deployment configuration changes.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-13T10:01:49.995704Z	98198d1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.