The CAPPZ SDK is open source: move off PHP route by route, keep every write, trust keys without a certificate authority

By CAPPZ.AI · October 27, 2026

The code behind our tutorials is now public under Apache-2.0. Move a PHP app off php-fpm one route at a time, verify signed requests with KeyZ Gate, and run wallets locally with no CAPPZ backend required. In our tests, PHP lost 76 confirmed orders; the CAPPZ port lost none.

Every command in our tutorials now runs on code you can read. The CAPPZ SDK is open source under Apache-2.0 at github.com/CAPPZ-ai/cappz-sdk. Clone it, run the tests, and check every claim below on your own machine.

Why it matters: PHP said yes and lost the order

We sent 300 orders, 50 at a time, to a small PHP app on nginx and php-fpm, and to its CAPPZ port.

PHP said "201 Created" to 88 orders and kept 12. Overlapping requests read the data file, changed it and wrote it back over each other. 76 customers were told yes for orders that were never stored.
212 of PHP's 300 requests crashed after reading a half-written file.
The CAPPZ port kept all 300. Each order is a new signed record on an append-only log, so nothing can overwrite a confirmed write. If the port can't record a write, it refuses it rather than confirm it.

Reading a file, changing it and writing it back is a common PHP pattern, and nothing in PHP flags this failure. The log just shows some 500s.

Signed requests: what the old checks let through

We ran a PHP signature check and KeyZ Gate, the CAPPZ edge verifier, on the same 12,051 signed requests.

Revoked keys: PHP accepted all 360 requests signed with a revoked key. KeyZ Gate refused every one.
Replays: PHP accepted all 359 replayed requests. KeyZ Gate refused every one.
The revocation window: an X.509 verifier holding its revocation list still answered "valid" one hour after the certificate was revoked. KeyZ answered "403 revoked" as soon as the revocation arrived.
Never looser: KeyZ Gate was stricter on 719 requests and looser on none, at the same speed as the PHP check.

With KeyZ, a wallet signs a declaration for each key it trusts. Revocations are signed records that every verifier replays offline, so there is no certificate authority to ask and no window of stale trust.

What's in the box

Move off PHP (@cappz/sdk/port): inventory your app in the browser, run each new handler beside PHP with every response compared, cut over on the evidence, and roll back in about a second. In our test, 84,051 of 84,051 compared responses matched, and the port served 45,593 requests per second against 34,662 for PHP tuned to 32 workers.
KeyZ and KeyZ Gate (@cappz/sdk/identity, /edge): wallet-signed key declarations, revocations and delegations; SD-JWT identity claims; signed HTTP requests (RFC 9421) checked at your reverse proxy.
Through firewalls (@cappz/sdk/transports): copies that reach each other over WebTransport, WebSocket or plain outbound HTTPS, through corporate proxies.
The wallet layer (@cappz/sdk/skills, /sync, /governance, /repoz): storage on your device first, sync between wallet copies, hash-verified principles, and RepoZ versioning. It runs with no CAPPZ backend at all; a hosted mirror is optional.
Paid agents (@cappz/sdk/paidAgent): run an agent on your own device and get paid in XRP or CAPPZ, stage by stage.
The CAPPZ edge node, with tools to rerun every benchmark in this post: write-race.ts, bench-routes.ts and compare-verifiers.ts.

One copy, in the open

cappz.ai installs this same repository, pinned to a commit. There is no private fork behind the public one: when the SDK changes, it changes there first.

Try it

git clone https://github.com/CAPPZ-ai/cappz-sdk cappz && cd cappz && npm install
npx vitest run

Then follow a tutorial:

The numbers come from one x86-64 test machine running our example apps, not a production instance. The tools are in the repository, so rerun them on yours.

Topics: Open source, SDK, PHP migration, KeyZ, Edge node, Local-first, RepoZ, Developers

Version 1 · recorded on the CAPPZ admin chain · content sha256 68bdd91f336d0f24