# The CAPPZ SDK is open source: move off PHP route by route, keep every write, trust keys without a certificate authority

> The code behind our tutorials is now public under Apache-2.0. Move a PHP app off php-fpm one route at a time, verify signed requests with KeyZ Gate, and run wallets locally with no CAPPZ backend required. In our tests, PHP lost 76 confirmed orders; the CAPPZ port lost none.

By CAPPZ.AI · October 27, 2026 · Source: https://cappz.ai/news/cappz-sdk-open-source

Every command in our tutorials now runs on code you can read. The CAPPZ SDK is open source under Apache-2.0 at [github.com/CAPPZ-ai/cappz-sdk](https://github.com/CAPPZ-ai/cappz-sdk). Clone it, run the tests, and check every claim below on your own machine.

## Why it matters: PHP said yes and lost the order

We sent 300 orders, 50 at a time, to a small PHP app on nginx and php-fpm, and to its CAPPZ port.

- **PHP said "201 Created" to 88 orders and kept 12.** Overlapping requests read the data file, changed it and wrote it back over each other. 76 customers were told yes for orders that were never stored.
- **212 of PHP's 300 requests crashed** after reading a half-written file.
- **The CAPPZ port kept all 300.** Each order is a new signed record on an append-only log, so nothing can overwrite a confirmed write. If the port can't record a write, it refuses it rather than confirm it.

Reading a file, changing it and writing it back is a common PHP pattern, and nothing in PHP flags this failure. The log just shows some 500s.

## Signed requests: what the old checks let through

We ran a PHP signature check and KeyZ Gate, the CAPPZ edge verifier, on the same 12,051 signed requests.

- **Revoked keys:** PHP accepted all 360 requests signed with a revoked key. KeyZ Gate refused every one.
- **Replays:** PHP accepted all 359 replayed requests. KeyZ Gate refused every one.
- **The revocation window:** an X.509 verifier holding its revocation list still answered "valid" one hour after the certificate was revoked. KeyZ answered "403 revoked" as soon as the revocation arrived.
- **Never looser:** KeyZ Gate was stricter on 719 requests and looser on none, at the same speed as the PHP check.

With KeyZ, a wallet signs a declaration for each key it trusts. Revocations are signed records that every verifier replays offline, so there is no certificate authority to ask and no window of stale trust.

## What's in the box

- **Move off PHP** (`@cappz/sdk/port`): inventory your app in the browser, run each new handler beside PHP with every response compared, cut over on the evidence, and roll back in about a second. In our test, 84,051 of 84,051 compared responses matched, and the port served 45,593 requests per second against 34,662 for PHP tuned to 32 workers.
- **KeyZ and KeyZ Gate** (`@cappz/sdk/identity`, `/edge`): wallet-signed key declarations, revocations and delegations; SD-JWT identity claims; signed HTTP requests (RFC 9421) checked at your reverse proxy.
- **Through firewalls** (`@cappz/sdk/transports`): copies that reach each other over WebTransport, WebSocket or plain outbound HTTPS, through corporate proxies.
- **The wallet layer** (`@cappz/sdk/skills`, `/sync`, `/governance`, `/repoz`): storage on your device first, sync between wallet copies, hash-verified principles, and RepoZ versioning. It runs with no CAPPZ backend at all; a hosted mirror is optional.
- **Paid agents** (`@cappz/sdk/paidAgent`): run an agent on your own device and get paid in XRP or CAPPZ, stage by stage.
- **The CAPPZ edge node**, with tools to rerun every benchmark in this post: `write-race.ts`, `bench-routes.ts` and `compare-verifiers.ts`.

## One copy, in the open

cappz.ai installs this same repository, pinned to a commit. There is no private fork behind the public one: when the SDK changes, it changes there first.

## Try it

    git clone https://github.com/CAPPZ-ai/cappz-sdk cappz && cd cappz && npm install
    npx vitest run

Then follow a tutorial:

- [Move off PHP, one route at a time](https://cappz.ai/tutorials/move-off-php#php-failed)
- [Identity and trust: KeyZ, KeyZ Gate and WAS](https://cappz.ai/tutorials/identity-and-trust)
- [Replicate through firewalls](https://cappz.ai/tutorials/replicate-through-firewalls)
- [Earn with your own agent](https://cappz.ai/tutorials/earn-with-your-agent)

*The numbers come from one x86-64 test machine running our example apps, not a production instance. The tools are in the repository, so rerun them on yours.*

---

CAPPZ.AI News: https://cappz.ai/news · RSS: https://cappz.ai/news/rss.xml