Foundation 3.0 post-release hardening: native caches and auth topology

[abmmhasan]

Summary

Post-release hardening discovered while certifying InfByte against Foundation 3.0.

Auth notification topology

When auth.drivers.notifications=talkingbytes, auth consumes both the optional communication capability and Foundation's native notifications capability. The module/catalog topology now declares that dependency explicitly so generated production graphs do not rely on development autowiring.

Native Webrick matcher caches

Foundation keeps ownership of the outer immutable release generation, but Webrick now owns the route-cache mechanics for every matcher strategy:

• fused publishes and boots Webrick's native fused matcher cache;
• generated publishes and boots Webrick's native generated matcher cache;
• sharded publishes and boots Webrick's native __current + immutable generation-* shard layout.

Foundation passes the selected generation-owned cache path to Webrick and requires canBootFromCache() when a cache was published. It does not wrap matcher caches with a Foundation whole-tree digest, pre-scan the shard tree on process boot, or restore the old mutable bootstrap/cache/routes layout.

Webrick remains responsible for cache format, activation, loading, lazy shard selection, and native integrity validation.

Native ArrayKit configuration caches

Development/build configuration caching now delegates both supported layouts to
ArrayKit's native mechanisms:

• sharded keeps LazyFileConfig::warmNamespaceCache() namespace files plus
  ArrayKit's __flat.php exact-leaf index;
• single writes and loads bootstrap/cache/config/config.php through
  Config::exportCache()/loadCache().

Foundation's __manifest.php now contains policy/identity metadata rather than
a second whole-config payload. Switching layouts removes stale artifacts from the
other native format. ArrayKit materializes Environment::ref() values and
closures during cache generation; Foundation validates both the permitted input
types and the resulting concrete generated data. Immutable release config keeps
the stricter production export contract.

There is no separate routing-style fused config mode: ArrayKit's sharded
strategy already provides fused scalar/null leaf acceleration through
__flat.php.

Native InterMix compiled-container ownership

Generated InterMix PHP ProductionContainer artifacts remain the native DI production cache for web, CLI, worker and scheduler. CacheLayer is core Foundation infrastructure, but Foundation does not automatically attach CacheLayer/PSR-6 definition caching to generated production containers.

The trusted non-web boot path now avoids duplicate InterMix sidecar I/O:

• Foundation validates Foundation-owned release metadata and the trusted InterMix digest identity;
• InterMix validates its own native .meta.json and generated container exactly once;
• generated PHP remains directly executable/OPcache-friendly.

Regression coverage verifies that selecting the Foundation cache capability does not silently enable InterMix definition caching and that tampered native InterMix metadata still fails closed at the InterMix boundary.

Release behavior

All artifacts remain inside one immutable Foundation generation with atomic activation, rollback, leasing and pruning. Source config/providers/routes are not rediscovered on trusted production boot.

Qualification

• final qualified head: 4560e91265be49ca815d8b113523c04efe1ff601
• Security & Standards run #1787 (36033750802) — success
• release evidence job 107750535716 — success
• PHP 8.4/8.5 lowest/stable QA, analysis, benchmarks and clean install — success
• all four production-consumer rows — success

This PR remains draft. Do not merge or release automatically.