Verified before it reaches you.

PXM releases bind each architecture's executable and archive to a source inventory, signed release metadata and recorded qualification. A successful compilation is one part of that evidence.

PXM 0.7.0 passed the recorded release gate on all six Ubuntu and architecture combinations. The public archives were checked against those exact accepted binaries.

ARM64 executable

d5fecd55c361df872a8c9ee10903659fd9a67e402c160940cd309c3f9d47ccbd

x86_64 (AMD64) executable

8becda6fe19ba5492a00422a367b28274cafa3ffd11ae5371920a11ac0a28798

Release proof

Read the qualification record · Read the source provenance · Signed release feed

d2691e7091a08a342a4da2dadc78bc9a1b487cbdfacdcff0f36cf0142ed83843

67dbb71e829469239eb2a883e9f181a14e51c2ec29fd46efb049487e1d57ab4a

620331b853af0f3f6f3cd9b5ae36125cc523ec3136485067e99612800bf10082

ee916ba94f6464c10ab58cf4866875d209ec1b619a48bc3df9d5ec3131b9cc0f

Supported targets

The release targets are Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS on ARM64 and x86_64. Qualification uses six bootable official Ubuntu guests with their own kernels and systemd. ARM64 uses hardware virtualization on Apple silicon. AMD64 uses QEMU full-system emulation, so these are correctness and compatibility checks, not native AMD64 performance measurements.

Other distributions, Alpine/musl, 32-bit platforms and every CPU model are not qualified.

Fresh checks for 0.7.0

This release adds optional Bun and a combined pxm update command. The exact release executables are exercised on Ubuntu 22.04, 24.04 and 26.04, each on ARM64 and AMD64.

• Bun installation, JavaScript and TypeScript execution, package installation, bunx, global selection and exact project pins. An authenticated Bun 1.4.3 installation updates to 1.4.4.
• Installed-only update plans, explicit confirmation, repeat no-ops and compatibility boundaries. PHP stays within its installed minor version. Node.js and Bun stay within their installed major versions.
• A genuine PHP 8.5 package rebuild, a Node 24 version update and the Bun update. PHP 8.4, PHP 8.6 preview and Node 26 are also checked as installed no-ops. Preview opt-in remains explicit.
• All twelve service families start and answer their protocols. MySQL, PostgreSQL and Redis use authenticated predecessor packages for real engine updates, rejected stale plans and rollback, with synthetic rows and credentials verified afterward.
• PHP-FPM and Node route replacement, failed-candidate preservation, exact project pins, stopped sites and pending helper restarts. Caddy is checked as an installed no-op with running and stopped state preserved; a Caddy version replacement is not claimed for this run.
• Fresh curl installation, interactive and unattended setup with Bun, repeat installation with active services, explicit manager restart, logout continuity and reboot autostart before the first login. A service with autostart disabled stays stopped.
• The dashboard's Bun actions, installer signature and filesystem refusal cases, and actual 0.6.0 to 0.7.0 executable replacement.

The final release gate binds native tests and actual CLI execution separately. CLI-last ordering and the exact Composer release plan are covered by native tests. Public CLI replacement and the advertised install command are replayed against the published endpoints after deployment. Before publication, installer tests use the exact release archives with an isolated test signing key and origin. The shipped installer has no such override.

The installer never starts setup or application services. Run pxm setup afterward. Combined updates can briefly stop an affected database to take a safe recovery backup and replace its engine; they do not automatically restart an already running PXM manager.

Retained installer evidence from 0.6.0

The published 0.6.0 evidence records the original curl installer and setup qualification. Its source and qualification objects remain pinned in the 0.7.0 release record. The 0.7.0 installer, setup, update and lifecycle checks above are fresh executions, with their own logs and hashes.

Preserved core evidence from 0.5.0

The release gate retains the exact published 0.5.0 qualification, reviews every permitted source change and verifies unchanged compiler and build settings. The checks below are recorded 0.5.0 evidence. They are not relabelled as fresh 0.7.0 executions.

That qualification also used a separate Ubuntu 22.04 guest with QEMU's baseline x86_64 CPU without AVX, AVX2 or SSE4. It exercised the CLI, Node 24 and 26 with npm scripts, Caddy HTTP and PHP-FPM HTTP with intl and sodium. Its additional service profile ran engines without imposing MongoDB's CPU requirements on the others; MongoDB correctly refused that unsupported CPU.

• Existing MySQL, PostgreSQL and Redis data and credentials through CLI upgrade, boot, logout, reboot, offline continuity and crash recovery.
• Private physical backups, restore, portable recovery, authentic engine updates and rollback, including application users and grants.
• Static, PHP-FPM, Node.js and reverse-proxy routes, private environments, replacement readiness and old-worker drain behavior.
• Node global and project selection, npm/npx, patch replacement and a running site's retained runtime until an explicit site update.
• PHP requests over HTTPS that connect to MySQL and PostgreSQL through PDO.
• Local HTTPS, explicit trust and untrust, ACME issuance and renewal, and router restart without replacing application workers.
• Verified multi-database imports from Oracle MySQL 8.4 and 9.7 and PostgreSQL 17 and 18, with source data preserved and targets stopped until cutover.
• Actual 0.4.0 to 0.5.0 executable replacement, followed by execution and exact installed-binary verification.

Automated issuance and short-lifetime renewal checks use Pebble, an isolated certificate authority with real HTTP-01 validation. A separate isolated hostname also received an actual Let's Encrypt certificate, with normal system trust and hostname verification. The public-certificate test does not simulate a full public CA renewal period. Public DNS, internet reachability, firewall policy and certificate authority rate limits still apply.

• All five supported PHP lines, stable Xdebug/SPX compatibility, preview module availability, real debugger protocol and code coverage.
• Twelve service families, authenticated lifecycle, retained credentials, safe snapshots, compatible updates and rollback. Memcached remains a volatile cache.
• Scheduled encrypted offsite backups, multipart upload, full ciphertext readback and recovery with a separately retained key.
• Application HTTP health checks, failed-deployment preservation, project tasks and reboot behavior.
• Local .test routing, folder discovery, explicit stop preservation and owned integration cleanup.
• Actual public Cloudflare Quick Tunnel links on all six targets, plus a separate custom-domain check covering authorized-zone discovery, verified HTTPS and exact resource cleanup.
• Private dashboard access, mail preview isolation, diagnostics inspection and the read-only MCP protocol with write refusal checks.

Download integrity

Runtime catalogs and CLI update feeds use PXM's pinned Ed25519 public key. Downloads must match their recorded archive size and SHA-256. Runtime installation checks the exact file inventory, executable roles, architecture and relocatable dependency closure before registering a package. Source kits and license notices accompany the runtime distribution.

Official Node and Bun release artifacts are authenticated against upstream signed checksums. Bun AMD64 uses the baseline vendor binary and requires SSE4.2; it does not require AVX. Bun is optional, so that requirement does not apply to the PXM CLI itself. PHP and service packages use verified official source material or authenticated vendor binaries, and Caddy is built from verified, pinned Go modules. Customers install the resulting binaries without a compiler or container engine.

Practical limits

PXM is a single-account application manager. It is not a hostile multi-tenant sandbox or a cluster orchestrator. Sites can use an explicit application HTTP endpoint for deployment readiness and periodic health reporting. A failing application is reported; it is not automatically restarted by the HTTP health monitor. Databases are local-only by default; exposing them is a separate operator decision.

Database snapshots require a pause and adequate disk space. Redis uses its standard AOF every-second policy, so host power loss can lose the last second of writes. Physical recovery requires the same CPU architecture. Logical import preserves supported database content through a verified copy; it does not copy global administrators and privileged grants. See scheduled encrypted backups, database operations, websites and imports for the complete operating boundaries.