Verified before it reaches you.

PXM releases bind each architecture's executable and archive to a source inventory, signed release metadata and recorded qualification. A successful compilation is one part of that evidence.

PXM 0.4.0 passed the recorded release gate on all six Ubuntu and architecture combinations. The public archives were checked against those exact accepted binaries.

ARM64 executable

ddc86b7cd745522f7f06475663b9b6f610f54746295eff40df79c0e51188d64c

x86_64 (AMD64) executable

373ab1c0141ac7b1ac843517ea43a2bb3f9c28121ea43d10f0c14d4dbc482f4c

Release proof

Read the qualification record · Read the source provenance · Signed release feed

7ab9e76749a8a40484453ba2bd012263d8d75e7ee74e094b0f1367d00b40e478

35edbf15afd3c89fd1ebdcd1b792dc26b9e459a0b95ca65847021a5d7b7ae37d

d5aed578bc397acbcf7ed052ebf8635695605ae1d70117da47e1c371ee7a4981

f0a55788c0fb8c09d0f8ed48a5f5daa9d51ed3f7acce4cb46386f7c60a3a3d87

Supported targets

The release targets are Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS on ARM64 and x86_64. Qualification uses six bootable official Ubuntu guests with their own kernels and systemd. ARM64 uses hardware virtualization on Apple silicon. AMD64 uses QEMU full-system emulation, so these are correctness and compatibility checks, not native AMD64 performance measurements.

A separate Ubuntu 22.04 guest uses QEMU's baseline x86_64 CPU without AVX, AVX2 or SSE4. It exercises the actual CLI, Node 24 and 26 with npm scripts, Caddy HTTP and PHP-FPM HTTP with intl and sodium. Other distributions, Alpine/musl, 32-bit platforms and every CPU model are not qualified.

What the release gate checks

• Existing MySQL, PostgreSQL and Redis data and credentials through CLI upgrade, boot, logout, reboot, offline continuity and crash recovery.
• Private physical backups, restore, portable recovery, authentic engine updates and rollback, including application users and grants.
• Static, PHP-FPM, Node.js and reverse-proxy routes, private environments, replacement readiness and old-worker drain behavior.
• Node global and project selection, npm/npx, patch replacement and a running site's retained runtime until an explicit site update.
• PHP requests over HTTPS that connect to MySQL and PostgreSQL through PDO.
• Local HTTPS, explicit trust and untrust, ACME issuance and renewal, and router restart without replacing application workers.
• Verified multi-database imports from Oracle MySQL 8.4 and 9.7 and PostgreSQL 17 and 18, with source data preserved and targets stopped until cutover.
• Actual 0.3.0 to 0.4.0 executable replacement, followed by execution and exact installed-binary verification.

ACME qualification uses Pebble, an isolated test certificate authority with real HTTP-01 challenge validation. It does not claim that a public certificate authority has issued a certificate for a customer domain. Public DNS, internet reachability, firewall policy and certificate authority rate limits still apply.

Download integrity

Runtime catalogs and CLI update feeds use PXM's pinned Ed25519 public key. Downloads must match their recorded archive size and SHA-256. Runtime installation checks the exact file inventory, executable roles, architecture and relocatable dependency closure before registering a package. Source kits and license notices accompany the runtime distribution.

Official Node release artifacts are authenticated against upstream signed checksums. PHP and database packages use authenticated official source material, and Caddy is built from verified, pinned Go modules. Customers install the resulting binaries without a compiler or container engine.

Practical limits

PXM is a single-account application manager. It is not a hostile multi-tenant sandbox or a cluster orchestrator. Site readiness checks the owned listener or PHP-FPM socket, not application-specific HTTP health. Databases are local-only by default; exposing them is a separate operator decision.

Database snapshots require a pause and adequate disk space. Redis uses its standard AOF every-second policy, so host power loss can lose the last second of writes. Physical recovery requires the same CPU architecture. Logical import preserves supported database content through a verified copy; it does not copy global administrators and privileged grants. See database operations, websites and imports for the complete operating boundaries.