Goridge Laravel Package

Technical Evaluation

What this release is. 4.6.0 is the first release since the rebrand with actual code surface change. Three entries: deprecation of MsgpackCodec and Frame::CODEC_MSGPACK; a bug fix that initializes MsgpackCodec with rybakit/msgpack when ext-msgpack is absent; and a second package-identity rename, spiral/roadrunner → roadrunner/roadrunner, in the package's own requirements. The first two are one story — the optional msgpack codec is now on a removal path, and its fallback implementation was just patched. The third extends the naming cascade begun in 4.5.0 beyond this library.

Correction to the 4.5.0 assessment. Two statements there are now stale and should not be carried forward: "no deprecation of a public class is disclosed" — there is one now, of a public class and a public class constant; and "runtime risk is flat, dependency-management risk is not" — still accurate for the default codec, but no longer the whole picture. The wire protocol itself is unchanged; a codec selector within it is now deprecated.

What msgpack is here, and who cares. Goridge frames carry a codec byte in their options field. Frame::CODEC_MSGPACK tells both ends to msgpack-encode the payload instead of passing raw bytes — and it only matters if the PHP side sets that codec and the RoadRunner Go server agrees. The default Octane topology almost certainly uses the raw/bytes codec, so the deprecation is a non-event for the mainstream path. It bites exactly the direct-consumer scenarios the prior assessment told you to prototype last: custom workers, custom relay clients, protocol-level tooling. Also determine what replaces it. If the recommendation is "serialize at the application layer and use the raw codec," migration is cheap. If it's "a new codec," that's a wire-level coordination exercise with the Go binary. Don't guess.

The ext-msgpack fallback. The fix implies msgpack is no longer hard-wired to the extension: without ext-msgpack, the class falls back to rybakit/msgpack (pure PHP). Three consequences: a path that previously failed at startup now runs, so latent fallback bugs surface as production behavior; if rybakit/msgpack is a hard require rather than a suggest, a new package enters your vendor tree and SBOM; and pure-PHP msgpack is meaningfully slower per payload than the extension. Net effect for anyone using msgpack: two possible implementations of the same codec depending on host configuration.

The second rename. require roadrunner/roadrunner instead of spiral/roadrunner is almost certainly a dev-only or self-test dependency (binary-downloader/CLI lineage), not something your application resolves at runtime — but verify rather than assume with composer why spiral/roadrunner across the estate. Either way it is the second identity-keyed artifact in nine days, and it confirms the pattern: the whole roadrunner-* family is mid-rebrand on its own schedule, independent of Octane's.

Architecture fit. Unchanged: entirely transitive via laravel/octane → roadrunner-http/roadrunner-worker → this package. Score high for "must be present and healthy," near-zero for "should we build on it." The msgpack deprecation sharpens the corollary — the more you touch the codec layer directly, the less this stays an invisible dependency. Stay on the default codec and 4.6.0 costs you nothing.

Integration feasibility. Still trivial to install and framework-agnostic. Naming remains the hard part and got harder: three package names are now in motion (spiral/goridge → roadrunner/goridge, spiral/roadrunner → roadrunner/roadrunner, plus whatever Octane's constraints say). The split-brain hazard from 4.5.0 stands — until replace: spiral/goridge is confirmed and dual install is ruled out, treat any direct pin as unsafe.

Technical risk.

• Package coexistence / split-brain remains the top risk, with a wider blast radius now that a second package name is moving.
• Deprecation clock (new). A deprecation in a library this small usually means removal in the next major. Removing CODEC_MSGPACK is a wire-contract change if anything still emits it, and it would land alongside a RoadRunner binary compatibility question. Low likelihood of affecting you, high cost if it does — worth a 30-minute check now rather than an unattended composer update later.
• Codec/implementation divergence (new). ext-msgpack vs pure-PHP rybakit/msgpack can differ in behavior and performance across environments.
• Scanner/advisory blindness unchanged and reinforced — every rename resets allowlists, SBOM consumers, and composer audit policies keyed to the old name.
• Version skew (PHP library ↔ roadrunner-* ↔ RoadRunner Go binary) unchanged, still the dominant runtime risk.
• Community-signal metrics still unreliable (split star/download/dependent counts). Release cadence — 4.5.0 → 4.6.0 in nine days — is a mild positive for maintenance and a mild negative for churn during a rebrand. Pin, don't float.
• Transport risk and blocking I/O unchanged: ext-sockets for SocketRelay, socket path/permission drift in containers, unauthenticated TCP port if misconfigured, hung recv presenting upstream as 502s.

Key questions before adopting or upgrading.

1. Does anything in our estate set Frame::CODEC_MSGPACK or otherwise opt into msgpack? Grep the constant, the string, and custom worker bootstraps. Answer this first — it's the only item in 4.6.0 with a removal date attached.
2. What does the deprecation notice recommend as a replacement, and does the RoadRunner Go binary in our image still support the msgpack codec if we need a transition window?
3. Is rybakit/msgpack a require or a suggest, and does ext-msgpack exist in our runtime images? Host-dependent codec behavior is a debugging tax.
4. Is roadrunner/roadrunner runtime or dev-only, and does the spiral/roadrunner move affect our binary-download/CLI path?
5. Does roadrunner/goridge declare replace: spiral/goridge, and does a resolution exist that installs both?
6. Are we a direct consumer, or only transitive via Octane?
7. Have laravel/octane, roadrunner-http, roadrunner-worker, and roadrunner-cli migrated to the new names, and what constraints do they carry?
8. What is the actual PHP floor and minimum stability for the 4.x constraint we would resolve to?
9. Are spiral/goridge and spiral/roadrunner marked abandoned on Packagist, and where do they point?
10. Which internal artifacts hardcode either old name — SBOM jobs, license allowlists, advisory-suppression lists, dashboards, runbooks, Slack alerts, composer.json pins?
11. Which relay/transport does the deployment actually use — pipes, Unix socket, or TCP?
12. What RoadRunner binary version is in the image, and is it pinned to match the library constraint?

Integration Approach

Stack fit. Unchanged: Laravel 10/11 + Octane on the RoadRunner driver, default codec, pipes or Unix sockets. Direct use stays narrow, and 4.6.0 narrows it further — opting into msgpack now means opting into a deprecated API plus a host-dependent codec implementation.

Migration path. Same two strategies and the same rule: migrate when something else forces it.

• Follow if Octane and the roadrunner-* family have migrated. Bump them together, let the renames arrive transitively, update identity-keyed artifacts in the same change.
• Defer if they haven't. Staying on the pinned spiral/goridge has no wire-protocol downside and avoids dual installs.

New on top of either: treat the msgpack deprecation as a separate, small workstream. If nothing sets the codec, close it with a line in the ADR and move on. If something does, plan removal before the next major — switch to application-level serialization over the raw codec, verify against the Go binary, then drop the constant. Do not couple this to the rename migration: different clocks, different failure modes.

And do not hand-edit composer.json to swap package names ahead of the constraints that reference them. If a direct dependency ever becomes necessary, put it behind an internal adapter so protocol and codec types never leak into domain code, and record an ADR.

Compatibility notes.

• Both renames are breaking at the Composer level; autoload namespaces are unchanged, which is what makes duplicate installs quiet.
• Co-resolvability must be checked against laravel/octane, roadrunner-cli, roadrunner-http, roadrunner-worker — and now roadrunner/roadrunner vs spiral/roadrunner.
• A msgpack codec change is not a PHP-side-only change; it requires agreement from the Go side.
• StreamRelay (pipes) still works without ext-sockets; prefer it for the default Octane topology.
• Re-verify PHP floor for 4.x rather than assuming 8.1.

Sequencing.

1. Grep for msgpack usage — constant, string, custom worker bootstrap. Cheap; do it first.
2. Inventory: composer why for spiral/goridge/roadrunner/goridge and spiral/roadrunner/roadrunner/roadrunner across every repo; record whether a direct dependency exists anywhere.
3. Inspect the target version's composer.json for a replace declaration and for how rybakit/msgpack is declared; confirm whether dual-install is even possible.
4. Check migration status of Octane and the roadrunner-* family; pick Follow or Defer explicitly and write it down.
5. Update every identity-keyed artifact — SBOM, allowlists, advisory configs, dashboards, runbooks — in the same PR as any constraint change, not as follow-up cleanup.
6. Keep the CI smoke test that boots an Octane worker and round-trips one request through the relay; extend it to assert exactly one Goridge implementation is installed and to fail on a deprecated-codec marker.
7. Record and pin the RoadRunner Go binary version alongside the PHP constraint.
8. Only after 1–7, prototype any direct use (custom worker, custom relay).

Operational Impact

Maintenance. Near-zero when transitive and pinned — but the pin matters more now. A nine-day release cadence is healthy, yet during a rebrand it means constraints and dependency names keep moving underneath you. Track the Go binary first and let Composer follow. The one-time bookkeeping cost of the rename now recurs twice; add both legacy names to the runbook. Still, do not fork: forking a wire protocol is a permanent tax, and forking during a rebrand guarantees you desynchronize from a moving target.

Support. MIT, small maintainer group, GitHub issues, no vendor SLA. Consolidation into the roadrunner-php organization continues to help discoverability, and the 4.6.0 fixes suggest the maintainers actively exercise the codec path — a good sign. Escalation is still community-based. Acceptable for an invisible component; not acceptable as a load-bearing direct dependency without internal expertise. The new wrinkle: a deprecation with no vendor SLA means you own the removal deadline.

Scaling. Unchanged. One relay per worker process; concurrency scales by adding workers, not by multiplexing within a relay. Blocking semantics make worker count and request timeouts the real levers; socket transports add file-descriptor pressure; pipes remain cheapest and most common. One new consideration: msgpack without ext-msgpack encodes in pure PHP and is slower per payload — measure before assuming it's free at high request rates.

Failure modes to instrument for.

• Duplicate Goridge — or duplicate roadrunner/spiral binary-package — installs after the renames. Inconsistent framing or autoload surprises across worker pools with no clean error.
• Scanner/advisory blind spot on renamed packages. A vulnerability ships unannounced because the allowlist still says spiral/*.
• Deprecated msgpack codec removed in a future major while a worker still requests it. Hard failure at frame decode, typically after an unattended composer update.
• Host-dependent codec behavior (extension vs pure-PHP fallback). Works in one image, slow or subtly different in another.
• Resolution failure on upgrade. One dependency pins the old name, one the new; looks like a Composer problem, is really a sequencing problem.
• Broken pipe / worker exit — RoadRunner respawns, in-flight request dies, expect 502s.
• Frame/CRC mismatch after version skew — hard failures with unhelpful traces; caught only by the CI round-trip test.
• Typed-payload decode errors — a payload contract change, not a transport bug.
• Unix socket path/permission drift in containers — intermittent, environment-specific.
• TCP relay exposed without auth — a security finding.
• Blocking recv with no timeout — hung workers that look like app-level slowness.

Observability belongs at the Octane/RoadRunner layer and worker stderr, not here.

Ramp-up. Under a day for a PHP engineer to understand the framing API; 2–3 days to become effective at debugging across the PHP/Go boundary. Add both legacy package names plus one line on the msgpack deprecation to the runbook, so the next engineer searching for any of it lands in the right place. The success criterion is unchanged, with one addition: for most teams nobody should ever need to know this package exists, nobody should need to know it used to have a different name — and nobody should first learn about the codec deprecation from a production traceback.