WS010 · Shutdown/runtime lifecycle assumption

Default severity: LOW · Framework: Any

Severity is contextual

This is the default severity, not a guarantee for every finding. The implementation and configured overrides determine the reported severity. Runtime targets describe a compatibility analysis, not a detected deployment.

What it checks

Under PHP-FPM the PHP request lifecycle ends after every request — the engine tears down the request context even though the OS worker process is reused — which makes shutdown hooks, exit() and SAPI checks behave in one specific way. An application worker loop keeps one PHP context alive across many requests, so the same code means something different.

What to review

• Do the cleanup where the request ends (terminating middleware, a request-lifecycle listener) instead of at process shutdown.
• Return a response instead of calling exit()/die() so the worker can finish the request loop.
• Do not branch on the SAPI name: check for the capability you actually need.

Inspect this rule

vendor/bin/worker-safety rules WS010

Accepting a reviewed risk

Use a targeted suppression or a baseline only after reviewing the value’s origin and lifetime. Changing an assignment elsewhere may not invalidate an existing property-level suppression.