From bb8dc82c720566a5d91a4cc523340793fac34eda Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 22:29:56 +0000
Subject: [PATCH 01/16] build: package the CLI as a standalone native binary

Add a build pipeline that turns the CLI into (a) a self-contained PHAR
and (b) a static native executable that runs without a system PHP.

- box.json.dist: Box 4 config that compiles src/ + vendor/ into
  build/durable-workflow.phar with PHP + JSON compactors and gzip
  compression.
- scripts/build.sh + Makefile: local "make phar" and "make binary"
  targets. The binary target downloads static-php-cli (spc) on demand,
  compiles phpmicro with the extensions the CLI actually uses
  (curl, mbstring, openssl, phar, tokenizer, ctype, filter, fileinfo,
  iconv, sockets, pcntl, posix), and splices the PHAR onto the micro
  SAPI via "spc micro:combine".
- .github/workflows/build.yml: PR/push CI. Runs PHPUnit across
  PHP 8.2/8.3/8.4 and smoke-builds the PHAR.
- .github/workflows/release.yml: on "v*" tags, builds the PHAR once
  and then a native binary per platform (linux x86_64/aarch64,
  macos x86_64/aarch64) using spc, then publishes a GitHub release
  with SHA256SUMS.
- README: document the three install paths (standalone binary, PHAR,
  Composer) and the "make" targets.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml   |  42 +++++++++
 .github/workflows/release.yml | 156 ++++++++++++++++++++++++++++++++++
 .gitignore                    |   2 +
 Makefile                      |  20 +++++
 README.md                     |  34 +++++++-
 box.json.dist                 |  32 +++++++
 scripts/build.sh              | 108 +++++++++++++++++++++++
 7 files changed, 393 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/build.yml
 create mode 100644 .github/workflows/release.yml
 create mode 100644 Makefile
 create mode 100644 box.json.dist
 create mode 100755 scripts/build.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
new file mode 100644
index 0000000..62cdf57
--- /dev/null
+++ b/.github/workflows/build.yml
@@ -0,0 +1,42 @@
+name: Build
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  test:
+    name: Test (PHP ${{ matrix.php }})
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php: ['8.2', '8.3', '8.4']
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php }}
+          tools: composer:v2
+          coverage: none
+      - run: composer install --prefer-dist --no-interaction
+      - run: composer test
+
+  build-phar:
+    name: Build PHAR (smoke test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: shivammathur/setup-php@v2
+        with:
+          php-version: '8.3'
+          tools: composer:v2, box:4.6.6
+          coverage: none
+          ini-values: phar.readonly=0
+      - run: composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+      - run: box compile --no-parallel
+      - run: box info build/durable-workflow.phar
+      - run: php build/durable-workflow.phar list
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..6438b2a
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,156 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Release tag (for manual dispatch, e.g. v0.0.1-test)'
+        required: false
+        default: ''
+
+permissions:
+  contents: write
+
+env:
+  SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets,pcntl,posix
+  PHP_VERSION: '8.3'
+  BOX_VERSION: '4.6.6'
+
+jobs:
+  build-phar:
+    name: Build PHAR
+    runs-on: ubuntu-latest
+    outputs:
+      phar-name: durable-workflow.phar
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ env.PHP_VERSION }}
+          tools: composer:v2, box:${{ env.BOX_VERSION }}
+          coverage: none
+          ini-values: phar.readonly=0
+
+      - name: Install dependencies
+        run: composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+
+      - name: Build PHAR
+        run: box compile --no-parallel
+
+      - name: Verify PHAR
+        run: |
+          php build/durable-workflow.phar --version || true
+          box info build/durable-workflow.phar
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: durable-workflow-phar
+          path: build/durable-workflow.phar
+          if-no-files-found: error
+
+  build-binary:
+    name: Build ${{ matrix.name }}
+    needs: build-phar
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - name: linux-x86_64
+            runner: ubuntu-latest
+            spc_asset: spc-linux-x86_64
+          - name: linux-aarch64
+            runner: ubuntu-24.04-arm
+            spc_asset: spc-linux-aarch64
+          - name: macos-x86_64
+            runner: macos-13
+            spc_asset: spc-macos-x86_64
+          - name: macos-aarch64
+            runner: macos-14
+            spc_asset: spc-macos-aarch64
+    runs-on: ${{ matrix.runner }}
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download PHAR artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: durable-workflow-phar
+          path: build/
+
+      - name: Download spc
+        run: |
+          mkdir -p build/.tools
+          curl -fsSL -o build/.tools/spc \
+            "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/${{ matrix.spc_asset }}"
+          chmod +x build/.tools/spc
+
+      - name: Cache spc downloads
+        uses: actions/cache@v4
+        with:
+          path: |
+            build/.tools/downloads
+            build/.tools/source
+          key: spc-${{ matrix.name }}-php${{ env.PHP_VERSION }}-${{ hashFiles('.github/workflows/release.yml') }}
+          restore-keys: |
+            spc-${{ matrix.name }}-php${{ env.PHP_VERSION }}-
+
+      - name: Fetch PHP sources & extension deps
+        working-directory: build/.tools
+        run: |
+          ./spc doctor --auto-fix || true
+          ./spc download --with-php=${{ env.PHP_VERSION }} \
+            --for-extensions="$SPC_EXTENSIONS" --prefer-pre-built
+
+      - name: Build phpmicro SAPI with extensions
+        working-directory: build/.tools
+        run: ./spc build "$SPC_EXTENSIONS" --build-micro
+
+      - name: Combine PHAR into standalone binary
+        working-directory: build/.tools
+        run: |
+          ./spc micro:combine ../../build/durable-workflow.phar \
+            --output=../../build/durable-workflow-${{ matrix.name }}
+
+      - name: Smoke test binary (native arch only)
+        if: matrix.name == 'linux-x86_64' || matrix.name == 'macos-aarch64'
+        run: |
+          chmod +x build/durable-workflow-${{ matrix.name }}
+          ./build/durable-workflow-${{ matrix.name }} --version || true
+          ./build/durable-workflow-${{ matrix.name }} list || true
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: durable-workflow-${{ matrix.name }}
+          path: build/durable-workflow-${{ matrix.name }}
+          if-no-files-found: error
+
+  release:
+    name: Publish Release
+    needs: [build-phar, build-binary]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/tags/v')
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all artifacts
+        uses: actions/download-artifact@v4
+        with:
+          path: dist
+          merge-multiple: true
+
+      - name: Generate checksums
+        working-directory: dist
+        run: sha256sum * > SHA256SUMS
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/*
+          generate_release_notes: true
+          fail_on_unmatched_files: true
diff --git a/.gitignore b/.gitignore
index 107ed1b..c17acbe 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,3 +3,5 @@
 .phpunit.result.cache
 /.idea
 /.vscode
+/build
+*.phar
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..80d8a54
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,20 @@
+.PHONY: help test phar binary clean
+
+help:
+	@echo "Targets:"
+	@echo "  test     Run PHPUnit test suite"
+	@echo "  phar     Build the durable-workflow PHAR (requires system PHP >= 8.2)"
+	@echo "  binary   Build a standalone native binary (PHAR + phpmicro)"
+	@echo "  clean    Remove build artifacts"
+
+test:
+	composer test
+
+phar:
+	./scripts/build.sh phar
+
+binary:
+	./scripts/build.sh binary
+
+clean:
+	./scripts/build.sh clean
diff --git a/README.md b/README.md
index f85c350..5515dd3 100644
--- a/README.md
+++ b/README.md
@@ -4,11 +4,43 @@ Command-line interface for running and interacting with the [Durable Workflow Se
 
 ## Installation
 
+Three options depending on what you have installed:
+
+**1. Standalone binary (no PHP required).** Download a native binary for your
+platform from the [releases page](https://github.com/durable-workflow/cli/releases):
+
+```bash
+curl -fsSL -o durable-workflow \
+  https://github.com/durable-workflow/cli/releases/latest/download/durable-workflow-linux-x86_64
+chmod +x durable-workflow
+./durable-workflow --version
+```
+
+Available assets: `durable-workflow-linux-x86_64`, `durable-workflow-linux-aarch64`,
+`durable-workflow-macos-x86_64`, `durable-workflow-macos-aarch64`.
+
+**2. PHAR (requires PHP >= 8.2).** Download `durable-workflow.phar` from the
+[releases page](https://github.com/durable-workflow/cli/releases) and run it
+with `php durable-workflow.phar` (or `chmod +x` and call directly — the PHAR
+has a `#!/usr/bin/env php` shebang).
+
+**3. Composer.**
+
 ```bash
 composer global require durable-workflow/cli
 ```
 
-Or download a binary from the [releases page](https://github.com/durable-workflow/cli/releases).
+### Building from source
+
+```bash
+make phar      # Build the PHAR (requires PHP >= 8.2 and Composer)
+make binary    # Build the PHAR plus a standalone native binary for the
+               # current platform (downloads Box and static-php-cli on demand)
+make clean     # Remove build artifacts
+```
+
+Build artifacts land in `./build/`. See [scripts/build.sh](scripts/build.sh)
+for the underlying steps; tools are cached under `build/.tools/`.
 
 ## Configuration
 
diff --git a/box.json.dist b/box.json.dist
new file mode 100644
index 0000000..576cfb2
--- /dev/null
+++ b/box.json.dist
@@ -0,0 +1,32 @@
+{
+    "$schema": "https://raw.githubusercontent.com/box-project/box/main/res/schema.json",
+    "main": "bin/durable-workflow",
+    "output": "build/durable-workflow.phar",
+    "chmod": "0755",
+    "directories": ["src"],
+    "finder": [
+        {
+            "name": "*.php",
+            "exclude": ["tests", "Tests", "test", "docs", "doc", "examples"],
+            "in": "vendor"
+        },
+        {
+            "name": ["LICENSE", "LICENSE.md"],
+            "in": "vendor"
+        }
+    ],
+    "compactors": [
+        "KevinGH\\Box\\Compactor\\Php",
+        "KevinGH\\Box\\Compactor\\Json"
+    ],
+    "compression": "GZ",
+    "banner": [
+        "Durable Workflow CLI",
+        "",
+        "(c) Durable Workflow <support@durable-workflow.com>",
+        "",
+        "Distributed under the MIT license."
+    ],
+    "exclude-composer-files": true,
+    "check-requirements": true
+}
diff --git a/scripts/build.sh b/scripts/build.sh
new file mode 100755
index 0000000..ca3cde6
--- /dev/null
+++ b/scripts/build.sh
@@ -0,0 +1,108 @@
+#!/usr/bin/env bash
+# Build the durable-workflow CLI as a PHAR and optionally as a standalone
+# static binary (PHAR embedded in phpmicro).
+#
+# Usage:
+#   scripts/build.sh phar        # Build the PHAR only (requires system PHP)
+#   scripts/build.sh binary      # Build the PHAR + standalone native binary
+#   scripts/build.sh clean       # Remove build artifacts
+#
+# Outputs land in ./build/.
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+BUILD_DIR="$ROOT/build"
+TOOLS_DIR="$ROOT/build/.tools"
+PHAR_OUT="$BUILD_DIR/durable-workflow.phar"
+
+# Extensions required by the CLI at runtime. Keep this list in sync with the
+# CI matrix in .github/workflows/release.yml.
+SPC_EXTENSIONS="curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets,pcntl,posix"
+
+BOX_VERSION="${BOX_VERSION:-4.6.6}"
+BOX_URL="https://github.com/box-project/box/releases/download/${BOX_VERSION}/box.phar"
+
+detect_platform() {
+    local os arch
+    case "$(uname -s)" in
+        Linux)   os="linux" ;;
+        Darwin)  os="macos" ;;
+        *) echo "Unsupported OS: $(uname -s)" >&2; exit 1 ;;
+    esac
+    case "$(uname -m)" in
+        x86_64|amd64) arch="x86_64" ;;
+        arm64|aarch64) arch="aarch64" ;;
+        *) echo "Unsupported arch: $(uname -m)" >&2; exit 1 ;;
+    esac
+    echo "${os}-${arch}"
+}
+
+ensure_tools() {
+    mkdir -p "$TOOLS_DIR"
+    if [[ ! -x "$TOOLS_DIR/box" ]]; then
+        echo ">> Downloading Box ${BOX_VERSION}"
+        curl -fsSL -o "$TOOLS_DIR/box" "$BOX_URL"
+        chmod +x "$TOOLS_DIR/box"
+    fi
+}
+
+ensure_spc() {
+    local platform
+    platform="$(detect_platform)"
+    if [[ ! -x "$TOOLS_DIR/spc" ]]; then
+        echo ">> Downloading spc (static-php-cli) for ${platform}"
+        curl -fsSL -o "$TOOLS_DIR/spc" \
+            "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-${platform}"
+        chmod +x "$TOOLS_DIR/spc"
+    fi
+}
+
+install_composer_deps() {
+    echo ">> Installing production Composer dependencies"
+    composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
+}
+
+build_phar() {
+    ensure_tools
+    install_composer_deps
+    mkdir -p "$BUILD_DIR"
+    echo ">> Building PHAR via Box"
+    php -d phar.readonly=0 "$TOOLS_DIR/box" compile --no-parallel
+    echo ">> PHAR built: $PHAR_OUT"
+}
+
+build_binary() {
+    build_phar
+    ensure_spc
+    local php_version="${PHP_VERSION:-8.3}"
+    local platform
+    platform="$(detect_platform)"
+    local out_name="durable-workflow-${platform}"
+
+    pushd "$TOOLS_DIR" >/dev/null
+    echo ">> Downloading PHP ${php_version} source + extension deps"
+    ./spc download --with-php="$php_version" --for-extensions="$SPC_EXTENSIONS" --prefer-pre-built
+    echo ">> Compiling phpmicro with required extensions"
+    ./spc build "$SPC_EXTENSIONS" --build-micro
+    echo ">> Embedding PHAR into micro SAPI"
+    ./spc micro:combine "$PHAR_OUT" --output="$BUILD_DIR/$out_name"
+    popd >/dev/null
+
+    chmod +x "$BUILD_DIR/$out_name"
+    echo ">> Standalone binary: $BUILD_DIR/$out_name"
+}
+
+clean() {
+    rm -rf "$BUILD_DIR"
+    echo ">> Cleaned $BUILD_DIR"
+}
+
+cmd="${1:-phar}"
+case "$cmd" in
+    phar)   build_phar ;;
+    binary) build_binary ;;
+    clean)  clean ;;
+    *) echo "Usage: $0 {phar|binary|clean}" >&2; exit 1 ;;
+esac

From 341e881263177dac0545a68d78c91f1f4b3a110f Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 22:35:29 +0000
Subject: [PATCH 02/16] build: add windows-x86_64 binary to the release
 workflow

Adds a windows-latest job that builds phpmicro + spc on MSVC and
splices the PHAR into a durable-workflow-windows-x86_64.exe. The
Windows extension list drops pcntl/posix (Unix-only).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 67 ++++++++++++++++++++++++++++++++++-
 README.md                     |  3 +-
 2 files changed, 68 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6438b2a..518f2d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,9 @@ permissions:
   contents: write
 
 env:
+  # Unix builds get pcntl+posix; Windows drops them (not available on NT).
   SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets,pcntl,posix
+  SPC_EXTENSIONS_WINDOWS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
   PHP_VERSION: '8.3'
   BOX_VERSION: '4.6.6'
 
@@ -129,9 +131,72 @@ jobs:
           path: build/durable-workflow-${{ matrix.name }}
           if-no-files-found: error
 
+  build-binary-windows:
+    name: Build windows-x86_64
+    needs: build-phar
+    runs-on: windows-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download PHAR artifact
+        uses: actions/download-artifact@v4
+        with:
+          name: durable-workflow-phar
+          path: build/
+
+      - name: Download spc.exe
+        shell: pwsh
+        run: |
+          New-Item -ItemType Directory -Force -Path build\.tools | Out-Null
+          Invoke-WebRequest `
+            -Uri "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-windows-x64.exe" `
+            -OutFile "build\.tools\spc.exe"
+
+      - name: Cache spc downloads
+        uses: actions/cache@v4
+        with:
+          path: |
+            build/.tools/downloads
+            build/.tools/source
+          key: spc-windows-x86_64-php${{ env.PHP_VERSION }}-${{ hashFiles('.github/workflows/release.yml') }}
+          restore-keys: |
+            spc-windows-x86_64-php${{ env.PHP_VERSION }}-
+
+      - name: Fetch PHP sources & extension deps
+        shell: pwsh
+        working-directory: build/.tools
+        run: |
+          .\spc.exe doctor --auto-fix
+          .\spc.exe download --with-php=${{ env.PHP_VERSION }} `
+            --for-extensions="$env:SPC_EXTENSIONS_WINDOWS" --prefer-pre-built
+
+      - name: Build phpmicro SAPI with extensions
+        shell: pwsh
+        working-directory: build/.tools
+        run: .\spc.exe build "$env:SPC_EXTENSIONS_WINDOWS" --build-micro
+
+      - name: Combine PHAR into standalone binary
+        shell: pwsh
+        working-directory: build/.tools
+        run: |
+          .\spc.exe micro:combine ..\..\build\durable-workflow.phar `
+            --output=..\..\build\durable-workflow-windows-x86_64.exe
+
+      - name: Smoke test binary
+        shell: pwsh
+        run: |
+          .\build\durable-workflow-windows-x86_64.exe --version
+          .\build\durable-workflow-windows-x86_64.exe list
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: durable-workflow-windows-x86_64
+          path: build/durable-workflow-windows-x86_64.exe
+          if-no-files-found: error
+
   release:
     name: Publish Release
-    needs: [build-phar, build-binary]
+    needs: [build-phar, build-binary, build-binary-windows]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
diff --git a/README.md b/README.md
index 5515dd3..75460a2 100644
--- a/README.md
+++ b/README.md
@@ -17,7 +17,8 @@ chmod +x durable-workflow
 ```
 
 Available assets: `durable-workflow-linux-x86_64`, `durable-workflow-linux-aarch64`,
-`durable-workflow-macos-x86_64`, `durable-workflow-macos-aarch64`.
+`durable-workflow-macos-x86_64`, `durable-workflow-macos-aarch64`,
+`durable-workflow-windows-x86_64.exe`.
 
 **2. PHAR (requires PHP >= 8.2).** Download `durable-workflow.phar` from the
 [releases page](https://github.com/durable-workflow/cli/releases) and run it

From 88fdae12ddb7b36a24ad9dd3e6650d1773ac7c0a Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 22:36:07 +0000
Subject: [PATCH 03/16] ci: trigger release workflow on the feature branch for
 pre-merge builds

---
 .github/workflows/release.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 518f2d0..2b99618 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,11 @@ on:
   push:
     tags:
       - 'v*'
+    branches:
+      # Lets the release workflow build artifacts on the feature branch
+      # before it is merged to main. The publish-release job stays gated
+      # on tag pushes, so nothing gets published from a branch build.
+      - 'standalone-binary-build'
   workflow_dispatch:
     inputs:
       tag:

From 6167204cd7fbf68b08c834bbd6180d596ee19188 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 22:37:05 +0000
Subject: [PATCH 04/16] ci: target PHP 8.4 and drop optional pcntl/posix

The committed composer.lock pins symfony/string v8.0.8, which requires
PHP >= 8.4. Updates both CI workflows and scripts/build.sh to build
against 8.4 (the lowest resolvable version for the locked deps).

Also drops pcntl and posix from the extension list. They are only used
by symfony/console for graceful signal handling and TTY detection, both
of which degrade cleanly when missing, and removing them gives Unix and
Windows builds the same extension set.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/build.yml   | 4 ++--
 .github/workflows/release.yml | 5 ++---
 scripts/build.sh              | 4 ++--
 3 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 62cdf57..aad1cb1 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        php: ['8.2', '8.3', '8.4']
+        php: ['8.4']
     steps:
       - uses: actions/checkout@v4
       - uses: shivammathur/setup-php@v2
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: shivammathur/setup-php@v2
         with:
-          php-version: '8.3'
+          php-version: '8.4'
           tools: composer:v2, box:4.6.6
           coverage: none
           ini-values: phar.readonly=0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2b99618..d5a8f1c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,10 +20,9 @@ permissions:
   contents: write
 
 env:
-  # Unix builds get pcntl+posix; Windows drops them (not available on NT).
-  SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets,pcntl,posix
+  SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
   SPC_EXTENSIONS_WINDOWS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
-  PHP_VERSION: '8.3'
+  PHP_VERSION: '8.4'
   BOX_VERSION: '4.6.6'
 
 jobs:
diff --git a/scripts/build.sh b/scripts/build.sh
index ca3cde6..9e6e52c 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -19,7 +19,7 @@ PHAR_OUT="$BUILD_DIR/durable-workflow.phar"
 
 # Extensions required by the CLI at runtime. Keep this list in sync with the
 # CI matrix in .github/workflows/release.yml.
-SPC_EXTENSIONS="curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets,pcntl,posix"
+SPC_EXTENSIONS="curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets"
 
 BOX_VERSION="${BOX_VERSION:-4.6.6}"
 BOX_URL="https://github.com/box-project/box/releases/download/${BOX_VERSION}/box.phar"
@@ -76,7 +76,7 @@ build_phar() {
 build_binary() {
     build_phar
     ensure_spc
-    local php_version="${PHP_VERSION:-8.3}"
+    local php_version="${PHP_VERSION:-8.4}"
     local platform
     platform="$(detect_platform)"
     local out_name="durable-workflow-${platform}"

From 58f1eb96b86b3cb56d1c4923cc58105c23fd6fd2 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 22:49:19 +0000
Subject: [PATCH 05/16] ci: restrict release workflow to tag pushes only

Building phpmicro from source per platform takes ~15-30 minutes
(especially on Windows). Running it on every feature-branch commit
is too expensive. Drop the feature-branch trigger so the workflow
only runs on 'v*' tag pushes or explicit workflow_dispatch.

Note: the in-flight branch build will still complete. This change
just prevents future commits from kicking off a new one.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d5a8f1c..859a0e8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,11 +4,6 @@ on:
   push:
     tags:
       - 'v*'
-    branches:
-      # Lets the release workflow build artifacts on the feature branch
-      # before it is merged to main. The publish-release job stays gated
-      # on tag pushes, so nothing gets published from a branch build.
-      - 'standalone-binary-build'
   workflow_dispatch:
     inputs:
       tag:

From 271729cf0920b0e7f7745587eaa57c1670af8a89 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 23:03:47 +0000
Subject: [PATCH 06/16] ci: debug windows build, harden spc download, drop
 macos-13

- Add --debug to the Windows phpmicro build and always upload the
  build/.tools/log/ directory so MSVC errors are recoverable.
- Retry the spc binary download up to 5 times on Linux/macOS/Windows.
  The bare curl call was hitting transient CDN failures on
  dl.static-php.dev (observed HTTP errors on linux-x86_64 and
  macos-aarch64 in the previous run).
- Drop the macos-x86_64 matrix entry. The macos-13 runner label is
  not available to this org ("macos-13-us-default is not supported"),
  and Apple Silicon is the practical target anyway.
- Temporarily re-enable the branch push trigger while we iterate on
  the Windows fix. Will be removed before merge.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 43 +++++++++++++++++++++++++++--------
 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 859a0e8..e24e54e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,10 @@ on:
   push:
     tags:
       - 'v*'
+    branches:
+      # Temporary: iterate on Windows/macOS build failures pre-merge.
+      # Remove before merging to main.
+      - 'standalone-binary-build'
   workflow_dispatch:
     inputs:
       tag:
@@ -67,9 +71,6 @@ jobs:
           - name: linux-aarch64
             runner: ubuntu-24.04-arm
             spc_asset: spc-linux-aarch64
-          - name: macos-x86_64
-            runner: macos-13
-            spc_asset: spc-macos-x86_64
           - name: macos-aarch64
             runner: macos-14
             spc_asset: spc-macos-aarch64
@@ -86,8 +87,16 @@ jobs:
       - name: Download spc
         run: |
           mkdir -p build/.tools
-          curl -fsSL -o build/.tools/spc \
-            "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/${{ matrix.spc_asset }}"
+          for attempt in 1 2 3 4 5; do
+            if curl -fsSL --retry 3 --retry-all-errors --connect-timeout 10 \
+                -o build/.tools/spc \
+                "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/${{ matrix.spc_asset }}"; then
+              break
+            fi
+            echo "spc download attempt $attempt failed, retrying in 10s..."
+            sleep 10
+          done
+          test -s build/.tools/spc
           chmod +x build/.tools/spc
 
       - name: Cache spc downloads
@@ -147,9 +156,17 @@ jobs:
         shell: pwsh
         run: |
           New-Item -ItemType Directory -Force -Path build\.tools | Out-Null
-          Invoke-WebRequest `
-            -Uri "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-windows-x64.exe" `
-            -OutFile "build\.tools\spc.exe"
+          $url = "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-windows-x64.exe"
+          for ($i = 1; $i -le 5; $i++) {
+            try {
+              Invoke-WebRequest -Uri $url -OutFile "build\.tools\spc.exe" -TimeoutSec 120
+              break
+            } catch {
+              Write-Host "spc.exe download attempt $i failed: $_"
+              if ($i -eq 5) { throw }
+              Start-Sleep -Seconds 10
+            }
+          }
 
       - name: Cache spc downloads
         uses: actions/cache@v4
@@ -172,7 +189,15 @@ jobs:
       - name: Build phpmicro SAPI with extensions
         shell: pwsh
         working-directory: build/.tools
-        run: .\spc.exe build "$env:SPC_EXTENSIONS_WINDOWS" --build-micro
+        run: .\spc.exe build "$env:SPC_EXTENSIONS_WINDOWS" --build-micro --debug
+
+      - name: Upload spc build logs (always)
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-spc-logs
+          path: build/.tools/log/
+          if-no-files-found: warn
 
       - name: Combine PHAR into standalone binary
         shell: pwsh

From 9fcd6bdf307be2d2bec8a03a167004acc7d979ae Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 23:17:57 +0000
Subject: [PATCH 07/16] ci: fix windows openssl build and macos github rate
 limit

- Drop ext-openssl from the Windows phpmicro build. PHP 8.4 on Windows
  fails to compile its openssl extension against OpenSSL 3.x because
  php_openssl.h still references the removed ERR_NUM_ERRORS constant
  (upstream php-src issue). The CLI does not need ext-openssl on
  Windows: curl is built with -DCURL_USE_SCHANNEL=ON, so HTTPS via
  Symfony HttpClient -> ext-curl -> Schannel continues to work.

- Export GITHUB_TOKEN as a workflow-level env so every spc step can
  authenticate against the GitHub API when resolving source tarballs
  and pre-built static-php-cli-hosted libs. The unauthenticated calls
  were hitting HTTP 403 and failing the macos-aarch64 download step.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e24e54e..901fc49 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,9 +20,16 @@ permissions:
 
 env:
   SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
-  SPC_EXTENSIONS_WINDOWS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
+  # Windows: drop ext-openssl. PHP 8.4's Windows openssl extension fails
+  # to build against OpenSSL 3.x (references removed ERR_NUM_ERRORS).
+  # curl on Windows uses Schannel for TLS, so HTTPS still works without
+  # ext-openssl.
+  SPC_EXTENSIONS_WINDOWS: curl,mbstring,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
   PHP_VERSION: '8.4'
   BOX_VERSION: '4.6.6'
+  # Passed to every spc step so it can use authenticated GitHub API calls
+  # when fetching source tarballs / pre-built libs (avoids 403 rate limits).
+  GITHUB_TOKEN: ${{ github.token }}
 
 jobs:
   build-phar:

From 16d8bfd9e875ccf9734a30c2c86ba0b1da6c75fe Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 23:32:44 +0000
Subject: [PATCH 08/16] ci: allow windows build to fail without blocking
 releases

The Windows phpmicro build is blocked on an upstream bug: PHP 8.4's
Windows ext-openssl references ERR_NUM_ERRORS (removed in OpenSSL 3),
and spc pulls ext-openssl in as a transitive dependency of ext-curl
even though curl on Windows uses Schannel. Fixing this requires an
spc dep-map change or a php-src patch.

Until that is resolved upstream:
  - The Windows job keeps running (so regressions vs. a future fix
    are visible) but uses continue-on-error so it does not block the
    Linux/macOS binary release.
  - The publish-release job only hard-depends on build-phar and
    build-binary (Linux + macOS). If Windows succeeds, its artifact
    is still picked up.
  - README lists only the platforms we actually ship.

Also drops the temporary standalone-binary-build push trigger; the
release workflow is back to tag/dispatch-only.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 18 +++++++++++++-----
 README.md                     |  9 +++++++--
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 901fc49..769d4ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,10 +4,6 @@ on:
   push:
     tags:
       - 'v*'
-    branches:
-      # Temporary: iterate on Windows/macOS build failures pre-merge.
-      # Remove before merging to main.
-      - 'standalone-binary-build'
   workflow_dispatch:
     inputs:
       tag:
@@ -150,6 +146,14 @@ jobs:
     name: Build windows-x86_64
     needs: build-phar
     runs-on: windows-latest
+    # Windows builds currently fail at the ext-openssl compile step:
+    # PHP 8.4's Windows openssl extension references ERR_NUM_ERRORS,
+    # which was removed in OpenSSL 3.x. spc adds ext-openssl as a
+    # transitive dep of curl even though curl-on-Windows uses Schannel.
+    # Until there is an upstream fix (or an spc option to suppress the
+    # transitive dep), this job is allowed to fail without blocking the
+    # release of the PHAR and Linux/macOS binaries.
+    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
 
@@ -227,7 +231,11 @@ jobs:
 
   release:
     name: Publish Release
-    needs: [build-phar, build-binary, build-binary-windows]
+    # Windows is intentionally not a hard dependency: it runs with
+    # continue-on-error so a Windows-build failure doesn't block the
+    # Linux/macOS release. If the Windows job succeeds, its artifact
+    # is picked up by download-artifact below.
+    needs: [build-phar, build-binary]
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/v')
     steps:
diff --git a/README.md b/README.md
index 75460a2..9c85eae 100644
--- a/README.md
+++ b/README.md
@@ -17,8 +17,13 @@ chmod +x durable-workflow
 ```
 
 Available assets: `durable-workflow-linux-x86_64`, `durable-workflow-linux-aarch64`,
-`durable-workflow-macos-x86_64`, `durable-workflow-macos-aarch64`,
-`durable-workflow-windows-x86_64.exe`.
+`durable-workflow-macos-aarch64`.
+
+Windows and macOS x86_64 standalone binaries are not currently produced.
+Windows is blocked on an upstream PHP 8.4 + OpenSSL 3 compile bug in
+static-php-cli; macOS x86_64 is dropped because the `macos-13` runner
+label is not available to this org. On Windows, install a system PHP
+(>= 8.4) and use the PHAR.
 
 **2. PHAR (requires PHP >= 8.2).** Download `durable-workflow.phar` from the
 [releases page](https://github.com/durable-workflow/cli/releases) and run it

From 124ef6a614c6f1f6bec90d9f0a929559cdaa7097 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 23:36:37 +0000
Subject: [PATCH 09/16] ci: build windows phpmicro with PHP 8.3 to sidestep 8.4
 openssl bug

PHP 8.4's Windows ext-openssl fails to compile against OpenSSL 3.x
because php_openssl.h still references the removed ERR_NUM_ERRORS
constant. PHP 8.3's openssl extension doesn't have this reference
and compiles cleanly on spc's Windows pipeline.

Using 8.3 phpmicro to run the PHAR that was built with 8.4 Composer
resolution is acceptable here: the locked runtime code is expected
to be ABI-compatible with 8.3. If any locked dep actually uses
8.4-only syntax, the smoke test at the end of the job will catch it
before the artifact is uploaded.

Also re-adds the temporary feature-branch push trigger and drops
continue-on-error on the Windows job so this iteration reports a
real result.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 27 +++++++++++----------------
 1 file changed, 11 insertions(+), 16 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 769d4ad..f24b21f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,6 +4,8 @@ on:
   push:
     tags:
       - 'v*'
+    branches:
+      - 'standalone-binary-build'  # temporary, for Windows iteration
   workflow_dispatch:
     inputs:
       tag:
@@ -16,12 +18,13 @@ permissions:
 
 env:
   SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
-  # Windows: drop ext-openssl. PHP 8.4's Windows openssl extension fails
-  # to build against OpenSSL 3.x (references removed ERR_NUM_ERRORS).
-  # curl on Windows uses Schannel for TLS, so HTTPS still works without
-  # ext-openssl.
-  SPC_EXTENSIONS_WINDOWS: curl,mbstring,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
+  SPC_EXTENSIONS_WINDOWS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
   PHP_VERSION: '8.4'
+  # Windows phpmicro uses PHP 8.3. PHP 8.4's Windows openssl extension
+  # fails to compile against OpenSSL 3.x (php_openssl.h references the
+  # removed ERR_NUM_ERRORS constant). 8.3 compiles cleanly and is still
+  # ABI-compatible enough to run the PHAR built against 8.4 deps.
+  PHP_VERSION_WINDOWS: '8.3'
   BOX_VERSION: '4.6.6'
   # Passed to every spc step so it can use authenticated GitHub API calls
   # when fetching source tarballs / pre-built libs (avoids 403 rate limits).
@@ -146,14 +149,6 @@ jobs:
     name: Build windows-x86_64
     needs: build-phar
     runs-on: windows-latest
-    # Windows builds currently fail at the ext-openssl compile step:
-    # PHP 8.4's Windows openssl extension references ERR_NUM_ERRORS,
-    # which was removed in OpenSSL 3.x. spc adds ext-openssl as a
-    # transitive dep of curl even though curl-on-Windows uses Schannel.
-    # Until there is an upstream fix (or an spc option to suppress the
-    # transitive dep), this job is allowed to fail without blocking the
-    # release of the PHAR and Linux/macOS binaries.
-    continue-on-error: true
     steps:
       - uses: actions/checkout@v4
 
@@ -185,16 +180,16 @@ jobs:
           path: |
             build/.tools/downloads
             build/.tools/source
-          key: spc-windows-x86_64-php${{ env.PHP_VERSION }}-${{ hashFiles('.github/workflows/release.yml') }}
+          key: spc-windows-x86_64-php${{ env.PHP_VERSION_WINDOWS }}-${{ hashFiles('.github/workflows/release.yml') }}
           restore-keys: |
-            spc-windows-x86_64-php${{ env.PHP_VERSION }}-
+            spc-windows-x86_64-php${{ env.PHP_VERSION_WINDOWS }}-
 
       - name: Fetch PHP sources & extension deps
         shell: pwsh
         working-directory: build/.tools
         run: |
           .\spc.exe doctor --auto-fix
-          .\spc.exe download --with-php=${{ env.PHP_VERSION }} `
+          .\spc.exe download --with-php=${{ env.PHP_VERSION_WINDOWS }} `
             --for-extensions="$env:SPC_EXTENSIONS_WINDOWS" --prefer-pre-built
 
       - name: Build phpmicro SAPI with extensions

From aff85cb0bc264f387a5585aa37dd237b8a604775 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 23:51:20 +0000
Subject: [PATCH 10/16] ci: run spc from source on windows and drop ext-openssl
 from curl deps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both PHP 8.3 and 8.4 fail to compile ext-openssl on Windows against
OpenSSL 3.x — php_openssl.h references the removed ERR_NUM_ERRORS
constant. spc's dependency map (config/ext.json) hard-codes openssl
as a Windows-only transitive dep of ext-curl, so even removing
openssl from --for-extensions does not help: spc still pulls it in.

The prebuilt spc binary embeds ext.json, so overriding it externally
is impossible. Switch the Windows job to run spc from a source clone:

  - shivammathur/setup-php installs PHP 8.3 on the runner
  - git clone static-php-cli, then a small Python patch strips
    "openssl" from curl.ext-depends-windows in config/ext.json
  - composer install inside the spc clone
  - php bin\spc download/build/micro:combine

libcurl itself still links libopenssl at the transport layer for TLS,
so HTTPS via Symfony HttpClient -> ext-curl continues to work without
the PHP-side ext-openssl.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 80 ++++++++++++++++++++++-------------
 1 file changed, 50 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f24b21f..43ce7a0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,12 +18,13 @@ permissions:
 
 env:
   SPC_EXTENSIONS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
-  SPC_EXTENSIONS_WINDOWS: curl,mbstring,openssl,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
+  # Windows: no ext-openssl. PHP's Windows openssl extension fails to
+  # compile against OpenSSL 3 on both 8.3 and 8.4 (php_openssl.h uses
+  # the removed ERR_NUM_ERRORS). We patch spc's config/ext.json to
+  # stop it from being pulled in as a transitive dep of ext-curl;
+  # curl still links libopenssl at the transport layer for TLS.
+  SPC_EXTENSIONS_WINDOWS: curl,mbstring,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
   PHP_VERSION: '8.4'
-  # Windows phpmicro uses PHP 8.3. PHP 8.4's Windows openssl extension
-  # fails to compile against OpenSSL 3.x (php_openssl.h references the
-  # removed ERR_NUM_ERRORS constant). 8.3 compiles cleanly and is still
-  # ABI-compatible enough to run the PHAR built against 8.4 deps.
   PHP_VERSION_WINDOWS: '8.3'
   BOX_VERSION: '4.6.6'
   # Passed to every spc step so it can use authenticated GitHub API calls
@@ -158,58 +159,77 @@ jobs:
           name: durable-workflow-phar
           path: build/
 
-      - name: Download spc.exe
+      - name: Setup PHP for spc
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ env.PHP_VERSION_WINDOWS }}
+          tools: composer:v2
+          coverage: none
+
+      - name: Clone spc and patch ext.json
         shell: pwsh
         run: |
-          New-Item -ItemType Directory -Force -Path build\.tools | Out-Null
-          $url = "https://dl.static-php.dev/static-php-cli/spc-bin/nightly/spc-windows-x64.exe"
-          for ($i = 1; $i -le 5; $i++) {
-            try {
-              Invoke-WebRequest -Uri $url -OutFile "build\.tools\spc.exe" -TimeoutSec 120
-              break
-            } catch {
-              Write-Host "spc.exe download attempt $i failed: $_"
-              if ($i -eq 5) { throw }
-              Start-Sleep -Seconds 10
-            }
-          }
+          git clone --depth=1 https://github.com/crazywhalecc/static-php-cli.git build\spc-src
+          # Strip 'openssl' from curl's Windows ext-depends. Upstream spc
+          # forces PHP's ext-openssl in whenever ext-curl is built on
+          # Windows, but PHP's Windows ext-openssl fails to compile
+          # against OpenSSL 3 (php_openssl.h references the removed
+          # ERR_NUM_ERRORS). libcurl itself still links libopenssl for
+          # transport-layer TLS, so HTTPS continues to work.
+          python - <<'PY'
+          import json, pathlib
+          p = pathlib.Path("build/spc-src/config/ext.json")
+          d = json.loads(p.read_text())
+          d["curl"]["ext-depends-windows"] = [
+              x for x in d["curl"]["ext-depends-windows"] if x != "openssl"
+          ]
+          p.write_text(json.dumps(d, indent=4))
+          PY
+
+      - name: Install spc Composer dependencies
+        shell: pwsh
+        working-directory: build\spc-src
+        run: composer install --no-dev --prefer-dist --no-interaction
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
 
       - name: Cache spc downloads
         uses: actions/cache@v4
         with:
           path: |
-            build/.tools/downloads
-            build/.tools/source
-          key: spc-windows-x86_64-php${{ env.PHP_VERSION_WINDOWS }}-${{ hashFiles('.github/workflows/release.yml') }}
+            build/spc-src/downloads
+            build/spc-src/source
+            build/spc-src/buildroot
+          key: spc-src-windows-x86_64-php${{ env.PHP_VERSION_WINDOWS }}-${{ hashFiles('.github/workflows/release.yml') }}
           restore-keys: |
-            spc-windows-x86_64-php${{ env.PHP_VERSION_WINDOWS }}-
+            spc-src-windows-x86_64-php${{ env.PHP_VERSION_WINDOWS }}-
 
       - name: Fetch PHP sources & extension deps
         shell: pwsh
-        working-directory: build/.tools
+        working-directory: build\spc-src
         run: |
-          .\spc.exe doctor --auto-fix
-          .\spc.exe download --with-php=${{ env.PHP_VERSION_WINDOWS }} `
+          php bin\spc doctor --auto-fix
+          php bin\spc download --with-php=${{ env.PHP_VERSION_WINDOWS }} `
             --for-extensions="$env:SPC_EXTENSIONS_WINDOWS" --prefer-pre-built
 
       - name: Build phpmicro SAPI with extensions
         shell: pwsh
-        working-directory: build/.tools
-        run: .\spc.exe build "$env:SPC_EXTENSIONS_WINDOWS" --build-micro --debug
+        working-directory: build\spc-src
+        run: php bin\spc build "$env:SPC_EXTENSIONS_WINDOWS" --build-micro --debug
 
       - name: Upload spc build logs (always)
         if: always()
         uses: actions/upload-artifact@v4
         with:
           name: windows-spc-logs
-          path: build/.tools/log/
+          path: build/spc-src/log/
           if-no-files-found: warn
 
       - name: Combine PHAR into standalone binary
         shell: pwsh
-        working-directory: build/.tools
+        working-directory: build\spc-src
         run: |
-          .\spc.exe micro:combine ..\..\build\durable-workflow.phar `
+          php bin\spc micro:combine ..\..\build\durable-workflow.phar `
             --output=..\..\build\durable-workflow-windows-x86_64.exe
 
       - name: Smoke test binary

From 44ea06b1e986dee7bafa79b849a46910cd242c55 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Tue, 14 Apr 2026 23:58:39 +0000
Subject: [PATCH 11/16] ci: fix powershell heredoc in windows ext.json patch
 step

---
 .github/workflows/release.yml | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 43ce7a0..fa025b4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -169,14 +169,14 @@ jobs:
       - name: Clone spc and patch ext.json
         shell: pwsh
         run: |
-          git clone --depth=1 https://github.com/crazywhalecc/static-php-cli.git build\spc-src
           # Strip 'openssl' from curl's Windows ext-depends. Upstream spc
           # forces PHP's ext-openssl in whenever ext-curl is built on
           # Windows, but PHP's Windows ext-openssl fails to compile
           # against OpenSSL 3 (php_openssl.h references the removed
           # ERR_NUM_ERRORS). libcurl itself still links libopenssl for
           # transport-layer TLS, so HTTPS continues to work.
-          python - <<'PY'
+          git clone --depth=1 https://github.com/crazywhalecc/static-php-cli.git build\spc-src
+          @'
           import json, pathlib
           p = pathlib.Path("build/spc-src/config/ext.json")
           d = json.loads(p.read_text())
@@ -184,7 +184,9 @@ jobs:
               x for x in d["curl"]["ext-depends-windows"] if x != "openssl"
           ]
           p.write_text(json.dumps(d, indent=4))
-          PY
+          '@ | Set-Content -Path patch-ext.py -Encoding utf8
+          python patch-ext.py
+          Get-Content build\spc-src\config\ext.json | Select-String -Pattern '"curl"' -Context 0,8
 
       - name: Install spc Composer dependencies
         shell: pwsh

From 76626cf7e4f26757e02656518268c2336ab26af5 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Wed, 15 Apr 2026 00:04:18 +0000
Subject: [PATCH 12/16] ci: use php 8.4 on windows host (spc composer deps
 require 8.4)

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fa025b4..b85d752 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ env:
   # curl still links libopenssl at the transport layer for TLS.
   SPC_EXTENSIONS_WINDOWS: curl,mbstring,phar,tokenizer,ctype,filter,fileinfo,iconv,sockets
   PHP_VERSION: '8.4'
-  PHP_VERSION_WINDOWS: '8.3'
+  PHP_VERSION_WINDOWS: '8.4'
   BOX_VERSION: '4.6.6'
   # Passed to every spc step so it can use authenticated GitHub API calls
   # when fetching source tarballs / pre-built libs (avoids 403 rate limits).

From 634d3534046d06f568167fde85db36b8ef5f3480 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Wed, 15 Apr 2026 00:21:03 +0000
Subject: [PATCH 13/16] fix: include symfony/console Resources in PHAR so
 completion command can enumerate shells

---
 .github/workflows/release.yml | 4 ++--
 box.json.dist                 | 4 ++++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b85d752..154b86f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -137,8 +137,8 @@ jobs:
         if: matrix.name == 'linux-x86_64' || matrix.name == 'macos-aarch64'
         run: |
           chmod +x build/durable-workflow-${{ matrix.name }}
-          ./build/durable-workflow-${{ matrix.name }} --version || true
-          ./build/durable-workflow-${{ matrix.name }} list || true
+          ./build/durable-workflow-${{ matrix.name }} --version
+          ./build/durable-workflow-${{ matrix.name }} list
 
       - uses: actions/upload-artifact@v4
         with:
diff --git a/box.json.dist b/box.json.dist
index 576cfb2..240ee1c 100644
--- a/box.json.dist
+++ b/box.json.dist
@@ -13,6 +13,10 @@
         {
             "name": ["LICENSE", "LICENSE.md"],
             "in": "vendor"
+        },
+        {
+            "name": "*",
+            "in": "vendor/symfony/console/Resources"
         }
     ],
     "compactors": [

From 6fe70fa6f737b5a182ec7a1d5c8dcf5f4b78dc0a Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Wed, 15 Apr 2026 00:53:04 +0000
Subject: [PATCH 14/16] ci: drop v-prefix on release tags to match
 durable-workflow/workflow convention

---
 .github/workflows/release.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 154b86f..02505cd 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -3,7 +3,7 @@ name: Release
 on:
   push:
     tags:
-      - 'v*'
+      - '[0-9]+.[0-9]+.[0-9]+*'
     branches:
       - 'standalone-binary-build'  # temporary, for Windows iteration
   workflow_dispatch:
@@ -254,7 +254,7 @@ jobs:
     # is picked up by download-artifact below.
     needs: [build-phar, build-binary]
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/v')
+    if: startsWith(github.ref, 'refs/tags/')
     steps:
       - uses: actions/checkout@v4
 

From 87912ad5e020308949cfbb55e5599799f7800495 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Wed, 15 Apr 2026 00:56:18 +0000
Subject: [PATCH 15/16] release: remove temp branch trigger, update README for
 installer one-liner

---
 .github/workflows/release.yml |  2 --
 README.md                     | 29 ++++++++++++++++-------------
 2 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 02505cd..570f159 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -4,8 +4,6 @@ on:
   push:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+*'
-    branches:
-      - 'standalone-binary-build'  # temporary, for Windows iteration
   workflow_dispatch:
     inputs:
       tag:
diff --git a/README.md b/README.md
index 9c85eae..6ad470a 100644
--- a/README.md
+++ b/README.md
@@ -6,24 +6,27 @@ Command-line interface for running and interacting with the [Durable Workflow Se
 
 Three options depending on what you have installed:
 
-**1. Standalone binary (no PHP required).** Download a native binary for your
-platform from the [releases page](https://github.com/durable-workflow/cli/releases):
+**1. Standalone binary (no PHP required).** The easiest path — a one-liner
+installer that detects your OS and arch:
 
 ```bash
-curl -fsSL -o durable-workflow \
-  https://github.com/durable-workflow/cli/releases/latest/download/durable-workflow-linux-x86_64
-chmod +x durable-workflow
-./durable-workflow --version
+# Linux and macOS
+curl -fsSL https://durable-workflow.com/install.sh | sh
 ```
 
-Available assets: `durable-workflow-linux-x86_64`, `durable-workflow-linux-aarch64`,
-`durable-workflow-macos-aarch64`.
+```powershell
+# Windows
+irm https://durable-workflow.com/install.ps1 | iex
+```
+
+Or download a native binary directly from the [releases
+page](https://github.com/durable-workflow/cli/releases). Available assets:
+`durable-workflow-linux-x86_64`, `durable-workflow-linux-aarch64`,
+`durable-workflow-macos-aarch64`, `durable-workflow-windows-x86_64.exe`.
 
-Windows and macOS x86_64 standalone binaries are not currently produced.
-Windows is blocked on an upstream PHP 8.4 + OpenSSL 3 compile bug in
-static-php-cli; macOS x86_64 is dropped because the `macos-13` runner
-label is not available to this org. On Windows, install a system PHP
-(>= 8.4) and use the PHAR.
+macOS x86_64 standalone binaries are not currently produced because the
+`macos-13` runner label is not available to this org; Intel Mac users can
+run the PHAR with a system PHP.
 
 **2. PHAR (requires PHP >= 8.2).** Download `durable-workflow.phar` from the
 [releases page](https://github.com/durable-workflow/cli/releases) and run it

From 8ae493793064b8700758a2533364a5d689a1be21 Mon Sep 17 00:00:00 2001
From: Durable Workflow <support@durable-workflow.com>
Date: Wed, 15 Apr 2026 00:58:24 +0000
Subject: [PATCH 16/16] build: rename artifacts to dw (binary name changed on
 main)

---
 .github/workflows/build.yml   |  4 ++--
 .github/workflows/release.yml | 40 +++++++++++++++++------------------
 README.md                     |  8 +++----
 box.json.dist                 |  4 ++--
 scripts/build.sh              |  4 ++--
 5 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index aad1cb1..f4bb734 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -38,5 +38,5 @@ jobs:
           ini-values: phar.readonly=0
       - run: composer install --no-dev --prefer-dist --no-interaction --optimize-autoloader
       - run: box compile --no-parallel
-      - run: box info build/durable-workflow.phar
-      - run: php build/durable-workflow.phar list
+      - run: box info build/dw.phar
+      - run: php build/dw.phar list
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 570f159..c5b9cfa 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,7 @@ jobs:
     name: Build PHAR
     runs-on: ubuntu-latest
     outputs:
-      phar-name: durable-workflow.phar
+      phar-name: dw.phar
     steps:
       - uses: actions/checkout@v4
 
@@ -54,13 +54,13 @@ jobs:
 
       - name: Verify PHAR
         run: |
-          php build/durable-workflow.phar --version || true
-          box info build/durable-workflow.phar
+          php build/dw.phar --version || true
+          box info build/dw.phar
 
       - uses: actions/upload-artifact@v4
         with:
-          name: durable-workflow-phar
-          path: build/durable-workflow.phar
+          name: dw-phar
+          path: build/dw.phar
           if-no-files-found: error
 
   build-binary:
@@ -86,7 +86,7 @@ jobs:
       - name: Download PHAR artifact
         uses: actions/download-artifact@v4
         with:
-          name: durable-workflow-phar
+          name: dw-phar
           path: build/
 
       - name: Download spc
@@ -128,20 +128,20 @@ jobs:
       - name: Combine PHAR into standalone binary
         working-directory: build/.tools
         run: |
-          ./spc micro:combine ../../build/durable-workflow.phar \
-            --output=../../build/durable-workflow-${{ matrix.name }}
+          ./spc micro:combine ../../build/dw.phar \
+            --output=../../build/dw-${{ matrix.name }}
 
       - name: Smoke test binary (native arch only)
         if: matrix.name == 'linux-x86_64' || matrix.name == 'macos-aarch64'
         run: |
-          chmod +x build/durable-workflow-${{ matrix.name }}
-          ./build/durable-workflow-${{ matrix.name }} --version
-          ./build/durable-workflow-${{ matrix.name }} list
+          chmod +x build/dw-${{ matrix.name }}
+          ./build/dw-${{ matrix.name }} --version
+          ./build/dw-${{ matrix.name }} list
 
       - uses: actions/upload-artifact@v4
         with:
-          name: durable-workflow-${{ matrix.name }}
-          path: build/durable-workflow-${{ matrix.name }}
+          name: dw-${{ matrix.name }}
+          path: build/dw-${{ matrix.name }}
           if-no-files-found: error
 
   build-binary-windows:
@@ -154,7 +154,7 @@ jobs:
       - name: Download PHAR artifact
         uses: actions/download-artifact@v4
         with:
-          name: durable-workflow-phar
+          name: dw-phar
           path: build/
 
       - name: Setup PHP for spc
@@ -229,19 +229,19 @@ jobs:
         shell: pwsh
         working-directory: build\spc-src
         run: |
-          php bin\spc micro:combine ..\..\build\durable-workflow.phar `
-            --output=..\..\build\durable-workflow-windows-x86_64.exe
+          php bin\spc micro:combine ..\..\build\dw.phar `
+            --output=..\..\build\dw-windows-x86_64.exe
 
       - name: Smoke test binary
         shell: pwsh
         run: |
-          .\build\durable-workflow-windows-x86_64.exe --version
-          .\build\durable-workflow-windows-x86_64.exe list
+          .\build\dw-windows-x86_64.exe --version
+          .\build\dw-windows-x86_64.exe list
 
       - uses: actions/upload-artifact@v4
         with:
-          name: durable-workflow-windows-x86_64
-          path: build/durable-workflow-windows-x86_64.exe
+          name: dw-windows-x86_64
+          path: build/dw-windows-x86_64.exe
           if-no-files-found: error
 
   release:
diff --git a/README.md b/README.md
index c280168..d5ea5ff 100644
--- a/README.md
+++ b/README.md
@@ -21,16 +21,16 @@ irm https://durable-workflow.com/install.ps1 | iex
 
 Or download a native binary directly from the [releases
 page](https://github.com/durable-workflow/cli/releases). Available assets:
-`durable-workflow-linux-x86_64`, `durable-workflow-linux-aarch64`,
-`durable-workflow-macos-aarch64`, `durable-workflow-windows-x86_64.exe`.
+`dw-linux-x86_64`, `dw-linux-aarch64`,
+`dw-macos-aarch64`, `dw-windows-x86_64.exe`.
 
 macOS x86_64 standalone binaries are not currently produced because the
 `macos-13` runner label is not available to this org; Intel Mac users can
 run the PHAR with a system PHP.
 
-**2. PHAR (requires PHP >= 8.2).** Download `durable-workflow.phar` from the
+**2. PHAR (requires PHP >= 8.2).** Download `dw.phar` from the
 [releases page](https://github.com/durable-workflow/cli/releases) and run it
-with `php durable-workflow.phar` (or `chmod +x` and call directly — the PHAR
+with `php dw.phar` (or `chmod +x` and call directly — the PHAR
 has a `#!/usr/bin/env php` shebang).
 
 **3. Composer.**
diff --git a/box.json.dist b/box.json.dist
index 240ee1c..622ffcb 100644
--- a/box.json.dist
+++ b/box.json.dist
@@ -1,7 +1,7 @@
 {
     "$schema": "https://raw.githubusercontent.com/box-project/box/main/res/schema.json",
-    "main": "bin/durable-workflow",
-    "output": "build/durable-workflow.phar",
+    "main": "bin/dw",
+    "output": "build/dw.phar",
     "chmod": "0755",
     "directories": ["src"],
     "finder": [
diff --git a/scripts/build.sh b/scripts/build.sh
index 9e6e52c..ec5a505 100755
--- a/scripts/build.sh
+++ b/scripts/build.sh
@@ -15,7 +15,7 @@ cd "$ROOT"
 
 BUILD_DIR="$ROOT/build"
 TOOLS_DIR="$ROOT/build/.tools"
-PHAR_OUT="$BUILD_DIR/durable-workflow.phar"
+PHAR_OUT="$BUILD_DIR/dw.phar"
 
 # Extensions required by the CLI at runtime. Keep this list in sync with the
 # CI matrix in .github/workflows/release.yml.
@@ -79,7 +79,7 @@ build_binary() {
     local php_version="${PHP_VERSION:-8.4}"
     local platform
     platform="$(detect_platform)"
-    local out_name="durable-workflow-${platform}"
+    local out_name="dw-${platform}"
 
     pushd "$TOOLS_DIR" >/dev/null
     echo ">> Downloading PHP ${php_version} source + extension deps"