Build on primitives that already work
Tiknix is a PHP application framework where membership, authentication, two-factor auth, role-based permissions, an ORM, a Bootstrap design layer, data integrations, an MCP gateway, and an AI build pipeline are already wired together. These articles explain what each piece does, why it was built the way it was, and what you still own once you adopt it.
How to read this series
Each article stands on its own, but they are ordered so that the earlier ones set up vocabulary the later ones use. If you are evaluating Tiknix, read Start From Primitives and Why PHP and SQLite first. If you have already installed it and want to ship something, start at Convention-Based Routing.
Every article ends with an honest notes section: the trade-offs, the sharp edges, and the work the framework does not do for you. A tool you can only describe in superlatives is a tool you do not understand yet.
Foundations
The substrate: language, storage, routing, and data modeling. Choices you make once and live inside for years.
Start From Primitives, Not From Scratch
Every app needs the same twenty things before it needs anything interesting. Inheriting them is the whole point.
Foundations 8 min 02Why PHP and SQLite Are a Serious Choice in 2026
Two of the most-deployed pieces of software on earth, chosen on merit: boring operations, a copy-the-file backup story, and an ecosystem now moving toward Turso and in-database vector search.
Foundations 11 min 03The Members Table Is the Spine
One identity table, one privilege number, and a key/value settings store that absorbs everything which would otherwise become a column.
Foundations 9 min 04Convention-Based Routing: A URL Is a Method Name
How Tiknix maps /member/profile to Member->profile() with no route table — and why that makes a codebase legible to humans and agents alike.
Foundations 7 min 05Modeling Data Without a Migration Backlog
RedBeanPHP's fluid schema lets the database follow your code while you explore, then freezes for production. What that buys and what it costs.
Foundations 9 min 06Bootstrap as a Design Primitive
Accessible components and a responsive grid you inherit; palette, type, and identity you own — because 5.3 puts its decisions in variables.
Foundations 10 minSecurity & Access
Identity, authorization, and sharing. The parts that are unglamorous to build and expensive to get wrong.
The Login You Don't Have to Write
Registration, sessions, password hashing, reset flows, Google OAuth, CSRF, rate limiting — shipped, wired, and already exercised.
Security & Access 9 min 08Two-Factor Authentication as a Config Switch
TOTP, QR enrollment, recovery codes, and 30-day device trust with three policy states: off, optional, required.
Security & Access 8 min 09Permissions as Data, Not If-Statements
One authcontrol row per route, four privilege levels, and a build mode that writes the rows as you develop.
Security & Access 9 min 10Teams, Ownership, and Sharing Work Safely
Personal vs. team resources, four roles, and a single access-control service the rest of the app asks before it shows you anything.
Security & Access 7 minBuilding with AI
How an agent works inside a codebase that can describe itself — and the guardrails that keep the output coherent.
Give Your AI Assistant a Map, Not a Flashlight
Tiknix ships MCP tools that hand an agent a structured inventory of what already exists — so its first instinct is reuse, not reinvention.
Building with AI 10 min 12MCP as a Primitive: One Endpoint for Every Agent
A gateway that aggregates tools, namespaces them, authenticates per key, and logs every call — so agent access is managed like user access.
Building with AI 10 min 13Plan With the Expensive Model, Execute With the Cheap One
The planner/worker/auditor pipeline: who is allowed to make design decisions, who merges, and why concurrency stays at three.
Building with AI 11 min 14Pipelines: Automation That Ships With the App
Declarative JSON steps — HTTP, DB, shell, agent, MCP call, branch, notify — versioned in the repo next to the code they automate.
Building with AI 9 min 15Scaffolding Is a Reading Exercise
Generated code is only a gift if it looks like the code around it. How conventions turn a generator into a teacher.
Building with AI 8 minOperations
Integrations, performance, growth, and the move to production. What happens after it works on your laptop.
Five Ways Data Crosses the Boundary
Outbound connectors, inbound API keys, signed webhooks, two-way email threads, and pipelines — sharing one set of auth, logging, and revocation machinery.
Operations 11 min 17Third-Party Credentials Without Sprawl
Encrypted-at-rest tokens on the control plane, OAuth connectors behind one interface, and revocable broker keys instead of shared secrets.
Operations 10 min 18Caching You Don't Have to Think About
A transparent query cache, a three-tier permission cache, and OPcache preloading — with an honest look at when each one earns its keep.
Operations 9 min 19Growing Without Bloating the Core
Per-member feature flags with a privilege floor, and sidecar apps that live in their own repo but log in through yours.
Operations 8 min 20From Localhost to Production: The Honest Checklist
Defaults that are right for development are wrong for the internet. The specific switches to flip, and what breaks if you don't.
Operations 10 min