I've been building an open-source CMS called Kestello. It's PHP 8.4 and Vue, for developers who build sites for clients.

Early on I decided the PHP side would have no runtime Composer dependencies. That keeps installing and updating simple on plain shared hosting: you upload a zip and run the installer, and updates arrive in the admin as signed zips. There is a composer.json, but it requires nothing at runtime. It only installs dev tools like PHPStan and PHP CS Fixer.

The cost is that I maintain things a library would otherwise handle: routing, the query builder, migrations, mail, the update pipeline. I drew the line at crypto. Passwords use password_hash, signing and encryption use libsodium, and the database goes through PDO. The front end's built files are made in CI and shipped in the release zip, so a host never needs Node. Without Node, pages are still rendered to HTML for visitors and crawlers.

To be upfront: I use AI coding tools heavily, and the agent instructions are in the repo.…