AI Rust Rewrites: How to Audit php-rust Yourself

8 min read · Last updated: October 25, 2026

An AI rewrite in Rust is a port of an existing language, written mostly by coding agents and judged by that language's own test suite. You can audit one yourself: build it, run the official tests, diff its output against the real interpreter, and count its unsafe code. This guide does that with php-rust.

Came here from Instagram, LinkedIn, X or YouTube? Here is the full source list you came for. Everything below is built from these, nothing else.

The repos

• francescotinti/php-rust, README status pinned September 16, 2026
• pingdotgg/ts-rust (tsc-rs), pinned October 19, 2026
• ekinertac/Phargo, July 5, 2026
• jolicode/rphp, July 29, 2026

The write-ups by the builders

• Jarred Sumner, Rewriting Bun in Rust, Bun blog, July 2026
• Ekin Ertac, I don't know Rust, my AI is rewriting PHP in it, July 5, 2026
• Joël Wurtz, Writing the PHP Virtual Machine in Rust, JoliCode, July 29, 2026

The press

• The Register, $24,000 AI experiment ports TypeScript compiler to Rust, October 15, 2026
• Techzine, AI agents rewrite TypeScript compiler in Rust for $24,000, October 16, 2026

Key takeaways

• The $420k figure belongs to Theo Browne's TypeScript port. His README says he spent over $400,000 in API-priced tokens on OpenAI models, then $24,047 on the Claude run that worked.
• Bun's Zig to Rust port took 11 days and, per its maintainer, around $165,000 at API pricing.
• php-rust's own README claims 30,472 WordPress core tests and 65.3% of runnable Zend/tests passing. These are self-reported, so verify them.
• Pass rates mean nothing without the denominator. One PHP port sits at 17.4% of 22,037 tests, another at about 80% of basic compatibility tests.
• Bun's Rust port has roughly 13,000 unsafe keywords, about 4% of its code. Count this in any rewrite you trust.

What will you build, and why audit an AI rewrite at all?

You will build a repeatable audit script for any AI-written language rewrite. It checks four things: does it build, does it pass the official tests, does it match the real implementation, and how much unsafe code hides inside.

I ran into this because the headlines keep coming. Bun, the JavaScript runtime, moved from Zig to Rust. TypeScript's compiler got a Rust port. PHP now has several. Each one comes with a big number, a pass rate, and a claim that nobody wrote the code by hand.

Those claims are testable. That is the whole point of this guide.

Why are people rebuilding whole languages in Rust with AI?

Because the hard part of a rewrite, knowing what correct means, already exists. A mature language ships a huge test suite, and the Rust compiler gives agents strict, repeatable feedback. That turns a rewrite into a loop an agent can run for days. This is my reading of the sources below.

Joël Wurtz of JoliCode put the second half plainly: "AI needs deterministic tools to be good." He chose Rust because he knows it well and because its strict compiler checks give the AI deterministic feedback.

Ekin Ertac, who says he does not know Rust, describes the first half. PHP's own .phpt suite is an independent oracle, so the AI does not grade its own work. He credits that principle to the Bun team's approach.

Here is what each public project reports:

Project	What it ports	Reported cost or effort	Reported result
Bun (Anthropic)	Zig to Rust	About $165,000 at API pricing, 11 days	100% of the existing test suite passed in CI
ts-rust (Theo Browne)	TypeScript 7 compiler (Go) to Rust	Over $400,000 in OpenAI tokens, then $24,047 on Claude	186,890 tests pass, 0 fail
php-rust (francescotinti)	PHP 8.5 to Rust	Not stated	65.3% of runnable Zend/tests, WordPress suite
Phargo (Ekin Ertac)	PHP to Rust	Not stated	17.4% of 22,037 PHP tests
rphp (JoliCode)	PHP VM in Rust	About 200 euros, one month of Claude Max 20x	About 80% of basic compatibility tests

All figures are the builders' own. None are independent audits, which is why the rest of this guide exists.

What do you need before you start?

You need four things installed and about 10 GB of free disk. The disk figure is my estimate, not a number from the projects.

• Rust and Cargo, installed through rustup.
• Real PHP. php-rust's README benchmarks against PHP 8.5.7, so use 8.5 if you can.
• Git to clone the repos.
• A scratch directory you can delete afterwards.

One warning first. Several projects are named "php-rust" or something close. This guide uses the one at github.com/francescotinti/php-rust. I could not read the Level Up Coding article that prompted this post, so I cannot confirm it covers this exact repo.

Step 1: Pin your oracle

The oracle is the real PHP you compare against. Check its version and keep it fixed.

php -v
which php

Write the version down. A port that passes against 8.5.7 may not match 8.4, and you will not notice until a test disagrees.

Step 2: Clone and build the port

The README gives the build command directly.

git clone https://github.com/francescotinti/php-rust
cd php-rust
cargo build --release

The build produces phpr, described as a drop-in for php. If it does not compile on a clean machine, you have found your first finding. Note it.

Step 3: Smoke test against real PHP

Run the same script through both and diff the output. Start with something that has branches, strings, arrays and exceptions.

cat > /tmp/t.php <<'EOF'
<?php
$a = ['b' => 2, 'a' => 1];
ksort($a);
echo json_encode($a), PHP_EOL;
try { intdiv(1, 0); } catch (\Throwable $e) { echo get_class($e), PHP_EOL; }
var_dump("10" == "1e1", 0 == "a");
EOF

php /tmp/t.php > /tmp/real.txt
./target/release/phpr /tmp/t.php > /tmp/port.txt
diff /tmp/real.txt /tmp/port.txt && echo MATCH

The == line is deliberate. PHP's type juggling is where reimplementations drift first. php-rust's README claims a differential check of 37,835 type-juggling cases with 0 mismatches, so a mismatch here would contradict it.

Step 4: Run the project's own tests

The README lists two commands. The second compares the port to your real PHP on the same inputs.

cargo test --release
PHP_ORACLE=$(which php) cargo test -p php-types --test differential

The README claims 1,748 Rust unit and integration tests. Count what you actually see pass. Tests written by the same agent that wrote the code prove less than tests written by someone else, which leads to the next step.

Step 5: Run PHP's official test corpus

This is the step that matters most. The .phpt files come from PHP itself, not from the port's author.

git clone --depth 1 https://github.com/php/php-src /tmp/php-src
./target/release/phpt-runner --isolate /tmp/php-src/Zend/tests
./target/release/phpt-runner --isolate --list-fails /tmp/php-src/Zend/tests

The README reports 2,655 passing, which it states as 65.3% of runnable tests. Note the phrase "of runnable". Tests that need C extensions the port does not implement are excluded from that denominator. Ekin Ertac's Phargo post estimates a realistic ceiling of about 40 to 45% of the full PHP suite for the same reason.

So ask two questions of any pass rate: out of what, and who chose what counts.

Step 6: Count the unsafe code

Rust's safety promise only holds outside unsafe blocks. A mechanical translation tends to produce a lot of them. Bun's maintainer reports about 4% of the new Rust code sits inside an unsafe block, roughly 13,000 unsafe keywords across about 780,000 lines.

grep -rn "unsafe" --include="*.rs" . | wc -l
find . -name "*.rs" -not -path "./target/*" | xargs wc -l | tail -1

The php-rust README gives no repo-wide unsafe count. It does say its Fiber implementation uses no unsafe, and it lists FFI calls to system libraries such as gd, zlib and libxslt. Your two numbers will be the first independent figure.

Step 7: Check who graded the homework

Look at how the repo was built. The php-rust README does not say whether AI wrote it, so treat this as evidence, not proof.

ls -a | grep -iE "claude|agents|codex|diary|sessions"

The repo contains CLAUDE.md, AGENTS.md, .claude/rules, and directories for diary/ and sessions/. Those are indicators that agents were involved, with per-session logs. Read a few. Good logs show failing tests found first and fixes second.

Step 8: Time it on your own workload

Speed claims are the easiest to inflate. Run your own script both ways.

time php /tmp/bench.php
time ./target/release/phpr /tmp/bench.php

The README's own numbers show where it stands. Its micro suite runs 2.4x to 4.6x PHP's CPU time depending on the category, and the full WordPress test suite about 1.77x. The stated target is parity. It is honest that it has not arrived.

What are the common mistakes when judging an AI rewrite?

The biggest mistake is trusting one headline number. Cost, pass rate and speed each hide a denominator. Check what was counted, what was excluded, and who did the counting before you believe any of them.

The specific traps I would watch for:

1. Treating $420k as the price of the result. Theo Browne's README says he spent over $400,000 in API-priced tokens on OpenAI models that never got past about 84% compatibility. The working Claude run was $24,047 over two weeks. The two figures sum to just over $424,000 by my arithmetic, and the README itself says you could probably have done it for about $20k.
2. Reading API price as cash spent. The README says Claude usage was between 925% and 983% of his $200 plan's weekly limits. API-priced and subscription-priced are different bills. JoliCode's one month cost about 200 euros.
3. Comparing pass rates with different denominators. 17.4% of all PHP tests and 65.3% of runnable Zend/tests are not the same kind of number.
4. Line endings. Ekin Ertac found that missing CRLF normalization had silently failed many multi-line tests. Normalize output the way PHP's run-tests.php does.
5. Believing features that only look like they work. In Phargo, clone, unset($arr[$key]), trim() with a charlist, and catch (\Throwable) were each silently broken while the score looked fine.
6. Skipping the cost of keeping the code. Bun's maintainer reports 6,502 commits in 11 days. Someone still has to read and maintain the output.

Two cautions apply to the TypeScript port in particular. Techzine reports that Browne's speed claims have not been independently verified, and that Claude worked from Microsoft's Go version, so some existing bugs carried over. The README also adds, in his words, "I have no idea if this will actually work."

What should you do next?

Pick one rewrite and publish your audit. Three useful follow-ups:

• Run the same Step 5 against Phargo and compare the failing categories with php-rust's.
• Repeat Step 6 on ts-rust and Bun and put the unsafe ratios in one table.
• Run your real application through phpr and write down the first thing that breaks.

If you want the bigger picture on what AI coding can and cannot do, read our analysis of AI coding limits and the vibe coding guide. For why this matters to your career, see why coding fundamentals still matter.

FAQ

How much does an AI rewrite of a programming language cost?

The public figures range from about 200 euros to over $400,000. JoliCode's PHP VM took one month on a Claude Max 20x plan. Bun's port is reported at around $165,000 at API pricing. Theo Browne reports $24,047 for the TypeScript run that worked and over $400,000 for the earlier one that stalled.

Is the $420k TypeScript rewrite figure real?

It comes from Theo Browne's own accounting in the ts-rust README, not from an audit. He reports over $400,000 in API-priced tokens on OpenAI models plus $24,047 on Claude, which together are just over $424,000. Techzine, citing The Register, reports the $24,000 figure and an estimated API value of over $400,000 for the earlier attempt.

Is php-rust ready for production?

Its own README says the current focus is performance and that it runs about 1.77x PHP's CPU time on the WordPress suite. It also lists open failures, such as 13 failures in the Doctrine ORM suite. Treat it as a serious experiment and test your own workload before relying on it.

Do you need to know Rust to audit one of these?

No. Steps 1 to 5 and 8 need only a terminal and real PHP. Step 6 is a text search. Ekin Ertac's Phargo project was itself directed without reading the Rust, using PHP's own test suite as the judge.

Pick one rewrite, run Steps 1 to 5, and see which claim holds up. Our free tools on Art of Code are there while you wait for the build, and our programming languages explainer covers how languages get built in the first place.

Written by Adithya Guttha, Founder of Art of Code.