PHP - Rscp Communication With Php

I have two servers: WebServer and FaxServer.  WebServer needs to send a fax.  Is my approach shown below fairly secure?

Before sending a fax, ServerWeb needs to store a record in a table representing the message, and I am using a pseudo random value for the PK which is generated as 2147483648+mt_rand(-2147483647,2147483647).

WebServer then generates a hash equal to hash('sha256',$pk.'secretCodeWhichOnlyWebServerAndFaxServerKnow').

WebServer then sends curl request to FaxServer using POST which includes $pk, the hash, the fax number, some text to include in the fax, and an optional array of document to include (array(array('id'=>321,'name')=>'fileName.pdf')).

FaxServer verifies that the hash is correct given $pk, that the minimum information has been received, and that the fax number is a valid phone number, and quickly responds to WebServer by echoing 0 or 1 so the code in the WebServer could continue and inform the user.  If all looks okay, a new instance of PHP is started.
 

if(missingInformation) {echo(0);}
else {
   session_start();
   $_SESSION['_xfr']=$_POST;
   exec('/usr/bin/php -q /path/to/send_fax.php '.session_id().' >/dev/null &');
   echo(1);
}

New instance of PHP send_fax.php then does the following:
 

session_id($argv[1]);//Set by parent
session_start();
$data=$_SESSION['_xfr'];

$doc_list=null;
foreach ($data['documents'] AS $doc)
{
    if(ctype_alnum($doc['id']))
    {
        $file='/some/tmp/directory/'.$doc['id'];
        if(!file_exists($file))
        {
            $url='http://machine.WebServer.com/index.php?task=displayDocument&id='.$doc['id'].'&x='.hash('sha256','displayDocument'.$doc['id'].'secretCodeWhichOnlyWebServerAndFaxServerKnow');
            $cmd='wget -O '.$file.' '.escapeshellarg($url);
            exec($cmd);
        }    
        $doc_list.=' '.$file;
    }
    exit('invalid document');
}

//Send the fax...

//Send another CURL request to the WebServer similar to the wget giving the fax status.
exit;

When WebServer receives the wget request for a document, it confirms the hash and sends the document to the FaxServer using X-Sendfile.

When WebServer receives the CURL request regarding status, it updates the database for the applicable message.   Seem reasonably secure?