Current Handover - 2026-08-12
Project root:
`C:\Users\Administrator\Desktop\Storage\Projects\The Grand Project`
Current objective status
The current batch continued the existing Grand Project implementation into the deployment-readiness phase for generic PHP hosting.
This pass did not rebuild working functionality. It extended the current runtime and installer path toward a production-viable web installation model while preserving the existing operational authentication, MFA, SSO, administration, Website Builder, and commerce path already in place.
What changed in this batch
- Added protected install-state loading so runtime configuration can persist from a browser-driven installation without requiring shell access or a server-side `.env` workflow.
- Expanded application, authentication, and database config to read from either environment variables or the protected install state.
- Added driver-aware database configuration for `sqlite`, `mysql`, and `mariadb` using PDO and the expected hosting-style credentials model.
- Updated the PDO connection wrapper to translate the current SQLite-first schema/setup SQL into MySQL/MariaDB-compatible SQL at execution time for the present deployment path.
- Extended unattended install profile handling so database credentials and installation metadata can drive either SQLite or MySQL/MariaDB installs.
- Upgraded the platform installer to build runtime config from the install profile, persist application/auth/database state, and install without assuming a SQLite-only local path.
- Reworked the browser installer from a status page into a real web install form that accepts application URLs, database settings, administrator credentials, and secrets, then performs installation and redirects into the live auth path.
- Expanded installer phases and environment checks toward the deployment-readiness brief, including explicit PDO MySQL, extension, filesystem, HTTPS, and optional PHP CLI reporting.
- Updated default OAuth client bootstrap to use configured installation URLs instead of only localhost assumptions.
- Adjusted SSO callback URL generation to use the configured/request base URL rather than fixed localhost hostnames.
- Refreshed the installer and unattended smoke coverage to validate the richer installation contract while preserving the existing end-to-end functional deployment verification.
- Added real MySQL/MariaDB-backed smoke execution for both the functional deployment and commerce stack paths using fresh temporary databases on a local isolated MariaDB instance.
- Hardened the PDO transaction wrapper so MariaDB DDL auto-commit behavior does not break the framework migration/install transaction helper.
- Added explicit endpoint deployment records for generated web entrypoints, including target ID, endpoint type, Local Web Root, Public Base URL, environment, status, entrypoint version, and generation timestamps.
- Added a managed endpoint deployment service that validates permitted Local Web Roots, prevents silent overwrite of unrelated `index.php` files, backs up replaced entrypoints, and generates tiny marker/versioned `index.php` shims with no secrets or business logic.
- Updated the runtime public website path so a generated website endpoint can identify the active site explicitly from endpoint configuration, removing hostname discovery as a requirement for deployed Website Builder entrypoints.
- Added administration support for endpoint deployment plus a dedicated smoke test that proves an explicit generated website endpoint can render a published page on `localhost` without any domain lookup.
Primary files changed
- `Core Platform/Common Application Framework/config/install-state.php`
- `Core Platform/Common Application Framework/config/app.php`
- `Core Platform/Common Application Framework/config/authentication.php`
- `Core Platform/Common Application Framework/config/database.php`
- `Core Platform/Common Application Framework/src/Database/DatabaseManager.php`
- `Core Platform/Common Application Framework/src/Database/PdoConnection.php`
- `Core Platform/Common Application Framework/src/Runtime/EndpointDeploymentService.php`
- `Core Platform/Common Application Framework/src/Installer/InstallerService.php`
- `Core Platform/Common Application Framework/src/Installer/UnattendedInstallProfile.php`
- `Core Platform/Common Application Framework/src/Runtime/PlatformInstaller.php`
- `Core Platform/Common Application Framework/src/Runtime/PlatformKernel.php`
- `Core Platform/Common Application Framework/src/Runtime/PlatformRepository.php`
- `tests/smoke/endpoint-entrypoint.php`
- `tests/smoke/web-installer.php`
- `tests/smoke/unattended-installer.php`
Key runtime references
- Protected install-state fallback: `Core Platform/Common Application Framework/config/install-state.php`
- Runtime database config and driver selection: `Core Platform/Common Application Framework/config/database.php`
- SQL portability shim for MySQL/MariaDB: `Core Platform/Common Application Framework/src/Database/PdoConnection.php`
- Explicit endpoint deployment and entrypoint generation: `Core Platform/Common Application Framework/src/Runtime/EndpointDeploymentService.php`
- Browser installer rendering and environment checks: `Core Platform/Common Application Framework/src/Installer/InstallerService.php`
- Installer apply path and install-state persistence: `Core Platform/Common Application Framework/src/Runtime/PlatformInstaller.php`
- Web install request handling, explicit endpoint routing, and runtime boot path: `Core Platform/Common Application Framework/src/Runtime/PlatformKernel.php`
- OAuth client bootstrap, endpoint records, and schema migration path: `Core Platform/Common Application Framework/src/Runtime/PlatformRepository.php`
Exact verification performed
Date run:
- Wednesday, August 12, 2026
Checks run:
- `php -l "Core Platform/Common Application Framework/config/install-state.php"`
- `php -l "Core Platform/Common Application Framework/config/app.php"`
- `php -l "Core Platform/Common Application Framework/config/authentication.php"`
- `php -l "Core Platform/Common Application Framework/config/database.php"`
- `php -l "Core Platform/Common Application Framework/src/Database/DatabaseManager.php"`
- `php -l "Core Platform/Common Application Framework/src/Database/PdoConnection.php"`
- `php -l "Core Platform/Common Application Framework/src/Runtime/EndpointDeploymentService.php"`
- `php -l "Core Platform/Common Application Framework/src/Installer/InstallerService.php"`
- `php -l "Core Platform/Common Application Framework/src/Installer/UnattendedInstallProfile.php"`
- `php -l "Core Platform/Common Application Framework/src/Runtime/PlatformInstaller.php"`
- `php -l "Core Platform/Common Application Framework/src/Runtime/PlatformKernel.php"`
- `php -l "Core Platform/Common Application Framework/src/Runtime/PlatformRepository.php"`
- `php tests/smoke/endpoint-entrypoint.php`
- `php tests/smoke/web-installer.php`
- `php tests/smoke/unattended-installer.php`
- `php tests/smoke/functional-deployment.php`
- `php tests/smoke/commerce-stack.php`
- `php tests/smoke/functional-deployment.php` with `GRAND_PROJECT_TEST_DB_DRIVER=mariadb`, `GRAND_PROJECT_TEST_DB_HOST=127.0.0.1`, `GRAND_PROJECT_TEST_DB_PORT=3307`
- `php tests/smoke/commerce-stack.php` with `GRAND_PROJECT_TEST_DB_DRIVER=mariadb`, `GRAND_PROJECT_TEST_DB_HOST=127.0.0.1`, `GRAND_PROJECT_TEST_DB_PORT=3307`
Results:
- `php tests/smoke/endpoint-entrypoint.php` -> passed
- `php tests/smoke/web-installer.php` -> passed
- `php tests/smoke/unattended-installer.php` -> passed
- `php tests/smoke/functional-deployment.php` -> passed on SQLite
- `php tests/smoke/commerce-stack.php` -> passed on SQLite
- `php tests/smoke/functional-deployment.php` -> passed on MariaDB `10.4.32-MariaDB`
- `php tests/smoke/commerce-stack.php` -> passed on MariaDB `10.4.32-MariaDB`
Exact runtime verified:
- PHP CLI: `8.2.33`
- MariaDB product/version: `10.4.32-MariaDB`
- Isolated local MariaDB listener used for proof: `127.0.0.1:3307`
Important remaining blockers before first live generic-host deployment
- Endpoint records and generated public `index.php` entrypoints are now implemented for the Website Builder deployment path, but endpoint diagnostics, repair/regeneration UX, and the auth/admin endpoint rollout still need broader production completion.
- A secure web scheduler endpoint with bounded execution, locking, rotation, and auditing is still outstanding.
- Framework rate limiting and abuse throttling for login, password reset, MFA, OAuth, checkout, payments, webhooks, and expensive APIs is still not implemented.
- Production email transport wiring and installer test-email support are still pending.
- Portable PDO-based MySQL/MariaDB backup and resumable web restore are still pending.
- Recovery and updater surfaces still need the remaining deployment-readiness work for resumable web-first production use.
- Real generic-host HTTPS staging installation testing is still required even though local MariaDB proof is now complete.
Recommended next work
1. Extend the endpoint work into full diagnostics, repair/regeneration flows, and completed auth/admin endpoint deployment coverage.
2. Add the secure scheduler HTTP endpoint with bounded queue/task execution and durable run-state recording.
3. Implement framework-native rate limiting and cover the auth, OAuth, payment, webhook, and checkout paths with positive and negative tests.
4. Add provider-backed SMTP configuration, test-email support, and production-safe reset/verification delivery.
5. Implement the portable PDO MySQL/MariaDB backup provider and protected resumable web restore path.
Notes for the next Codex session
- Continue from the current implementation. Do not rebuild working functionality.
- Preserve the existing auth, MFA, SSO, tenant isolation, administration, Website Builder, and commerce path.
- Treat `GRAND-PROJECT-SPECIFICATION.md` as authoritative.
- Keep `todo.md`, `updates.md`, and `decisions.md` current with any further changes.
- If doing coding, check current working project out from GitHub when the project is handed back to Codex, per `AGENTS.md`.