updates.md

2026-08-12 - Deployment proof and explicit endpoints

- Ran the functional deployment and commerce smoke suites against a real isolated local MariaDB instance on `127.0.0.1:3307` using `MariaDB 10.4.32`, each on a fresh empty temporary database created for the run.

- Fixed a real MariaDB portability issue in the PDO transaction helper so framework migrations and installation survive DDL auto-commit behavior without weakening the existing install flow.

- Added explicit endpoint deployment records and a managed entrypoint deployment service that writes tiny marker/versioned `index.php` files with no secrets or business logic, validates permitted Local Web Roots, prevents silent overwrite of unrelated files, and backs up replaced entrypoints.

- Updated the runtime public website path so Website Builder entrypoints can resolve the active site explicitly from endpoint configuration instead of requiring hostname discovery.

- Added endpoint deployment administration wiring and a dedicated smoke test that proves a generated website endpoint can render the right published site on `localhost` without any domain mapping.

2026-08-11 - Project Tendering

- Added a real `Plugin Modules/Project Tendering` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `ProjectTenderingService` surface.

- The Project Tendering module stays within the authoritative tendering boundary from the specification: it covers tender registers, requirements, scope breakdowns, pricing inputs, deadlines, clarifications, site visits, compliance documents, approvals, submission packs, and tender status.

- Added a smoke test that validates the Project Tendering manifest, tendering surfaces, and update/rollback rotation against the real payload on disk.

2026-08-11 - Lead Pipeline

- Added a real `Plugin Modules/Lead Pipeline` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `LeadPipelineService` surface.

- The Lead Pipeline module stays within the authoritative lead-management boundary from the specification: it covers leads, opportunities, enquiries, quotes, estimates, revisions, approvals, deposits, pipeline stages, and conversion into orders, projects, and invoices, and it keeps suppliers optional rather than required.

- Added a smoke test that validates the Lead Pipeline manifest, pipeline surfaces, and update/rollback rotation against the real payload on disk.

2026-08-11 - Invoice Generation

- Added a real `Plugin Modules/Invoice Generation` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and an `InvoiceGenerationService` surface.

- The Invoice Generation module stays within the authoritative invoicing boundary from the specification: it covers invoices, credit notes, statements, numbering, tax calculations, invoice PDF output, delivery status, payment status, and overdue reminders, and it treats invoice output as derived from source records rather than authoritative over them.

- Added a smoke test that validates the Invoice Generation manifest, invoice surfaces, and update/rollback rotation against the real payload on disk.

2026-08-11 - Payments & Billing

- Added a real `Plugin Modules/Payments & Billing` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `PaymentsBillingService` surface.

- The Payments & Billing module stays within the authoritative billing boundary from the specification: it covers payment providers, one-off payments, deposits, payment links, partial payments, recurring payments, subscriptions, refunds, reconciliation, provider webhooks, transaction logs, receipts, and Xero integration, and it does not store raw card details.

- Added a smoke test that validates the Payments & Billing manifest, billing surfaces, and update/rollback rotation against the real payload on disk. The required `Invoice Generation` dependency is declared exactly as specified, and full install/lifecycle verification is deferred until that module exists as a real plugin.

2026-08-11 - E-commerce

- Added a real `Plugin Modules/E-commerce` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and an `EcommerceService` surface.

- The E-commerce module stays within the authoritative commerce boundary from the specification: it covers products, variants, categories, carts, checkout, orders, discounts, shipping, tax, returns, and refunds, and it keeps billing and invoice ownership in the separate modules named by the spec.

- Added a smoke test that validates the E-commerce manifest, commerce surfaces, and update/rollback rotation against the real payload on disk. Required dependencies are declared exactly as specified, and full install/lifecycle verification is deferred until the billing and invoice modules exist.

2026-08-11 - Website Builder

- Added a real `Plugin Modules/Website Builder` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `WebsiteBuilderService` surface.

- The Website Builder module stays within the authoritative website boundary from the specification: it covers websites, pages, layouts, themes, blocks, menus, forms, media, SEO, publishing, and domains, and it treats published site content as non-authoritative over source plugins.

- Added a smoke test that validates the Website Builder manifest, lifecycle scripts, content surfaces, and update/rollback rotation against the real payload on disk.

2026-08-11 - Business Intelligence & Reporting

- Added a real `Plugin Modules/Business Intelligence & Reporting` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `BusinessIntelligenceReportingService` surface.

- The BI & Reporting module stays within the authoritative analytics boundary from the specification: it covers dashboards, KPIs, authorised analytical views, reporting, and exports, and it explicitly treats derived analytical data as non-authoritative over source plugins.

- Added a smoke test that validates the BI & Reporting manifest, lifecycle scripts, analytical surfaces, and update/rollback rotation against the real payload on disk.

2026-08-11 - Supplier Portal

- Added a real `Plugin Modules/Supplier Portal` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `SupplierPortalService` surface.

- The Supplier Portal module stays within the authoritative supplier-facing boundary from the specification: it covers authorised supplier records, catalogues, products, documents, purchasing interactions, and communications, and it keeps `suppliers` as the required upstream dependency.

- Added a smoke test that validates the Supplier Portal manifest, lifecycle scripts, supplier-facing access surfaces, and update/rollback rotation against the real payload on disk while installing and enabling `Suppliers` first to satisfy the dependency chain.

2026-08-10 - Partner Portal

- Added a real `Plugin Modules/Partner Portal` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `PartnerPortalService` surface.

- The Partner Portal module stays within the authoritative portal boundary from the specification: it provides partner, distributor, and reseller-facing access based on role and relationship, without introducing a hard dependency that the spec does not require.

- Added a smoke test that validates the Partner Portal manifest, lifecycle scripts, role/relationship access surfaces, and update/rollback rotation against the real payload on disk.

2026-08-10 - OpsRoom

- Added a real `Plugin Modules/OpsRoom` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and an `OpsRoomService` surface.

- The OpsRoom module stays within the internal operations boundary from the specification: it covers projects, procedures, documents, internal workflows, business knowledge, and management tools, and it explicitly keeps Tendering outside the module boundary.

- Added a smoke test that validates the OpsRoom manifest, lifecycle scripts, internal operations surfaces, and update/rollback rotation against the real payload on disk.

2026-08-10 - Developer Platform

- Added a real `Plugin Modules/Developer Platform` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `DeveloperPlatformService` surface.

- The Developer Platform module stays within the authoritative tooling boundary from the specification: it covers scaffolding, diagnostics, migrations, test support, deployment utilities, documentation, plugin validation, and contract testing without introducing a hard dependency that the spec does not require.

- Added a smoke test that validates the Developer Platform manifest, lifecycle scripts, tooling surfaces, and update/rollback rotation against the real payload on disk.

2026-08-10 - Order Processing

- Added a real `Plugin Modules/Order Processing` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and an `OrderProcessingService` surface.

- The Order Processing module stays inside the authoritative fulfilment boundary from the specification: it owns allocation, fulfilment, picking, packing, dispatch, completion, cancellation, and recovery states, and it keeps `inventory-tracking` as the required upstream dependency.

- Added a smoke test that validates the Order Processing manifest, dependency chain, lifecycle scripts, fulfilment surfaces, and update/rollback rotation against the real payload on disk while installing and enabling `Products` and `Inventory Tracking` first to satisfy the dependency chain.

2026-08-09 - Inventory Tracking

- Added a real `Plugin Modules/Inventory Tracking` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and an `InventoryTrackingService` surface.

- The Inventory Tracking module keeps the required `Products` dependency explicit and models the spec-owned inventory domains: stock on hand, available and reserved stock, warehouses, stores, bin locations, vehicles, technician stock, transfers, receipts, sales allocations, returns, adjustments, serial numbers, batch/lot tracking, reorder levels, stocktakes, movement history, and valuation.

- Added a smoke test that validates the Inventory Tracking manifest, lifecycle scripts, stock and warehouse surfaces, and update/rollback rotation against the real payload on disk while installing and enabling `Products` first to satisfy the hard dependency.

2026-08-09 - Suppliers

- Added a real `Plugin Modules/Suppliers` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `SuppliersService` surface.

- The Suppliers module stays within the authoritative spec boundary: it owns supplier records, contacts, terms, lead times, catalogues, preferred-supplier status, purchasing information, and supplier/product relationships, with `products` declared as the optional/recommended integration.

- Added a smoke test that validates the Suppliers manifest, lifecycle scripts, supplier catalogue and purchasing surfaces, and update/rollback rotation against the real payload on disk.

2026-08-09 - ServiceVault

- Added a real `Plugin Modules/ServiceVault` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `ServiceVaultService` surface.

- The ServiceVault module keeps the required `Asset Registry` dependency explicit and leaves Products, Inventory Tracking, Invoice Generation, and Payments & Billing as optional integrations, which matches the dependency model in the specification.

- Added internal `customer-portal` and `technician-portal` module folders under ServiceVault to represent the internal customer and technician experiences without promoting them to standalone top-level plugin modules.

- Added a smoke test that validates the ServiceVault manifest, top-level lifecycle scripts, internal portal modules, dependency installation order, and update/rollback rotation against the real payload on disk.

2026-08-09 - Asset Registry

- Added a real `Plugin Modules/Asset Registry` module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and an `AssetRegistryService` surface.

- The Asset Registry module stays within the authoritative spec boundary: it owns the `ar_` prefix, covers assets, asset types, specifications, properties, locations, relationships, installation history, lifecycle events, maintenance, warranties, manuals, documents, QR identifiers, and equipment knowledge, and it models the initial asset-class catalog from the spec.

- Added an internal `asset-classes/Pool` reference package under Asset Registry to represent the first complete specialised asset-class implementation without turning it into a separate top-level plugin module.

- Added a smoke test that validates the Asset Registry manifest, asset-class catalog, top-level lifecycle scripts, nested Pool reference package, and update/rollback rotation against the real payloads on disk.

2026-08-09 - Workflow viewer

- Added a root-level `administration/workflows.php` entrypoint and a framework workflow administration service that summarizes workflow snapshot state, instance status counts, recent instance history, and step execution history in HTML or JSON.

- The workflow viewer reads from the existing workflow history snapshot format so operators can inspect saga outcomes, compensations, and failure context without introducing a separate admin-side workflow store or mutating the workflow engine.

- Added a smoke test that seeds successful and compensated workflow runs, then verifies the workflow viewer renders the expected instance and step history data in both JSON and HTML modes.

2026-08-09 - Scheduler

- Added a root-level `administration/scheduler.php` entrypoint and a framework scheduler administration service that summarizes scheduler snapshot state, due and upcoming tasks, lock registry state, and runtime readiness in HTML or JSON.

- The scheduler page reads from the existing scheduler snapshot format so operators can inspect task timing and lock behavior without introducing a separate admin-side scheduler store or mutating the scheduler subsystem.

- Added a smoke test that seeds scheduled tasks and an active lock, then verifies the scheduler dashboard renders the expected task, timing, lock, and runtime data in both JSON and HTML modes.

2026-08-09 - Queues/jobs

- Added a root-level `administration/queues.php` entrypoint and a framework queues/jobs administration service that summarizes queue snapshot state, backlog counts, worker readiness, and recent job history in HTML or JSON.

- The queues/jobs page reads from the existing queue snapshot format so operators can inspect queue activity without introducing a separate admin-side job store or mutating the queue subsystem.

- Added a smoke test that seeds a queue snapshot with completed, queued, retrying, and canceled jobs, then verifies the queues/jobs dashboard renders the expected inventory and job history in both JSON and HTML modes.

2026-08-09 - Backup/restore

- Added a root-level `administration/backup-restore.php` entrypoint and a framework backup/restore administration service that summarizes restore-point inventory, latest snapshot integrity, emergency recovery utility readiness, recovery log history, and restore target writability in HTML or JSON.

- The backup/restore page reuses the existing restore-point manager and recovery file layout so operators can inspect the same backup metadata that powers update safeguards and emergency recovery without introducing a second source of truth.

- Added a smoke test that seeds multiple restore points plus recovery logs and config files, then verifies the backup/restore dashboard renders the expected inventory, snapshot, utility, log, and target data in both JSON and HTML modes.

2026-08-09 - Updates

- Added a root-level `administration/updates.php` entrypoint and a framework updates administration service that summarizes release-slot state, update-plan readiness, and backup preflight context in HTML or JSON.

- The updates page reuses the existing `UpdateReleaseManager`, `UpdateClient`, and `RestorePointManager` classes so operators can inspect staged/current/previous slots, dependency-ordered update plans, compatibility errors, and restore-point availability without duplicating update logic.

- Added a smoke test that seeds staged and current releases, a restore point, and a release metadata file, then verifies the update dashboard renders the expected release and plan data in both HTML and JSON modes.

2026-08-09 - Dependency visualiser

- Added a root-level `administration/dependencies.php` entrypoint and a framework dependency-visualiser service that scans plugin modules, reads manifests, resolves dependency relationships, and renders a manifest-driven graph in HTML or JSON.

- The visualiser surfaces required, optional, recommended, and conflicting relationships directly from plugin manifests, highlights missing targets as warnings, and includes dependency-order and dependency-error metadata for operator review.

- Added a smoke test that seeds a temporary plugin catalog with valid modules plus one missing dependency, then verifies the graph output, dependency map, and warning state in both JSON and HTML modes.

2026-08-09 - Plugin manager

- Added a root-level `administration/plugins.php` entrypoint and a framework plugin-manager service that inventories plugin module directories, validates manifests, builds registry state, and renders plugin details in HTML or JSON.

- The plugin manager reports manifest content, dependencies, capabilities, permissions, routes, jobs, events, configuration, updates, rollback, uninstall, and health-check metadata directly from `plugin.json`, and it emits a manifest-derived dependency map so operators can inspect plugin relationships from the admin surface.

- Added a smoke test that seeds a temporary plugin catalog with valid and missing-manifest modules, verifies the JSON and HTML output, and confirms the dependency map and summary counts are present.

2026-08-09 - Health dashboard

- Added the root-level `administration/health.php` entrypoint and a framework administration health service that renders a dashboard in HTML or JSON.

- The dashboard reuses installer readiness checks for framework health, reports authentication, database, storage, update/backup, queues, scheduler, plugin status, security alerts, and analytics, and derives the project root from the framework bootstrap path so the filesystem checks stay aligned with the actual repository layout.

- Added a smoke test that seeds a restore point, exercises the dashboard in JSON and HTML modes, and verifies the dashboard surface stays reachable with the local PHP and PDO setup.

2026-08-09 - Unattended installer

- Added a config-driven unattended installer entrypoint in `install/unattended.php` that reuses the shared installer readiness report and emits either text or JSON output.

- Added a validated unattended install profile that requires application, database, administrator, secrets, and selected-plugin configuration so unattended runs can be checked before any live install work begins.

- Added a smoke test that executes the unattended installer against a generated JSON config file and verifies the structured output, selected plugin list, administrator details, and readiness state.

2026-08-09 - CLI installer

- Added a root-level CLI installer entrypoint in `install/install.php` that reuses the shared installer report and prints the fresh-install lifecycle plus environment checks in terminal-friendly form.

- Added a companion `install/checks.php` helper so the installer readiness report can be emitted consistently from either a direct script run or the CLI installer path.

- Added a smoke test that executes the CLI installer and verifies the expected readiness output and exit code.

2026-08-09 - Web installer

- Added a framework-native web installer that renders an installer landing page with environment checks, installer phases, and readiness status when installation is not yet marked complete.

- The installer report checks PHP version, OpenSSL, PDO availability, writable project paths, disk space, HTTPS/network hints, scheduler/worker capability, and required binaries while keeping non-blocking items as warnings.

- Added a smoke test that verifies the installer page renders, the phase list matches the fresh-install lifecycle, and the readiness report stays green in this environment.

2026-08-09 - Feature flags

- Added an in-memory feature-flag service with immutable records, logical flag keys, and installation/company/user scopes under the Common Application Framework.

- Feature flag resolution follows the requested rollout hierarchy, with user-specific flags overriding company-specific flags and company-specific flags overriding installation-wide defaults.

- Added a smoke test that verifies scoped precedence, snapshot round-tripping, and query behavior across multiple companies and users.

2026-08-09 - Secrets service

- Added an append-only secrets service with a logical-key lookup API, immutable secret records, and an encrypted local secrets provider under the Common Application Framework.

- Secrets are stored with AES-256-GCM encryption and versioned history so the framework can support local encrypted storage now while leaving room for future external providers through a shared provider interface.

- Added a smoke test that verifies secret rotation, lookup by logical key, encrypted snapshot output, restore from JSON, and deletion behavior.

2026-08-08 - Audit service

- Added an append-only audit service with immutable audit records, audit entries, and an in-memory audit trail under the Common Application Framework.

- Audit entries flow through the same structured logging redaction rules, with category/action/entity/company/actor/request/correlation metadata preserved for security and business state changes.

- Added a smoke test that verifies sensitive-field redaction, filtering, JSON round-tripping, and logger output for audit events.

- Adjusted the file-service upload helper to accept an explicit timestamp so the retention smoke test can run deterministically against the same clock used for deletion.

2026-08-08 - Install lifecycle

- Added a framework-native plugin installer plus installation result/error types under the Common Application Framework.

- Installation performs dependency preflight, installs selected discovered plugins in dependency order, records installation metadata, and refreshes capability indexing after the state transition.

- Added a smoke test that verifies successful installation of a target plugin with an enabled dependency plus a clean failure path when required dependencies are missing.

2026-08-08 - Capability registry

- Added a framework-native capability registry and capability provider value object under the Common Application Framework.

- Capability registration is derived from the `provides` manifest field and the current plugin registry state, allowing callers to ask which enabled plugin supplies a given capability.

- Added a smoke test that exercises capability registration, provider lookup, enabled-only filtering, and unregister behavior.

2026-08-08 - Capability registry

- Added a framework-native capability registry and capability provider value object under the Common Application Framework.

- Capability registration is derived from the `provides` manifest field and the current plugin registry state, allowing callers to ask which enabled plugin supplies a given capability.

- Added a smoke test that exercises capability registration, provider lookup, enabled-only filtering, and unregister behavior.

2026-08-08 - Dependency resolver

- Added a framework-native dependency resolver and supporting resolution result/error types under the Common Application Framework.

- The resolver builds a dependency graph from registry entries, checks framework compatibility, detects missing or disabled required dependencies, flags conflicts, and reports circular dependencies while producing a safe install order.

- Added a smoke test that verifies a valid dependency order plus representative framework, missing-dependency, conflict, and cycle failures.

2026-08-08 - Dependency resolver

- Added a framework-native dependency resolver and supporting resolution result/error types under the Common Application Framework.

- The resolver builds a dependency graph from registry entries, checks framework compatibility, detects missing or disabled required dependencies, flags conflicts, and reports circular dependencies while producing a safe install order.

- Added a smoke test that verifies a valid dependency order plus representative framework, missing-dependency, conflict, and cycle failures.

2026-08-08 - Plugin registry

- Added an in-memory plugin registry plus immutable registry entries for discovered modules and lifecycle state.

- The registry supports registration, lookup by id/package, state filtering, and state promotion so later lifecycle phases can reuse a single authoritative store.

- Added a smoke test that exercises discovered, installed, enabled, and missing-plugin behavior.

2026-08-08 - Plugin registry

- Added an in-memory plugin registry plus immutable registry entries for discovered modules and lifecycle state.

- The registry supports registration, lookup by id/package, state filtering, and state promotion so later lifecycle phases can reuse a single authoritative store.

- Added a smoke test that exercises discovered, installed, enabled, and missing-plugin behavior.

2026-08-08 - Plugin discovery

- Added a framework-native plugin discovery service and supporting discovered-module and discovery-error value objects.

- Discovery scans immediate plugin module directories, validates each `plugin.json` with the manifest validator, and returns successful discoveries together with per-module errors.

- Added a smoke test that exercises valid discovery, invalid manifest handling, and ignored directories without manifests.

2026-08-08 - Manifest validator

- Added a framework-native plugin manifest validator and supporting validation result/error types under the Common Application Framework.

- The validator checks the canonical required manifest fields, nested framework/database/install/update sections, dependency arrays, lifecycle flags, and basic type constraints before plugin runtime code consumes a manifest.

- Added a smoke test that verifies a valid manifest passes, invalid manifests fail, and the fail-fast helper throws with validation errors.

2026-08-08 - Manifest validator

- Added a framework-native plugin manifest validator and supporting validation result/error types under the Common Application Framework.

- The validator checks the canonical required manifest fields, nested framework/database/install/update sections, dependency arrays, lifecycle flags, and basic type constraints before plugin runtime code consumes a manifest.

- Added a smoke test that verifies a valid manifest passes, invalid manifests fail, and the fail-fast helper throws with validation errors.

2026-08-08 - `plugin.json` JSON schema

- Added the canonical plugin manifest JSON schema at `Core Platform/Common Application Framework/api/schemas/plugin.json.schema.json`.

- The schema captures the required `plugin.json` shape from the specification, including framework compatibility, database configuration, dependencies, routes, lifecycle hooks, uninstall policy, health checks, and default enablement.

- Added a smoke test that parses the schema file and verifies the core manifest contract fields are present.

updates.md

2026-08-09 - Independent recovery utility

- Added a standalone `recovery/recovery.php` emergency recovery utility with its own helper class so restore points can be listed, inspected, and restored outside the normal application runtime.

- The utility supports restoring files, database snapshots, and configuration snapshots, runs basic health checks, and writes recovery actions to its own log file under `recovery/`.

- Added a smoke test that drives the recovery utility end to end against a generated restore point, verifies all restore paths, health checks, and recovery log output, and confirmed the command works with natural `recovery.php <command> --json` ordering.

2026-08-09 - Automatic rollback

- Added an automatic rollback coordinator under the Common Application Framework that combines the release manager and restore-point manager to recover from critical post-update failures.

- The coordinator marks restore points as restoring, rolls back the release directories, optionally restores the database snapshot through a supplied callback, and then marks the restore point restored so recovery remains auditable.

- Added a smoke test that exercises a successful critical-failure rollback path, confirms the database-restorer callback is invoked, and verifies the failure path when no restore point exists.

2026-08-09 - Backup/restore points

- Added a filesystem-backed restore-point manager under the Common Application Framework that captures framework files, affected plugin files, database snapshots, plugin registry state, configuration, migration state, dependency lock data, version metadata, checksums, and storage metadata references.

- Restore points now carry explicit lifecycle states for creating, ready, invalid, restoring, restored, failed, and expired, and the manager can list and inspect snapshots while updating their manifest state.

- Added a smoke test that creates a restore point from temporary source trees, verifies the captured files and manifest data, and exercises restored and expired state transitions.

2026-08-09 - Staging/current/previous release mechanism

- Added a filesystem-based update release manager under the Common Application Framework that stages release payloads into isolated directories and promotes them by rotating whole directories instead of overwriting live files in place.

- The release manager tracks staging, current, and previous slots, persists release manifests with each staged bundle, and exposes rollback semantics by restoring the previous slot through the same controlled file-switching model.

- Added a smoke test that stages and activates two releases, verifies the directory rotation results, and confirms rollback returns the previous release without mutating live files piecemeal.

2026-08-09 - Signed-package verification

- Added a framework package-verification service under the Common Application Framework that checks package checksums and RSA signatures before an update can proceed.

- Added verification result and exception types so callers can distinguish checksum mismatches, invalid signatures, and missing signatures while preserving the package metadata that was checked.

- Added a smoke test that signs a package artifact with a generated RSA keypair, verifies the happy path, and confirms checksum and signature failures are detected separately.

2026-08-09 - Update client

- Added the framework update-client model under the Common Application Framework with release, package, plan, policy, and exception types plus a dependency-aware planner.

- The planner reuses the plugin dependency resolver, orders updates by dependency, records compatibility gaps when release metadata is incomplete, and exposes both text and JSON rendering for operator use.

- Added a root `updates/update.php` entrypoint and a smoke test that verifies dependency ordering, release metadata round-tripping, policy preservation, and the rendered operator output.

2026-08-08 - Record policies

- Added record policy records, grants, a record-scoped policy context and a resolver interface to the framework authentication layer.

- The record policy context supports global and company-scoped policy checks, active policy enumeration, and record-type filtering with optional record-level targeting.

- Added a smoke test that verifies global and company-scoped record policy behavior alongside the existing identity, role and permission contexts.

2026-08-08 - Service identities

- Added service identity records, a service identity context and a resolver interface to the framework authentication layer.

- Service identities carry scoped company access, request-scoped metadata, and explicit credential linkage so service/API requests can be resolved without human identity assumptions.

- `ServiceCredential` now tracks issuance, versioning and rotation lineage, and the smoke test verifies credential rotation plus service identity scope checks.

2026-08-08 — Request and correlation IDs

- Added stable request and correlation ID support to the HTTP request object.

- `Request::fromGlobals()` now honors inbound `X-Request-Id` and `X-Correlation-Id` headers when present and generates a request ID otherwise.

- Added a smoke test that verifies inbound and generated identifiers behave as expected.

2026-08-08 — Database abstraction

- Added a framework database abstraction centered on a connection interface, a PDO-backed adapter and an in-memory adapter for environments without a local PDO driver.

- Added a database configuration file and a smoke test that exercises create, insert, update, select, scalar, delete and transaction behavior.

2026-08-08 - Router and middleware pipeline

- Added immutable, framework-native routing and middleware primitives in the Common Application Framework.

- The router supports exact-match method/path registration for GET, POST, PUT, PATCH, DELETE and wildcard routes, with a 404 fallback.

- The middleware pipeline supports ordered middleware execution around route handlers and enforces Response returns.

- Added a smoke test that exercises middleware request mutation, handler dispatch and 404 handling end to end.

2026-08-08 — Request/response abstractions

- Added immutable HTTP request and response value objects to the Common Application Framework.

- Requests now support method, URI, path, headers, query data, body content and request attributes.

- Responses now support status codes, headers, plain text responses, JSON responses and immutable header/status mutation.

- Added a smoke test that exercises the request and response abstractions together.

updates.md

2026-08-08 — Master specification docs added to repository

- Mirrored the authoritative handover documents into the repository root:

- `GRAND-PROJECT-SPECIFICATION.md`

- `ARCHITECTURE.md`

- `DEPENDENCIES.md`

- `SECURITY.md`

- `CODEX-HANDOVER-PROMPT.md`

- `todo.md`

- `updates.md`

- `decisions.md`

- The repository now carries the master specification and supporting implementation records alongside the codebase, which keeps the root tree aligned with the handover package.

2026-08-08 — Baseline coding standards and CI

- Added repo hygiene files for editor, line-ending and ignored-path consistency: `.editorconfig`, `.gitattributes`, and `.gitignore`.

- Added baseline PHP tooling config files: `phpunit.xml.dist` and `phpstan.neon.dist`.

- Added a GitHub Actions CI workflow that validates the Composer manifest and runs the project PHP syntax checks on Windows.

- Extended Composer scripts with `lint`, `lint:json`, `lint:syntax`, and `ci` so local checks match the CI baseline.

2026-08-08 — Composer project and framework bootstrap

- Added a root `composer.json` for the monorepo with PHP 8.2 as the baseline and PSR-4 autoload mappings for the framework and future root-level platform code.

- Added a minimal Common Application Framework bootstrap with a local autoloader fallback, application factory, config loading, environment detection and a simple public entry point.

- Established the first framework classes under `Core Platform/Common Application Framework/src/` so the project now has a runnable bootstrap path once PHP and Composer are available.

2026-08-08 — Canonical structure scaffolding

- Created the canonical top-level project folders in the workspace root.

- Added the Core Platform, Core System Services, Plugin Modules, and `recovery/` directories called for by the master specification.

- Added `.gitkeep` placeholders in the empty canonical leaf directories so the structure remains versionable before the first code files land.

- Added a `.gitkeep` placeholder in `recovery/` so the emergency recovery root is tracked as part of the canonical structure.

2026-08-08 — Architecture consolidation

- Consolidated The Grand Project into one authoritative master specification.

- Standardised all installable applications under `Plugin Modules`.

- Standardised infrastructure services under `Core System Services`.

- Defined Central Authentication, Common Application Framework and Administration as Core Platform components.

- Defined current 17 Plugin Modules.

- Removed Customer Portal and Technician Portal as top-level plugins; they are internal to ServiceVault.

- Removed tendering from OpsRoom.

- Renamed Sales Floor to Lead Pipeline.

- Added Suppliers, Products and Order Processing.

- Defined Xero API support under Payments & Billing.

- Finalised required and optional plugin dependency model.

- Lead Pipeline no longer requires Suppliers.

- E-commerce requires Products + Suppliers + Payments & Billing + Invoice Generation.

- Inventory Tracking requires Products.

- Order Processing requires Inventory Tracking.

- ServiceVault requires Asset Registry.

- Payments & Billing requires Invoice Generation.

- Supplier Portal requires Suppliers.

- Defined manifest, plugin lifecycle, request lifecycle, data ownership, migrations, events, queues, workflows, APIs, installer/updater/recovery, shared services, Administration Portal, security and test requirements.

2026-08-08 — Structured logging

- Added a structured logging subsystem with log levels, log records, handler interfaces, a stream handler, a buffering handler and sensitive-data redaction.

- Added logging configuration and a smoke test that verifies JSON log output and redaction behavior.

2026-08-08 - Central Authentication integration contract

- Added the authentication gateway contract and immutable value objects for authenticated identities, sessions, service credentials and service status.

- Added authentication configuration to the framework bootstrap so the platform has a canonical place for central auth service settings.

- Added a smoke test that verifies the contract honors inbound identity tokens, issues service credentials and rejects invalid tokens.

2026-08-08 — User context

- Added a framework user context object that carries the authenticated identity, session information, request identifiers and request-scoped metadata.

- Added a resolver interface for building user context from the HTTP request layer.

- Added a smoke test that covers guest, human and service contexts.

2026-08-08 — Company and relationship context

- Added company and relationship record value objects plus a framework company/relationship context.

- The context can represent the active company, enumerate related companies and filter relationship records by company or relationship type.

- Added a smoke test that verifies active-company lookup, relationship filtering and request-scoped metadata.

2026-08-08 — Roles

- Added role records, role assignments, a request-scoped role context and a resolver interface to the framework authentication layer.

- The role context supports global and company-scoped role checks plus role filtering for the current company context.

- Added a smoke test that verifies global and company-scoped role assignment behavior.

2026-08-08 — Permissions

- Added permission records, permission grants, a request-scoped permission context and a resolver interface to the framework authentication layer.

- The permission context supports global and company-scoped permission checks, active permission enumeration and grant filtering by company.

- Added a smoke test that verifies global and company-scoped permission grants alongside the existing role context.

2026-08-08 — Enable/disable lifecycle and reverse-dependency protection

- Added the plugin lifecycle manager for enabling installed plugins and disabling enabled plugins through registry state transitions.

- Enable operations honor dependency preflight and activate target plugins in dependency order, while disable operations refuse to deactivate a plugin that still has enabled reverse dependents.

- Fixed the lifecycle smoke test to capture the catalog state immediately after the failed disable attempt so the later cleanup step does not overwrite the assertion target.

- Verified the full smoke suite and Composer lint pass after the lifecycle update.

2026-08-08 — Dependency lock file

- Added a dependency lock file value object that records exact installed plugin versions, package names, lifecycle status and lock timestamps from the registry.

- The installer and lifecycle manager now refresh the shared dependency lock snapshot after installation, enable and disable transitions so the lock stays aligned with the current registry state.

- Added a smoke test that verifies lock-file synchronization, version retention and JSON round-tripping after lifecycle changes.

2026-08-08 — Events/outbox

- Added a framework event envelope plus a transactional outbox repository in the Common Application Framework.

- The outbox stores durable asynchronous events with envelope metadata, claim/release/dispatched state, retry fields and JSON snapshot support.

- Added a smoke test that verifies enqueue, claim, dispatch, transaction rollback and JSON round-tripping behavior using the in-memory database adapter.

2026-08-08 — Queue/workers

- Added an in-memory queue manager, queue job envelope, queue job record, and worker/context classes under the Common Application Framework.

- The queue system supports priorities, delayed availability, retries, dead-letter routing, cancellation, progress updates, idempotency keys, and JSON snapshotting.

- Added a smoke test that verifies queue ordering, retry and dead-letter behavior, scheduling, cancellation, progress reporting, idempotent enqueue behavior, and snapshot reloads.

2026-08-08 — Scheduler/locks

- Added a scheduler task definition, task record, lock entry, lock registry, task context, and scheduler manager in the Common Application Framework.

- The scheduler prevents duplicate execution by acquiring per-task locks before running handlers and skips tasks when a competing lock is already active.

- Added a smoke test that verifies lock acquisition, duplicate-run prevention, recurring task rescheduling, one-shot completion, and JSON snapshot reloads.

2026-08-08 — Workflow/saga engine

- Added workflow definitions, workflow instances, workflow history, step records, step contexts, and a saga-style workflow manager in the Common Application Framework.

- The workflow engine executes declared steps in order, records inspectable step history, and runs compensating actions in reverse order when a later step fails.

- Added a smoke test that verifies successful execution, compensation ordering, failure metadata, inspectable history, and snapshot reloads.

2026-08-08 — Storage abstraction

- Added the Common Application Framework storage layer with storage policies, upload requests, stored object records, file records, temporary URLs, and provider interfaces.

- Implemented both in-memory and local filesystem storage providers, plus a storage manager that handles versioning, retention enforcement, signed temporary URLs, and record indexing.

- Added a smoke test that verifies safe filename normalization, version superseding, retention-protected deletion, provider retrieval, and temporary URL verification against the local filesystem provider.

2026-08-08 — File service

- Added a framework file service facade on top of the storage manager plus upload/download/temporary URL/delete helpers.

- The file service enforces company boundaries and consults the existing permission and record-policy contracts, while still honoring owner metadata and public visibility for safe access.

- Added a smoke test that verifies private and public file access, permission/policy-backed operations, company scoping, and denial of cross-company uploads.

2026-08-08 — PDF/document service

- Added a framework document engine with serializable templates, render requests, rendered snapshot records, and a shared document service on top of storage.

- The service supports template data substitution, branding, headers, footers, numbering, attachments, page size/orientation metadata, draft/final status, and snapshot revision tracking.

- Added a deterministic PDF writer so final rendered snapshots can be stored as PDF bytes without introducing a missing external runtime dependency, plus a smoke test that verifies HTML and PDF outputs, snapshot versioning, and snapshot reloads.

2026-08-08 — Notifications/email

- Added a shared notification service with channel awareness, template rendering, recipient preferences, in-app notifications, and email delivery tracking.

- Implemented email sender identities, templates, messages, attachments, delivery records, an email provider interface, and a development mail capture provider for local testing.

- Added queued email retry support and a smoke test that verifies in-app delivery, email template rendering, mandatory security notices, preference suppression, retry handling, and serialized service snapshots.

2026-08-09 - Integration manager

- Added a root-level `administration/integrations.php` entrypoint and a framework integration administration service that summarizes the API gateway contract, service-credential support, webhook and queue delivery primitives, and tracing/safety signals in HTML or JSON.

- The integration manager is read-only and is grounded in the framework's existing authentication, queue, event, audit, logging, and notification primitives, while explicitly surfacing the current rate-limiting gap instead of inventing a separate integration runtime.

- Added a smoke test that seeds authentication and logging overrides, then verifies the integration manager renders the expected contract, credential, delivery, and tracing data in both JSON and HTML modes.

2026-08-09 - Credentials

- Added a root-level `administration/credentials.php` entrypoint and a framework credentials administration service that summarizes the authentication gateway contract, service credential lifecycle, session boundary, and credential-related security posture in HTML or JSON.

- The credentials page is read-only and is grounded in the framework's existing authentication primitives, including scoped and rotatable `ServiceCredential` objects, while making it clear that credentials are not stored in source.

- Added a smoke test that seeds authentication and logging overrides, then verifies the credentials page renders the expected contract, lifecycle, session, and security data in both JSON and HTML modes.

2026-08-09 - AI agents

- Added a root-level `administration/ai-agents.php` entrypoint and a framework AI agents administration service that summarizes the AI gateway contract, agent registry, tool/approval governance, and safety controls in HTML or JSON.

- The AI agents page is config-driven and read-only: it reports configured providers, local models, agent scopes, approval gates, limits, and audit/tracing safeguards without inventing an unrestricted AI runtime or database access path.

- Added a smoke test that seeds a representative AI configuration with active and revoked agents, then verifies the AI agents dashboard renders the expected registry, governance, and safety data in both JSON and HTML modes.

2026-08-09 - Logs / Audit

- Added a root-level `administration/logs-audit.php` entrypoint and a framework logs/audit administration service that summarizes structured logging, buffered records, audit trail entries, and logging safety posture in HTML or JSON.

- The logs/audit page is read-only and grounded in the framework's existing audit, structured logging, buffering, and redaction primitives, including an explicit redacted audit-summary log event so the smoke test can verify sensitive fields are scrubbed in the buffered output.

- Added a smoke test that seeds logging overrides, then verifies the logs/audit dashboard renders the expected logging configuration, audit trail, buffered logs, and safety data in both JSON and HTML modes.

2026-08-09 - Diagnostics

- Added a root-level `administration/diagnostics.php` entrypoint and a framework diagnostics administration service that summarizes runtime, installer readiness, configuration, and filesystem/tooling checks in HTML or JSON.

- The diagnostics page is read-only and reuses the installer readiness report plus direct PHP/runtime inspection so the portal can surface low-level environment facts without inventing a second diagnostics runtime.

- Added a smoke test that seeds a healthy admin configuration, then verifies the diagnostics dashboard renders the expected runtime, installer, configuration, and filesystem data in both JSON and HTML modes.

2026-08-09 - Products

- Added a real `Plugin Modules/Products` catalogue module with manifest, configuration, navigation, permissions, routes, migration metadata, seeder metadata, lifecycle scripts, health checks, storage placeholder, and a `ProductsService` surface.

- The Products module stays inside the authoritative catalogue boundary from the spec: it owns the `prd_` prefix, declares only optional/recommended Suppliers integration, and exposes catalogue, pricing, document, and supplier-link metadata without jumping ahead into the later commerce stack.

- Added a smoke test that validates discovery, manifest shape, configuration, routes, migration/seeder metadata, service responses, and update/rollback rotation against the real module payload on disk.

- Adjusted the existing Test Plugin contract smoke to resolve the module by id instead of discovery order so the new Products module does not destabilise the phase-7 gate.

2026-08-09 - Security centre

- Added a root-level `administration/security-centre.php` entrypoint and a framework security centre administration service that summarizes identity perimeter, encrypted secrets, logging redaction, notification safety, and update hardening in HTML or JSON.

- The security centre is read-only and grounded in the framework's existing authentication, roles, permissions, record policies, secrets, notification, logging, and update policy primitives so operator guidance comes from the real platform contracts.

- Added a smoke test that seeds a healthy security configuration, an in-memory encrypted secrets vault, and a conservative update policy, then verifies the security centre renders the expected controls in both JSON and HTML modes.

2026-08-09 - Test Plugin contract

- Added a deliberately small `Plugin Modules/Test Plugin` module with manifest, config, routes, migration, seeder, service, event, job, install/update/rollback scripts, health checks, and storage placeholder files.

- The Test Plugin is read-only and purpose-built for the phase-7 contract gate: it exercises plugin discovery, manifest validation, installation, enable/disable, capability synchronization, lock-file sync, and release update/rollback rotation using the actual plugin payload on disk.

- Added a smoke test that validates the manifest, discovers the plugin from the real `Plugin Modules` tree, installs and toggles it through the framework lifecycle managers, and stages a plugin release twice to prove rollback restores the previous payload.

2026-08-09 - Test Plugin lifecycle gate

- The phase-7 Test Plugin contract smoke now covers the remaining lifecycle gates as well: manifest validation, discovery, install, enable/disable, capability registry sync, dependency lock sync, update promotion, and rollback restoration.

- The release manager check stages the actual Test Plugin payload into current and previous release slots, then verifies a second staged version can be rolled forward and rolled back cleanly without losing the original plugin version.

2026-08-12 - Operational auth, installer, and website deployment path

- Added a real SQLite-backed deployment path to the Common Application Framework, including installer-driven schema creation, migration tracking, and durable records for users, companies, memberships, sessions, OAuth clients, authorization codes, access tokens, service credentials, audit logs, plugin statuses, sites, domains, pages, revisions, and publications.

- Upgraded the framework runtime from an installer-only bootstrap to an operational HTTP application path. `public/index.php` now dispatches requests through the application kernel, and the runtime can serve login, admin, SSO, health, audit, and public website traffic from the same shared framework.

- Implemented operational Central Authentication features for the milestone path: hashed passwords, login/logout, session records, login-attempt logging, account status checks, password-reset tokens, email-verification tokens, service credentials, application client registration, redirect validation, and authorization-code SSO token exchange.

- Implemented the first real Administration path for the milestone, including authenticated dashboard actions for creating companies, users, OAuth clients, sites, domains, pages, publication events, company switching, health inspection, and audit review.

- Bound the Website Builder module to real persistence and host resolution. The runtime now supports multi-site records, hostname mapping, draft pages, published pages, structured section content, basic revision records, and unauthenticated public rendering on separate hostnames.

- Added `tests/smoke/functional-deployment.php`, which proves the intended first deployment path end to end: install, admin login, company creation, membership assignment, two websites, hostname assignment, page publishing, public rendering, admin protection, and SSO token exchange.

- Updated `todo.md` to distinguish genuinely functional work from contract/scaffold-only plugin modules instead of reporting those deferred modules as complete.

2026-08-12 - Security and tenant-isolation hardening pass

- Reworked the live administration runtime so explicit permissions are enforced on administration, audit, health, MFA, and content-management routes instead of treating authentication alone as sufficient access.

- Fixed active-company isolation in the operational path: session roles and permissions now resolve from the active company membership only, the company switcher is limited to accessible memberships, invalid company switches are rejected, and site/page/domain/publish actions verify company ownership before mutating Website Builder data.

- Turned the existing session CSRF token into a real browser protection mechanism by emitting framework form tokens, validating them on state-changing routes, and rotating both session and CSRF tokens on company switches and MFA completion.

- Hardened cookie and session handling for the operational milestone with configurable `Secure`, `HttpOnly`, `SameSite`, cookie-domain, and lifetime behavior, plus application-local session cookies for browser SSO callbacks.

- Hardened OAuth and cross-domain SSO by validating active clients, exact redirect URIs, allowed scopes, active-company application access, short code expiry, one-time code use, and PKCE verification for browser/public flows. The SSO path now proves real host-local application sessions instead of incorrectly treating a central auth cookie as cross-domain proof.

- Added the first real MFA provider using TOTP secrets stored through the encrypted secrets architecture, including enrolment, confirmation, recovery codes, login challenge, and disable flow with audit events.

- Preserved local password-reset development capture while suppressing reset-token disclosure when debug mode is off, and routed reset-delivery intent through the shared notification/email service path for future provider-backed delivery.

- Rebuilt `tests/smoke/functional-deployment.php` to cover negative and unauthorised paths: missing CSRF, permission denial, company-switch denial, cross-tenant site/page/domain/publish denial, company-role isolation, PKCE enforcement, authorization-code reuse denial, production-style password reset responses, browser-realistic SSO, and MFA challenge completion.

- Ran the real Windows smoke suite with `composer test:smoke` on Wednesday, August 12, 2026. Result: passed, including the rebuilt `tests/smoke/functional-deployment.php` deployment proof.

2026-08-12 - First commerce stack implemented

- Added a real framework-owned `CommerceRepository` that persists Products, Categories, Variants, Suppliers, Supplier/Product relationships, Stores, Carts, Orders, Invoices, Payments, Webhooks, and commerce-owned file references on the live SQLite deployment path.

- Implemented the first commercially useful Product stack: authoritative product catalogue records, hierarchical categories, sane base-price resolution with extension points, optional inline media/documents through the shared storage path, variant records without parent duplication, and company-scoped catalogue retrieval.

- Implemented the first real Suppliers stack: supplier records, contacts/address snapshots, commercial terms, preferred status, lead times, and supplier-specific product purchasing metadata while preserving Products as the authoritative catalogue owner.

- Implemented the first real E-commerce stack: per-site store configuration, public `/shop`, `/shop/category/{slug}`, `/shop/product/{slug}`, `/cart`, `/checkout`, and `/order-confirmation` routes, persistent cart cookies, server-side price validation, tax/shipping totals, order creation, and Website Builder host integration without forcing E-commerce on sites that do not enable it.

- Implemented minimum Invoice Generation and Payments & Billing support required for checkout: invoice numbering, invoice/order/customer snapshots, PDF generation into storage, payment-provider diagnostics, Stripe configuration scaffolding, test-provider success flow, webhook receipt persistence, transaction logs, audit, and payment idempotency.

- Added real administration and API surfaces for Products, Suppliers, Stores, Orders, categories, pricing lookup, supplier listing, store listing, and payment diagnostics, all guarded by explicit granular permissions rather than authentication-only access.

- Added `tests/smoke/commerce-stack.php`, which proves the requested first commerce path end to end: supplier creation, product plus variant creation, supplier linking, store configuration, public listing, cart, checkout, invoice generation, test-payment success, paid-order state, audit/event capture, idempotent payment retry handling, and second-store isolation.