E Event

Changelog

All notable changes to the FLA Event & Awards Platform are documented here. Format: Keep a Changelog · Versioning: SemVer · Tags: annotated git tags per milestone (rule in WORKFLOW.md).

[Unreleased]

Added

  • SRS: admin dashboard spec expanded — graphs (FR-0805: votes-over-time, funnel,

category shares, top candidates, AI score distribution), full stats coverage (FR-0806, 7d/30d trend KPIs), audit tab (FR-0807), AI insights (FR-0407: weekly summaries, judge-ready applicant briefs, vote-anomaly flags), new use case UC-16, chart-stack decision D11 (Chart.js CDN + JSON endpoints). Roadmap updated: v0.2.0 gets a dashboard starter, completion in v0.8.0.

  • bin/qa.sh — repeatable QA suite (29 checks: route statuses + body markers for every

public page and all docs, security probes .env/.git/path traversal, HTTPS redirect). Usage: ./bin/qa.sh [base-url].

Fixed

  • Docs viewer fatal error (sort($paths ??= []) — expression cannot be passed by

reference); /docs, /docs/srs and all workflow pages restored.

  • Doc slugs are canonical: docs/SRS.md → /docs/srs, workflows → /docs/workflows~<name>;

registration placeholder cross-links updated accordingly.

  • QA script: grep marker handling (-- guard) and correct HTTP→HTTPS redirect probe.

Security

  • database/migrate.sh no longer carries a default DB password — credentials come from

.env / environment, script refuses to run without them.

  • Production posture: APP_DEBUG=false in live .env — stack traces are no longer

rendered to visitors (errors go to logs only).

[0.1.0] — 2026-08-29

Docs + scaffold baseline.

Added

  • Plain-PHP modular core: Router, DB (PDO/MariaDB), Settings, View, Config,

Env, Auth session skeleton, helpers (url(), setting(), absolute_url()…).

  • Module skeletons under src/Modules/: Home, Docs, Registration, Branding, Events,

Ai, Voting, Cards, Judges, Tickets, Comms, Winners, Audit, Notifications, Dashboard.

  • Docs viewer (/docs, /docs/{slug}): renders all repo .md files as organized

webpages with TOC + mermaid support (FR-0103).

  • Core services:
    • AI gateway — MiniMax platform driver (minimax-m3, OpenAI-compatible) + deterministic

MockProvider; mock active until keys (NFR-08).

    • LinkedIn OIDC client + mock fixture.
    • WhatsApp null driver (logs to storage/logs/whatsapp.log).
    • Share-card generator: GD driver (applied / visiting / winner, 1080×1080 PNG);

AI driver reserved (cards.driver).

  • Landing page (responsive, DB-branded), 404 page, registration placeholder pages.
  • Database migrations 001–009: settings(+seeds), users, events, categories,

registrations, question_bank, ai_sessions, ai_answers, votes, judge_assignments, judge_reviews, tickets, ticket_messages, feature_toggles(+seeds), audit_log, notifications, communications, communication_recipients. Runner: database/migrate.sh.

  • Documentation set: docs/SRS.md (business use-cases UC-01…15, FR/NFR, BR-001…010),

7 workflow docs (docs/WORKFLOWS/), TODO.md (session handoff), ROADMAP.md, WORKFLOW.md, HELP.md, AGENTS.md.

  • .env.example, .gitignore, composer.json (PSR-4 autoload only — no framework),

bin/card-demo.php, Apache-inline public .htaccess.

  • Live deployment: nginx vhost (deploy/nginx.conf template) serving

https://event.production1.jugaar.ai on plain 443 — Let's Encrypt certificate issued, HTTP→HTTPS redirect enabled. Verified public responses on /, /health, /docs/*.

Fixed

  • Router treats HEAD as GET (monitoring tools send HEAD).

Security

  • .env git-ignored; PDO prepared statements; session cookie flags

(HttpOnly, SameSite=Lax, Secure on HTTPS).