E Event

TODO — Session Handoff

READ THIS FIRST in every new session. It tells you where FLA is, what's next,
and what's waiting on decisions. Update it at the end of every working session
(rule in WORKFLOW.md). Full spec: docs/SRS.md · Plan: ROADMAP.md.

Project in one line

FLA Event & Awards Platform — plain PHP 8.3 + MariaDB, modular, hosted at https://event.production1.jugaar.ai (plain 443). Flagship: public-voted, AI-assessed awards (70% public / 30% board, admin veto).

Current state

  • Version: v0.1.0 (tagged) + post-release QA pass 2026-08-29 — ./bin/qa.sh

suite: 29/29 checks green (all pages, all docs render incl. SRS tables/TOC/mermaid, security probes, HTTPS redirect, DB idempotency ×2, 25 FKs, no dup seeds).

  • Live: https://event.production1.jugaar.ai (nginx + PHP 8.3 FPM, Let's Encrypt

cert issued 2026-08-29, HTTP→HTTPS redirect). Health: /health, docs: /docs.

  • Live routes: / landing · /docs (+/docs/{slug}) · /health ·

registration placeholders (/register/visitor, /register/award, /guest-of-honor).

  • Implemented core: Router, DB (PDO), Settings, View, Router, Config, Env, Auth skeleton,

Markdown renderer (docs viewer), AI gateway (MiniMax driver + Mock), LinkedIn client (+Mock), WhatsApp null-driver, GD card generator (+ AI driver reserved).

  • DB: fla_event, migrations 001–009 applied (settings/users/events/categories/

registrations/ai_qa/votes/judges/tickets/system+audit).

  • Mocks active: AI_MOCK=true, LinkedIn mock, WhatsApp null → site fully works without keys.

Next up — v0.2.0 (Admin core + Branding)

  1. Admin auth (session login, first admin user — seed + forced password change).
  2. Branding control panel: /admin/branding → edit settings (name/logo/colors/tagline/campaign texts) live + feature toggles UI.
  3. Audit writer (Core\Audit::log) wired to admin actions.
  4. Layout consumes branding incl. logo upload.
  5. Admin home starter: KPI cards + Chart.js line (registrations over time) — full

admin dashboard spec lives in SRS FR-0805–0807 + AI insights FR-0407, build completes in v0.8.0.

  1. Docs: SRS UC-01 marking implemented parts; CHANGELOG 0.2.0; update this file.

Backlog by milestone

MilestoneScope
v0.3.0Events + categories CRUD, status lifecycle, show/hide, public event pages
v0.4.0Registration ×3 (visitor, award, GoH) + LinkedIn OAuth + manual entry + photo upload
v0.5.0AI interview (bank, session, marking, stats) via gateway (MiniMax m3)
v0.6.0Public voting + restrictions + reason + 70/30 engine + share cards (GD)
v0.7.0Judges panel (+ assignments, decisions, admin report)
v0.8.0Dashboards (applicant/staff/admin) + tickets + mass comms + notifications
v0.9.0Winners (finalize, audit-lock, announce, badges) + audit UI
v1.0.0Responsive polish, comprehensive dashboard, hardening, launch checklist

Open questions (waiting on owner)

  1. MiniMax m3: exact model id + base URL + API key (platform.minimax.io). Code assumes minimax-m3 @ https://api.minimax.io/v1 — verify when key arrives.
  2. LinkedIn App client id/secret (OIDC: openid, profile, email).
  3. WhatsApp provider: Meta Cloud API or Twilio (+ keys).
  4. Email: SMTP details or transactional provider for comms/notifications.
  5. AI image API (later, for fancy share cards).
  6. Vote-change policy: final (current default) or changeable until window closes?
  7. Public leaderboard before finalization? Default: admin-only (BR-006).

Environment notes

  • Host runs MariaDB 10.11 + PHP 8.3 (pdo_mysql, gd, opcache) + Nginx + certbot.
  • DB creds live in .env (never committed). Rotate the dev password on public exposure.
  • Branding/campaign/weights all in settings — admin panel edits them from v0.2.0.
  • DejaVu fonts available at /usr/share/fonts/truetype/dejavu/ (GD card text).

Definition of done (per milestone)

Docs updated (SRS → workflow → CHANGELOG → ROADMAP → this file) → code → verified → conventional commit → annotated git tag.