Release v1.0.20 — hkm module command, http package dependency, Pageflow stage consolidation, OSS/CI hardening

.env.example

@@ -0,0 +1,119 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# AlfacodeTeam PhpServicePlatform — example environment
+#
+# Copy to `.env` and fill in real values:   cp .env.example .env
+# Read config in first-party code via env(), never getenv().
+# This file covers the CORE + commonly-used plugin settings. Each plugin
+# documents its full env surface in plugins/<Name>/README.md.
+# Run `hkm doctor` to verify your PHP runtime and required extensions.
+# ─────────────────────────────────────────────────────────────────────────────
+
+# ── Application ──────────────────────────────────────────────────────────────
+APP_ENV=production                 # local | production
+APP_DEBUG=false                    # NEVER true in production (leaks source/traces)
+APP_LOCALE=en
+APP_FALLBACK_LOCALE=en
+APP_LOCALES=en                     # comma-separated negotiation set (e.g. en,fr,es)
+
+# 32+ byte secret used for app crypto, CSRF token signing, cookie encryption.
+# Generate one:  php -r "echo base64_encode(random_bytes(32)).PHP_EOL;"
+APP_KEY=
+# APP_KEY_PREVIOUS=                # set during key rotation to decrypt old data
+
+# ── Database (DatabasePort) ──────────────────────────────────────────────────
+DB_DRIVER=mysql                    # mysql | pgsql | sqlite | sqlsrv
+DB_HOST=127.0.0.1
+DB_PORT=3306
+DB_DATABASE=app
+DB_USERNAME=root
+DB_PASSWORD=
+DB_CHARSET=utf8mb4
+# Connection pool (OpenSwoole only; ignored under PHP-FPM):
+DB_POOL_ENABLED=false
+DB_POOL_MIN=1
+DB_POOL_MAX=10
+
+# ── Cache & Queue — Redis (CachePort / QueuePort) ────────────────────────────
+REDIS_HOST=127.0.0.1
+REDIS_PORT=6379
+REDIS_PASSWORD=
+REDIS_DB=0
+REDIS_PREFIX=hkm:
+REDIS_OVERRIDE=false               # true = use Redis even if another cache is bound
+
+# ── Sessions (Session plugin) ────────────────────────────────────────────────
+SESSION_DRIVER=cookie              # cookie | file | array
+SESSION_LIFETIME=43200             # seconds (12h) — MUST match CSRF lifetime below
+SESSION_IDLE_TIMEOUT=7200
+SESSION_COOKIE=hkm_session
+SESSION_SECURE=true                # send only over HTTPS
+SESSION_SAMESITE=lax               # lax | strict | none
+SESSION_SIGNING_KEY=               # defaults to APP_KEY when empty
+
+# ── Authentication / JWT (Auth plugin) ───────────────────────────────────────
+JWT_ALGO=HS256                     # HS256 | RS256 | ES256 | PS256
+JWT_SECRET=                        # required for HS*; use JWT_PRIVATE_KEY(_FILE) for RS/ES/PS
+JWT_ISSUER=hkm
+JWT_AUDIENCE=hkm
+# JWT_PRIVATE_KEY_FILE=/path/to/private.pem
+# JWT_PUBLIC_KEY_FILE=/path/to/public.pem
+AUTH_SESSION_TTL=1209600           # remember-me seconds (14d)
+AUTH_REFRESH_TTL=2592000           # refresh-token seconds (30d)
+HASH_BCRYPT_COST=12
+
+# ── CSRF (kernel CsrfTokenLayer) ─────────────────────────────────────────────
+# Lifetime MUST equal SESSION_LIFETIME. The bound cookie must be in
+# COOKIE_ENCRYPT_EXEMPT (the layer reads the RAW cookie at SecurityStage).
+# CSRF secret defaults to APP_KEY.
+
+# ── Security filters (SecurityFilters plugin) ────────────────────────────────
+CORS_ALLOWED_ORIGINS=*
+CORS_ALLOWED_METHODS=GET,POST,PUT,PATCH,DELETE,OPTIONS
+CORS_ALLOWED_HEADERS=Content-Type,Authorization,X-CSRF-Token
+CORS_ALLOW_CREDENTIALS=false
+RATE_LIMIT_MAX=60
+RATE_LIMIT_WINDOW=60
+# CONTENT_SECURITY_POLICY=
+HSTS_MAX_AGE=31536000
+
+# ── Mail (Mail plugin) ───────────────────────────────────────────────────────
+MAIL_TRANSPORT=array               # smtp | sendmail | mail | array | log
+MAIL_HOST=127.0.0.1
+MAIL_PORT=587
+MAIL_USERNAME=
+MAIL_PASSWORD=
+MAIL_ENCRYPTION=tls                # tls | ssl | none
+MAIL_FROM_ADDRESS=no-reply@example.com
+MAIL_FROM_NAME="AlfaCode Platform"
+
+# ── Storage (Storage plugin — StoragePort) ───────────────────────────────────
+STORAGE_DRIVER=local               # local | s3
+STORAGE_ROOT=userdata/storage
+# S3 / S3-compatible:
+# STORAGE_S3_KEY=
+# STORAGE_S3_SECRET=
+# STORAGE_S3_REGION=us-east-1
+# STORAGE_S3_BUCKET=
+# STORAGE_S3_ENDPOINT=
+# STORAGE_S3_PATH_STYLE=false
+
+# ── Outbound HTTP (HttpClient plugin — HttpClientPort) ───────────────────────
+HTTP_CLIENT_TIMEOUT=30
+HTTP_CLIENT_CONNECT_TIMEOUT=10
+HTTP_CLIENT_RETRY=2
+HTTP_CLIENT_MAX_RESPONSE_BYTES=33554432   # 32 MiB OOM guard
+
+# ── Multi-tenancy (Tenancy plugin — control plane) ───────────────────────────
+# Only needed when deploying the multi-tenant control plane.
+# TENANCY_MODE=subdomain
+# TENANCY_BASE_DOMAINS=example.com
+# TENANCY_CONTROL_PLANE=admin.example.com
+
+# ── Views / Frontend (View + ViteManifest plugins) ───────────────────────────
+# VIEW_PATHS=                      # extra template roots, prepended to the cascade
+# VITE_MANIFEST=manifest.json
+# VITE_SURFACE=app
+
+# ── SEO / IndexNow (SiteSEO plugin) ──────────────────────────────────────────
+# INDEXNOW_KEY=                    # required to submit URLs to search engines
+# INDEXNOW_LIVE=false              # true = real submit, else enqueued dry run

.github/CODEOWNERS

@@ -1,2 +1,5 @@
-# Every change requires review from a repo owner.
-*  @hakeemRash @Alshatri
+# Code owners — required reviewers for every change into `main`.
+# A PR needs approval from at least one of these owners (branch protection
+# enforces 1 code-owner review). Authors cannot approve their own PR, so keep
+# more than one owner listed.
+*  @hakeemRash @Alshatri @craftdevscommunity

.gitmodules

@@ -10,3 +10,7 @@
 [submodule "modules/let-migrate"]
 	path = modules/let-migrate
 	url = https://github.com/AlfaCode-Team/Let-Migrate.git
+[submodule "modules/http"]
+	path = modules/http
+	url = git@github.com:AlfaCode-Team/http.git
+	branch = master

CHANGELOG.md

@@ -6,6 +6,30 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.0.20] - 2026-07-22
+
+### Added
+- **`hkm module` command** for managing first-party kernel packages (the
+  `modules/` submodules: bind-it, php-io-cli, let-migrate, http) — inspect,
+  and update the pinned package set from one CLI entry point.
+- **`alfacode-team/http` as a first-party package dependency** (`^1.0`;
+  dev-master inside the monorepo, `v1.0.0` for stable releases). The http
+  submodule is pinned at its latest master.
+
+### Changed
+- **Pageflow stages refactored and consolidated** — the SPA-bridge pipeline
+  stages are simplified into fewer, clearer units.
+- **Open-source readiness** — license, composer package metadata, and a
+  `.env.example` added; issue/PR templates, CODEOWNERS, and required-reviewer
+  configuration for `main`.
+
+### Fixed
+- **`MigrateListCommand`** parent wiring repaired and the **`OutboxWriter`**
+  port contract corrected.
+- **CI analysis gates** — PHPStan level-5 config + baseline made a blocking
+  gate (optional Swoole/OpenSwoole coroutine calls ignored); CodeQL, Semgrep,
+  and `composer audit` wired in.
+
 ## [1.0.19] - 2026-07-21
 
 ### Added