# Change Log

## 02.01.00 — Phase 02.1

### Added

- New private/public application layout isolated from the legacy ExamCert system
- Pure PHP namespaced autoloader
- environment and configuration services
- dependency/service container
- request, response, router and view foundation
- centralized exception/fatal error handling
- JSON file logger with redaction, retention and request correlation
- trusted-host, HTTPS, access-log, exception, security-header and CSRF middleware
- secure server-side session manager
- application key generation and validation
- strict PDO MySQL connector
- application, liveness, readiness and CSRF-token endpoints
- cPanel-aware installer and CLI verification commands
- Apache rewrite and PHP per-directory hardening
- staging foundation interface
- automated tests and deployment documentation

### Security decisions

- No application secrets or source files inside the document root
- Exact host allowlist; no wildcard host matching
- No query-string CSRF tokens
- No PDO emulated prepares or persistent connections
- No external script/style origins in the initial CSP
- No debug output in staging/production
- No deployment into the current legacy document root

### Database changes

None. Release 02.02.00 begins the migration system and schema baseline.