CORIABLE V16.2: SOCIAL ICON DISPLAY FIX (31 OCTOBER 2026)

BUG FIX
- Removes broken desktop header share dropdown and social links from the mobile navigation panel.
- Repairs the overlapping Facebook, LinkedIn, Instagram, X and WhatsApp labels shown in V16.1.
- Replaces icon-font-dependent markup with inline SVG graphics, with accessible names on the links.
- Displays icons in the footer on all public pages and on the Contact page, using a unified 44px tap target.
- Keeps configured platform destinations and WhatsApp numbers; no changes to data, database, SEO or permissions.
- Hides invalid/unconfigured social destinations. Header search, login and booking buttons remain unchanged.
- Loads new cache-busted /css/coriable-social-v162.css?v=16.2.0; no database migration.

INSTALLATION
- This live patch requires V16.1. Back up the existing website and private configuration.
- Extract the V16.2 LIVE PATCH into the active domain document root, preserving directory structure.
- Replace matching files. Do not rerun install.php, update.php or database migrations for this presentation fix.
- Clear LiteSpeed/Cloudflare cache, hard refresh Safari/Chrome and check the footer on mobile.
- Check Admin > Settings for correct official Facebook, LinkedIn, Instagram, X and WhatsApp destinations.
- Use the FULL FRESH package only for an empty new installation.

TESTS
- Run `php tests/social-v162.php` for component output, URL validation and header-removal checks.
- Run `php tests/social-v161.php` to ensure previous social destination validation works.
- Visual regression checked at 1440px, 375px and 320px using a local browser fixture.
- This release was not installed on the live Coriable website.

PREVIOUS CAPABILITIES
- Retains V16 original blog, SEO, backlink planning and previous tenant-security changes.
- The existing installer and database isolation deployment requirements remain unchanged.

CORIABLE V16.0: BLOG, TECHNICAL SEO AND EARNED BACKLINK WORKSPACE (31 OCTOBER 2026)

- Adds 8 original, in-depth Ghana-focused editorial articles, without overwriting old posts.
- Adds correct blog pagination canonicals, author identity, scheduled publication filtering and mobile typography.
- Includes administrator Website SEO Audit for source-level readiness checks.
- Adds 5 researched, prospect-only outreach opportunities and stronger live-link evidence requirements.
- Adds a dedicated admin-only V16 content migration and fresh installer SQL content, preserving administrator-edited posts.
- Does not claim live backlinks, live SEO rankings or production Search Console access.
- Retains all V15.9 mobile video and V15.8 protected installation features.
- Fresh ZIP has exactly one consolidated Markdown manual and one consolidated TXT release guide.

CORIABLE V15.9: MOBILE VIDEO AND PUBLIC COPY REFINEMENT (31 OCTOBER 2026)

- Repairs the mobile hero video loader which previously prevented any source from loading at widths below 992px.
- Removes the duplicate mobile play controller; one loader now handles muted inline autoplay, user tap-to-play, reduced motion, data saver and error fallback.
- Includes a tiny locally hosted H.264 mobile background video (540x960, 5s loop). Upload approved video footage to media/hero-mobile.mp4 to use that footage instead; media/hero-desktop.mp4 is supported too.
- Replaces old generic placeholder-dimension poster on the homepage with a branded gradient until a real hero image is configured.
- Improves homepage and key service-page copy and page metadata for clear Ghana digital-agency search intent.
- Replaces em dash punctuation in authored PHP, CSS and fresh-install seed SQL; historic migration files are deliberately unchanged. Database-authored content on an existing live installation must be reviewed through the content editor; it is not silently rewritten.
- Versioned CSS/JS, accessible tap-to-play button, mobile readability fixes and appropriate caching for static video only.
- The full fresh ZIP retains one consolidated Markdown manual and one consolidated TXT guide. Existing RLS and security limitations remain unchanged.

CORIABLE V15.8 — PROTECTED CPANEL INSTALL RESUME (31 OCTOBER 2026)

- Fixes a V15.7 installation stuck at "Installation is disabled by the existing private configuration."
- Reusing an existing private install token (32+ characters) allows a guarded HTTPS setup session only when database contains NO tables, no install lock exists, and a valid CSRF and rate limit check succeed.
- No automatic enabling of global install mode, overwriting a private config, clearing an installation lock or resetting credentials.
- Installer blocks overwriting existing staff accounts when lock is missing.
- If the private token is unavailable, back up and inspect the existing private config in cPanel; for an unused genuinely fresh deployment only, move the obsolete config aside and restart the original automatic wizard.
- Apply hotfix over V15.7; use the complete fresh package for a new deployment.
- Offline checks only, MySQL/cPanel production install not verified.

V15.7 FRESH INSTALLER ROUTING + NOT FOUND RECOVERY (30 OCTOBER 2026)

- Explicit /install -> install.php rewrite for cPanel Apache, still secured by install lock and installer token.
- Wizard redirects to install.php directly after database setup instead of relying on rewrite rules.
- Existing but disabled private configuration now shows protected recovery instructions (403) instead of plain “Not found.”
- Displayed installer version updated to V15.7 to distinguish stale files/caches.
- Normal site security remains fail-closed; installed sites cannot be publicly reinstalled.
- For an empty first-time installation, extract fresh ZIP into the correct cPanel domain document root and open https://coriable.com/install.php.
- If an existing private file remains outside public_html from previous attempts, back it up and fix it through cPanel; do not delete working-site credentials or locks.
- OFFLINE ONLY: syntax, source tests, and PHP HTTP fixture checks. Production MariaDB and Apache configuration still require a cPanel test.

V15.6 — PUBLIC CONTACT FORM TURNSTILE SETUP AND SAFE FALLBACK (2026-10-30)
- Protected form readiness guard, site+secret+cURL status, admin test with real Turnstile challenge.
- User-friendly contact alternatives and newsletter pause when unconfigured; no security bypass.
- Configure Cloudflare keys and hostname in admin settings; server-side validation remains mandatory.
- No database migration. Use V15.5 base; one MD and one TXT in full zip.

CORIABLE V15.5 — CPANEL INSTALLER DEPLOYMENT RECOVERY
30 October 2026
The V15.3 installer warning shown on the live screenshot proves an older installer response is being served. This release adds V15.5 version markers and a temporary file-fingerprint check. No database or public website changes. Do not replace an existing private config or installation lock. Use the top of the consolidated security manual for exact recovery instructions.

CORIABLE V15.4 — AUTO CPANEL INSTALLER RESTORED
30 October 2026

The browser-based first-run wizard returns for new cPanel installations.
At https://coriable.com/install, enter local MySQL database details; the wizard
checks the database and creates private app secrets, then guides you through
Super Admin setup. No manual PHP config editing is needed for a fresh install.
HTTPS, pdo_mysql and a pre-created cPanel database/user remain required.
It will NOT overwrite an existing private config or a completed installation.
Source changes: install.php, includes/first-run-wizard.php,
includes/install-setup-screen.php, tests/installer-wizard-v154.php.
LIVE_PATCH must be applied to the V15.3 baseline, not an older build.
Read the start of CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md before deploying.

======================================================================

CORIABLE V15.3 — cPanel SHARED HOSTING INSTALLER HOTFIX
30 October 2026

Fixes fresh installation showing "Application security configuration is unavailable".
Supports private PHP configuration at /home/ACCOUNT/coriable-config.php
or public_html/includes/cpanel-config.php (the includes folder denies web requests).
New public /install preflight gives safe setup instructions without weakening
any normal web routes. Installer token, app key and install.lock remain mandatory.
No database schema changes. V15.3 LIVE_PATCH requires a V15.2 baseline.

For step-by-step instructions and security limitations, see the very beginning
of CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md.

======================================================================

CORIABLE V15.2 — TENANT READ ISOLATION + PUBLIC EXPERIENCE
29 October 2026
LIVE patch requires V15.1. Fresh package has full source.

DB: 26 restricted MariaDB tenant views, CLI-only view installer and restricted principal provisioner, two-tenant integration test (must run on staging), six-relationship integrity audit, optional composite foreign keys, RLS admin readiness view. Full shared-application database RLS still requires application migration and real grants.
UI: new palette, responsive design, reduced fonts, mobile-friendly service filters, progress bar, accessible back-to-top, conditional background video, static-asset cache/compression.
OPERATION: run the guarded updater, disable it; deploy restricted views/users only with DBA privileges; do not represent application as fully RLS-protected until every runtime query uses restricted identities.
SEE CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md for all migration steps, tests, security caveats, and rollback.

CORIABLE V15.1 — SECURITY REMEDIATION
29 October 2026
Fresh and V15.0-only live update packages.

CHANGES: Admin-only global chat/booking access; CRM conversion checks; portal invoice/request/reward role checks; Paystack server-recorded checkout reconciliation; trusted origin CIDR checks; fail-closed portal permission queries; enforced public static CSP boundaries.

DEPLOYMENT: Back up and upgrade patched PHP; test staging; protect Cloudflare origin and configure proxy CIDRs; verify Paystack events; deploy tenant DB grants separately. Full DB-level RLS and live penetration tests remain outstanding.

READ CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md FOR COMPLETE INSTRUCTIONS.

CORIABLE V14.7 FRESH / LIVE PATCH SECURITY RELEASE
Source-level hardening; external database RLS roles, live testing and deployment evidence still required.
See CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md before deployment.

======================================================================
LEGACY FILE: ADMIN-SUBDOMAIN-HTACCESS-SNIPPET.txt
======================================================================
# Coriable admin.coriable.com routing
# Prerequisite: in cPanel create subdomain admin.coriable.com and set its Document Root
# to THE SAME directory as coriable.com (normally /home/CPANELUSER/public_html).
# Place these rules inside the existing <IfModule mod_rewrite.c> block,
# immediately after "RewriteBase /" and BEFORE the normal public-site routes.

# Root of admin.coriable.com -> admin index/login/dashboard dispatcher.
RewriteCond %{HTTP_HOST} ^admin\.coriable\.com$ [NC]
RewriteRule ^$ admin/index.php [END,QSA]

# Existing files inside /admin (e.g. admin-theme.css, login.php, dashboard.php).
RewriteCond %{HTTP_HOST} ^admin\.coriable\.com$ [NC]
RewriteCond %{DOCUMENT_ROOT}/admin/$1 -f
RewriteRule ^(.+)$ admin/$1 [END,QSA]

# Clean admin routes: /login -> /admin/login.php, /dashboard -> /admin/dashboard.php, etc.
RewriteCond %{HTTP_HOST} ^admin\.coriable\.com$ [NC]
RewriteCond %{DOCUMENT_ROOT}/admin/$1.php -f
RewriteRule ^([A-Za-z0-9-]+)/?$ admin/$1.php [END,QSA]

# After the existing "preserve existing files/directories" block and BEFORE public clean URLs,
# add this catch so an unknown admin-host route cannot fall through to the public website:
# RewriteCond %{HTTP_HOST} ^admin\.coriable\.com$ [NC]
# RewriteRule ^ 404.php [END]

# Environment configuration (place with your existing SetEnv values, not inside this snippet):
# SetEnv CORIABLE_ADMIN_URL https://admin.coriable.com
#
# Enable AutoSSL/SSL for admin.coriable.com before enabling CORIABLE_ADMIN_URL.


======================================================================
LEGACY FILE: FINAL-VERIFICATION-V14.5.txt
======================================================================
CORIABLE BUSINESS OS V14.5 — FINAL SOURCE VERIFICATION
Release: 14.0.5
Date: 2026-09-05

SCOPE
- V14.4 functional repairs retained (AI Copilot, Import/Export, Invoice Studio, Client Hub access/reset, unified staff directory).
- V14.5 dashboard consolidation and universal Media Library added.

DASHBOARD CONSOLIDATION
- People & Workforce is the canonical staff/HR entry point.
- Client 360 Center is the canonical client relationship entry point.
- Enterprise Suite aliases that share one implementation are grouped by destination.
- Audited Enterprise definitions: 235.
- Distinct Enterprise Suite destinations after consolidation: 205 (178 specialist record workspaces + 27 canonical destinations).
- Maintenance & System Tools de-duplicates backup/storage/settings aliases.
- Security Center exposes specialist security workspaces from one hub.
- Legacy analytics.php remains a compatibility redirect to Intelligence.

UNIVERSAL MEDIA
- Shared Media Library picker available to dashboard image fields and rich-text editor.
- Normal media workflow: existing library item OR fresh PC upload OR external public URL.
- System assets indexed: logos, favicons, artwork, blog hero images and other package images.
- Trusted local SVG system assets are indexed; SVG upload/link remains blocked.
- ICO images are supported.
- Confidential attachments never become public Media Library items.
- Staff may reuse an existing local library image/PDF by copying it into private storage with SHA-256 integrity evidence.
- External URLs are not fetched into private storage.
- media.file_path expanded to VARCHAR(1024); live migration included.

VALIDATION
- PHP syntax: 276 files, 0 failures.
- Non-minified JavaScript syntax: 20 files, 0 failures.
- CSS parser: 24 files, 0 failures.
- JSON/webmanifest parse: 7 files, 0 failures.
- SVG/XML parse: 26 files, 0 failures.
- Consolidated schema: 134 unique tables, 0 duplicate declarations.
- Foreign-key references: 223, 0 missing target tables.
- Resume-safe schema: 0 unsafe/plain initial seed INSERT statements.
- Literal PHP include/require references checked: 698, 0 missing.
- Key admin/static PHP links checked: 99, 0 missing.
- V13 content seed retained: 18 blog posts, 33 FAQs, 5 legal/policy sections.
- Public-media resolver calls present across website image/logo/content forms.
- Private Media Library secure-copy handlers present for Enterprise attachments, Client Hub staff sharing and invoice signature.
- High-risk PHP execution primitive scan: no eval/system/shell_exec/passthru/proc_open/popen/unserialize calls found in application PHP.
- V14.5 migration file present.
- Release marker in fresh schema/update path: 14.0.5.

DEPLOYMENT BOUNDARY
- Fresh master includes install.php and consolidated schema.
- Live overlay must exclude install.php, real .env, active root .htaccess and uploads/runtime data.


======================================================================
LEGACY FILE: FINAL-VERIFICATION-V14.6.txt
======================================================================
CORIABLE BUSINESS OS V14.6 — FINAL SOURCE VERIFICATION
Release: 14.0.6
Verified: 2026-09-05

SCOPE COMPLETED
- PayPal removed from active application source, checkout, settings, integrations, readiness checks, callback and webhook surfaces.
- Paystack retained as the supported online gateway with enable switch, encrypted secret-key configuration, currency allow-list, callback and webhook routes.
- Desktop public navigation font sizing increased slightly with responsive overrides preserved.
- 8 additional image-backed blogs/insights added to the idempotent V14.6 content migration and fresh schema.
- 12 additional Coriable FAQs added to the idempotent V14.6 content migration and fresh schema.
- Media Library supports selecting one or many items for metadata editing and safe bulk deletion; protected system assets are not deletable.
- Central email + SMS operational event routing added for Work Center assignments, People & Workforce/staff, projects, client operations, quotes/proposals, invoices/recurring billing and verified payment receipts.
- People, HR & Payroll generic Enterprise Suite records are covered without enabling unrelated suite modules.
- Client notification routing respects client-visible/portal-visible work and existing secure invoice/proposal delivery flows.

STATIC VERIFICATION RESULTS
- PHP syntax: PASS — 275 PHP files checked, 0 failures.
- Active-source PayPal references: PASS — 0 matches in PHP/JS/CSS/SQL.
- Legacy active PayPal files: PASS — includes/paypal.php, paypal-callback.php and webhooks/paypal.php are absent.
- V14.6 migration parser: PASS — 14 statements using updater-compatible SQL splitting.
- Content seed: PASS — 8 new article rows and 12 FAQ statements detected.
- Article media: PASS — all 8 referenced bundled images exist.
- SBOM JSON: PASS — valid JSON; release metadata updated to 14.0.6.
- Updater registration: PASS — V14.6 migration is loaded and release marker is 14.0.6.

DEPLOYMENT REQUIREMENTS
1. Configure a strong CORIABLE_APP_KEY before saving encrypted integration secrets.
2. Configure Paystack live secret key in Settings or CORIABLE_PAYSTACK_SECRET_KEY and register the included webhook URL in Paystack.
3. Configure and test SMTP for email delivery.
4. Configure and test WigAL FROG credentials/sender ID for SMS delivery.
5. Run the guarded updater and confirm UPDATE STATUS: PASS, then disable updater access.
6. Run Production Readiness integration tests with non-production/test transactions before go-live.

NOTE
Historical PayPal values/enum entries already present in an existing live database are not destructively rewritten by the updater so historic accounting records remain intact. The application no longer exposes or accepts PayPal for new transactions.


======================================================================
LEGACY FILE: RELEASE-MANIFEST.txt
======================================================================
Coriable Business OS — CONSOLIDATED FRESH MASTER
Release: 2026-09-05-v14.6-paystack-notifications-content-media
Purpose: Brand-new blank installation, controlled live upgrade source, and disaster-recovery master.

INCLUDED
- Complete public website/CMS with modern responsive UI and system-wide Media Library
- Modern Business OS administration dashboard and Client Hub at clients.coriable.com
- Central email + SMS operational event routing across Work Center, workforce/staff, projects, clients, proposals, invoices and verified payment receipts
- Media Library one-or-many metadata editing and protected bulk deletion
- CRM/Client 360, leads, bookings, communications, proposals, projects, billing, payments and support
- Contracts/e-signatures, workflow automation, SLA, CSAT/NPS, client health and forecasting
- Omnichannel communications, knowledge base, onboarding, governed documents and approvals
- Paystack-only online invoice checkout plus recurring billing/dunning foundations using provider tokens/secure payment flows; no raw card storage
- OIDC/SCIM identity foundations, granular client permissions, developer API and signed webhooks
- Staff/client PWA/push subscriptions and human-reviewed AI Copilot drafts
- Encrypted backup/run evidence, restore-drill records and Production Readiness integration-test evidence
- 26 SEO-ready articles/insights with bundled imagery, 45 FAQs, Privacy, Terms, Cookies, Accessibility and Data Protection content
- Eight rotating local digital-agency login background scenes
- Strict @coriable.com staff creation policy, validated mobile numbers, dual email/SMS account alerts
- MFA/session/CSRF/CSP/private-document/object-authorization and webhook/SSRF hardening
- SEO/AEO, structured data, sitemap/robots/RSS, analytics and Core Web Vitals intelligence
- V14 privacy-rights workflow and private status links
- V14 consent evidence with necessary/analytics/marketing choices
- V14 allow-listed retention policy engine with preview and scheduled evidence
- V14 feature flags for environment/percentage/time-window rollouts
- V14 scheduled-job heartbeat and protected system health endpoint
- V14 SBOM and deploy-time SHA-256 release-integrity verification

FRESH DATABASE METHOD
- install.php loads database/schema.sql.
- database/schema.sql is the only fresh-install database source of truth.
- Historical migrations are not required for a blank install.
- Fresh schema contains 135 unique application tables.
- V14 adds 8 governance/reliability tables over the 126-table V13 state.

FRESH INSTALLER INCLUDED: YES
LIVE UPDATER INCLUDED: YES — guarded additive/idempotent upgrade through V14
HISTORICAL INCREMENTAL MIGRATIONS REQUIRED FOR BLANK INSTALL: NO
EXTERNAL PROVIDER CREDENTIALS INCLUDED: NO
PROVIDER READINESS REQUIRES RECORDED TEST EVIDENCE: YES



V14.8 — 29 OCTOBER 2026 — SPAM/UPLOAD SECURITY UPDATE
- Turnstile production enforcement with server-side action/hostname/timestamp validation for public forms and portal registration.
- Original public forms lacked the Turnstile script; fixed. Missing keys fail closed.
- Suppress immediate internal and public autoresponse mail by default for contact, custom request and booking; accepted submissions still save to dashboard.
- Independent global/form/email request quotas; atomic one-time form claim and duplicate content protection.
- SQL replay-guard table installed by fresh schema and update.php patch.
- New local ClamAV upload scan adapter, required by default in production; if no scanner, upload rejected. Office ZIP content checks and fail-closed MIME validation.
- Security dashboards updated; CLI integrity audit and restricted DB view negative staging tests provided.
- This is not a production malware/ransomware certification, nor full database-enforced RLS. See the consolidated security manual.
- Tests: 282 PHP syntax checks; three offline code assertions passed. No live database, inbox or host scan was possible.
- Set CORIABLE_TURNSTILE_SITE_KEY and CORIABLE_TURNSTILE_SECRET_KEY before enabling public submissions.
- Set CORIABLE_CLAMD_SOCKET to a live local scanner before accepting uploaded files.

V14.9 SECURITY ASSESSMENT - see CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md for findings, cPanel PHP runtime upgrade, MFA, DNS pinning, tenant DB grants, spam and antivirus deployment.


V15.0 SEO & ORGANIC DISCOVERY UPDATE — 2026-10-29
New free resources: website project brief, Ghana SEO checklist, custom software requirements checklist, and cybersecurity checklist. Backlinks & Outreach added under admin Search Engines. Canonical apex-to-www redirect for public GET/HEAD, guides included in XML sitemap and internal links, targeted SEO metadata updates. The prospects seeded in the outreach database are NOT real backlinks and require external publisher approval. Run authorized update.php migration then disable updater; test on staging first. See the one consolidated CORIABLE-CONSOLIDATED-SECURITY-MANUAL.md for detailed SEO copy, 12-month calendar, outreach emails and operational steps.

V16.1 SOCIAL LINKS
Shared accessible public-site social icon component for Facebook, LinkedIn, Instagram, X and WhatsApp, added to desktop nav, mobile nav and footer. Admin settings remain editable. Social URLs have platform-specific validation; mobile WhatsApp uses the configured number. SEO Organization sameAs uses configured profiles. No database migration necessary for live patches.
