# White Label CMS — Master Progress Checklist

This is the single source of truth for build progress. **Completed files are
never regenerated.** Each phase must lint and boot before the next begins.

Legend: ✅ done · 🔄 in progress · ⬜ not started

---

## Phase 1 — Foundation Core ✅ (complete & verified)

### Project scaffold
- ✅ `composer.json` (PSR-4 autoload, scripts)
- ✅ `.gitignore`, `.env.example`
- ✅ `.htaccess` (root) and `public/.htaccess` (front controller + hardening)
- ✅ Directory tree (`src`, `config`, `routes`, `resources`, `database`, `storage`, `bin`, `docs`)

### Kernel
- ✅ `src/Core/Support/Env.php` — `.env` parser
- ✅ `src/Core/Config.php` — config repository (dot notation)
- ✅ `src/Core/Container.php` — DI container with autowiring
- ✅ `src/Core/Application.php` — kernel / bootstrap
- ✅ `src/Core/Support/helpers.php` — global helpers
- ✅ `src/Core/Support/bootstrap-autoload.php` — dev fallback autoloader
- ✅ `config/{app,database,session,security,logging,mail,cache}.php`

### HTTP layer
- ✅ `src/Core/Http/Request.php`
- ✅ `src/Core/Http/Response.php`
- ✅ `src/Core/Http/Route.php`
- ✅ `src/Core/Http/Router.php`
- ✅ `src/Core/Http/Middleware.php` (contract)
- ✅ `src/Core/Http/Controller.php` (base)
- ✅ `src/Core/Http/View.php` (layouts, sections, partials)

### Data layer
- ✅ `src/Core/Database/Connection.php` (lazy PDO, transactions)
- ✅ `src/Core/Database/QueryBuilder.php` (injection-safe)
- ✅ `src/Core/Database/Repository.php` (base + pagination)
- ✅ `src/Core/Database/Migration.php` (base)
- ✅ `src/Core/Database/Migrator.php` (ledger, batches, rollback, fresh)
- ✅ `database/migrations/2026_07_09_000001_create_core_tables.php`
- ✅ `database/seeds/DatabaseSeeder.php`

### Security & support
- ✅ `src/Core/Security/Hash.php`
- ✅ `src/Core/Security/Session.php`
- ✅ `src/Core/Security/Csrf.php`
- ✅ `src/Core/Security/Sanitizer.php`
- ✅ `src/Core/Support/Logger.php`
- ✅ `src/Core/Exceptions/{ContainerException,DatabaseException,ViewException,HttpException,ExceptionHandler}.php`

### Middleware, routing, demo, views
- ✅ `src/Middleware/SecurityHeaders.php`
- ✅ `src/Middleware/VerifyCsrfToken.php`
- ✅ `src/Controllers/HomeController.php`
- ✅ `src/Controllers/Api/SystemController.php`
- ✅ `routes/web.php`, `routes/api.php`
- ✅ `public/index.php` (front controller)
- ✅ `resources/views/layouts/app.php`
- ✅ `resources/views/home/index.php`
- ✅ `resources/views/errors/{404,generic}.php`

### Tooling & docs
- ✅ `bin/console` (migrate, rollback, fresh, seed, key:generate)
- ✅ `docs/ARCHITECTURE.md`
- ✅ `docs/DEPLOY-CPANEL.md`
- ✅ `PROJECT_CHECKLIST.md`
- ✅ `README.md`

### Verification
- ✅ `php -l` clean on all 48 PHP files
- ✅ App boots on built-in server; `/` renders, `/api/health` returns JSON, 404 handled
- ✅ Logic harness: parameterised SQL, injection blocked, hash verify/reject, CSRF round-trip, container singletons, named-route generation

---

## Phase 2 — Authentication & RBAC ⬜
- ⬜ `User`, `Role`, `Permission` models + repositories
- ⬜ `AuthService` (login, logout, remember, throttling via `login_attempts`)
- ⬜ JWT service + `Authenticate` / `Authorize` middleware
- ⬜ Password reset flow (tokens, email)
- ⬜ Admin shell layout + login screen + dashboard
- ⬜ Activity logging service
- ⬜ Rate-limit middleware

## Phase 3 — Settings & White-Label ⬜
- ⬜ **Web-based installer** (`/install` wizard: env + DB check, writes `.env`, runs migrate + seed, then self-locks) — enables no-SSH cPanel setup
- ⬜ `SettingsService` + cached settings repository
- ⬜ Theme / brand manager (logo, colours, fonts, contact)
- ⬜ Media library (upload, storage, validation)
- ⬜ File cache store

## Phase 4 — Content Engine ⬜
- ⬜ Pages + Page Builder, Menu Builder, Header/Footer Builder
- ⬜ Blog CMS, Portfolio, Testimonials, Team, Case Studies

## Phase 5 — Business Modules ⬜
- ⬜ Services, Industries, Pricing, FAQs
- ⬜ CRM & Lead Pipeline, Newsletter, Email Marketing, SMTP

## Phase 6 — SEO / AEO / GEO ⬜
- ⬜ Meta + Schema (JSON-LD) generator, breadcrumbs
- ⬜ XML/HTML/Image sitemaps, Redirect Manager, Robots editor
- ⬜ Automatic internal linking, PAA / Q&A blocks, AI-overview optimisation

## Phase 7 — Ops & QA ⬜
- ⬜ Analytics dashboard, Backup, Maintenance mode, API keys
- ⬜ Security settings, CWV optimisation
- ⬜ PHPUnit test suite, end-to-end docs

---

## Change log
- 2026-07-09 — Phase 1 foundation core completed and verified.