Skip to content

Gate 18 remediation — rewrite first RC changelog as release delta #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Maatify merged 1 commit into from
Sep 30, 2026
Merged

Gate 18 remediation — rewrite first RC changelog as release delta #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 9 additions & 17 deletions CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,23 +10,15 @@ The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and

### Added

- Initial selective pinned engineering Standards Adoption.
- Composer and package identity foundation for `maatify/php-return-target`.
- Runtime foundation: `ReturnTargetConfig`, `ReturnTargetExceptionInterface`, and `InvalidReturnTargetConfigurationException`.
- PHPStan maximum-level configuration covering the real `src/` and `tests/` paths.
- Canonical internal `rt1` HMAC token codec, internal `VerifiedTokenPayloadDTO`, and `ReturnTargetCryptoConfigurationException`.
- Runtime requirements for `ext-hash`, `ext-json`, and `maatify/crypto` `^1.0`.
- Public `ReturnTargetServiceInterface` and canonical `HmacReturnTargetService`.
- Canonical target validation, optional restrict-only policy, `VerifiedReturnTargetDTO`, and shared `ClockInterface` expiry integration.
- Direct Runtime dependency on `maatify/shared-common` `^1.0`.
- Reproducible external Consumer Verification Harness with two clean-state runs.
- GitHub Actions CI for PHP 8.4 and 8.5, latest/lowest dependencies, Composer 2.10 policy audit, syntax, whitespace, PHPStan max, formatting, tests, examples, and workflow lint.
- Stable `Final Gate` aggregate CI job and immutable action pins.
- Consumer Usage Guide, runnable Public API example, `llms.txt`, and synchronized Package Reference/README workflow documentation.
- Security policy with private reporting through `support@maatify.dev`.
- CONTRIBUTING guide covering contribution paths, verification gates, testing boundaries, and reusable-library lock policy.
- Code of Conduct and linked governance/presentation documentation surfaces.
- Composer `support.security` metadata synchronized with the repository security policy URL.
- Framework-agnostic stateless handling of internal return targets through the public `ReturnTargetServiceInterface` and canonical `HmacReturnTargetService`.
- Opaque, expiring `rt1` HMAC tokens with exact original-target preservation, current-policy revalidation during verification, and `VerifiedReturnTargetDTO` results.
- Canonical internal-target validation with an optional restrict-only Host policy, plus Host integration through `KeyProviderInterface` and `ClockInterface`.
- Typed configuration and classified crypto-configuration failure semantics, with normal target, token, policy, and expiry rejection kept separate from unexpected provider or Host-policy failures.
- Consumer Usage Guide, maintained runnable Public API example, external Consumer Verification Harness, and current Package Reference/README navigation.

### Security

- The canonical token is signed rather than encrypted and must not carry secrets or confidential data; HTTP, routing, authentication, authorization, persistence, key storage, and redirect execution remain Host-owned.

[Unreleased]: https://github.com/Maatify/php-return-target/compare/v1.0.0-rc.1...HEAD
[1.0.0-rc.1]: https://github.com/Maatify/php-return-target/releases/tag/v1.0.0-rc.1
Loading