vibtools · victorsteele · Aug 21, 2026 · Aug 21, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -134,18 +134,18 @@ jobs:
         run: |
           short_sha="${GITHUB_SHA:0:12}"
           mkdir -p release
-          bash scripts/package-release.sh v5.7.1 "$GITHUB_SHA" "release/Licora-5.7.1-ci-${short_sha}.zip"
-          cp "release/Licora-5.7.1-ci-${short_sha}.zip" "release/Licora-5.7.1.zip"
-          python3 scripts/build-update-manifest.py --version 5.7.1 --ref "$GITHUB_SHA" --package "release/Licora-5.7.1.zip" --output release/licora-update-manifest.json
-          rm "release/Licora-5.7.1.zip"
+          bash scripts/package-release.sh v5.8.1 "$GITHUB_SHA" "release/Licora-5.8.1-ci-${short_sha}.zip"
+          cp "release/Licora-5.8.1-ci-${short_sha}.zip" "release/Licora-5.8.1.zip"
+          python3 scripts/build-update-manifest.py --version 5.8.1 --ref "$GITHUB_SHA" --package "release/Licora-5.8.1.zip" --output release/licora-update-manifest.json
+          rm "release/Licora-5.8.1.zip"
 
       - name: Upload CI release-candidate artifact
         uses: actions/upload-artifact@v6
         with:
-          name: Licora-5.7.1-${{ github.sha }}
+          name: Licora-5.8.1-${{ github.sha }}
           path: |
-            release/Licora-5.7.1-ci-*.zip
-            release/Licora-5.7.1-ci-*.zip.sha256
+            release/Licora-5.8.1-ci-*.zip
+            release/Licora-5.8.1-ci-*.zip.sha256
             release/licora-update-manifest.json
           if-no-files-found: error
           retention-days: 14
diff --git a/BASELINE_v5.8.0.md b/BASELINE_v5.8.0.md
@@ -0,0 +1,20 @@
+# Licora v5.8.0 Candidate Baseline
+
+- Parent published baseline: `v5.7.1` / `c029fee375895e1384dd18410855da3a38443653`.
+- Parent published release ZIP SHA-256: `da99765fcca91262fb778d9ead48c5f069536604d02aa76897ad185b53964a8f`.
+- Scope: authenticated Developer Integration Guide, multi-language Secure API v2 lifecycle examples and PowerShell test tool.
+- Database migrations: none.
+- Delete list: empty.
+- External API v1/v2 protocol: frozen/unchanged.
+- Dashboard, updater runtime, authentication/roles, license/device semantics and Cron behavior: frozen/unchanged.
+- Target version: `5.8.0`.
+- Direct signed update source: `5.7.1`.
+
+This file records the source candidate. It becomes the published official baseline only after merge, exact tag, successful release workflow, signed manifest verification and GitHub Release publication.
+
+## Candidate Verification
+
+- Developer Guide targeted contracts: `PASS`.
+- Final local repository verifier: `PASS`.
+- Remote CI/MySQL: `PENDING`.
+- Manual Developer Guide UI/download smoke: `PENDING`.
diff --git a/BASELINE_v5.8.1.md b/BASELINE_v5.8.1.md
@@ -0,0 +1,23 @@
+# Licora v5.8.1 Source Baseline Freeze
+
+## Status
+
+- Parent uploaded baseline: `Licora_v5.8.0_Baseline.zip`
+- Parent ZIP SHA-256: `eb718abd13e4bef50654c1ee2730f37f7667abb01e54fc399b0968118bc857bb`
+- Parent embedded Git HEAD: `c029fee375895e1384dd18410855da3a38443653`
+- Target source version: `5.8.1`
+- Release channel: stable candidate
+- Database migrations: none
+- Delete files: none
+- Accepted updater sources: `5.7.1`, `5.8.0`
+
+## Corrective scope
+
+1. Re-audit and preserve the v5.8.0 Developer Integration Guide and ten approved API v2 examples.
+2. Correct v5.8.x CI candidate ZIP/manifest version coherence.
+3. Correct the two Dashboard device glyphs that used an icon unavailable in Bootstrap Icons 1.8.1.
+4. Add targeted regression coverage and v5.8.1 release/documentation identity.
+
+No API/database/license-device/auth/Dashboard-data/Cron/updater-runtime redesign is authorized or included. The reported external Chrome download failure is not attributable to this PHP repository because no Chrome launcher/downloader exists in the baseline; no speculative browser installer is added.
+
+The final baseline ZIP SHA-256 is recorded in the delivery checksum file generated after this source record is frozen.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -6,7 +6,35 @@ All notable public-release changes are recorded here. Historical project notes r
 
 ### Planned
 
-- No additional Dashboard scope is approved beyond the v5.7.1 Phase 2 corrective release candidate.
+- No additional feature scope is approved beyond the verified v5.8.1 Developer Integration Guide correction.
+
+## [5.8.1] - 2026-08-20
+
+### Fixed
+- Corrected the pull-request CI candidate-package identity so the v5.8.1 ZIP and generated updater manifest use the same version instead of pairing a v5.8.x package with a stale v5.7.1 manifest version.
+- Replaced the unsupported Dashboard `bi-devices` icon with the Bootstrap Icons 1.8.1 `bi-laptop` icon for **Recently Seen Devices** and **Manage Devices**, restoring visible device glyphs without changing Dashboard behavior.
+- Expanded release-readiness and Dashboard contracts so future version/manifest drift and the missing Dashboard device icon are rejected automatically.
+- Extended the browser-dependency source guard to the Developer Guide page/controller; no Chrome launcher, installer or downloader exists in the Licora PHP source.
+
+### Verified
+- Re-audited the v5.8.0 Developer Integration Guide, ten approved Secure API v2 examples and PowerShell test tool against the existing API v2 proof/token contract.
+- No fake/demo API path, shared API v1 secret, database migration, file deletion or external API/backend behavior change is introduced.
+
+### Compatibility
+- Signed update compatibility accepts the published `v5.7.1` baseline and an already-applied `v5.8.0` source candidate.
+- API v1/v2 server behavior, license/device enforcement, authentication/roles, Dashboard data semantics, Cron and updater runtime/protocol remain unchanged.
+
+## [5.8.0] - 2026-08-20 (source baseline; superseded by v5.8.1 corrective)
+
+### Added
+- Added an authenticated compact Developer Guide under **API & Clients** with detected Secure API v2 endpoints, Quick Start, canonical device-proof documentation, stable error codes and production security rules.
+- Added downloadable Secure API v2 lifecycle examples for Python, PowerShell/CMD, C, C++, C#/.NET, Java, Flutter, React Native, PHP and Node.js.
+- Added a one-file PowerShell lifecycle test and copy/download interactions for developer onboarding.
+- Added automated Developer Guide route/security/example contract and syntax checks.
+
+### Compatibility
+- No database migration, file deletion, API v1/v2 protocol change, license/device enforcement change, authentication/role change, Dashboard change, Cron mutation or updater runtime/protocol change.
+- Signed update compatibility starts from the published v5.7.1 baseline.
 
 ## [5.7.1] - 2026-08-20
 

diff --git a/README.md b/README.md
@@ -125,7 +125,7 @@ The application accepts deployment-specific values through environment variables
 | Database password | `LICENSE_DB_PASS` | empty |
 | Application name | `APP_NAME` | `Licora` |
 | Application URL | `APP_URL` | `http://localhost` |
-| Application version | `APP_VERSION` | `5.7.1` |
+| Application version | `APP_VERSION` | `5.8.1` |
 | Environment | `APP_ENV` | `production` |
 | Encryption key | `LICENSE_ENCRYPTION_KEY` | empty fallback |
 | API limit | `API_RATE_LIMIT` | `1000` |
@@ -156,6 +156,8 @@ The validation script checks PHP syntax, security behavior, compatibility invari
 - [Secure in-app updater](docs/UPDATER.md)
 - [UI design system](docs/UI_DESIGN_SYSTEM.md)
 - [Troubleshooting](docs/TROUBLESHOOTING.md)
+- [v5.8.1 release notes](RELEASE_NOTES_v5.8.1.md)
+- [v5.8.0 source-candidate notes](RELEASE_NOTES_v5.8.0.md)
 - [v5.7.1 release notes](RELEASE_NOTES_v5.7.1.md)
 - [v5.7.0 release notes](RELEASE_NOTES_v5.7.0.md)
 - [v5.6.1 release notes](RELEASE_NOTES_v5.6.1.md)
@@ -176,7 +178,12 @@ The validation script checks PHP syntax, security behavior, compatibility invari
 - [Dependency review](audit/DEPENDENCY_REPORT.md)
 
 
-## Dashboard Phase 2 verification corrective candidate (v5.7.1)
+
+## Developer Integration Guide (v5.8.1; introduced in v5.8.0 source candidate)
+
+The verified v5.8.1 authenticated **API & Clients → Developer Guide** provides a compact Secure API v2 Quick Start, the exact P-256 device-proof canonical contract, detected endpoint URLs, stable error codes and downloadable lifecycle references for Python, PowerShell/CMD, C, C++, C#/.NET, Java, Flutter, React Native, PHP and Node.js. Public-client examples never embed an API v1 shared/master key. Production clients must keep the P-256 private key and rotated refresh credential in platform-secure storage and verify pinned `LICORA-V2`/`RS256` access-token signatures before trusting claims locally.
+
+## Dashboard Phase 2 published corrective release (v5.7.1)
 
 Licora v5.7.1 corrects the client-side refresh lifecycle found during forensic review of the v5.7.0 Phase 2 source baseline: stale refresh keeps `Retry`, `401 AUTH_REQUIRED` keeps refresh paused/disabled, synchronous transport errors are captured without leaving the request lock stuck, and the last-success timestamp advances only after a successful render. Phase 2 layout/data semantics, backend contracts, database schema, APIs, licensing/device enforcement, authentication, Cron behavior, updater protocol and shared shell remain unchanged.
 

diff --git a/RELEASE_COMMANDS_v5.8.0.md b/RELEASE_COMMANDS_v5.8.0.md
@@ -0,0 +1,22 @@
+# Licora v5.8.0 Release Commands
+
+Run only after the v5.8.0 implementation branch, remote CI and required manual Developer Guide UI/download smoke gates are complete.
+
+```cmd
+cd /d "D:\VibTools_Workspace\02_Websites\01_Licora_Open_Source_Cental_License_System\github_release"
+git switch main
+git pull --ff-only origin main
+git status --short --branch
+git rev-parse HEAD
+```
+
+Create and inspect the release tag only from the verified merge commit:
+
+```cmd
+git tag -a v5.8.0 -m "Licora v5.8.0 - Developer Integration Guide"
+git show --no-patch --decorate v5.8.0
+git push origin v5.8.0
+gh run list --workflow release.yml --limit 3
+```
+
+Do not rewrite a published tag or release. The tag-triggered release workflow owns exact-tag packaging, checksum generation, signed updater manifest creation, DB integration gates and GitHub Release publication.
diff --git a/RELEASE_COMMANDS_v5.8.1.md b/RELEASE_COMMANDS_v5.8.1.md
@@ -0,0 +1,37 @@
+# Licora v5.8.1 Release Commands
+
+Run only after the v5.8.1 verification delta is applied and Git/CI scope has been reviewed.
+
+## Local branch publication
+
+```cmd
+git diff --check
+git status --short
+```
+
+Stage only the explicit paths supplied with the final delta audit. Do not use `git add .`, `git add -A` or `git add --all`.
+
+After staged-scope review:
+
+```cmd
+git diff --cached --check
+git diff --cached --name-status
+git commit -m "feat: complete Developer Guide with v5.8.1 verification fixes"
+git push -u origin feature/v5.8.0-developer-guide
+```
+
+Create/review the PR against `main`. Merge/tag/release require separate explicit authorization.
+
+## Tagged release after merge and authorization
+
+```cmd
+git switch main
+git pull --ff-only origin main
+git status --short --branch
+git rev-parse HEAD
+git tag -a v5.8.1 -m "Licora v5.8.1 - Developer Integration Guide Complete and Verified"
+git show --no-patch --decorate v5.8.1
+git push origin v5.8.1
+```
+
+The tag-triggered `release.yml` must build/sign/publish the exact tag.
diff --git a/RELEASE_NOTES_v5.8.0.md b/RELEASE_NOTES_v5.8.0.md
@@ -0,0 +1,29 @@
+# Licora v5.8.0 — Developer Integration Guide
+
+Licora v5.8.0 adds an authenticated, compact **Developer Guide** to the existing Licora admin shell. The guide documents the real Secure API v2 device-proof contract, shows the detected API v2 endpoints for the current installation, and ships downloadable multi-language lifecycle reference clients.
+
+## Added
+
+- New `Developer Guide` route under **API & Clients**.
+- Secure API v2 Quick Start covering Client App registration, scoped licensing, P-256 device identity, activation, status, refresh rotation and deactivation.
+- Exact canonical request-proof reference for `X-Licora-Timestamp`, `X-Licora-Nonce` and `X-Licora-Device-Signature`.
+- Downloadable examples for Python, PowerShell/CMD, C, C++, C#/.NET, Java, Flutter, React Native, PHP and Node.js.
+- One-file `licora-v2-test.ps1` lifecycle test for Windows developers.
+- Stable error-code and production security checklists.
+- Copy-to-clipboard and compact language-tab UI without changing Licora's shared shell.
+
+## Security
+
+- Public-client examples never embed the API v1 shared/master credential.
+- Examples sign the exact raw JSON bytes sent to Licora and use fresh timestamp/nonce values.
+- Test clients use ephemeral P-256 device credentials and deactivate them after the lifecycle test.
+- Production guidance requires OS-backed private-key/refresh-token storage and pinned `LICORA-V2`/`RS256` server-token verification before trusting claims locally.
+
+## Compatibility
+
+- Direct signed update source: `v5.7.1`.
+- Database migrations: none.
+- Deleted files: none.
+- API v1 behavior: unchanged.
+- Secure API v2 protocol/cryptography: unchanged.
+- License/device enforcement, authentication/roles, Dashboard, Cron and updater runtime/protocol: unchanged.
diff --git a/RELEASE_NOTES_v5.8.1.md b/RELEASE_NOTES_v5.8.1.md
@@ -0,0 +1,26 @@
+# Licora v5.8.1 — Developer Integration Guide Verification Fix
+
+Licora v5.8.1 is a no-migration corrective release for the v5.8.0 Developer Integration Guide source candidate.
+
+## Fixed
+
+- Aligns the pull-request CI candidate ZIP, release specification and generated updater manifest on version `5.8.1`; the v5.8.0 source candidate used a stale `--version 5.7.1` manifest-builder argument.
+- Restores the **Recently Seen Devices** and **Manage Devices** Dashboard glyphs by using `bi-laptop`, which exists in the existing Bootstrap Icons 1.8.1 dependency, instead of unsupported `bi-devices`.
+- Adds regression checks for CI version coherence and the Dashboard device-icon contract.
+
+## Verified scope
+
+- Preserves the authenticated Developer Guide and exactly ten approved Secure API v2 reference targets: Python, PowerShell/CMD, C, C++, C#/.NET, Java, Flutter, React Native, PHP and Node.js.
+- Revalidates the canonical device-proof sequence, P-256/ECDSA-SHA256 signing, activation/refresh/status/deactivate contexts, stable error codes and no-shared-API-v1-secret rule.
+- Extends the source browser-dependency guard to the Developer Guide page/controller. Licora contains no Chrome installer/downloader/launcher; any external Chrome download failure requires the separate launcher/wrapper source to diagnose.
+
+## Compatibility
+
+- Upgrade sources: `5.7.1`, `5.8.0`.
+- Database migrations: none.
+- Deleted files: none.
+- API v1/v2 server behavior: unchanged.
+- License/device enforcement: unchanged.
+- Authentication/roles: unchanged.
+- Dashboard data/refresh behavior: unchanged; only two icon classes change.
+- Cron and updater runtime/protocol: unchanged.
diff --git a/REPOSITORY_METADATA.md b/REPOSITORY_METADATA.md
@@ -27,10 +27,34 @@
 
 Licora v5.1.0 adds a ten-step first-run installer, delimiter-aware schema execution, secure administrator and secret generation, atomic private configuration, installation locking, optional demo data, database-port support, safe installer diagnostics, and expanded regression validation. The release preserves the existing license engine, API contracts, database schema, routes, admin UI, cron entry points, and encrypted-data compatibility.
 
-## v5.7.1 corrective release candidate
+## v5.8.1 Developer Integration Guide verification candidate
 
-- **Intended tag:** `v5.7.1`
-- **Publication status:** source candidate only; GitHub write/release not yet authorized
+- **Intended tag:** `v5.8.1`
+- **Publication status:** source candidate; GitHub publication requires separate authorization
+- **Title:** `Licora v5.8.1 — Developer Integration Guide Verification Fix`
+- **Release notes:** `RELEASE_NOTES_v5.8.1.md`
+- **Database migration:** none
+- **Delete list:** empty
+- **Supported update sources:** published `v5.7.1`, already-applied `v5.8.0`
+
+Licora v5.8.1 preserves the v5.8.0 Developer Guide and ten approved API v2 examples, corrects CI package/manifest version coherence and restores the two Dashboard device glyphs with an icon available in the pinned Bootstrap Icons 1.8.1 set. It does not alter API, license/device, authentication, Dashboard data, Cron or updater runtime semantics.
+
+## v5.8.0 Developer Integration Guide source baseline
+
+- **Intended tag:** `v5.8.0`
+- **Publication status:** uploaded source baseline; superseded by the v5.8.1 verification candidate
+- **Title:** `Licora v5.8.0 — Developer Integration Guide`
+- **Release notes:** `RELEASE_NOTES_v5.8.0.md`
+- **Database migration:** none
+- **Delete list:** empty
+- **Supported update source:** `v5.7.1`
+
+Licora v5.8.0 adds an authenticated Developer Guide and downloadable multi-language Secure API v2 lifecycle references without changing the existing API v2 protocol, licensing/device semantics, Dashboard, authentication, Cron or updater runtime.
+
+## v5.7.1 published corrective release
+
+- **Tag:** `v5.7.1`
+- **Publication status:** published and release-verified
 - **Title:** `Licora v5.7.1 — Dashboard Phase 2 Verification Fix`
 - **Release notes:** `RELEASE_NOTES_v5.7.1.md`
 - **Primary assets:** `Licora-5.7.1.zip`, `.zip.sha256`, `licora-update-manifest.json`, `licora-update-manifest.sig`

diff --git a/ROADMAP.md b/ROADMAP.md
@@ -3,7 +3,7 @@
 ## Dashboard production program (v5.6.1 → v5.7.1)
 
 - **Phase 1 — Data Truth, Backend Read Model & Error Contract:** COMPLETE + VERIFIED in the published v5.6.1 baseline.
-- **Phase 2 — Compact UI, Reload-Free Refresh & Production Gate:** implemented in the v5.7.0 source baseline and corrected in the v5.7.1 candidate with server-rendered fallback, 30-second authenticated AJAX polling, manual refresh, in-place KPI/chart/activity updates, overlap protection and stale/auth UX. v5.7.1 additionally verifies stale/auth/transport/render lifecycle correctness; remote CI and live production smoke remain release gates.
+- **Phase 2 — Compact UI, Reload-Free Refresh & Production Gate:** implemented in the v5.7.0 source baseline and corrected/published in v5.7.1 with server-rendered fallback, 30-second authenticated AJAX polling, manual refresh, in-place KPI/chart/activity updates, overlap protection and stale/auth UX. The v5.7.1 release workflow and live 5.6.1 → 5.7.1 updater smoke are complete.
 
 
 Roadmap items are proposals and must be implemented through reviewed, backward-compatible changes.
@@ -39,3 +39,10 @@ Roadmap items are proposals and must be implemented through reviewed, backward-c
 - v5.4.1: updater recovery and v5.3/v5.4 scope-integrity hotfix with browser DOM contract coverage and release/rollback hardening.
 - v5.5.0: VibTools compact light UI refinement, truthful runtime-backed Settings, tracked Licora branding, About page and Windows builder-test portability; no database/API/updater protocol change.
 - v5.5.1: Settings layout, collapsible Settings submenu, and professional About Licora UI hotfix; no database/API/updater behavior change.
+
+## Developer onboarding program (v5.8.0 → v5.8.1)
+
+- **Developer Integration Guide:** IMPLEMENTED in the v5.8.0 source candidate and re-audited/corrected in the v5.8.1 verification candidate.
+- **v5.8.1 corrective gate:** CI package/manifest version coherence fixed; Dashboard device glyph compatibility fixed; no API/DB/runtime protocol expansion.
+- Scope is limited to the authenticated guide route, API & Clients sidebar link, exact Secure API v2 protocol documentation, downloadable examples for the ten approved language/runtime targets, PowerShell test tool, tests/docs/version/release identity.
+- API v1/v2 behavior, database schema, licensing/device enforcement, Dashboard, authentication/roles, Cron and updater runtime/protocol remain frozen.