Licora v5.6.1 - Dashboard Phase 1 Verification Fix

.github/workflows/ci.yml

@@ -43,7 +43,7 @@ jobs:
         run: python3 scripts/verify-local.py
 
   mysql-integration:
-    name: API v2 + updater MySQL integration
+    name: API v2 + updater + dashboard MySQL integration
     runs-on: ubuntu-latest
     services:
       mysql:
@@ -84,6 +84,7 @@ jobs:
           php tests/api_v2_db_integration.php
           php tests/admin_v2_ui_db_integration.php
           php tests/updater_db_integration.php
+          php tests/dashboard_db_integration.php
 
   windows-python-contract:
     name: Windows Python builder portability
@@ -133,18 +134,18 @@ jobs:
         run: |
           short_sha="${GITHUB_SHA:0:12}"
           mkdir -p release
-          bash scripts/package-release.sh v5.5.1 "$GITHUB_SHA" "release/Licora-5.5.1-ci-${short_sha}.zip"
-          cp "release/Licora-5.5.1-ci-${short_sha}.zip" "release/Licora-5.5.1.zip"
-          python3 scripts/build-update-manifest.py --version 5.5.1 --ref "$GITHUB_SHA" --package "release/Licora-5.5.1.zip" --output release/licora-update-manifest.json
-          rm "release/Licora-5.5.1.zip"
+          bash scripts/package-release.sh v5.6.1 "$GITHUB_SHA" "release/Licora-5.6.1-ci-${short_sha}.zip"
+          cp "release/Licora-5.6.1-ci-${short_sha}.zip" "release/Licora-5.6.1.zip"
+          python3 scripts/build-update-manifest.py --version 5.6.1 --ref "$GITHUB_SHA" --package "release/Licora-5.6.1.zip" --output release/licora-update-manifest.json
+          rm "release/Licora-5.6.1.zip"
 
       - name: Upload CI release-candidate artifact
         uses: actions/upload-artifact@v6
         with:
-          name: Licora-5.5.1-${{ github.sha }}
+          name: Licora-5.6.1-${{ github.sha }}
           path: |
-            release/Licora-5.5.1-ci-*.zip
-            release/Licora-5.5.1-ci-*.zip.sha256
+            release/Licora-5.6.1-ci-*.zip
+            release/Licora-5.6.1-ci-*.zip.sha256
             release/licora-update-manifest.json
           if-no-files-found: error
           retention-days: 14

.github/workflows/release.yml

@@ -61,7 +61,7 @@ jobs:
       - name: Full source verification
         run: python3 scripts/verify-local.py
 
-      - name: API v2 and updater database integration
+      - name: API v2, updater and dashboard database integration
         env:
           LICORA_V2_TEST_ALLOW_SCHEMA_RESET: '1'
           LICORA_TEST_DB_DSN: mysql:host=127.0.0.1;port=3306;dbname=licora_test;charset=utf8mb4
@@ -76,6 +76,7 @@ jobs:
           php tests/api_v2_db_integration.php
           php tests/admin_v2_ui_db_integration.php
           php tests/updater_db_integration.php
+          php tests/dashboard_db_integration.php
 
       - name: Build exact-tag release ZIP and checksum
         shell: bash

BASELINE_v5.6.1.md

@@ -0,0 +1,36 @@
+# Licora v5.6.1 — Next Source Baseline Freeze
+
+## Freeze Status
+
+- Version: `5.6.1`
+- Freeze type: **Verified source baseline freeze — Phase 1 COMPLETE + VERIFIED**
+- Parent Official Baseline Freeze: `Licora_v5.6.0_Baseline.zip`
+- Parent ZIP SHA-256: `ba99c6e4fd74c2b59d392c3010b3aefe493390b3b0b0c94bd3c211218f14d597`
+- Parent Git commit: `5c685636e955422bc70e3bf07694f55d9c7fb1dc`
+- Parent Git tree: `848801c1785ebba0b2523a34afcf6af3ee05d5d6`
+- Database migration: `NONE`
+- Deleted files: `NONE`
+- External API v1/v2 contract change: `NONE`
+- Phase 2 implementation: `NONE`
+
+## Frozen Corrective Scope
+
+This source freeze contains only the verified Phase 1 corrective scope:
+
+1. foreign-key-safe Dashboard MySQL integration fixture isolation;
+2. exact top-level Dashboard `recent_activity` contract parity;
+3. API v2 readiness based on complete schema plus valid matching signing key pair;
+4. v5.6.1 version/release/CI/documentation alignment;
+5. browser-agnostic runtime verification guard after confirming no Chrome installer/downloader exists in Licora source.
+
+## Local Verification
+
+`python3 scripts/verify-local.py` passed after the corrective runtime/test changes. The targeted release-readiness check also passed after final publication-status documentation correction. Final `git diff --check` and delta extraction/hash parity are recorded in the v5.6.1 delta manifest.
+
+Environment-dependent DB tests were skipped locally where the dedicated test database was unavailable. The mandatory remote acceptance gate was then satisfied by PR #8 Actions run `32423210356`: MySQL integration, PHP 8.0–8.4, Windows Python portability, and verified source artifact jobs all passed.
+
+## GitHub/Release Status
+
+The verified v5.6.1 Phase 1 implementation commit is `ab085ae1738ef49be506cb10ae2353799108a969`. PR #8 Actions run `32423210356` completed successfully. `v5.6.0` was not published as a GitHub tag/release.
+
+Phase 1 is `COMPLETE + VERIFIED`. Phase 2 is `NOT STARTED`. This documentation-completion delta records the passed remote gate; after it is committed/pushed and the resulting PR CI remains green, PR #8 can be merged into `main`, followed by the v5.6.1 tag/release flow.

CHANGELOG.md

@@ -6,7 +6,32 @@ All notable public-release changes are recorded here. Historical project notes r
 
 ### Planned
 
-- Continue reviewed Zero Freedom development after the v5.1.0 installer release.
+- Continue the reviewed Dashboard production program with Phase 2: compact UI and reload-free refresh.
+
+## [5.6.1] - 2026-08-20
+
+### Fixed
+- Corrected the Dashboard MySQL integration test cleanup so prior API v2 foreign-key tables are removed safely before the dashboard fixture is created.
+- Aligned the implemented Dashboard JSON response with the declared top-level `recent_activity` contract while preserving separate API v1 and API v2 tracked sources.
+- Tightened Dashboard API v2 readiness so `Ready` now requires the complete v2 schema and a readable, cryptographically matching private/public signing key pair; only readiness booleans are exposed to the browser.
+- Added a runtime source guard confirming Licora does not require or download Google Chrome; Licora remains browser-agnostic server software.
+
+### Compatibility
+- No database migration, deleted files, external API contract change, license/device enforcement change, Cron mutation change, updater protocol change, or Phase 2 polling/UI implementation.
+- Signed update compatibility accepts both the official v5.5.1 source and an already-applied v5.6.0 baseline.
+
+## [5.6.0] - 2026-08-20 (unreleased source baseline; superseded by 5.6.1)
+
+### Added
+- Added a centralized read-only Dashboard data model and authenticated `GET /admin/ajax/dashboard-data.php` JSON endpoint.
+- Added explicit license, device, API v1/API v2, expiration and measured health/config reporting semantics.
+- Added Dashboard contract/MySQL integration tests and made the Dashboard DB test mandatory in CI/tagged-release MySQL gates.
+
+### Fixed
+- Replaced misleading Dashboard health labels with measured facts, separated API v1 and Secure API v2 tracked activity, split past/future expiration data, and changed device reporting from an active flag to explicit recently-seen semantics.
+
+### Compatibility
+- No database migration or deleted files. Signed direct source is `v5.5.1`; external API contracts, license/device enforcement, authentication/roles, Cron mutation behavior and updater protocol/state machine remain unchanged. The existing 30-second full-page Dashboard reload remains intentionally in Phase 1 for Phase 2 replacement.
 
 ## [5.5.1] - 2026-08-18
 

DASHBOARD_PRODUCTION_UPDATE_INDEX.md

@@ -0,0 +1,49 @@
+# Licora Dashboard Production Update — Documentation Index
+
+## Authority
+
+এই documentation program v5.5.1 থেকে শুরু হয়েছিল; বর্তমান corrective source authority হলো uploaded **Licora v5.6.0 Official Baseline Freeze**।
+
+- Current baseline ZIP SHA-256: `ba99c6e4fd74c2b59d392c3010b3aefe493390b3b0b0c94bd3c211218f14d597`
+- Current baseline Git commit: `5c685636e955422bc70e3bf07694f55d9c7fb1dc`
+- Current baseline Git tree: `848801c1785ebba0b2523a34afcf6af3ee05d5d6`
+- Current baseline version: `5.6.0`
+- Original Phase-program baseline: `v5.5.1 / 2f48ef569e6c532ab0de974a418c644e4ea8423f`
+- Development implementation status: **v5.6.1 Phase 1 COMPLETE + VERIFIED — PR #8 Actions run 32423210356 PASS**
+- Planned update phases: **2**
+- Current corrective target: **v5.6.1 — Phase 1 verified baseline; Phase 2 NOT STARTED**
+
+এই document set Phase 1 runtime implementation এবং v5.6.1 corrective verification state record করে। v5.6.1 কোনো database migration, external API contract change, license/device enforcement change, Cron mutation change, updater protocol change বা Phase 2 polling/UI feature যোগ করে না।
+
+## Document Map
+
+| Document | Purpose |
+|---|---|
+| `audit/V5.5.1_DASHBOARD_PRODUCTION_READINESS_FORENSIC_REPORT.md` | Baseline forensic findings, production-readiness gaps, scope boundary |
+| `docs/DASHBOARD_PRODUCTION_ROADMAP_2_PHASE.md` | A–Z implementation roadmap, maximum 2 phases |
+| `docs/DASHBOARD_UPDATE_PHASE_LOG.md` | Phase completion ledger and continuation point |
+| `docs/ERROR_HANDLING_BASELINE_AND_TARGET.md` | Existing error handling + required additions |
+| `docs/ACTUAL_IMPLEMENTATION_LEDGER.md` | What actually works now, what becomes working after each phase, what remains |
+| `docs/DASHBOARD_DATA_CONTRACT.md` | Exact implemented read-only dashboard data semantics and AJAX response contract |
+| `docs/DASHBOARD_PRODUCTION_VALIDATION_GATES.md` | Automated/manual acceptance gates before phase completion/release |
+| `docs/DASHBOARD_CHANGE_CONTROL.md` | Freeze rules, decision rules, no-scope-creep rules, rollback discipline |
+| `audit/DASHBOARD_PRODUCTION_DOCS_DELTA_MANIFEST.md` | Documentation delta contents and extraction instructions |
+| `audit/DASHBOARD_PRODUCTION_DOCS_DELTA_SHA256SUMS.txt` | SHA-256 checksums for every file in this patch |
+
+## Mandatory Working Order
+
+1. Baseline Freeze remains immutable.
+2. Read forensic report.
+3. Read exact data contract.
+4. Implement **Phase 1 only**.
+5. Run Phase 1 validation gates.
+6. Update `DASHBOARD_UPDATE_PHASE_LOG.md` and `ACTUAL_IMPLEMENTATION_LEDGER.md`.
+7. Only after Phase 1 is verified, implement **Phase 2**.
+8. Run final production gates.
+9. Update logs/ledger.
+10. Only then prepare a runtime delta/release.
+
+## Continuation Rule
+
+যে phase `COMPLETE + VERIFIED` নয় সেটিকে completed ধরা যাবে না।
+যে feature source/tests দিয়ে verify হয়নি সেটিকে `ACTUAL WORKING` লেখা যাবে না।

README.md

@@ -124,7 +124,7 @@ The application accepts deployment-specific values through environment variables
 | Database password | `LICENSE_DB_PASS` | empty |
 | Application name | `APP_NAME` | `Licora` |
 | Application URL | `APP_URL` | `http://localhost` |
-| Application version | `APP_VERSION` | `5.5.1` |
+| Application version | `APP_VERSION` | `5.6.1` |
 | Environment | `APP_ENV` | `production` |
 | Encryption key | `LICENSE_ENCRYPTION_KEY` | empty fallback |
 | API limit | `API_RATE_LIMIT` | `1000` |
@@ -155,6 +155,8 @@ The validation script checks PHP syntax, security behavior, compatibility invari
 - [Secure in-app updater](docs/UPDATER.md)
 - [UI design system](docs/UI_DESIGN_SYSTEM.md)
 - [Troubleshooting](docs/TROUBLESHOOTING.md)
+- [v5.6.1 release notes](RELEASE_NOTES_v5.6.1.md)
+- [v5.6.0 release notes](RELEASE_NOTES_v5.6.0.md)
 - [v5.5.1 release notes](RELEASE_NOTES_v5.5.1.md)
 - [v5.5.0 release notes](RELEASE_NOTES_v5.5.0.md)
 - [v5.4.1 release notes](RELEASE_NOTES_v5.4.1.md)
@@ -171,6 +173,14 @@ The validation script checks PHP syntax, security behavior, compatibility invari
 - [Dependency review](audit/DEPENDENCY_REPORT.md)
 
 
+## Phase 1 verification corrective update (v5.6.1)
+
+Licora v5.6.1 is a no-migration corrective update over the applied v5.6.0 Phase 1 source baseline; v5.6.0 was not published as a GitHub tag/release and is superseded by v5.6.1. It fixes the MySQL integration-test foreign-key cleanup exposed by PR #8 CI, aligns the authenticated Dashboard JSON envelope with its documented top-level `recent_activity` field, and makes the Dashboard API v2 `Ready` status depend on a verified matching server signing key pair rather than the public key alone. Licora remains a browser-based PHP application and contains no Google Chrome installer/downloader dependency. Phase 2 reload-free polling/UI work remains unimplemented.
+
+## Dashboard data truth and read model (v5.6.0)
+
+Licora v5.6.0 completes Phase 1 of the Dashboard production program without changing external API, license/device enforcement, database schema, Cron mutation or updater contracts. Dashboard initial rendering now uses a centralized read-only data model; an authenticated GET-only JSON endpoint exposes the same safe snapshot for the Phase 2 reload-free controller. API v1 `api_logs` and Secure API v2 `v2_audit_logs` are reported as distinct tracked sources, expiration data separates past from upcoming expirations, device reporting distinguishes active flags from five-minute recently-seen activity, and hardcoded operational-health claims are replaced by measured facts. The existing 30-second full-page Dashboard reload is intentionally retained until Phase 2.
+
 ## Settings and About UI finishing (v5.5.1)
 
 Licora v5.5.1 is a no-migration UI corrective release over v5.5.0. Settings shortcuts use a balanced responsive grid, the integration area uses a dedicated API + Cron/Signing composition without forced blank card height, Settings child routes are available through a collapsible accessible submenu, and About Licora uses shared product/feature/company components instead of the previous sparse definition-list layout. Backend/API/license/device/cron/updater behavior remains unchanged.

RELEASE_COMMANDS_v5.6.0.md

@@ -0,0 +1,52 @@
+# Licora v5.6.0 Release Commands
+
+Run after applying the verified v5.6.0 Phase 1 replace-ready delta to a clean `v5.5.1` working copy.
+
+## Local verification
+
+```cmd
+python scripts\verify-local.py
+php tests\dashboard_data_contract.php
+php tests\dashboard_db_integration.php
+php tests\ui_v551_contract.php
+php tests\ui_route_contract.php
+php tests\ui_component_contract.php
+php tests\ui_form_contract.php
+php tests\ui_updater_contract.php
+php tests\updater_dom_contract.php
+node tests\updater_browser_runtime.js
+node tests\sidebar_submenu_runtime.js
+python tests\updater_builder_contract.py
+git diff --check
+git status
+```
+
+`tests/dashboard_db_integration.php` requires the same dedicated MySQL test environment used by CI (`LICORA_V2_TEST_ALLOW_SCHEMA_RESET=1` plus the `LICORA_TEST_DB_*` variables). Without that explicit test DB, it reports a skip rather than touching a normal database.
+
+## Commit and push
+
+Stage only the reviewed v5.6.0 Phase 1 paths; do not use `git add -A` on a mixed worktree.
+
+```cmd
+git diff --check
+git status
+git commit -m "feat: add truthful dashboard read model and data endpoint in Licora v5.6.0"
+git push -u origin feature/v5.6.0-dashboard-phase1
+```
+
+Do not create the tag until the reviewed changes are on the intended release branch/main and GitHub CI is green.
+
+## Tag and release
+
+```cmd
+git pull --ff-only
+git tag -a v5.6.0 -m "Licora v5.6.0 - Dashboard Data Truth and Read Model"
+git push origin v5.6.0
+```
+
+The tag-triggered release workflow must publish:
+
+- `Licora-5.6.0.zip`
+- `Licora-5.6.0.zip.sha256`
+- `licora-update-manifest.json`
+- `licora-update-manifest.sig`

RELEASE_COMMANDS_v5.6.1.md

@@ -0,0 +1,44 @@
+# Licora v5.6.1 Release Commands
+
+Run these commands only after applying the reviewed v5.6.1 corrective delta.
+
+## Local verification
+
+```cmd
+python scripts\verify-local.py
+php tests\dashboard_data_contract.php
+git diff --check
+git status --short --branch
+```
+
+`tests/dashboard_db_integration.php` requires the dedicated MySQL test environment used by GitHub Actions. Do not point it at a normal/production database.
+
+## Recommended feature-branch commit
+
+Stage only the reviewed v5.6.1 corrective paths. Do not use `git add -A`.
+
+```cmd
+git status
+git diff --check
+git add -- .github/workflows/ci.yml BASELINE_v5.6.1.md CHANGELOG.md DASHBOARD_PRODUCTION_UPDATE_INDEX.md README.md RELEASE_COMMANDS_v5.6.1.md RELEASE_NOTES_v5.6.1.md REPOSITORY_METADATA.md ROADMAP.md admin/ajax/dashboard-data.php admin/index.php audit/V5.6.1_DELTA_MANIFEST.md audit/V5.6.1_DELTA_SHA256SUMS.txt audit/V5.6.1_PHASE1_VERIFICATION_AUDIT.md config.sample.php docs/ACTUAL_IMPLEMENTATION_LEDGER.md docs/ARCHITECTURE.md docs/CONFIGURATION.md docs/DASHBOARD_CHANGE_CONTROL.md docs/DASHBOARD_DATA_CONTRACT.md docs/DASHBOARD_PRODUCTION_ROADMAP_2_PHASE.md docs/DASHBOARD_PRODUCTION_VALIDATION_GATES.md docs/DASHBOARD_UPDATE_PHASE_LOG.md docs/ERROR_HANDLING_BASELINE_AND_TARGET.md docs/FEATURE_MATRIX.md docs/INSTALLATION.md docs/RELEASE.md docs/UPGRADE_GUIDE.md includes/config.php includes/dashboard.php includes/installation.php install.php scripts/verify-local.py tests/compatibility_regression.php tests/dashboard_data_contract.php tests/dashboard_db_integration.php tests/installer_smoke.php tests/release_readiness.php tests/updater_state_machine.php update/release-spec.json
+git status
+git commit -m "fix: verify Dashboard Phase 1 and correct CI contract in Licora v5.6.1"
+git push
+```
+
+The existing PR #8 should update automatically when the commit is pushed to `feature/v5.6.0-dashboard-phase1`.
+
+## CI stop rule
+
+Run/check PR #8. If the MySQL integration job or any other check fails, stop and inspect that new concrete failure; do not repeatedly rerun unchanged failing jobs.
+
+Do not merge or tag until all required checks are green.
+
+## Tag after merge and final verification
+
+```cmd
+git switch main
+git pull --ff-only origin main
+git tag -a v5.6.1 -m "Licora v5.6.1 - Dashboard Phase 1 Verification Fix"
+git push origin v5.6.1
+```