# Direct Selling Hub — Release Candidate 1

**Build date:** 2026-07-19  
**Status:** Staging candidate; not approved for production

## Included

- Hardened PHP application source
- Secure session, authentication, CSRF, upload, and tenant-isolation helpers
- Versioned schema migrations `001` and `002`
- Read-only database preflight
- Portable PHP/cPanel security configuration
- Automated CLI release audit
- cPanel staging, smoke-test, backup, and rollback runbook

## Deliberately excluded

- Live/private database credentials
- Demo credentials
- Database dump copies
- Historical uploaded tenant/product/logo files
- Screenshots and internal sales-preview materials
- Public test-email and edition-test endpoints
- Unreferenced duplicate dashboards, subscription screens, settings screens, mailer, and cart handler

## Required before production

1. Run the read-only database preflight against a staging copy.
2. Reconcile every returned anomaly manually and document the decision.
3. Apply migrations in order.
4. Run `bash tools/release_audit.sh` with the cPanel PHP CLI.
5. Complete the full smoke-test and tenant-isolation matrix.
6. Rehearse database and file rollback.
7. Rotate the old database password before any live deployment.

Only after all seven items pass should this candidate be promoted and renamed as the production release ZIP.
