Self-contained HTML mockup of the public-site redesign: Arabic-first, engraved
gold balance over olive photography, Markazi Text + IBM Plex Sans Arabic.
Checked against the code (booking component, post model, public layout); no
unbacked promises. Spec (docs/ux-design.md) waits for the client's yes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
env('ERROR_NOTIFICATION_THROTTLE_MINUTES', 15) returns the literal string
"15" from production's .env (env() doesn't cast numeric strings), which
Carbon 3.11's addMinutes() rejects with a TypeError. That crash happened
before the throttle-dedup cache write, so it silently masked the *original*
exception on every notify-worthy error, indefinitely (discovered while
investigating a missing workshop-registration email — the real SMTP error
was hidden behind this crash). Cast to (int).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Client reported the site's address was missing "Jaffa Street" — added to
both Arabic and English footer strings (lang/ar/footer.php, lang/en/footer.php).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
max-h-40 (160px) was too small to read comfortably; bumped to max-h-56
(224px), between that and the original too-large 256px. Rebuilt frontend
assets and confirmed the class compiled.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Reused existing, already-compiled design-system pieces instead of ad hoc
inline colors: the login page's auth-pattern background (public/images/
auth-pattern.svg) on the standalone layout, and the reusable <x-ui.card
highlight> component (Warm Gold accent border) for the form card. Replaced
inline style="color: #2D322A" with the text-body token.
Also fixes the actual root cause behind "the picture still looks the same"
from the prior two tasks: public/build's compiled CSS was stale (last built
Jan 17, before this session), so max-h-40/max-h-64 were never in the
generated stylesheet. Rebuilt via npm run build and verified the new classes
compile; production has its own deploy-time build so this shouldn't recur
there.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Logo image removed entirely from the registration page per Naser's request;
flyer capped to max-h-40 (was max-h-64). Pure markup/styling change, no
logic — 7/7 existing tests unchanged and passing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Flyer capped to max-h-64 (was w-full, ~640x853px dominating the page); logo
reduced to h-10 (was h-16), matching the site's own sm-logo convention.
Pure styling change, no logic — 7/7 existing tests unchanged and passing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- public/images/logo.png replaced with the client's professionally-designed
version, cropped to remove excess background margin (used sitewide via
logo.blade.php / app-logo.blade.php / app-logo-icon.blade.php)
- New standalone, unlinked registration form at /forms/nablus-workshop for a
one-off workshop Libra is co-hosting with Smart Business Center, replicating
a ClickUp form the client previously used but with Libra's own branding.
Submissions email info@libra.adv.ps and redirect to /about. No nav/footer
link, no DB storage, no captcha (PRD v1.3).
- Tasks 17 (parent), 17-1 (Mailable + email template), 17-2 (page/route/form)
taken through product-definition -> task-readiness -> dev-implement -> dev-qa,
all Done. 11 new tests passing; full suite run clean of new regressions
(69 pre-existing unrelated failures, documented in docs/tasks/17.md).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First full scan (no docs/security-kb.md yet). 2 High, 3 Medium, 3 Low,
4 Informational findings — most notable: national_id stored/exported in
plaintext despite architecture.md claiming encryption, and a confirmed
CVE (CVE-2026-48019, CVSS 8.9) affecting the installed laravel/framework
12.43.1 via the guest-booking form's Mail::to() call. Report only — no
fixes applied, per the security-scan skill's non-capabilities.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Checked all 21 manual commits between abde8698 and 147231f (pre-dating
today's takeover) against the newly-built docs/tasks/ and docs/ux-design.md.
Two real conflicts found and fixed:
- Scholarship Aspiration section (task 16-6) was built, then fully removed
from /about in production (commit e8c1730, 2026-01-11) — task title and
ux-design.md corrected to say REMOVED, do not re-implement.
- Two-factor authentication was disabled in config/fortify.php at client
request (commit f8d9133, 2026-01-17) — CLAUDE.md and ux-design.md
corrected to say the 2FA code path is dormant, not live.
Everything else in that range (copy edits, mail/SMTP fixes, autorefresh bug
fixes, footer brand wording, php-fpm production notes already captured in
CLAUDE.md) doesn't contradict anything in the pipeline docs — no edit needed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Naser confirmed all remaining QA Review / Draft rows (97 subtasks, 16
parent rollups) are done in substance: the site has been in production
for roughly a year. Overrides the conservative QA-Review/Draft mapping
from the prior takeover commit (0f9d12c) at his explicit instruction.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds docs/tasks/ (16 epics + 102 stories converted to task/subtask files with
statuses.md as the new status source of truth) and docs/ux-design.md
(retrospective design-system reference), and points CLAUDE.md at them.
docs/prd.md and docs/architecture.md are kept as BMAD wrote them; the legacy
docs/stories/, docs/epics/, docs/qa/gates/ and .bmad-core/ stay in place as
historical/traceability records, superseded but not deleted.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Naser Mansour