Flyer capped to max-h-64 (was w-full, ~640x853px dominating the page); logo
reduced to h-10 (was h-16), matching the site's own sm-logo convention.
Pure styling change, no logic — 7/7 existing tests unchanged and passing.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- public/images/logo.png replaced with the client's professionally-designed
version, cropped to remove excess background margin (used sitewide via
logo.blade.php / app-logo.blade.php / app-logo-icon.blade.php)
- New standalone, unlinked registration form at /forms/nablus-workshop for a
one-off workshop Libra is co-hosting with Smart Business Center, replicating
a ClickUp form the client previously used but with Libra's own branding.
Submissions email info@libra.adv.ps and redirect to /about. No nav/footer
link, no DB storage, no captcha (PRD v1.3).
- Tasks 17 (parent), 17-1 (Mailable + email template), 17-2 (page/route/form)
taken through product-definition -> task-readiness -> dev-implement -> dev-qa,
all Done. 11 new tests passing; full suite run clean of new regressions
(69 pre-existing unrelated failures, documented in docs/tasks/17.md).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
First full scan (no docs/security-kb.md yet). 2 High, 3 Medium, 3 Low,
4 Informational findings — most notable: national_id stored/exported in
plaintext despite architecture.md claiming encryption, and a confirmed
CVE (CVE-2026-48019, CVSS 8.9) affecting the installed laravel/framework
12.43.1 via the guest-booking form's Mail::to() call. Report only — no
fixes applied, per the security-scan skill's non-capabilities.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Checked all 21 manual commits between abde8698 and 147231f (pre-dating
today's takeover) against the newly-built docs/tasks/ and docs/ux-design.md.
Two real conflicts found and fixed:
- Scholarship Aspiration section (task 16-6) was built, then fully removed
from /about in production (commit e8c1730, 2026-01-11) — task title and
ux-design.md corrected to say REMOVED, do not re-implement.
- Two-factor authentication was disabled in config/fortify.php at client
request (commit f8d9133, 2026-01-17) — CLAUDE.md and ux-design.md
corrected to say the 2FA code path is dormant, not live.
Everything else in that range (copy edits, mail/SMTP fixes, autorefresh bug
fixes, footer brand wording, php-fpm production notes already captured in
CLAUDE.md) doesn't contradict anything in the pipeline docs — no edit needed.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Naser confirmed all remaining QA Review / Draft rows (97 subtasks, 16
parent rollups) are done in substance: the site has been in production
for roughly a year. Overrides the conservative QA-Review/Draft mapping
from the prior takeover commit (0f9d12c) at his explicit instruction.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Adds docs/tasks/ (16 epics + 102 stories converted to task/subtask files with
statuses.md as the new status source of truth) and docs/ux-design.md
(retrospective design-system reference), and points CLAUDE.md at them.
docs/prd.md and docs/architecture.md are kept as BMAD wrote them; the legacy
docs/stories/, docs/epics/, docs/qa/gates/ and .bmad-core/ stay in place as
historical/traceability records, superseded but not deleted.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Naser Mansour