Future Leaders Award

ROADMAP — FLA Event & Awards Platform

Living plan. Status: ✅ done · 🚧 in progress · ✅ planned.
Browse in-app at /docs/roadmap. Spec: docs/SRS.md. Handoff: TODO.md.

Vision

A modular, plain-PHP platform at https://event.production1.jugaar.ai for running events whose centerpiece is public-voted, AI-assessed awards — branded entirely from an admin control panel, auditable end-to-end, and shareable by design (everyone gets cards + links worth posting).

Milestones

Status 2026-09-07: v4.2.0 live — all gap-closure + visual-audit rounds done
(v0.1.0 → v4.2.0); verified by bin/qa.sh (37 checks) + bin/qa-e2e.sh (266 checks) — both green (first perfect run).

v4.2.0 — Completion round ✅ (delivered 2026-09-07)

  • Recurring events (weekly/monthly, repeat-until, auto-drafted next occurrence via queue cron).
  • Guided tour (4-step spotlight on admin overview, per-user, dismissible).
  • Judges transparency panel on public results (post-lock).
  • Fixed: vote-change reason silently dropped (rechain() bug — the "flaky" E2E test);

event-create INSERT regression. E2E 266/266.

  • Opt-in persistent PDO pooling; full a11y sweep (alt text everywhere, focusable mains).

v4.1.0 — Visual/UX audit round ✅ (delivered 2026-09-06)

  • Root cause: every /media/ image 404 — nginx static-cache intercepted before PHP; bypass added.
  • Missing uploads serve graceful placeholders (no broken-image icons ever).
  • Admin shell was JS-less: app.js (toasts/theme), burger drawer on mobile.
  • Hall of fame paginated (mobile page 36,526px → 8,157px); touch-target + contrast fixes;

WebP backgrounds (78–96% smaller); HTTP/2.

v4.0.0 — Gap-closure ✅ (delivered 2026-09-06)

  • Vote management (soft-delete + /admin/votes, audited, reversible) · event templates ·

admin onboarding checklist · public /speakers GoH directory · candidate compare · event package JSON export · hall-of-fame search · .ics calendar export · Telegram ops alerts · async job queue (bin/queue.php, cron) · structured login_attempts.

v3.5.0 – v3.9.0 — UX, trust & imagery ✅ (delivered 2026-09-03 → 2026-09-05)

  • Dark mode, toasts, notification badges, mobile tabs, skeletons, breadcrumbs, countdown.
  • Vote-abuse intervention (auto-hold bursts), sponsor ROI dashboard, alumni network, email digest.
  • MiniMax M3 live (interviews, assistant, briefs, insights); AI-generated hero/category art

(WebP), share cards (GD + Brainiall driver ready, quota resets monthly).

v3.4.0 — Event-day readiness & trust ✅ (delivered 2026-09-02)

  • Ceremony media upload UI on /admin/ceremony/setup (anthem video, fanfare audio, custom slides).
  • One-click backup button on /admin/system.
  • Printable name badges (/badges) with check-in QR; run-sheet already present.
  • Post-event feedback survey (/survey) → engagement score.
  • Public /about-scoring transparency hub (weights, rubric, hash-chain verify, lock metadata).
  • Data-retention jobs (/admin/retention): page_views rollup, audit_log archive, mail-log hygiene.
  • CSP hardening: removed 'unsafe-inline' from script-src, nonce-based inline scripts.
  • E2E extended to 266 checks (all green); surface QA 37 checks (all green).

v0.1.0 — Docs & Scaffold ✅

  • Plain-PHP modular scaffold (Core + 14 Modules), views, config, composer (autoload only).
  • Living docs: SRS, 7 workflows, TODO, ROADMAP, CHANGELOG, WORKFLOW, HELP, AGENTS.
  • Docs viewer: every .md rendered as organized webpages at /docs.
  • Core services: AI gateway (MiniMax m3 driver + mock), LinkedIn (+mock), WhatsApp (null), GD cards.
  • DB migrations 001–009 + seed (settings, toggles).
  • Git baseline + tag.

v0.2.0 — Admin Core & Branding ✅ (delivered in v1.0.0 drop)

  • Admin auth + first admin (seeded, forced password change).
  • Branding control panel (name, logo upload, colors, tagline, campaign texts).
  • Feature toggles UI; audit writer wired in.
  • Admin home starter: KPI cards + first chart (registrations over time) using Chart.js.

v0.3.0 — Events & Categories ✅

  • Event CRUD + status lifecycle; category CRUD, show/hide, ordering.
  • Public event pages (details, categories list).

v0.4.0 — Registration ✅

  • Visitor, Award, Guest-of-Honor flows (LinkedIn OAuth + basic + WhatsApp).
  • Photo upload; staff manual entry; BR-001/002/007 enforced.
  • "I am visiting / I have applied" cards wired to success pages.

v0.5.0 — AI Interview ✅

  • Admin question bank per category; randomized session; progressing UI.
  • MiniMax m3 marking (score + feedback); session stats; fallback to mock.

v0.6.0 — Public Voting & Cards ✅

  • Share links, candidate pages (OG tags), LinkedIn voter auth, restriction modes,

optional voter reason, 70/30 engine, veto UI.

  • Public cards polished (better templates/fonts); AI card driver pluggable.

v0.7.0 — Judges Panel ✅

  • Judge accounts + assignments; review board; decisions + notes; admin report.

v0.8.0 — Dashboards, Tickets, Comms ✅

  • Admin dashboard full: graphs (votes-over-time, funnel, per-category shares, top candidates, AI score distribution), KPI cards with 7d/30d trends, audit-log tab with filters, drill-down lists.
  • AI insights (FR-0407): weekly event summary, judge-ready applicant briefs, vote-anomaly flags — mock-compatible until MiniMax key.
  • Applicant (own votes chart/voters/AI stats/tickets/cards), staff queue.
  • Ticketing system; mass comms (email + WhatsApp simulated→live); notifications + reminders.

v0.9.0 — Winners & Audit ✅

  • Finalize (blend, veto, approve & lock), public results, winner badges/cards.
  • Audit log viewer (filter/search).

v1.0.0 — Launch Polish ✅

  • Full responsive pass; accessibility; rate limiting; backups verified; perf pass;

owner walkthrough + go-live checklist.

Post-1.0 releases

v1.1.0 — Duplicate candidate detection ✅

  • BR-011 repeat-candidate surveillance: email/LinkedIn/CNIC-hash/name+WhatsApp signals +

same-account repeat detection; flag + alert admin (never auto-block).

  • Admin review queue /admin/duplicates (confirm → auto-veto / dismiss), badges + KPI.
  • CNIC mandatory on award forms (hash-only storage). Judges anchoring fix (SRS A2).
  • E2E: bin/qa-e2e.sh extended to 50 checks (all green).

v1.2.0 — Release-control completions ✅

  • Winner un-lock flow (retract results, revert statuses, event→judging, audited) — FR-1005.
  • Team password reset by admin (temp pass re-issue + forced change) — FR-0705.
  • E2E extended to 63 checks (all green).

v1.3.0 — Polish pack ✅

  • Email verification for non-LinkedIn signups (log mailer mock-safe) — FR-0309/0310.
  • Per-event vote-change policy toggle — FR-0509 (audited vote.changed).
  • ?ref= share-link attribution → applicant channel breakdown — FR-0510.
  • Finalist certificate cards — FR-0604. Security headers incl. HSTS — NFR-11.
  • E2E extended to 76 checks (all green).

v1.4.0 — Public discovery & ops ✅

  • Events directory /events (live + archive) — FR-0204 · Hall of fame /hall-of-fame — FR-1006.
  • Printable winner/finalist certificates — FR-0605 · Public read-only JSON API v1 — FR-1500.
  • robots.txt + dynamic sitemap.xml · vote rate limiting per IP (NFR-12) ·

bin/backup.sh (DB+storage, 14-day retention).

  • E2E extended to 91 checks (all green).

v1.5.0 — Integrations & experience ✅

  • Webhooks (signed JSON POSTs, subscriptions, delivery log, test ping) — FR-1601.
  • Venue leaderboard screen /screen/{slug} — FR-1602 · CSV exports — FR-1603.
  • Admin 2FA (TOTP, RFC 6238) — FR-1604 · PWA installable (manifest/icons/SW) — NFR-13.
  • E2E extended to 110 checks (all green).

v1.6.0 — Scale & polish ✅

  • Maintenance mode (503 + admin bypass, toggle in /admin/toggles) — FR-0106.
  • Bulk approve/reject for registrations — FR-1604 · Audit CSV export — FR-1103.
  • System health dashboard /admin/system — NFR-15 (DB/storage/queues/backups).
  • Hardened: toggles no longer clear on maintenance-only posts; vote guards + audit.
  • E2E extended to 119 checks (all green).

v1.7.0 — Photo flexibility ✅

  • B: Award/GoH photo optional at signup, upload/change via POST /dashboard/photo on member dashboard (Pakistan UX).
  • Approval (single + bulk) blocked until photo exists — audited, UI shows ?err=nophoto / ?skipped.
  • Docs: SRS FR-0304/0305/0308 + UC-04/05 updated; E2E 119/119 + 33/33 green.

v1.8.0 — Search & verification ✅

  • Global admin search /admin/search + header box — FR-1606.
  • SMS comms channel (log transport, Pakistan-ready) — FR-0906.
  • QR verification on printable certificates + public verify page — FR-0606.
  • E2E extended to 131 checks (all green).

v2.0.0 — Program growth & ops ✅ (A→M, one release)

  • Nominations (invite→convert) · AI Assistant (context-aware, multi-chat) · Judge rubric.
  • Cert numbers · Ceremony reveal · Capacity+waitlist · Scheduled comms · Embed widget.
  • Data rights · Auditor role · Event cloning · wa.me links · Public caching.
  • E2E extended to 169 checks (all green) + surface 33/33.

v2.1.0 — Reach ✅

  • Web Push end-to-end (pure PHP VAPID+RFC8291, admin broadcast, winner auto-push) — FR-1820.
  • CSV bulk import — FR-0311 · waitlist UI chip · nomination throttle setting.
  • E2E extended to 178 checks (all green).

v2.2.0 — Section 2 core ✅

  • GoH decision emails/SMS + submit confirmation — FR-0305b · GoH card — FR-0608.
  • GoH event-page listing · ratings + roster — FR-0620 · public profiles + socials — FR-1701.
  • E2E extended to 190 checks (all green).

v2.3.0 — Engage ✅

  • Magic-link member login — FR-0180 · messaging team↔members — FR-1830.
  • AI drafting (composer + bulk per-GoH) — FR-1840 · scheduling both directions — FR-1850.
  • E2E extended to 211 checks (all green).

v2.4.0 — Track & Trust ✅

  • People tracking + engagement + timelines — FR-1860 · anonymous page views (hashed).
  • Vote receipts + hash chain + public verification — FR-1870.
  • AI category fit — FR-1880 · share-link click analytics — FR-1890.
  • E2E extended to 223 checks (all green).

v2.5.0 — Section 3: Day of Event ✅

  • QR check-in · presenters + printable run-sheet · media gallery (both phases) · ceremony ops.

v2.6.0 — Growth ✅

  • Sponsor wall · season report. E2E final: 239 checks (all green).

v3.0.0 — Ceremony Production System ✅

  • MC Dashboard /mc (dedicated role, full show control) — FR-3000.
  • Stage Screen /stage/{slug} (polling, multi-GoH, anthem) — FR-3010.
  • Award Team /award-team (shield confirmation) — FR-3030.
  • Winner Queue + Shields + Admin Override — FR-3020/3040.
  • GoH Substitution + Self Check-in + Multi-GoH Presenters — FR-3050/3060/3070.
  • Ceremony Auto-generate from event data — FR-3080. Migration 027.
  • E2E extended to 260 checks (all green).

v3.1.1 — Security hotfix (audit) ✅

  • Pre-auth account-takeover closed (forms never auto-login; magic-link defer).
  • Veto absoluteness (BR-005) before any UPDATE; forced password change enforced.
  • Check-in secret split from public share token; LinkedIn account linking;

2FA/login per-account throttling; judge recusal withdraws scores; ops docs gated.

v3.1.2 — Integrity milestone (audit) ✅

  • DB::transaction() + transactions around winner lock/unlock, vote cast,

magic-link consume, ceremony generate, queue reorder; advisory locks for vote-chain tail and cert sequence.

  • Deterministic vote hash chain (recomputable chainVerified()); finalist

runner-up promotion (certs/cards live); vote races closed; card cache fixed.

  • Comms scheduling honored on send + retry-failed; profile vote-count gating;

MC cross-event slide guard; event FSM; version from config.

v3.2.0 — Event-Day UX ✅

  • Stage screen start gate (sound/fullscreen), heartbeat, live sponsor slide,

real pre-flight checklist; MC keyboard shortcuts; award-team auto-refresh.

  • Old-input forms, a11y pass, category rosters, sidebar completeness, favicon

upload, 500 page, asset cache-busting, OG tags, bug fixes across admin views.

  • E2E extended to 266 checks (all green).

Feature / enhancement backlog (post-1.0 ideas)

Event-day readiness (from the 2026-08-31 audit, ordered by value)

  • Media upload UI on /admin/ceremony/setup (anthem video, fanfare, slide images).
  • One-click backup button on /admin/system; quick "all attendees" push/comms preset.
  • Printable name badges with the dedicated check-in QR; day-of runbook page.
  • Post-event feedback survey (1–5 + comment) feeding the engagement score.
  • Ticket upgrades: attachments, internal staff notes, escalation flags + mail.

Trust & growth (mission-aligned, from the audit)

  • Public /about-scoring transparency hub (weights, rubric, hash-chain verify, lock metadata).
  • Vote-abuse intervention loop (auto-hold bursts, LinkedIn re-verify, clean-vote % KPI).
  • Sponsor ROI dashboard (impressions/clicks from page_views, per-tier CSV export).
  • Per-applicant judge-ready AI brief on the review page (FR-0407 completion).
  • Jury transparency post-lock (judge counts, rubric distributions, recusal register).
  • Season/alumni network (cross-season hall-of-fame profiles, finalist priority list).
  • Bilingual UI (EN/UR) + RTL for the Pakistani audience.

Engineering

  • Pagination UI for big admin lists (registrations/people/audit).
  • CSP hardening — remove 'unsafe-inline' (needs inline script/style extraction).
  • Data-retention jobs (page_views rollup, audit_log archive, log-mailer cleanup).
  • More OAuth providers for voters (X, Google). Referral tracking (done v1.3.0).
  • AI-generated share cards (cards.driver=ai) once an image API key is provided.
  • Multi-event homepage, leaderboard, PWA, REST API, webhooks (v1.4–1.5).
  • SMS channel (v1.6.0).

Workflow

Per feature: SRS use-case → workflow doc → code → CHANGELOG/ROADMAP/TODO → conventional commit → tag (details in WORKFLOW.md).