Campus Placement Engine v0.1.0-alpha.4

Campus Placement Engine v0.1.0-alpha.4

The fourth public alpha turns the Engine into a safer integration platform while
making day-to-day placement operations easier to understand. It remains a
dependency-light, independently self-hosted product; Cloud is optional and does
not own placement behaviour or institution records.

What changed

• Installed systems now fail closed when durable authorization state is missing,
  invalid, or unavailable. Protected routes and commands return fixed denials
  without exposing records, and optional observers can no longer roll back core
  placement decisions.
• The public integration contract now governs a privacy-reviewed application
  status event, signed institution webhooks, institution-local service accounts,
  bounded read APIs, and one controlled application-transition command. API
  retries are idempotent and state changes require the expected aggregate
  version.
• Webhook delivery is asynchronous, encrypted at rest through externally
  supplied keys, HTTPS-only, redirect-free, SSRF-resistant, retryable, and
  dead-lettered with audited replay. Worker fencing and concurrency contracts run
  on SQLite and PostgreSQL.
• A new Candidate opportunities workspace gives authorized university teams
  one outcome-focused view of candidates who need action. It uses existing
  product records, distinguishes unavailable evidence from an empty queue, and
  hides action links the current role cannot use.
• Integration setup and health now use consistent language and show worker,
  backlog, dead-letter, TLS, encryption-key, and database readiness without
  exposing endpoints or secrets. php placement support-report emits a bounded,
  privacy-safe diagnostic document for support handoffs.
• Installation, migration, database ownership, backup/restore, package, and
  concurrency boundaries received additional negative-path and PostgreSQL
  coverage. The release archive includes all governed contracts, examples,
  documentation, and verification tests while excluding runtime and quarantined
  material.

Upgrade from alpha.1, alpha.2, or alpha.3

Preserve the current database, backups, runtime configuration, and data/
directory. Replace only application files with the verified alpha.4 package,
then run:

php placement upgrade
php placement doctor
php placement readiness

Configure webhook encryption keys and the Integration worker before enabling
signed webhooks. Create narrowly scoped service accounts only for approved
integrations. Unknown migration history, ownership ambiguity, authorization
state failure, or institution-identity drift fails closed and requires operator
review rather than manual registry edits.

Hosted and Connector operation

Cloud consumers must pin this exact release commit, artifact SHA-256,
managed-hosting contract, and contracts/public-integration.v1.json digest.
Connector artifacts, tenant-local credentials, execution isolation, runtime
receipts, canary evidence, and rollback generations remain separate deployment
proofs; none are implied by the Engine package alone. Placement payloads and
institution API credentials must never enter the Cloud control plane.

Release boundary

This remains an evaluation alpha, not a claim of production capacity or an
unattended SaaS for a particular university. Real deployment still requires an
institution-approved security and privacy review, verified DNS and certificates,
secret management, monitoring and on-call operations, encrypted offsite backups,
isolated restore drills, and a controlled pilot.

If CPE_POSTGRES_TLS_TEST_URL is absent, this evaluation-alpha release may skip
live negotiated-TLS evidence from a production-shaped PostgreSQL endpoint and
must report that omission. Beta, release-candidate, stable, malformed, and other
tag classes fail before publication without that evidence.

Real candidate records, runtime databases, exports, credentials, backups, and
private historical material are excluded from release assets and must never be
committed to the repository.