2.0.3

fix(sandbox): narrow admin-API surface to api/core, keep customer api/front open

The api prefix covered both api/core/* (API to admin) and api/front/*
(the customer-facing REST API: front login, member orders). Guarding the
whole api prefix would wrongly block customer API calls.

Narrow admin_surface_prefixes to api/core so only the admin-facing API is
sandboxed; storefront web checkout/registration (Livewire) and the customer
REST API (api/front/*) keep working. version 2.0.3.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

2.0.2

fix(sandbox): scope write-guard to admin + admin-API surfaces only

The Layer A DB::beforeExecuting hook is global, so it also fired on the
storefront: a product page write (view counter) was blocked whenever an
admin was logged in the same browser, rendering a full-page 403 on
/product/*.html.

isActive() now also requires isAdminSurface(request()): the request path
starts with an admin/API prefix (admin_surface_prefixes + GP247_ADMIN_PREFIX

• vendor/pmo when installed), or a Livewire update whose Referer host page is
  admin. Storefront, console and queue are never enforced.

• config.php: add admin_surface_prefixes (gp247_admin, api).
• readme: note admin/API-only scope; version 2.0.2.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

2.0.1

docs(sandbox): rewrite bilingual README for v3 guard; set configCode Security

• readme_vi.md / readme.md: 247-doc bilingual docs describing the v3
  two-layer guard (DB write choke point + LFM route-name block), the
  .env switch, infra allowlist, and conditions/Q&A. Replaces the stale
  v1 method-based description.
• gp247.json: group under configCode "Security"; bump version 2.0.1.

Co-Authored-By: Claude Opus 4.8 noreply@anthropic.com

1.0.2

Update new config

1.0.1

Improve process code

1.0

Fix condition middleware