Carceris v0.6.14, Public Release Candidate Hardening

Carceris v0.6.14

Carceris v0.6.14 is the first public GitHub release candidate after the v0.6.11 build.

This release focuses on public-release readiness, upgrade safety, documentation cleanup, manifest validation, permission tightening, and shared-hosting compatibility. It also fixes a migration runner issue discovered during upgrade testing from v0.6.11.

Highlights

• Added release manifest validation for upgrade packages.
• Added stronger release-audit tooling.
• Improved upgrade safety and package integrity checks.
• Added migration baselining for fresh installs.
• Added schema health checks for installed systems.
• Tightened Viewer permissions around live log access.
• Added a user Account page for password changes.
• Improved correction and void workflow validation.
• Cleaned stale maintenance/admin workflow references.
• Improved backup, restore, and SMTP credential documentation.
• Updated public GitHub documentation for install, upgrade, security, roles, testing, and production deployment.
• Fixed a migration runner buffering issue affecting some MySQL/MariaDB shared-hosting environments.

Upgrade safety

The upgrade system now performs stricter package validation using RELEASE_MANIFEST.json.

Upgrade validation checks that expected files exist, match their recorded hashes, and that unexpected extra files are not included in the package. This helps protect the upgrade process from incomplete, modified, or malformed release ZIPs.

This release also improves cleanup behavior for stale files removed from newer packages.

Install and migration improvements

Fresh installs now baseline migrations correctly, so a new installation does not incorrectly appear to have pending historical migrations.

The system status and audit tooling now provide better visibility into schema health and release integrity.

Permission and workflow improvements

Viewer access has been tightened so read-only users cannot access the live Active Log through direct routes.

Correction and void workflows were also cleaned up to improve validation, return behavior, and record integrity.

Reporting, backup, and security documentation

Documentation has been updated to better explain:

• internal facility deployment expectations
• shared-hosting testing considerations
• upgrade package validation
• backup and restore sensitivity
• SMTP credential storage
• cron behavior
• role permissions
• production-readiness checks

Fixed

• Fixed a failed upgrade path from v0.6.11 to later packages caused by result-returning marker migrations on some MySQL/MariaDB hosts.
• Replaced result-returning marker migrations with comment-only markers.
• Updated the migration runner to safely handle result-returning SQL statements.
• Enabled buffered MySQL queries when supported by the server.
• Prevented raw cron exception messages from being exposed in web responses.
• Improved stale-file cleanup during upgrade.
• Strengthened release-audit checks against unlisted files.

Validation

This release package was checked for:

• PHP syntax validity
• route and include integrity
• release manifest validity
• upgrade package integrity
• install path safety
• upgrade path safety
• public page access
• admin page access
• Viewer permission behavior
• config and storage preservation
• ZIP integrity

Deployment note

Carceris is designed for internal correctional facility logging workflows.

Do not expose a production Carceris instance containing real operational data to the open public internet without proper server hardening, HTTPS, access controls, backups, and facility approval.

For testing on shared hosting, use fake data only unless the hosting environment has been reviewed and approved for the sensitivity of the records being stored.

Carceris v0.6.11, Open-Source Release Candidate

Carceris v0.6.11

Carceris is an AGPLv3 self-hosted PHP and MariaDB daily logging system for correctional facilities. This release is an open-source release candidate intended for internal facility deployment, controlled pilot testing, and production-readiness evaluation.

Current status

Carceris v0.6.11 is suitable for internal testing and controlled internal deployment planning.

Public internet exposure is not recommended without additional hardening, access controls, and independent security review.

Highlights

• Active daily operational log
• Operational day start-time settings
• Late and backfilled entries
• Archive search with basic and advanced search
• Print view
• PDF, text, and HTML completed-log downloads
• Daily Logs operations dashboard
• Optional Log Delivery
• Delivery history and failed-send review
• Correction and void workflow
• Correction and void history
• Audit log
• Role-based access for Admin, Supervisor, Officer, and Viewer
• Admin Backup & Restore
• Admin ZIP upgrade system
• Production readiness and system status checks
• GitHub-ready documentation cleanup

Documentation included

• INSTALL.md
• UPGRADE.md
• SECURITY.md
• DEPLOYMENT.md
• BACKUP-RESTORE.md
• ROLE-PERMISSIONS.md
• ADMIN-GUIDE.md
• PRODUCTION-CHECKLIST.md
• TESTING.md
• CONTRIBUTING.md
• CODE-AUDIT.md

License

Carceris is released under the GNU Affero General Public License v3.0.

SPDX-License-Identifier: AGPL-3.0-only

Deployment note

Carceris is designed for internal facility servers, LAN or VPN access, firewalled environments, and facility-controlled workstations.