v1.0.0

First stable release of Quiote.

Quiote began as a PHP 8 port of Agavi, an
MVC framework whose active development ended in the mid-2010s. What started
as a compatibility port (PHP 7.4, then 8.2, then 8.4) grew into a ground-up
rewrite of the framework's internals, to the point that little of the
original design remains.

One of the biggest drivers of that rewrite was FrankenPHP worker mode.
Quiote is built to run as a long-lived worker process, not the traditional
one-request-then-die php-fpm/Apache model — that meant auditing and fixing
every piece of global/static state that used to quietly reset itself between
requests (see Quiote\Context, config caching, and the DI container
lifecycle). Worker mode is the first-class, recommended way to run Quiote;
php-fpm/Apache still work, but they're the compatibility path, not the
target.

• PSR-15 middleware pipeline replaces Agavi's global/action filter chain
  end to end (routing, content negotiation, CSRF, security, validation,
  dispatch, form population, and more each live in their own middleware).
• PSR-7 HTTP messages (via nyholm/psr7) instead of Agavi's bespoke
  request/response objects.
• A DI container (Quiote\DI\Container) with constructor injection for
  actions, services, and views, replacing factories.xml-driven
  instantiation.
• PSR-3-compatible structured logging (Quiote\Logging\*), with
  per-category log levels and pluggable sinks, replacing ad-hoc error
  logging.
• CSRF protection built into the middleware stack
  (symfony/security-csrf), covering both cookie-based PHP UIs and
  header-based API/SPA clients.
• Authentication, layered on top of the existing authorization pipeline:
  form login and HTTP Basic (quioteframework/auth), bearer/JWT resource-server
  validation with JWKS support (quioteframework/auth-jwt, firebase/php-jwt),
  and an OAuth 2.1 / OIDC client with mandatory PKCE plus Client Credentials for
  service-to-service calls (quioteframework/auth-oauth, league/oauth2-client).
  Firewalls, password hashing, and pluggable user providers (in-memory, PDO,
  callable) are all DI-swappable, the same way every other Quiote subsystem is.
• A config system that isn't XML-only anymore: settings, factories,
  databases, and most other config types can be written as plain PHP
  arrays or YAML instead of XML, mixed and matched per file, with
  autodetection or an explicit override, and full parent/imports
  inheritance across formats.
• A validator compiler: XML validators.xml files still work, but
  validators can now be declared directly in PHP via a fluent builder.
• An MCP server exposing the application over stdio and HTTP (with
  bearer auth), including actions-as-tools with validator-derived JSON
  Schemas.
• Symfony components for routing, caching (including APCu-backed config
  caching for persistent workers like FrankenPHP), rate limiting, and YAML
  parsing, instead of Agavi's homegrown equivalents.
• A modern PHP 8.5 codebase: typed properties, enums, readonly
  properties, first-class callable syntax, and attributes throughout, in
  place of the PHP 5-era code Agavi started with.

The project was renamed from Agavi to Quiote once the rewrite had diverged
far enough that "Agavi" no longer described it. Quiote is the flower that
blooms from the agave plant at the end of its life.

This release predates the project's adoption of Conventional Commits, so it
ships with hand-written notes rather than a generated changelog. Every
release from here on is generated from the commit history by
git-cliff.