Chaos MVC 1.2.1

Release Date: September 19, 2026
Release Type: Security and Core Feature Release

Download ChAoS MVC 1.2.1

---

Build More. Fight the Framework Less.

ChAoS MVC 1.2.1 is a major step forward for building real websites with ChAoS.

This release introduces built-in Pages, greatly expanded Markdown support, RSS feeds, improved search-engine discovery, and a machine-readable Site Resource Declaration.

You can now create traditional website Pages directly in ChAoS, publish rich Markdown content, automatically expose public content to search engines and other discovery systems, and keep your installation's content safely separated from the protected Core.

Already running ChAoS MVC 1.2.0?

Your Core Updater can take care of the upgrade.

New to ChAoS?

Welcome. 1.2.1 gives you considerably more to build with.

---

Pages Are Here

Not everything belongs in a Module.

Sometimes you just need a page.

ChAoS MVC 1.2.1 introduces a filesystem-backed Pages system for creating content such as:

• About pages
• Documentation
• Policies
• Project information
• Landing pages
• Contact information
• Other permanent website content

Pages get clean URLs:

/about-us
/documentation
/our-project

And you can write them using:

• Markdown
• HTML
• Plain text
• JSON

Pages support draft and published states, Admin editing, theme-aware rendering, slug changes, recoverable deletion, and automatic discovery by supported ChAoS resources.

Your Pages live under /user/pages, keeping your content separate from the protected ChAoS Core.

---

Markdown Got a Serious Upgrade

If you like writing in Markdown, 1.2.1 is a good release for you.

ChAoS now supports a much richer Markdown vocabulary, including:

• Headings
• Bold and italic text
• Strikethrough
• Code and fenced code blocks
• Links and automatic URL linking
• Blockquotes
• GitHub-style alerts
• Ordered and unordered lists
• Nested lists
• Task lists
• Tables
• Definition lists
• Footnotes
• Escaped Markdown characters
• Controlled small text
• Allowlisted named colors

That makes Markdown useful for far more than simple Posts. Documentation, research, project pages, technical writing, and long-form content can all remain readable in source form while rendering cleanly on your site.

ChAoS continues to escape raw source HTML before transforming supported Markdown, and unsafe URL schemes remain rejected.

---

Your Site Is Easier to Discover

Publishing something shouldn't mean manually updating five different discovery files.

ChAoS 1.2.1 modernizes its discovery system so supported resources can automatically find public content across your installation.

That includes:

• Public Core routes
• Public user Modules
• Published Pages
• Published Posts where applicable

ChAoS can use that information to maintain:

sitemap.xml
ror.xml
rss.xml
llms.txt
site.json

Add something public to your site, refresh your indices, and ChAoS does the bookkeeping.

---

RSS Is Now Built In

ChAoS MVC now includes Core RSS support for published Posts.

Your site can provide a standard RSS feed with stable post URLs and XML-safe content, including presentation support through the included RSS stylesheet.

For site owners, that means another discovery and subscription mechanism is available without requiring an additional Module.

---

Meet site.json

ChAoS MVC 1.2.1 introduces a machine-readable Site Resource Declaration.

site.json describes the installation and its public resources using a defined schema, giving machines a predictable way to understand what a ChAoS site exposes.

Declarations are validated against the STN-Labz Site Schema before publication.

Remote schema data is used strictly for validation and receives no executable authority inside ChAoS.

The 1.2.1 security review also tightened this system so public requests consume the existing validated declaration rather than repeatedly regenerating it.

---

Your Stuff Stays Yours

One of the most important ChAoS boundaries remains unchanged:

Updating ChAoS does not mean replacing your website.

The 1.2.1 Core update preserves installation-owned content, including your:

• Modules
• Themes
• Pages
• Public assets
• Site configuration
• Installation data

The distributed Core remains separate from the things that make your installation yours.

There is also no database migration required for 1.2.1.

---

The Stock Modules Got Some Attention Too

The included Home and Example Modules were reviewed as part of the 1.2.1 release process.

Home remains the simple public starting point for a ChAoS installation.

Example remains the reference Module for developers and demonstrates the current ChAoS Module lifecycle, including:

• MVC structure
• Public and Admin routing
• CSRF-protected changes
• Database lifecycle handling
• Schema installation and migration
• CRUD operations
• Data reset and deletion
• Input validation
• Escaped output

If you're learning to build ChAoS Modules, Example is there specifically to be taken apart.

---

Already Running ChAoS MVC 1.2.0?

Updating is straightforward.

Go to:

Admin → Core Updater

The updater verifies the release and package, protects installation-owned files, creates a previous-Core snapshot, installs the new Core, and verifies the result.

If installation fails, the previous Core can be restored.

As always, keep a current external backup before updating production software.

---

New to ChAoS MVC?

ChAoS MVC is a lightweight PHP MVC framework built around a simple idea:

The Core provides the framework. Your installation belongs to you.

Start with the framework, choose or build a Theme, create Pages, add Modules when you need application behavior, and extend the installation without turning every website feature into Core code.

ChAoS MVC 1.2.1 gives that model considerably more room to grow.

Download ChAoS MVC 1.2.1

---

For Developers

Want the technical details?

• Developer Documentation
• Module Creation Guide
• Theme Documentation
• Full Changelog

The complete technical change record remains available in the ChAoS MVC documentation.

1.2.0

ChAoS MVC 1.2.0

ChAoS MVC 1.2.0 establishes the finalized separation between framework-owned Core files and installation-owned user content.

This release also introduces a rebuilt Core updater, complete module and theme update lifecycle improvements, stronger release verification, and additional security maintenance.

Core Updater

The Core updater now:

• Updates only framework files under /app.
• Never modifies /user or /public.
• Preserves installation-owned app/core/config.php.
• Preserves app/data and app/views/public.
• Removes obsolete Core files during replacement.
• Verifies every staged and installed Core file against the release manifest.
• Rejects files outside the authorized Core boundary.
• Rejects external database-migration payloads.
• Retains exactly one previous Core snapshot.
• Provides authenticated, CSRF-protected Core rollback.
• Automatically restores the previous Core when installation fails.
• Keeps Admin accessible while updater maintenance mode is active.
• Reports early manifest failures instead of leaving progress frozen.
• Requires generated releases to contain all boot-critical framework files.

Core release packages are produced and published exclusively by chaos-mvc.org.

Module Updates

Module maintenance now includes:

• Signed package verification.
• RSA-SHA256 and OpenPGP publisher verification.
• SHA-256 package-integrity verification.
• Locally pinned publisher trust.
• HTTPS update-source enforcement.
• Authorized package-host validation.
• Whole-directory staged replacement.
• Removal of obsolete module files.
• One previous filesystem snapshot.
• Automatic restoration when activation fails.
• Manual module rollback.
• Signed, version-specific module database migrations.
• Module-owned database-table confinement.
• Durable migration replay prevention.
• Transactional module removal and Nuke recovery.
• Accurate Up to date, Update available, and failure reporting.

Modules without a public admin() method no longer appear in site administration.

Theme Updates

Themes now use the same general update lifecycle as modules:

• Remote version discovery.
• Signed release verification.
• RSA-SHA256 and OpenPGP support.
• SHA-256 package verification.
• Locally pinned publisher identity.
• Staged whole-theme replacement.
• Archive path and size validation.
• Required theme-part validation.
• PHP syntax validation before activation.
• Automatic recovery from failed activation.
• One previous theme snapshot.
• Manual theme rollback.
• Active-theme preservation during updates.

Theme packages cannot contain SQL migrations or claim database ownership.

User-Land Separation

This release strengthens the boundary between Core and user-land components:

• User modules are loaded from /user/modules.
• User themes are loaded from /user/themes.
• Core controllers retain routing priority.
• Service modules can receive declared index parameters.
• One-character module slugs are supported.
• Module models and views resolve inside their established module context.
• User-land code does not automatically inherit unrestricted Core authority.
• Domain-specific modules and themes remain outside Core updates.

Themes and Administration

• Administrators can upload, select, and apply user themes.
• Site administration inherits the active site theme.
• Core header, navigation, and footer files remain available as fallbacks.
• Theme metadata and update-source errors are reported accurately.
• The Admin dashboard displays the installed ChAoS MVC Core version.

Security

Security maintenance includes:

• Rejection of comments targeting unpublished posts.
• Strengthened module class-ownership checks.
• Confined archive extraction.
• Rejection of path traversal and symbolic-link archive entries.
• Portable filename and case-collision checks.
• Bounded manifest, package, archive-entry, and expanded-file sizes.
• Public-address validation for update servers.
• TLS peer-name verification.
• Rejection of redirects during module and theme package retrieval.
• Publisher-key pinning.
• Rejection of checksum-only publisher authentication.
• Isolated OpenPGP verification keyrings.
• Authentication throttling support.
• Improved output handling in affected views.
• Safer module filesystem and database lifecycle operations.

Maintenance and Error Handling

• Core error handling is registered during bootstrap.
• Framework errors render through the site instead of generic browser pages.
• Maintenance mode can be enabled or disabled through Site administration.
• Updater maintenance does not block administrator recovery routes.
• Logout uses POST and CSRF protection and returns users to /.
• Optional Sentinel perimeter inspection remains available when Sentinel is installed.
• Installations without Sentinel continue normally.

Release Compatibility

• Target version: 1.2.0
• Oldest supported automatic-update version: 1.1.9
• Core database migration: none
• PHP database schema changes: none

Module database migrations remain independently controlled by their signed module packages.

Updating

Before updating:

1. Confirm the installation reports ChAoS MVC 1.1.9 or newer.
2. Back up installation-owned data as normal operational practice.
3. Open Admin → Core Updater.
4. Select Update Now.
5. Confirm that the installed Core reports 1.2.0.
6. Verify the public site, Admin interface, active theme, modules, and assets.

The updater retains one previous Core filesystem snapshot for rollback.

Live Validation

The corrected Core update pipeline was successfully exercised against live ChAoS MVC installations before release.

Documentation

This release includes expanded documentation for:

• Module creation and lifecycle operations.
• Theme update packages.
• RSA-SHA256 release signing.
• OpenPGP and RSA publisher verification.
• Core, module, and theme rollback behavior.
• Installation and ownership boundaries.

ChAoS MVC v1.1.9 has been released

Chaos MVC 1.1.9 — Separation & Security

Chaos MVC 1.1.9 completes a major architectural milestone focused on installation ownership, module boundaries, theme support, and security hardening.

This release continues the fundamental ChAoS principle:

Protect the core. Grow outward.

What's New

Core / User Separation

Chaos MVC now establishes a clear ownership boundary between framework-managed code and installation-managed code.

• Core framework components remain under /app
• Installation-owned modules live under /user/modules
• Installation-owned themes live under /user/themes
• Module loading and routing respect the Core/user ownership boundary
• Module administration operates against the user module space
• Existing installations can migrate into the new structure without abandoning the established MVC architecture

User Themes

Installation-owned PHP themes are now supported as a first-class part of Chaos MVC.

Themes can provide their own:

• Header
• Navigation
• Footer
• CSS
• JavaScript
• Images
• Icons

Theme assets are resolved through Chaos MVC rather than requiring theme files to be copied into the public web root.

Module Security Hardening

The module system received additional authority and ownership validation.

Chaos MVC now more strictly controls:

• Module controller ownership
• Routable module actions
• Declared module routes
• Administrative module access
• Package identity
• Update metadata
• Release integrity
• Module signing trust

These changes strengthen module isolation while preserving the ability for modules to grow independently around the protected Core.

Module Updating

The module update lifecycle has been expanded and qualified against a real existing Chaos MVC installation.

The updater now supports controlled replacement of module source while preserving installation-owned trust information and validating release integrity before activation.

Module packages may also carry explicitly declared, version-specific database migrations when an existing installation requires a schema change.

Database migrations are tied to the signed module package and the specific installed-to-target version transition rather than being independently retrieved from a remote source.

Error Handling

Core error handling has been strengthened to provide safer production failures while retaining useful diagnostic correlation through server-side reference identifiers.

Existing Installation Qualification

Chaos MVC 1.1.9 was qualified through migration and operation of an existing production-style Chaos MVC installation rather than relying solely on a clean installation environment.

Testing covered the new Core/user ownership model, user themes, module administration, routing boundaries, update discovery, signed package verification, source replacement, database migration, preservation of existing module data, and post-update module operation.

Security

Version 1.1.9 includes security-related changes to module ownership, routing, update validation, package verification, signing trust, and application boundaries.

Detailed implementation and exploit-specific information is intentionally not included in the public release notes.

Upgrade Notice

Chaos MVC 1.1.9 introduces significant ownership and directory-structure changes.

Existing installations should be backed up before migration or upgrade, particularly installations containing custom modules, themes, or locally modified framework files.

Looking Ahead

With the Core/user ownership boundary established and qualified, development can proceed toward the next stage of the Chaos MVC update lifecycle.

---

Chaos MVC 1.1.9

Protect the core. Grow outward.

v1.1.8

RELEASE

Version: 1.1.8

This release comes with security patches to known issues
See the Changelog below

Added

• Registration route /register → auth → register
• Full registration flow integrated with accounts_model::create($data)
• Email address update functionality in admin accounts

Fixed

• Admin account creation not submitting (routing + POST handling)
• Inconsistent controller-to-model data handling
• Broken signup method (now model-compliant)
• Session messaging not displaying reliably in account actions
• Admin account deletion incorrectly reporting "You cannot delete your own account" when deleting other accounts
• Account deletion routing corrected so Admin → Accounts uses the intended account deletion handler

Changed

• Standardized all account operations to array-based model input
• Enforced role assignment via user_level (1 = user, 9 = admin)
• Updated all registration forms to match new routing
• Refactored authentication controller for consistent MVC flow

Cleaned

• Enforced PSR-12 formatting across accounts and auth systems
• Added DocBlock coverage to controllers and models
• Standardized database queries to positional bindings (?)
• Removed inconsistent AI-generated logic and patchwork code

Chaos-MVC-1.1.7

Chaos MVC v1.1.7 introduces a native module update system, enabling controlled version management and seamless updates across the ecosystem.

Chaos-MVC-1.1.6

Only here for the Tag. Final files are released on our primary domain. Do not trust code here on GitHub, as it is never final.