Root hosting deployment

What changed in v1.2.0

The package now extracts directly into the hosting root. There is no wrapper folder and no required public/ document root. This is the layout expected by many shared-hosting control panels where the domain root is already the web root.

Required top-level files:

index.php
.htaccess
assets/
content/
docs/
src/
templates/
config/
.uai/
agent-file-handoff/

Deployment steps

1. Back up the existing domain root.
2. Remove the old extracted wrapper folder if present.
3. Remove the old public/ folder if it came from the earlier package.
4. Extract the new ZIP directly into the domain root.
5. Confirm index.php exists at the same level as assets/ and content/.
6. Visit /health.
7. Visit /start-here.
8. Confirm /docs/ returns forbidden or not found, not a directory listing.
9. Confirm /assets/css/app.css returns CSS.

Why the old package showed a directory index

The previous package expected the server document root to point at public/. When that package was extracted into a shared-hosting root, the server saw folders such as public, content, docs, and src instead of a root index.php. The server therefore displayed an Index of / page.

Private directories

The root .htaccess denies direct browser access to application internals. PHP still reads these folders locally. Research downloads are served through manifest-controlled routes rather than direct file browsing.

PROCEDURE verify_root_deploy(base_url)
    REQUIRE HTTP_GET(base_url + "/").status == 200
    REQUIRE HTTP_GET(base_url + "/health").json.status == "ok"
    REQUIRE HTTP_GET(base_url + "/assets/css/app.css").status == 200
    REQUIRE HTTP_GET(base_url + "/docs/").status IN [403, 404]
    REQUIRE HTTP_GET(base_url + "/.uai/").status IN [403, 404]
END PROCEDURE

Environment variables

Use APP_CANONICAL_URL=https://modelbreeder.com, APP_ENV=production, and APP_DEBUG=0 when the host supports environment variables. APP_CANONICAL_URL is only a metadata fallback. Public navigation, CSS, JavaScript, manifests, and image paths are root-relative so local development hosts cannot leak into production HTML.

Localhost URL failure mode

If a host inherits a local URL such as http://127.0.0.1:8080, visitors cannot load assets from that address because it points at their own machine. Version 1.2.1 prevents this by using root-relative public URLs for navigation and assets.