# PHASE 1 - ARCHITECTURE

## Stack
- PHP 8.1+ (no Python, no Node mandatory)
- MySQL/MariaDB
- MVC + Service Layer
- Plugin Hook System (WordPress-like)
- Cron-based Queue

## Core Layers
1. Core Framework: Router, Request, Response, DB, Security, Cache
2. Auth + RBAC
3. Plugin Engine: manifest.json, hooks, migrations
4. Content Source Engine
5. Discovery Engine: RSS + Sitemap (with XXE/SSRF protection)
6. Link Library + Content Pool
7. Distribution Engine
8. Publishing Engine (Adapter Pattern for platforms)
9. Cycle Engine
10. Analytics + AI
11. Backup/Recovery

## Security by Design
- PDO prepared statements only
- CSRF tokens
- XSS escaping
- SSRF: block private IPs (10/8, 172.16/12, 192.168/16, 127/8, 169.254, ::1, fc00::/7)
- XXE: LIBXML_NOENT disabled, libxml_disable_entity_loader
- File upload whitelist