diff --git a/CHANGELOG.md b/CHANGELOG.md
new file mode 100644
index 0000000..ba98835
--- /dev/null
+++ b/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable project changes should be recorded here before or with the matching Git commit.
+
+This project uses Git as the primary rollback trail. The `.old` convention is reserved for risky manual rewrites, legacy file replacement, or generated artifact recovery where a second local copy is useful before editing.
+
+## 2026-07-10
+
+### Added
+
+- Created the Laravel Provider Exchange prototype with Breeze authentication, seeded demo users, and role support for admins, providers, buyers, and hybrid accounts.
+- Added provider and buyer profile management with service areas, profile details, and external profile snapshot records.
+- Added social posts, buyer job posts, provider quotes, quote revisions, quote decline flow, and buyer quote acceptance.
+- Added work orders with buyer/provider participants, status transitions, deliverables, evidence attachments, completion notes, and work-order messages.
+- Added mutual reviews, category review metrics, peer-review disputes, dispute comments, evidence files, and structured dispute votes.
+- Added database notifications and a notification inbox with unread counts and mark-read actions.
+- Added a universal polymorphic rating layer for provider profiles, buyer profiles, job posts, work orders, and disputes.
+- Added search/filter forms for provider, buyer, and job directories.
+- Added MIT license and first-pass open-source/platform guardrails.
+
+### Verified
+
+- `php artisan test` passed with 35 tests and 116 assertions.
+- `npm run build` passed with a production Vite build.
+
+### Notes
+
+- Existing Git subjects are terse because commit message input in this environment repeatedly collapsed longer subjects to `Add`. This changelog is the durable human-readable record for those early commits.
diff --git a/README.md b/README.md
index cee0965..5a8debc 100644
--- a/README.md
+++ b/README.md
@@ -4,6 +4,14 @@ Provider Exchange is an early Laravel prototype for a provider-centered field se
 
 The code is intended to be open source under the MIT License.
 
+Project record keeping lives in:
+
+- `CHANGELOG.md` for shipped changes, verification notes, and unusual commit/history notes.
+- `docs/ROADMAP.md` for the current build direction and deferred features.
+- Git for rollback and branch history.
+
+The `.old` backup convention is not used for routine Laravel edits in this project. Use Git for normal recovery. Create a local `.old` copy only before risky manual rewrites, legacy file replacement, or generated artifact recovery where a second local copy is useful before editing.
+
 The product goal is not to clone Field Nation. The first version focuses on:
 
 - provider and buyer profiles;
@@ -57,6 +65,8 @@ npm run build
 
 ## Current Roadmap Status
 
+See `docs/ROADMAP.md` for the durable roadmap. The short status below is a convenience snapshot.
+
 1. Foundation: Laravel app, auth, roles, seeded demo users.
 2. Profiles: provider and buyer profiles.
 3. Social layer: community feed posts.
diff --git a/docs/ROADMAP.md b/docs/ROADMAP.md
new file mode 100644
index 0000000..5dfed4d
--- /dev/null
+++ b/docs/ROADMAP.md
@@ -0,0 +1,53 @@
+# Provider Exchange Roadmap
+
+Provider Exchange is a Laravel application for a provider-centered field-service network. The project should stay open source, avoid rate-setting, avoid payment custody in the first version, and keep reputation mutual between buyers and providers.
+
+## Current Foundation
+
+- Laravel app with Breeze authentication.
+- Role support for admin, provider, buyer, and hybrid users.
+- Seeded demo users for local testing.
+- Provider and buyer profile directories.
+- Community feed posts.
+- Buyer job posts and provider quote submission.
+- Quote revisions, quote decline flow, and quote acceptance.
+- Work-order creation from accepted quotes.
+- Work-order status transitions, messages, attachments, deliverables, and completion notes.
+- Mutual reviews with category metrics.
+- Peer-review disputes with comments, evidence, structured recommendations, and public vote breakdowns.
+- Universal community ratings for buyers, providers, job posts, work orders, and disputes.
+- Database notification events and notification inbox.
+- Starter Sanctum API surface for future app clients.
+- MIT license and no-payment/no-rate-setting guardrails.
+
+## Operating Principles
+
+- Providers and buyers are independent businesses.
+- The platform should not set, recommend, or enforce market rates.
+- Providers should control rate cards and terms.
+- Buyers should control posted offer terms.
+- Payment remains direct between buyer and provider unless a compliant payment partner is deliberately added later.
+- Reputation should be mutual, transparent, and appealable through community review.
+- Dispute voting is a community reputation signal, not legal adjudication.
+
+## Next Build Phases
+
+1. Profile depth: richer galleries, equipment lists, certifications, insurance fields, service coverage maps, and imported review summaries.
+2. Directory quality: saved searches, better filtering, profile badges, availability signals, and stronger buyer/provider discovery pages.
+3. Work-order depth: checklist templates, required evidence rules, appointment windows, onsite timestamps, and change-request records.
+4. Reputation refinement: rating category definitions, anti-abuse controls, edit windows, report flows, and moderation views.
+5. Dispute workflow: better evidence timelines, reason-coded votes, quorum/visibility rules, and admin/community moderation tools.
+6. Notifications: channel preferences, email templates, and event-specific subscription controls.
+7. API/mobile prep: token-scoped endpoints, versioned API resources, geolocation check-in groundwork, and mobile-safe work-order actions.
+8. Import tooling: guided manual imports for Field Nation, WorkMarket, and similar profile/review history.
+9. Admin operations: audit logs, queue health, system status, content moderation, and backup/export workflows.
+10. Deployment hardening: production environment docs, queue worker setup, scheduler setup, storage policy, and server provisioning notes.
+
+## Future/Deferred
+
+- Escrow or payment custody.
+- Automated rate recommendations.
+- Native mobile apps.
+- Real-time chat/websocket presence.
+- Marketplace-wide dispute binding beyond voluntary community reputation.
+- Automated scraping of third-party platforms where authentication, terms, or privacy boundaries are unclear.