# Phase 1 delivery

## Installed result

The project is created under `outputs/zentrikhrms`. Laravel 13.37.0, Livewire 4.4.7, Fortify 1.41.0, stable Reverb 1.12.0, Tailwind and Alpine are installed, with locked PHP and npm dependencies. Laravel 13's PHP requirement was checked against the [official release notes](https://laravel.com/framework/docs/releases). The local PHP runtime is 8.3.6 and MySQL is 8.3.0. Production Compose and CI target PHP 8.4 and MySQL 8.4 LTS.

Database `zentrikhrms` was empty before installation. All five migrations are applied and every application table uses InnoDB. The local installation includes a Zentrik tenant/company, two subscription plans, thirteen module catalog entries, nine tenant roles, a platform administrator and a company administrator. Passwords are randomly generated and saved outside source in the separate local access file. MFA has not been bypassed or pre-enrolled for these accounts.

## Delivered behavior

- Transactional tenant provisioning, commercial module entitlements, dependency validation, custom plans, user quotas, trial/expiry/suspension fields and SaaS/dedicated subscription modes.
- Twelve organization unit types with append-only effective versions, parent relationships, historical chart and status, salary-band metadata, searchable/paginated lists, saved browser filters and transactional bulk status versions.
- Versioned position planning with separate legal employer, branch, department, grade, salary band, cost center, approved/occupied capacity, vacancies and line/matrix reporting. Cycles and cross-tenant references are rejected.
- Password login/reset, login and MFA throttles, password-confirmed MFA enrollment/recovery management, TOTP challenges and recovery-code consumption.
- Company-scoped roles and policies, protected Company Admin role, account creation/role assignment and isolated platform authority.
- Tenant/branch setting inheritance and module applicability preferences; read-only workflow definition history after disablement.
- Event registry, transactional audit/outbox, idempotent database bell delivery, retries, scheduled dispatch, Livewire polling and optional private Reverb/Echo updates.
- Responsive desktop/mobile UI, collapsible navigation, breadcrumbs, keyboard search, quick actions, scoped dashboard and accessible native forms.
- Versioned same-origin session API for organization/positions/chart, with the same membership/policy checks and CSRF boundary.
- Deployment, CI, encrypted SQL backup scaffold, architecture, backlog, threat model and operational runbook.

## Verification performed

| Check | Result |
| --- | --- |
| PHPUnit feature/unit suite using SQLite | 35 passed, 132 assertions |
| Same suite using separate MySQL database | 35 passed, 132 assertions |
| Additional InnoDB regression check | Passed, 28 assertions; all 26 tables and connection default verified |
| Playwright Chrome end-to-end and mobile checks | 2 passed |
| MySQL rollback and fresh migration rehearsal | All five down/up migrations passed in disposable test database |
| Installed application migrations | All five applied; local data retained |
| Frontend production build | Passed |
| Blade view compilation | Passed |
| Laravel Pint formatting gate | Passed |
| Docker Compose configuration validation | Passed; engine-independent YAML/environment validation |
| Composer locked dependency audit | No known security advisories |
| npm audit | Zero vulnerabilities reported |
| Screenshot inspection | Desktop dashboard, mobile dashboard and mobile login inspected |

Tests include missing-context denial, cross-tenant route and record IDOR, forged tenant IDs, scoped role validation, platform escalation rejection, read-only roles, MFA gating/login/confirmation/recovery, login throttles, history boundaries, hierarchy/reporting cycles, headcount limits, disabled/expired modules, branch preference enforcement, inherited settings, user quotas, atomic bulk updates, outbox idempotency, append-only audit, Livewire boundary rechecks, private-channel authorization and rendered admin screens. Browser tests exercise MFA login, creation, retained history, command search, notification actions, logout and mobile overflow.

The working database is separate from `zentrikhrms_codex_test` and `database/browser.sqlite`. Tests never truncate or roll back the working installation.

## Commands used

```text
composer create-project laravel/laravel outputs/zentrikhrms ^13.0
composer require livewire/livewire laravel/fortify laravel/reverb league/flysystem-aws-s3-v3 predis/predis
composer update laravel/reverb guzzlehttp/psr7 guzzlehttp/guzzle -W
npm install
npm install --save-dev @playwright/test
npm install laravel-echo pusher-js
php artisan migrate --force
php artisan db:seed --class=FoundationSeeder --force
php artisan zentrik:outbox
npm run build
php artisan test --compact
npx playwright test
php vendor/bin/pint
php vendor/bin/pint --test
php artisan view:cache
php artisan migrate:status
composer audit --locked
npm audit --audit-level=high
```

MySQL tests and rollback commands used only the explicitly selected disposable test database. The server's original MyISAM default caused an initial migration failure; the verified empty table created by that attempt was removed, InnoDB was explicitly configured, and installation succeeded. Date-boundary and create-form bugs discovered during testing were fixed and covered by regression tests.

## Acceptance status and limits

Tenant isolation, module controls, secure authentication, organization history, role behavior, local migrations and browser workflows are verified. Infrastructure files are provided for review. Docker Desktop's Linux engine is not available on this machine, so container builds/startup, MySQL 8.4 execution, Redis/Reverb integration and encrypted backup/restore have not been exercised locally. CI is configured but has not run on a remote GitHub runner. Production readiness requires those deployment gates and environment-specific security review.

No document uploads, payroll, employee master, recruitment, asset/fleet operations, custom-domain TLS automation or signed offline licence verification are exposed. These are later approved phases. Workflow definitions in Phase 1 do not execute approvals; only the audit event/bell pipeline runs. Module disabling preserves history. Language preferences and RTL architecture exist, while translated Arabic content is future work. Audit model immutability does not protect against privileged database edits. Backup scaffolding covers SQL only; offsite replication and a restore drill remain operational requirements.

Phase 2 is awaiting explicit approval, as requested in the supplied specification.