# Phase 6 delivery — local default, optional deployment capabilities

The user approved Phase 6 and then requested a simple setup without additional configuration or Cloudflare. The installed default therefore remains the existing local WampServer application at http://127.0.0.1:8000/login, with database zentrikhrms, root and a blank password. Existing accounts/MFA are preserved. No public domain, cloud account, external IdP, production licence, webhook receiver or general worker was activated.

## Changed areas

| Area | Concrete implementation |
| --- | --- |
| Local startup | Start Zentrik HRMS.cmd and scripts/start-local.ps1 verify InnoDB, reuse/start the loopback PHP server and open the application without changing credentials or starting delivery workers |
| Branding | Tenant name, safe raster logo/favicon, accessible theme color, welcome text, entitled platform hiding; workspace/login/print/email presentation |
| Domain/TLS | Tenant ownership TXT plus CNAME verification, hostname state machine, HTTPS routing/certificate proof, fallback host mapping, Caddy on-demand TLS allow adapter, host-only secure cookies, lost-DNS recheck |
| Offline | Fixed RSA/SHA-256 verifier, externally trusted public keys, installation/company/sequence/date/user/module/feature binding, issuer-only signing tool and fresh installer; network-independent licence validation |
| APIs | Versioned bearer endpoints with explicit field/action registries, hashed revocable tokens, current user/MFA/role/module checks, bounded pagination/body/rates and transactional idempotency receipts |
| Webhooks | Transactional event capture, encrypted signing secret, reference-only JSON, timestamp HMAC, delivery reservation/deduplication, retries and sanitized diagnostics; public pinned HTTPS-only egress |
| Optional SSO | OIDC authorization code/PKCE, consumed state/nonce, fixed RSA ID token verification, issuer/audience/time checks, exact subject linking, host-bound callbacks and retained local MFA |
| Deployment | Fresh-install and upgrade/image-rollback scripts, optional Caddy/offline Compose overlays, GD/client runtime dependencies, explicit readiness and heartbeat checks |
| Recovery | Authenticated encrypted streaming SQL/manifest and encrypted objects, safe new-database-only restore, MFA/object key checks, actual disposable recovery and schema rollback/re-upgrade drills |
| Release controls | Independent evidence review, request IDs and security headers, dependency audits, browser/load fixtures, runbooks, UAT checklist and checksummed source release packaging |

## Storage and installation

Migration 2026_10_17_000007_create_production_features adds plans.features and ten explicit InnoDB tables: tenant_brandings, tenant_domains, offline_licences, api_access_tokens, api_command_receipts, webhook_endpoints, webhook_deliveries, sso_connections, sso_identities and release_reviews. Structural references are tenant bound. The working database has 83 InnoDB tables and all 10 migrations applied. MySQL/MariaDB connection initialization and Docker continue to force the project/session default to InnoDB; shared host-wide MySQL settings are unchanged.

PhaseSixSeeder and zentrik:phase6 zentrik install the Production Workforce catalog/permissions and branding entitlement. No synthetic employee, asset, financial, integration or review records are inserted into the working database. Pre-upgrade encrypted DPAPI backup and a new authenticated full recovery snapshot were taken; the source database's restored row counts matched exactly.

## Validation evidence

- MySQL regression: 196 tests passed, 753 assertions. SQLite regression: 195 passed, one MySQL-engine check skipped, 668 assertions.
- Browser regression: all eight scenarios passed. The two Phase 6 scenarios also passed after the final select-state and screenshot timing adjustments; desktop/mobile captures are in docs/screenshots.
- Bounded loopback API fixture: 40 requests at concurrency four against 500 fixture employees, zero failures, p50 635.27 ms and p95 971.82 ms. This is development-server evidence, not a production capacity claim; see PHASE_6_LOAD_VERIFICATION.json.
- Production asset build, Blade compilation, Pint formatting check and Composer validation passed. Composer and npm dependency audits reported no vulnerabilities.
- PHASE_6_STORAGE_VERIFICATION.json confirms 83 InnoDB tables, the InnoDB application session, ten applied migrations and two preserved working users. New business/integration tables remain empty.
- PHASE_6_RECOVERY_VERIFICATION.json records matching restored row counts and actual real-key recovery of an encrypted document plus an MFA secret/recovery-code fixture in isolated databases. PHASE_6_UPGRADE_ROLLBACK_VERIFICATION.json records the executed schema rollback/re-upgrade drill. No outgoing workers were started.
- Fresh CLI/offline installation tests, optional Compose configuration validation and the installed local launcher passed. Live login, liveness and local readiness were checked separately.

The source release is zentrikhrms-6.0.0.zip in the parent outputs folder. Its companion .zip.sha256 authenticates the archive; SHA256SUMS.txt inside inventories the packaged files. Runtime credentials, private keys, databases, uploaded files and dependency directories are excluded. The installed project retains its existing dependencies and configuration for the simple local launcher.

## Architecture and limits

Published branding images are marketing assets; HR documents retain the encrypted quarantine/antivirus path. Theme text/HTML is escaped, raster images are re-encoded and arbitrary SVG/HTML uploads are excluded. API fields are minimized and domain commands retain business-service approvals. Webhook receivers must implement at-least-once deduplication. Licence rollback detection assumes a trusted database/clock; issuer private keys never belong in customer runtime. SSO is optional, supports RS256 with same-origin discovery/token/JWKS endpoints and never bypasses local MFA.

The fresh CLI/offline and database/schema drills are executed evidence; they do not constitute an actual external container/ACME/IdP deployment. Docker's Linux engine is unavailable here, and the user chose no public domain configuration. Optional production activation gates remain in PHASE_6_UAT_CHECKLIST.md. Existing scan/production Vault/object-storage deployment gates remain applicable; they were not bypassed. Independent penetration testing and production capacity/UAT are not claimed.

## Primary references used

- [Caddy on-demand TLS](https://caddyserver.com/on-demand-tls) and [ask policy](https://caddyserver.com/docs/caddyfile/options#on-demand-tls) support the optional certificate adapter.
- [OpenID Connect Core](https://openid.net/specs/openid-connect-core-1_0.html) guides ID-token/issuer/audience/nonce validation; [PHP JWT](https://github.com/googleapis/php-jwt) provides the maintained RSA/JWK verifier.
- [IANA IPv4](https://www.iana.org/assignments/iana-ipv4-special-registry) and [IPv6 special-purpose registries](https://www.iana.org/assignments/iana-ipv6-special-registry) inform conservative egress address blocking. Redirects/proxies are disabled and DNS is pinned at connection time.