# Phase 6 acceptance checklist

## Local delivery evidence

- [x] Existing local database/account/MFA setup preserved; no Cloudflare or cloud configuration required to start.
- [x] Double-click launcher verified against the existing local application.
- [x] 83 project tables and application session default verified as InnoDB.
- [x] Fresh company CLI installation and first MFA enrollment gate tested.
- [x] Signed offline fresh installation tested with network requests prohibited.
- [x] Licence signature, installation, expiry, module/quota, sequence and clock rollback checks tested.
- [x] DNS/TLS state, foreign tenant/host, host-only cookies and scoped authentication tested with controlled adapters.
- [x] API scopes, role freshness, idempotency, field minimization and revocation tested.
- [x] Webhook HMAC, deduplication, retries and DNS rebinding restrictions tested with controlled receivers.
- [x] OIDC real RSA signature, state/nonce/PKCE and exact subject mapping tested with a controlled provider.
- [x] Encrypted database recovery with matching counts and real DPAPI encrypted-object recovery performed on separate databases.
- [x] Schema rollback/re-upgrade rehearsal performed on a restored disposable database.
- [x] Responsive branding/integration/review screens and bounded local read-load fixture exercised.

## Future external production activation (optional for the user's local setup)

- [ ] Run Docker images on the destination host; rehearse a fresh stack and immutable-image rollback.
- [ ] Configure real public hostnames, trusted proxy addresses and certificates if custom domains are desired.
- [ ] Validate real IdP/SMTP/webhook endpoints only for integrations selected by the operator.
- [ ] Verify deployed antivirus, private storage and Vault/key recovery before publishing sensitive files.
- [ ] Review email/webhook backlog before starting general workers/scheduler.
- [ ] Conduct destination-specific load testing, independent penetration testing and user acceptance; record independent evidence review.

No boxes in the second list were automatically signed off in the working company database.