# QA Evidence and Known Gaps

## 1. Latest Known Passing Commands

Workspace:

```powershell
composer validate --no-check-publish
composer install --no-interaction --no-progress
composer check
```

XAMPP served copy:

```powershell
composer check
```

Browser:

```powershell
$env:FIELDOPS_BASE_URL='http://localhost/FieldOps-Cloud/public'
$env:BROWSER_EXECUTABLE_PATH='C:\Program Files\Google\Chrome\Application\chrome.exe'
$env:NODE_PATH='C:\Users\chama\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\node_modules;C:\Users\chama\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\node_modules\.pnpm\node_modules'
& 'C:\Users\chama\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe' tools\browser-smoke.cjs
& 'C:\Users\chama\.cache\codex-runtimes\codex-primary-runtime\dependencies\node\bin\node.exe' tools\role-walkthrough.cjs
```

Latest known results:

- `composer validate --no-check-publish`: PASS
- `composer install --no-interaction --no-progress`: PASS, no dependency changes
- `composer check`: PASS in workspace
- `composer check`: PASS in XAMPP folder
- `tools/browser-smoke.cjs`: PASS, `failureCount: 0`
- `tools/role-walkthrough.cjs`: PASS, `failureCount: 0`
- Route/action inventory: 98 routes, 0 findings

## 2. Current Automated Coverage

Current tests in `tests/run.php` cover:

- Password hashing and auth service behavior.
- Demo environment gating.
- Session cookie policy and security headers.
- RBAC permissions.
- Request base path handling for XAMPP.
- CSRF failure handling.
- Client validation and demo edit merging.
- Job workflow validation, transitions, stats, search/filter, detail sections, assignment scope.
- Database repository persistence for clients, jobs, quotes, invoices, team members.
- Recurring agreements and generated jobs.
- Dispatch crews, recommendations, assignments, conflict blocking.
- Team member validation and edit merging.
- SaaS plan catalog, pricing, subscription access, feature gating, seat limits.
- Platform admin navigation, tenant actions, billing, support access, audit events.
- System health, security admin, mobile/offline admin status.
- PWA/mobile/offline foundations.
- Store-readiness public pages.
- Import/export admin visibility and import pipeline.
- Quote and invoice validation, line items, totals, edit locking, payments, conversion.
- Customer portal token, quote approve/decline, invoice/job portal views.
- Demo reset and demo management.
- Accounting provider registry and sandbox connection.
- Calendar provider registry and sync strategy.
- Schedule calendar, booking, conflicts, existing/potential client attendee flows.
- Import schema/validation/commit/undo/export gating.
- LLM provider validation and import safety rules.
- AI assistant local generation, endpoint CSRF/RBAC, invalid mode, redaction.

Current browser coverage:

- `tools/browser-smoke.cjs`: public, tenant owner, and platform admin route smoke across mobile/tablet/desktop.
- `tools/role-walkthrough.cjs`: explicit role sessions, sidebar visibility, allowed/denied routes, support access flow, AI assistant click-through.

## 3. Known Gaps

These gaps should become test-plan risks:

1. Public API mismatch
   - Some docs describe broader `/api/*` endpoints, but active route table only includes `/api/portal/quote` and `/api/offline-sync`.
   - Test plan should include documentation consistency.

2. Live integrations
   - Accounting, calendar, and LLM live-provider connections are not production-wired.
   - Current tests should verify foundation/sandbox behavior only.

3. Payment processing
   - Invoice payment recording is internal state only.
   - Stripe or other payment provider is not implemented.

4. Production auth/deployment
   - Local demo flow is strong for QA, but production deployment requires separate end-to-end environment testing.
   - HTTPS, secrets, mail, background jobs, and queues require owner confirmation.

5. Database coverage
   - Repository tests exist, but a more formal two-tenant database fixture suite is needed.
   - Schema/table usage should be traced to active controllers.

6. Import/upload hardening
   - Text CSV flow is tested.
   - Full multipart file handling with MIME/size/row count restrictions should be expanded where implemented.

7. Accessibility
   - Responsive smoke exists.
   - Formal screen reader, keyboard-only, and axe-style checks are not yet complete.

8. Performance and reliability
   - No load test baseline.
   - No long-running import/export stress suite.
   - No resilience tests for failed database or provider downtime beyond service-level placeholders.

9. Mobile native
   - PWA and Capacitor foundation exist.
   - Native Android/iOS device tests, push notifications, app signing, and store review requirements remain future work.

10. Audit completeness
   - Sensitive SaaS/platform actions are audited in current tests.
   - Claude should inspect every new sensitive route/action and verify audit coverage.

## 4. Defect History To Consider

Known previous issues that should remain regression cases:

- Demo user could be silently promoted to platform admin by visiting `/platform-admin`; fixed.
- Some buttons/links were previously nonfunctional; route/action inventory now reports 0 findings.
- Schedule calendar slots needed click behavior; now tested statically and by browser smoke.
- Quotes/invoices/clients/team needed drill-in and editable unsent/unpaid records; tests now cover these.
- AI assistant was previously browser-only canned output; now a CSRF/RBAC local endpoint with tests.
- Composer install/audit previously blocked due dependency constraints; current install from lock succeeds.

## 5. Suggested Test Plan Exit Criteria

Claude should propose release gates at minimum:

- 100 percent P0 pass.
- No known P0/P1 open defects.
- Route/action inventory 0 findings.
- Browser smoke 0 failures across mobile/tablet/desktop.
- Role/RBAC walkthrough 0 failures.
- Every non-API POST has CSRF test.
- Every protected route has RBAC positive and negative tests.
- Financial calculations have deterministic expected totals.
- Tenant isolation has database tests for each repository.
- Import/export has malicious CSV tests.
- AI assistant has no external-call/no mutation/redaction tests.
- Production-like demo-disabled smoke passes.