# FieldOps Cloud Defect Register

Date: 2026-06-15

Severity definitions:

- SEV-1 Blocker: prevents install, core access, data safety, or commercial release.
- SEV-2 High: core workflow/security/business capability broken or incomplete.
- SEV-3 Medium: partial feature, validation, redirect, documentation, or non-critical workflow issue.
- SEV-4 Low: cosmetic or minor documentation issue.

| ID | Severity | Status | Area | Title | Evidence | Recommended fix | Retest |
| --- | --- | --- | --- | --- | --- | --- | --- |
| DEF-001 | SEV-1 | Fixed | Build | Fresh `composer install` failed | Yii package constraints referenced unavailable/abandoned versions and prevented lock generation | Removed abandoned/dev-only Yii web package, updated Yii component constraints to stable installable versions, and committed `composer.lock` | Passed `composer install --no-interaction --no-progress` |
| DEF-002 | SEV-1 | Fixed | Auth/Security | Demo auto-login was not production-gated | `public/index.php` previously logged in `demo@example.test` automatically without a production gate | Demo auto-login is now controlled through `AppEnvironment::shouldAutoLoginDemo()` and disabled when demo mode is disabled. | Passed `composer test`, `composer check`, XAMPP checks, and `tools/auth-production-smoke.cjs` |
| DEF-003 | SEV-2 | Open | Core CRUD | Client and job create flows do not persist created records | Valid form redirects, but current controllers are validation/redirect only | Wire clients/jobs to tenant-scoped repositories or session demo repositories until DB flow is complete | Not retested |
| DEF-004 | SEV-2 | Open | API | API reference documents endpoints not routed in app | `docs/API_REFERENCE.md` lists `/api/*`; `public/index.php` has no API routes | Implement API routes or mark API reference as planned/foundation only | Not retested |
| DEF-005 | SEV-2 | Fixed | Security | Production session/header hardening incomplete | Response cookie lacked HttpOnly/SameSite, CSP was absent, and `X-Powered-By` was exposed | Added session strict-mode/cookie policy, CSP, Permissions-Policy, production HTTPS HSTS, and `X-Powered-By` removal | Passed `composer test` and `tools/auth-production-smoke.cjs` header/cookie checks |
| DEF-006 | SEV-2 | Open | Integrations | Live accounting/calendar/LLM integrations are foundations only | Settings/provider registries exist; no OAuth/webhooks/live sync/API calls | Keep UI labelled as foundation/demo until live provider flows and mocks are implemented | Not retested |
| DEF-007 | SEV-2 | Open | Billing/SaaS | Live billing provider and webhook processing not implemented | Pricing/subscription foundations exist; no payment provider integration | Implement billing provider flow, signed webhooks, idempotency, audit logs, and entitlement tests | Not retested |
| DEF-008 | SEV-2 | Open | Import | Real CSV upload/import commit is not implemented | Import page validates schemas but has no multipart upload or DB mutation | Add safe upload, file validation, preview, row validation, import commit, rollback, and audit trail | Not retested |
| DEF-009 | SEV-3 | Fixed | Routing | `/export-data` produced PHP fatal | Route called `exportData()` without required `Request` | Passed `Request` to route handler | Passed route smoke |
| DEF-010 | SEV-3 | Fixed | XAMPP redirects | Client/job successful POSTs redirected to `/clients` or `/jobs` outside base path | Final URL became `http://localhost/jobs` before fix | Added base-path redirect helpers | Passed form-flow smoke |
| DEF-011 | SEV-3 | Fixed | CSV export security | CSV exports did not escape formula-leading cells | Static inspection found direct `fputcsv` of raw cells | Added CSV cell formula escaping | Verified `=1+1` exports as `'=1+1` |
| DEF-012 | SEV-3 | Open | Docs | Testing template expects `docs/SECURITY_NOTES.md`, but file is at repo root | File inspection | Move/link root `SECURITY_NOTES.md` into docs or update template references | Not retested |
| DEF-013 | SEV-3 | Fixed | Dependency audit | `composer audit` could not run | No installable dependency set and no lock file | Resolve DEF-001, then run `composer audit` | Passed; no known vulnerability advisories found |
| DEF-014 | SEV-3 | Open | Browser tooling | Browser smoke requires system Chrome and pnpm module path | Bundled Playwright package lacked normal top-level resolution | Document command or add project-managed browser test dependency after owner approval | Partially mitigated by `tools/browser-smoke.cjs` |
| DEF-015 | SEV-2 | Fixed | Auth/RBAC | Read-only demo user could promote to platform admin by opening `/platform-admin` | Demo-mode `/platform-admin` route silently replaced a `demo_user` session with a `platform_admin` session | Removed implicit promotion; platform admin demo entry is explicit through `/demo/platform-admin` or `/demo/role?role=platform_admin`; added regression coverage and role walkthrough | Passed `composer test`, `composer check`, `tools/role-walkthrough.cjs`, and in-app browser spot check |

## Fixed Files

- `public/index.php`
- `src/Client/Controller/ClientController.php`
- `src/Job/Controller/JobController.php`
- `src/Demo/Controller/OperationsController.php`
- `tools/browser-smoke.cjs`
- `tools/role-walkthrough.cjs`
- `tools/auth-production-smoke.cjs`
- `composer.json`
- `composer.lock`
- `src/Demo/Service/DemoRoleIdentityService.php`
- `src/Dispatch/Controller/DispatchController.php`
- `src/Infrastructure/Security/RbacService.php`
- `src/Infrastructure/Security/SecurityHeaderService.php`
- `src/Infrastructure/Security/SessionCookiePolicy.php`
- `src/Saas/Service/SecurityAdminService.php`
- `templates/layouts/main.php`
- `templates/site/demo.php`
- `tests/run.php`

## Open Release Blockers

Commercial deployment is blocked by DEF-003, DEF-004, DEF-006, DEF-007, and DEF-008. Production-mode auth/security smoke now passes, but broader production-mode role walkthroughs across core business modules remain a release gate.