# MVP Audit And Readiness Pass

Date: 2026-05-09

Branch: `codex-mvp-audit-readiness-pass`

## Baseline

The MVP is a Yii 3-oriented PHP project served locally from XAMPP. The active runtime remains the custom `public/index.php` front controller plus the larger `public/mvp.php` MVP router. The public event APIs, event detail API, checkout draft flow, organiser/admin consoles, role walkthrough page, and supporting domain services are present.

Full Yii controller migration remains post-MVP. The current safe goal is to keep the working local MVP stable while progressively extracting domain logic into `src/`.

## Fixes Applied In This Pass

- Added a root `.htaccess` guard so only `/public` is reachable when the project folder is placed directly under XAMPP `htdocs`.
- Tightened organiser-scoped permission checks so active staff membership in a different organiser cannot unlock another organiser's role assignment.
- Added CSRF protection coverage for `checkout/confirm-free` and checkout draft edit mutations.
- Added scanner-device organiser matching before accepting a scanner manifest, validation, or offline sync.
- Fixed the scanner page return link from `#check-in` to the live organiser route `#checkin`.
- Fixed finance export SQL that referenced columns not present in the canonical schema.
- Added finance export test coverage for settlement, ledger, orders, refunds, and attendees exports against schema-faithful tables.
- Redacted unauthenticated checkout draft customer details while preserving the local debug endpoint shape.
- Added ARIA expanded-state updates for sidebar, summary, and mobile nav toggles.

## Key Findings

| Area | Status | Notes |
|---|---|---|
| Root file exposure | Fixed | `.env`, `composer.json`, and `docs/schema.sql` now return 403 from the XAMPP root URL. |
| Composer/dependencies | Pass | `composer validate --strict` passes and audit reports no advisories. |
| PHPUnit | Pass | 504 tests, 1671 assertions, 2 skipped. |
| MVP smoke | Pass | 0 critical, 0 warnings. |
| Local live run | Conditional | 0 critical, 1 expected warning: paid completion needs Stripe test credentials or local mock. |
| Stripe readiness | Conditional | SDK and charge model are OK; real keys, webhook secret, and connected account are missing. |
| Deployment readiness | Conditional | No critical issues; production secrets, GD, media validation hardening, and Stripe setup remain. |
| Yii 3 migration | Deferred | Current MVP router is stable; full controller migration should be planned after launch hardening. |

## Remaining Risks

- `public/mvp.php` is still too large and should be split into controller/use-case classes after the MVP is stable.
- Runtime schema repair paths remain in the MVP router for local resilience; production readiness check confirms they are disabled for production.
- Full Stripe test-mode payment cannot be proven until real test credentials, webhook secret, and a connected organiser account are configured.
- Guest ticket/account claiming still needs a stricter verified-contact claim flow before internet-facing use.
- Physical mobile, scanner-device, and card-terminal QA require real devices.
- Production media processing currently relies on PHP GD and built-in validation only; managed malware scanning can be introduced later if required.
- Migration rollback and seed parity still need cleanup so `docs/schema.sql`, migrations, and `bin/install-database` remain one source of truth.

## Validation Evidence

| Command | Result |
|---|---|
| `C:\xampp\php\php.exe -l public\index.php` | Pass |
| `C:\xampp\php\php.exe -l public\mvp.php` | Pass |
| `node --check public\assets\js\zavvion-ui.js` | Pass |
| `node --check public\assets\js\mvp-profiles-page.js` | Pass |
| `C:\xampp\php\php.exe composer.phar validate --strict` | Pass |
| `C:\xampp\php\php.exe composer.phar audit` | Pass |
| `C:\xampp\php\php.exe vendor\bin\phpunit` | Pass, 504 tests |
| `C:\xampp\php\php.exe bin\check-mvp-smoke --base-url=http://localhost/zavvion-events/public` | Pass |
| `C:\xampp\php\php.exe bin\check-local-live-run --base-url=http://localhost/zavvion-events/public` | Warning: Stripe/local mock completion pending |
| `C:\xampp\php\php.exe bin\check-stripe-readiness` | Warning: credentials/webhook/connected account pending |
| `C:\xampp\php\php.exe bin\check-deployment-readiness` | Warning: production secrets, GD, media validation hardening, Stripe setup |

## Recommendation

Conditional GO for the next MVP QA/handoff phase.

Do not put the MVP internet-facing until production secrets, Stripe test configuration, media validation hardening, server virtual-host restrictions, and real-device QA are completed. The local MVP is healthier after this pass and is ready for the human architect to continue hardening and deployment preparation.