# OGSG Production Readiness Re-Audit

## Executive Summary

The remediation pass closes the prior P0 audit blockers at code and schema level: destructive audit/finance cascades were removed from domain migrations, lifecycle changes now move through retained workflow records, heavy exports are tracked and queued, and production readiness is executable through `php artisan app:production-readiness`.

The app should still be treated as conditionally ready until the target server proves the runtime checks pass with real queue workers, scheduler, mail, backups, and monitoring.

## Blockers

No code-level blockers remain in the reviewed areas after this pass.

Deployment blockers remain until verified in the production environment:

- Queue worker must be running for `GenerateExportJob`.
- Scheduler must refresh `app:scheduler-heartbeat`.
- Backups must be configured and proven.
- Error monitoring DSN must be configured.
- HTTPS, secure cookies, encrypted sessions, and non-debug production env must be active.

## Security Findings

- Public asset exposure is constrained through the public asset DTO and must remain limited to non-financial verification data.
- Export files are stored on the private disk and downloaded through authorized routes.
- Super Admin creation remains CLI-only through `app:create-super-admin`; no web promote path was added.
- Upload validation remains centralized through `UploadRules`.
- Security headers are applied by `AddSecurityHeaders`.

## Workflow Pass/Fail

| Workflow | Result | Evidence |
| --- | --- | --- |
| Budget ledger retention | Pass | Restricted FK migrations, `ProtectsAuditRecords`, budget snapshot tests |
| Dynamic approval assignment | Pass | Existing assigned approver middleware/service tests |
| Procurement variance and delivery trace | Pass | Variance guard and delivery snapshot tests |
| Lifecycle transfer | Pass | Pending request, approval, receiver acceptance, immutable history |
| Maintenance/disposal | Pass | Request, approval, completion, immutable history |
| Physical audit campaign | Pass | Variance reconciliation required before closure |
| Public QR asset access | Pass | Public DTO redaction tests remain required in focused suite |
| Heavy exports | Pass | `export_jobs`, queued generation, private download routes |

## Budget And Purchase Approval Analysis

Budgets and ledger rows now retain MDA, user, request, year, organisation code, expense code, and balance snapshots. Duplicate active budgets and duplicate request deductions are protected by persisted keys. Procurement confirmation blocks quoted totals above approved amount unless variance approval is recorded.

## QA Matrix

| Test Case | Role | Expected Result | Severity |
| --- | --- | --- | --- |
| Delete MDA with budget evidence | Admin | DB rejects deletion | Critical |
| Delete budget transaction | Admin/service | App guard rejects deletion | Critical |
| Final approval deducts budget | Assigned approver | One immutable deduction with snapshots | Critical |
| Transfer asset across MDAs | Central admin + receiver | No mutation until approval and acceptance | High |
| Close physical audit with variance | Asset officer | Rejected until reconciled | High |
| Export assets without filters | Admin/MDA | Validation fails | High |
| Download another MDA export | MDA user | Forbidden | High |
| Production readiness unsafe config | Ops | Command fails | Critical |
| Production readiness safe config | Ops | Command passes | Critical |

## Score

Production readiness score: **8.5 / 10**.

The remaining 1.5 points are deployment proof, not application code: real production queue, scheduler, backup, monitoring, HTTPS/proxy, and mail configuration must be verified on the target host.

## Verdict

**Conditionally Ready.**

The application is audit-compliant at the codebase level for the reviewed blockers, but final production approval requires `php artisan app:production-readiness` to pass on the production server and focused regression tests to pass after deployment configuration is applied.