# SNYT ERP — Project Status **Last verified:** 2026-10-23 **Baseline commit:** `d85fc58c8ee040cc0e875c893350dd0460ad0e81` ## Architecture - Backend: Laravel 12 / PHP 8.2+ / MariaDB. - Independent installation and database per customer. - Multiple legal companies are required inside an installation. - Flutter remains a separate repository; mobile builds require a separate build service. - ERP document root is `ERP/public`. - Catalog and Van production applications are out of scope and were not changed. - Core workflows must remain functional without AI. ## Verified foundation - Production environment and database connection are operational. - All 13 repository migrations are recorded as applied. - Git working tree was clean and both configured remotes referenced the same baseline commit. - Protected pre-P0 database and application backups were created on 2026-10-19. - A non-public staging working copy was created at `/home/snyt/public_html/SubDomain/ERP/storage/app/private/SNYT-ERP-p0-p1`. ## Existing prototype - Companies, branches and memberships - Roles, permissions, departments, assignments, teams and activation links - Partial access audit logging - Products, categories, catalogs, images and CSV/XLSX preview/import - Authenticated Blade administration pages These items are prototypes, not completed roadmap phases. ## Critical remediation - Remove all first-company assumptions and implement validated active-company context. - Add warehouse ownership and warehouse-scoped authorization. - Move business authorization into policies/services and cover it with isolation tests. - Standardize immutable audit events. - Define the product-master boundary before extending product tables. - Add versioned API conventions before Flutter integration. ## Current phase The owner confirmed on 2026-10-19 that the primary ERP installation is the development environment. P1 patch 1 (company selection and isolation) is applied directly there; 10 tests and 41 assertions pass with SQLite in memory. Future development stays inside ERP, with VAN changes only when specifically in scope. No new migrations or Git push were performed in this patch. Warehouse and broader P1 work remain pending. See `P0_BASELINE_AUDIT.md` and `docs/adr/`. ## P1 warehouse foundation — 2026-10-19 Warehouse administration and explicit access grants are applied to the primary development installation. The additive warehouse migration completed successfully. Current automated suite: 17 tests and 79 assertions. Stock movements and inventory balances are not yet implemented. See P1_WAREHOUSE_FOUNDATION.md for permissions, backups and remaining scope. ## P1 access hardening — 2026-10-19 Five editable role templates, strict record scoping, inactive-session logout, system-admin account-status controls and expanded audit coverage are applied. The role-template data migration completed. Automated suite: 30 tests / 151 assertions. Existing user assignments and customized role slugs were preserved. See P1_ACCESS_MATRIX.md for the matrix, scope rules, backups and remaining P1/release work. Future-module permission keys are not implementation claims. ## UI and audit history — 2026-10-19 Responsive header and role panels were verified in the authenticated in-app browser at desktop and 390px mobile width. Searchable read-only company audit history is available at /audit-history. Current test suite: 33 tests / 164 assertions. No real-user grants were changed. See P1_UI_AUDIT_QA.md. Database-level audit tamper resistance and retention remain pending. ## Permission-aware navigation — 2026-10-19 All implemented top-level pages and access tabs now have grouped sidebar links, filtered by destination permissions. Command search uses the same source. Planned workspace pages are marked separately. Browser desktop/mobile checks pass; automated suite: 38 tests / 225 assertions. No user grants changed. See P1_NAVIGATION.md. ## Confirmed future business rule — BR-SALES-001 On 2026-10-19 the owner requested bidirectional customer/product purchase-history search: search a product inside a customer's invoices for purchase dates and amounts, and search a customer inside a product's sales history. Scheduled for P4 with P6/P7 integration where applicable; documentation only, not implemented. See BR-SALES-001_CUSTOMER_PRODUCT_HISTORY.md. It must remain functional without AI and enforce company/customer visibility. ## 2026-10-20 — P2 import source decisions and SOH inspection Owner confirmed manually created ERP warehouses, bulk/manual products, warehouse-report product identities and quantities, and SOH multi-tier prices. Inspected SOH reference and newer regular/clearance subsets read-only; saved byte-verified private SOH copy inside ERP. See P2_IMPORT_SOURCE_RULES.md for observed two-sheet mappings, totals/consignment/aggregate exclusions, source freshness and staged implementation gates. No application code, migrations or business data changed in this step; import implementation remains pending. ## 2026-10-20 — P2 shared product/import implementation checkpoint Accepted shared master/company-specific commercial data, VAT-inclusive SOH at5%, ambiguous barcode candidates without merging. Deployed two additive migrations and shared-product/manual-pricing/import-batch surfaces; retained legacy products unchanged. Suite57/306 PASS; real MariaDB smoke rolled back; desktop/mobile browser QA PASS for inspected empty-state/forms; Composer audit clean. No real source data imported or stock posted, no Catalog/VAN changes, no push. Required decision: source SOH has12 prices with three decimals; current two-decimal acceptance deliberately blocks them. Proposed four-decimal unit-price preservation requires owner agreement. Persistent import worker, legacy reconciliation, stock ledger and remaining ERP modules are still pending. See P2_PRODUCT_IMPORT_PROGRESS.md for exact evidence, limits, backup and continuation. ## 2026-10-20 — source price precision resolved Owner directed preserving current source price values with later editing from product. Applied030000 DECIMAL(16,4), four-decimal validation/exact display and company-scoped product price edit page. No conversion/purchase-cost assumptions introduced. Tests61/333 PASS; real SOH dry parse2089 rows/zero precision issues; desktop/mobile populated synthetic price-page QA PASS; fixture removed with audit retained. Original source/business data unchanged. Earlier12 price precision blockers are superseded; duplicate identity checks, durable worker, legacy reconciliation and stock posting remain pending. Details and backup in P2_PRODUCT_IMPORT_PROGRESS.md follow-up. ## 2026-10-20 — Focus balance snapshots and retained QA implemented Owner confirmed periodic Focus uploads REPLACE included as-of balances, not additive receipts; explicit zero applies, omitted products remain unchanged. Applied040000 stock ledger/snapshots with tenant compositeFKs, exact quantity arithmetic, later-local-movement preservation, replay prevention, stale/as-of safeguards and per-page encrypted confirmation proofs (including multi-tab/row-selection protection). Added balance/history screens and permission-aware links. Analysis auto-starts on exact per-batch queues only; no general queue/cron changes. Full isolated suite83/522 PASS; real browser/MariaDB E2E verified20→15, B remains8, C becomes0, second warehouseA5, exact replay/no duplicate, SOH prices unchanged precision, stale/negative sources blocked and signed approval works. QA company3 and8 batches/4 snapshots/8 movements retained with an exact private manifest; original company restored. No actual-company inventory balances posted, no Catalog/VAN changes, no push. See P3_FOCUS_BALANCE_SNAPSHOTS.md for backup, evidence, scope and pending release work. This supersedes earlier statements that all warehouse quantities remain staged: only explicitly confirmed eligible warehouse snapshot batches now post audited reconciliations. ## 2026-10-23 — P0–P3 checkpoint verification Re-ran the full isolated SQLite suite from the live ERP development checkout: 83 tests / 522 assertions PASS on PHP 8.2.35. `git diff --check` is clean and all 19 migrations are applied on the development database. The implementation through P3 was checkpointed locally as commit `3b64fa3` before opening P4 Sales & CRM. No business data, user grants, Catalog/VAN application, or Focus system was changed by this verification. ## 2026-10-23 — P4 customer master foundation Applied additive migration `2026_10_23_010000` and the permission-scoped `/sales/customers` workspace. Customer identity, optional Focus code, branch, assignee, Cash/On-account classification, reference credit fields, contacts, audit and lifecycle status are implemented with company/branch/record-scope isolation. No existing customer data was imported or changed. Full isolated suite: 88 tests / 555 assertions PASS. Invoice posting, VAT rounding, stock event, number sequence, receivables and Focus XML remain intentionally blocked on explicit owner decisions. See `P4_SALES_CUSTOMER_FOUNDATION.md`. ## 2026-10-23 — P4 salesperson sequences and physical document books Owner confirmed independent system-invoice starts per salesperson, preservation of old Focus invoices, and physical custody for manual-invoice, return/damaged-goods and cash/cheque receipt books. Applied additive migration `2026_10_23_020000`, central duplicate-proof document-number registry, per-salesperson sequence locking, legacy-number preservation, book/range registration, custody assignment and exact printed-page use/void recording at `/sales/document-control`. Full isolated suite: 94 tests / 577 assertions PASS. No existing business rows, inventory or Focus system were changed. Historical invoice contents and Focus XML await representative accepted exports. See `P4_DOCUMENT_NUMBERING_BOOKS.md`. ## 2026-10-23 — P4 Focus historical invoice archive Analyzed the supplied representative Focus XML and applied additive migration `2026_10_23_030000`. Added manager-only `/sales/focus-invoices`, bounded/non-network XML parsing, exact source retention with SHA-256 duplicate protection, immutable header/line staging and mapping foundations for Focus customers, salespeople and products. Staging cannot post stock, accounting, customer balances or consume invoice sequences. Representative `W-3399` is preserved with 24 raw lines and remains unclassified pending confirmation of Focus voucher type 3336 and its negative-sign convention. Additive migration `2026_10_23_040000` provides manager-defined STI/STR voucher mappings so classification never relies on quantity signs. See `P4_FOCUS_INVOICE_ARCHIVE.md`. ## 2026-10-23 — SOH product identity and embedded images Owner confirmed that ERP should receive application functions while product selection/import remains operator-controlled: SOH supplies product identity, embedded images, specifications, SKU, barcode and prices; Focus warehouse files separately supply quantities. Applied additive migration `2026_10_23_050000`. SOH can now create missing product masters and checksum-deduplicated validated images while ignoring quantity columns. The retained reference maps 2,089 images (1,044 active and 1,045 stop-production). Full suite: 102 tests / 625 assertions PASS. No real products or quantities were imported. See `P4_SOH_PRODUCT_IMAGE_IMPORT.md`. ## 2026-10-23 — Sales order to invoice workflow foundation Applied additive migration `2026_10_23_060000` and a guarded workflow for draft, submit, approve and invoice. Server-side four-decimal totals cover discount, taxable amount, VAT and grand total. Invoice conversion consumes the salesperson sequence and central number registry, but deliberately posts no stock or financial entry. Full suite: 104 tests / 634 assertions PASS. No business orders were created. See `P4_SALES_ORDER_WORKFLOW.md`. ## 2026-10-23 — Sales order workflow UI Added responsive Blade pages for permission-scoped sales-order listing, server-validated draft creation and the draft → submitted → approved → invoiced timeline. Configured product prices are resolved again on the server, manual pricing is restricted to company-wide sales approval/management, and invoice conversion remains idempotent. HTTP coverage includes company and Own-scope isolation, unauthorized approval/invoicing, server totals, cross-company product rejection and zero inventory impact. Full isolated suite: 109 tests / 671 assertions PASS; `git diff --check` clean. No business order or inventory/finance record was created. Live desktop/mobile browser QA is pending an authenticated browser session.