# P0 Baseline Audit

**Audit date:** 2026-10-19
**Audited source:** production working tree at `/home/snyt/public_html/SubDomain/ERP`  
**Baseline commit:** `d85fc58c8ee040cc0e875c893350dd0460ad0e81`

## Safety boundary

The audit was read-only against the live application and database. No production migration or source change was made. Before staging work, protected backups were created outside `public_html`:

- `/home/snyt/backups/snyt-erp/2026-10-19-p0/database-before-p0.sql.gz`
- `/home/snyt/backups/snyt-erp/2026-10-19-p0/files-before-p0.tar.gz`

Both archives were integrity-checked and stored with mode `0600` inside directories with mode `0700`.

## Verified runtime and repository

- PHP 8.2.34
- Laravel Framework 12.70.0
- Branch `main`, clean, aligned with `origin/main` and `forgejo/main`
- Git remotes: GitHub `abdomuftah/SNYT-ERP`; Forgejo `ScarNaruto/SNYT-ERP`
- Composer manifest valid; PHP syntax checks pass
- All 13 repository migrations are recorded as applied in production
- 47 application web routes; no versioned API route file is registered

## Implemented prototype

- Login, logout, employee activation
- Companies, branches and user-company membership tables
- Departments, roles, permissions, scoped assignments and teams
- Access audit log helper and record-scope helper
- Product, category, catalog, product image and CSV/XLSX import prototype
- Blade pages for company, access and product administration

## Gaps and risks

1. The confirmed architecture requires multiple legal companies, but several routes use the first company in the database and initial setup prevents a second company.
2. Company selection is implicit; the current context picks the first membership rather than a validated active company.
3. Warehouses and warehouse-scoped access are absent.
4. Authorization is implemented directly in route closures and controllers; `RecordScope` is not consistently applied.
5. Audit coverage is partial and lacks a standard before/after envelope, correlation ID and redaction policy.
6. Product tables are a company-scoped prototype and do not yet implement variants, multiple barcodes, TDRA or the approved product-master boundary.
7. No `/api/v1` surface exists.
8. Only two framework example tests existed at baseline; one was stale and failed because the root URL intentionally redirects.
9. Project status documents stopped at 2026-10-13 and did not describe the 2026-10-14 implementation.

## P0 exit gate

- Architecture decisions recorded
- Staging isolated from the live document root and production database
- Baseline automated tests green
- Multi-company and authorization remediation plan reviewed
- No secrets or production data committed
- Backup and restore procedure documented before production rollout