# Expanded ERP validation

Validated on 21 October 2026 using fictional records in an isolated local test database. The demonstration school available at port 8088 was kept separate from the test school at port 8089.

## Passed checks

- **201 checks passed in the final suite**, comprising the five groups below.
- **61 HTTP/workflow checks:** administrator pages, printable documents, exports, sign-in for each tested role, parent/child isolation, student record isolation, hidden draft results, server-side permission rejection, duplicate-payment prevention, payment validation, independent verification, receipt reversal, results review/publication, attendance correction, unchanged-register deduplication, future-date rejection and CSRF rejection.
- **31 extended checks:** import validation, rejected-row explanations, import retry handling, class creation, teacher class restrictions, enrolment, guardian linking, linked-family access, class movement/history, currency-specific fees, duplicate billing prevention, refunds and reversal restrictions, repeated-refund rejection, script-content escaping, import-template restrictions and secretary financial-access restrictions.
- **95 deeper ERP checks:** administrative module access, cashier restrictions, profile corrections, private documents, admissions transitions, subject-specific teaching, timetable conflicts, homework submission/feedback, balanced journal approval, supplier billing/payment/reversal, bank matching, opening balances, invoice allocation, period closing/reopening, bulk promotion, official report publication/revisions, fee notes and accounting exports.
- **4 parent preference checks:** preferences displayed, own-child opt-out, rejection of another child’s preference changes and own-child opt-in.
- **10 financial/history invariants:** individually balanced journals, valid debit/credit lines, exact student-receivables and supplier-payables reconciliation in USD/ZWG/ZAR, archived report payload hashes and absence of timetable clashes. The same invariants also passed on the populated review demo.
- PHP syntax checks passed for the PHP source files; JavaScript syntax checking passed.
- The mail worker processed six queued test notifications into protected text previews. No real parent emails were sent.
- A complete SQL/private-file bundle was generated. Its SQL snapshot was restored into a separate database; all **46 tables** matched the source test database, including complete record content. Protected-file integrity and recovery were verified separately against the bundle manifest.
- Desktop accounting, timetables and an official report were visually inspected at **1440 × 1080**. The homework workspace was inspected at **390 × 844** and adjusted to use readable task cards on phones.

## Environment

- PHP 8.2.12 with PDO MySQL.
- MariaDB 10.4.32 using the MySQL protocol and MySQL-compatible schema.
- No separate MySQL 8 server was available for direct verification.
- In-app browser used for interactive layout review.

## Boundaries of validation

These checks establish the implemented pilot workflows against synthetic data. They do not establish production readiness, statutory compliance, real mail deliverability, large-school performance, offline operation, accountant approval of a school’s reporting policy or resistance to all security attacks.

Before live adoption, confirm the school’s curriculum and grading rules, fee policies, approval arrangements, privacy and retention requirements, hosting, mail delivery, backup scheduling, restore responsibilities and opening data. Complete a real fee cycle and result cycle with school sign-off. See README.md for implemented scope and remaining modules.