# Verification record

Testing used synthetic households and local test accounts, with PHP 8.5.10 and MySQL 8.4.11 on a loopback-only database. No household data from the source documents was copied into test records.

## Executed automated checks

- **36 scoring and identifier checks:** all domain maxima total 100; priority boundaries at 39/40, 59/60 and 79/80; household-size and income brackets; disability-count brackets; multiple emergency types counted once; no points added for unscored questions; pending no-assistance total/priority and known subtotal; later policy parameter; Arabic and Persian digit normalization.
- **52 HTTP workflow/security checks:** authentication; CSRF; role and location isolation; complete assessment submission; duplicate household/identity/family documents, including across locations and simultaneous HTTP requests; conditional validation; invalid composition and multi-choice responses; missing/stale coordinates; invalid/missing uploads; submission immutability at the API; reviewer decisions and stale-state conflicts; exclusion of sensitive fields and files from distribution; encrypted file download; contact notes; mandatory receiving note; single closure; closed-case protection; pending scores; manual eligibility; reports and filtered denominators; exports; user management; temporary-password enforcement; password change; session revocation; audit creation; and login throttling.
- **Four database/storage checks:** household and medical payloads are encrypted; the database trigger rejects changes to submitted facts; stored files are encrypted outside public; the limited database account cannot delete cases/documents or rewrite audit rows.
- **15 additional boundary checks:** valid JPEG uploads and metadata removal, attempted score/status/submitter injection, GET mutation rejection, account privilege protection, repeated-person consistency, national-ID validation, cache/security headers, ineligible/reopened cases and restricted GPS metadata.
- **Two password edge checks:** intentional spaces are preserved in a new password, and that exact password verifies when it is changed again.
- **54 MEAL/incentive/hours HTTP checks:** role boundaries, full case access, quality history and attribution, no self-appointed eligibility authority, exact rate accrual, duplicate/failed-work exclusion, future-only rate changes, mandatory receipt, CSV access, date filters, versioned settings, invalid rates/hours, active-session and fresh-login blocking, document/work blocking outside hours, administrator recovery access and logout.
- **22 schedule boundary checks:** all four non-admin roles before opening, exactly at opening, before closing, exactly at closing and late night; administrator exception; UTC-to-Jordan conversion.
- **Four additional privilege checks:** the limited web account cannot update/delete incentive entries or rewrite quality/settings history.
- Fresh full-schema installation verified separately from the existing-database upgrade, including defaults, empty ledger and immutable trigger.
- PHP syntax checks and JavaScript parsing checks.

The HTTP suite passed both before and after switching from the isolated setup administrator to the table-scoped application account. The local PHP development server serializes requests; the concurrent-request test exercises duplicate responses, while the MySQL UNIQUE constraints provide the production multi-worker race boundary.

## Browser checks

Reviewed the login screen, Arabic mobile dashboard and report navigation at 390 × 844, including no page-level horizontal overflow. Checked language switching with partially completed answers, conditional UNHCR questions, repeatable disability-person inputs, section navigation, and map selection producing coordinates with a required explanation. Browser testing uses synthetic local accounts only. Additional checks cover MEAL login, Arabic/English performance totals, phone layout without page overflow, quality submission without reviewer controls, administrator settings save and desktop layout. Both supplied logos load and preserve proportions. The working-hour restriction is tested through real HTTP requests and deterministic time-boundary helpers; a real-time 15:00 browser rollover has not been waited for.

## Reproduce in the source workspace

The source includes `tests/scoring.php`, `tests/database.php`, `tests/integration.py` and `tests/fixtures.php`. Fixture scripts refuse production configuration and require the isolated local database port 33077. They are excluded from the deployment archive.

With the test instance on `127.0.0.1:8088`:

```sh
php tests/scoring.php
python tests/integration.py
php tests/database.php
```

The integration suite adds synthetic records; run it only against a disposable development database. Do not copy local development configuration, `.runtime`, test accounts, credentials or test data to production.

## Server acceptance still required

The package has not been deployed to the actual JHASI host. Confirm its HTTPS/FastCGI setup, service-account ACLs, real phone location and file-picker behavior, configured malware scanner, backup restoration and any proxy/network rules. Load testing, independent penetration testing and a live JHASI server acceptance test have not been performed.