# Test status and pilot checklist

## Checks performed during package creation
See BUILD_REPORT.json for exact results. No PHP interpreter, MySQL server, cPanel account or MikroTik endpoint was available in the authoring environment. PHP source parsing can detect syntax errors but is NOT PHP runtime testing. No successful live connection, database installation, AI response, Telegram delivery, backup or repair is claimed.

## Supplied local checks (run on a non-production PHP environment)
- php bin/preflight.php
- php tests/unit.php
- Run PHP lint on all PHP files using the host's PHP CLI.

Unit tests cover encryption/tamper detection, role restrictions, endpoint allow-listing, metadata/loopback rejection, IP pinning, port restrictions, no arbitrary menu and output escaping. They do not test MySQL, HTTP sessions, concurrency or a live router.

## Mandatory pilot acceptance
1. Install into a new database/subdomain; verify config.php, app/, database/, storage/ and bin/ cannot be fetched over HTTP.
2. Confirm HTTPS and secure cookies; HTTP must not display login or accept credentials.
3. Create two companies, groups and non-admin users with distinct memberships.
4. Attempt direct router, snapshot, incident and proposal IDs from the other company; access must be denied. Revoke membership and repeat in an active session.
5. Try POST without CSRF and a viewer attempting an admin/diagnostic/download action; reject.
6. Create a proposal as engineer; requester cannot approve it. A different authorized approver can record a decision once. No router write occurs.
7. Use a LAB RouterOS v7 device with dedicated read-only account and trusted TLS certificate. Test resource read and each required menu. Verify a bad certificate fails closed.
8. Test wrong credentials, unreachable endpoint, unavailable menu, large route response and missing permission. Confirm honest error state, no credentials in logs.
9. Run cron and confirm due polling/snapshot jobs, no overlapping worker and no duplicate incident under ordinary serialized polling.
10. Create/download snapshot, verify SHA-256, test tamper detection, role restrictions and retention. Confirm nobody mistakes JSON for .backup/.rsc.
11. Configure a private operator Telegram chat and induce a lab failure; verify notification and audit. No Telegram approval is expected.
12. If AI is enabled, approve external data handling, test configured model compatibility, confirm no secrets sent and no execution possible.
13. Test mobile layout, company/group filters, empty states, long names, card preferences and keyboard focus.
14. Test host execution/time/memory limits, router fleet load, queue delay, log rotation and existing backup/DR procedures.

Do not replace existing NOC monitoring or backups until independently validated. The full SRS write/repair/restore acceptance tests cannot pass in this release because those features are not implemented.