# Requirement completion checklist

Stage 1: runtime/framework/schema — locally verified.
Stage 2: application/admin/scanner/billing features — implemented with tests.
Stage 3: local automated acceptance — passed with disclosed socket skip.
Stage 4: live VPS/provider/browser/payment/SMTP acceptance — pending.

**Release status: acceptance candidate; NOT production-ready.**

| Requirement | Completion status | Evidence / remaining gate |
|---|---|---|
| Laravel 12 / PHP 8.3+ / Composer dependencies + lock | Locally verified | Framework boots; locked dependencies installed. Laravel 12.70.1, Filament 3.3.57; production target remains VPS gate. |
| MySQL 8 / migrations / seeders | Locally verified | Actual MySQL 8.0.46 suite; repeatable seeders; SQLite suite also passes. |
| Redis background jobs / recovery | Locally verified | Real Redis 7 worker consumed jobs; scanner/provider failures propagated without invented results; recovery/deadline commands implemented. |
| Blade / Tailwind / Alpine responsive frontend | Implemented; browser acceptance pending | Compiled Vite assets and rendered Blade endpoints; phone/desktop interaction, progress, keyboard and JS console review still required. |
| File upload / drag-and-drop / progress | Backend verified; browser acceptance pending | Actual HTTP multipart upload stores private content; drag/drop/progress uses XHR/Alpine; live browser test gate. |
| URL scanning + SSRF controls | Contract/security tests pass; live provider pending | Actual VirusTotal URL submission/poll adapter; public DNS/IP validation; no local target fetch, no provider redirects. Requires licensed key + consent. |
| SHA-256 lookup | Contract tests pass; live credentials pending | VirusTotal/MetaDefender/MalwareBazaar adapters; not-found distinct from undetected. |
| Column results / names / verdicts / threats / versions / dates | Locally verified API; browser gate | Individual engine evidence with separate provider analysis time and record time; unsupported/missing dates explicit. |
| Search / sort / downloadable reports | Implemented; exports verified | Alpine search/sort; policy-protected CSV/JSON; CSV formula neutralization test passes. Live browser interaction pending. |
| Registration / login / email verification / reset | Local tests pass; SMTP delivery pending | Signed email links, reset broker, throttles, hashed passwords, queued encrypted notifications. |
| Guest / Free / Premium / Business plans | Locally verified | Seeded/admin-manageable limits; effective paid access follows canonical Stripe state and 48-hour reconciliation freshness. |
| Dashboard / history / account settings | Locally verified | Owner-isolated private history, quotas, profile/password settings, deletion of finished scans. |
| Premium checkout / portal / verified webhook | Contract tests pass; live Stripe pending | Hosted checkout, price IDs, raw-body signature verification, replay/canonical status/customer/price tests; no live bank transaction verified. |
| Filament complete admin dashboard | Locally verified routes/forms | User/plan/engine/scan/log resources, metrics and site/SMTP settings. Browser administration review pending. |
| Engine enable / disable / priority / quotas | Locally verified | Transactional provider limits; engine control/connection action; usage counters and redacted request logs. |
| Secure API key configuration / connection tests | Local tests pass; remote tests pending | Encrypted/hidden model credentials; existing key not rehydrated into forms; replacement/blank-preservation tested. |
| SMTP / website settings / audit logs | Local tests pass; live delivery pending | Encrypted SMTP password, operator/contact/plain-text policy settings, changed-field audit records excluding secrets. |
| Real ClamAV file scanning | Real binary verified; full VPS gate pending | Actual clamscan detects EICAR and ignores benign text using isolated test HDB. Fresh official DB + restricted socket pipeline not accepted yet. |
| Real YARA scanning | Real binary verified; full VPS gate pending | Actual compiled EICAR/PHP pattern rules and benign tests. Initial rule coverage deliberately small; operator feed review required. |
| VirusTotal API integration | Implemented + contract tests; licensing/live gate | Real API v3 file/URL/lookup/poll code; account rights and paid credentials required for commercial deployment. |
| MetaDefender integration | Implemented + contract tests; licensing/live gate | Real API v4 file submit/hash/polling; account-specific field/entitlement validation required. |
| Permitted free malware intelligence | Implemented + contract tests; permission/live gate | MalwareBazaar hash lookup only; Auth-Key/fair-use/commercial terms apply; no sample upload. |
| Modular scanner adapters | Locally verified | Adapter/Outcome/Registry with local and remote implementations; unknown categories fail conservatively. |
| Private quarantine / auto cleanup | Locally verified | UUID private files, owner/session policies, expiration tests, orphan cleanup, no original-file download route. |
| Restricted scanner workers / Unix socket | Direct binary/path tests pass; socket UNVERIFIED | Dedicated root-owned daemon and non-login systemd account. Host forbids Unix sockets; actual socket test skipped, not counted as passed. |
| AlmaLinux 9 / cPanel scripts / service units | Implemented + syntax checks; live VPS pending | EA-PHP paths, reviewed package provisioning, separate account workers, readonly/no-network scanner. WHM paths/groups/SELinux/TLS remain gates. |
| Browser-based installation | Implemented + unit and actual HTTP/MySQL/Redis tests | Private owner key, prerequisites, connection tests, migrations/seeders/admin/.env, existing-data refusal and automatic lockout. See BROWSER-INSTALLER.md. |
| Documented installation | Complete | DEPLOYMENT.md, OPERATIONS.md, PROVIDERS.md, SECURITY.md, TESTING.md and ACCEPTANCE.md. |
| Automated unit / integration / security tests | Locally verified with disclosed skip | PHP suites, real binary tests, MySQL quota concurrency, real Redis jobs, real HTTP CSRF/ownership/root checks; provider responses are test fixtures. |
| Dependency audits / syntax / assets | Locally verified; results included | Composer/npm audit output, PHP/Python/shell checks and Vite build recorded. Repeat when dependencies change. |
| Final ZIP / all code / setup / test results | Archive contents and CRC verified | Included vendor dependencies, lockfiles, built assets, source, docs and results; archive validated; secrets, runtime samples, caches and node_modules excluded. |
| Production-ready label | NOT ACCEPTED | All applicable staging/VPS/provider/browser/SMTP/payment gates must pass first. See ACCEPTANCE.md. |