JEMESROSS CONSTRUCTION — RELEASE QA REPORT
Domain target: https://jemesrossconstruction.com
Completed: 2026-08-31 (regression pass added 2026-09-04)

RESULT: PASS after corrective work described below.

============================================================
REGRESSION PASS — 2026-09-04
============================================================
RESULT: PASS after corrective work described below.

Scope: full real-browser QA of every public route and every admin
route (desktop + mobile viewports), all public form submission
pipelines end to end, the customer portal end to end, file-upload
security, rate limiting, role-permission boundaries, and SEO output.

Defects found and corrected
1. Every public page emitted a duplicated canonical/og:url when the
   app's own base_url path segment reappeared in REQUEST_URI (e.g.
   ".../jemesross-php-production/jemesross-php-production/about.php"
   on a subfolder deployment). Fixed in app/helpers.php
   public_canonical_url() by stripping the base_url's own path
   prefix from REQUEST_URI before re-prepending it.
2. No custom 404 page existed; missing URLs fell through to the raw
   Apache default error page (unbranded, no navigation, leaked
   server/software versions). Added 404.php matching full site
   chrome, wired via .htaccess rewrite fallback + ErrorDocument,
   returns real HTTP 404 with noindex.
3. project-detail.php and resource-detail.php used a stub nav (logo
   + one button, no menu, no mobile nav) and had no footer and no
   per-record <meta name="description">, unlike every other public
   page. Rebuilt both to the full site chrome with real per-record
   SEO description/canonical.
4. Sitewide: no og:image/twitter:image was ever emitted, so shared
   links (WhatsApp, Facebook, LinkedIn) showed no preview image.
   Added automatic per-page og:image (first meaningful content image,
   falling back to a default) in start_public_seo_buffer().
5. Admin > Activity Log had no require_permission() call, so any
   authenticated admin role (including the low-privilege Content
   Manager role) could read the full cross-module audit trail.
   Restricted to users.manage, matching its Administration sidebar
   placement. Verified 403 for Content Manager, 200 for Super Admin.
6. Admin Equipment Fleet, Materials, and News/Resources list pages
   had no delete action (only add/edit), inconsistent with Projects
   and Material Categories. Added matching confirm-guarded delete
   actions to admin/equipment.php, admin/materials.php and
   admin/resources.php; Media Library delete also now removes the
   physical file from storage.
7. Admin login email/password <label> elements were not associated
   with their inputs (no for/id) — a real accessibility gap; the
   same pattern exists sitewide across most other forms. Fixed the
   admin login page as a sample; the sitewide sweep is tracked as a
   follow-up task.

Verified working end to end (no defects found)
- All 26 public content routes: one H1, zero broken images, zero
  horizontal overflow, zero console errors, at desktop and mobile
  (375px) viewports.
- Quote/equipment, general contact, material supply, and tender
  (with real PDF attachment) submissions: persisted to enquiries
  plus the correct category child table (rental_requests /
  supply_requests / tender_requests), admin notification created,
  audit-logged, correct JRC-prefixed reference returned.
- Honeypot field silently discards spam without a DB write or
  consuming the rate limit.
- Public submission rate limit (6 per 15 minutes per IP) confirmed
  blocking the 7th request with HTTP 429.
- Upload pipeline uses real finfo MIME sniffing, not extension
  trust: a .php file and a PHP payload renamed to .pdf were both
  rejected; valid PDFs are stored under storage/private with a
  randomised filename and 403 on direct web access; admin download
  endpoint serves them with correct Content-Disposition/Content-Type
  and requires an authenticated session.
- Admin Projects and News/Resources: create → draft hidden from
  public site and sitemap → publish → appears on the public listing,
  detail page, and dynamic sitemap.xml → delete removes it, verified
  round trip with disposable test records.
- Role-permission boundaries re-verified server-side (not just
  hidden nav) across every admin route for the Content Manager role.
- Customer portal: registration, login, password change (verified
  new password authenticates), profile update, new-request
  submission, claim-by-reference-and-email (both the correct-match
  and wrong-email-rejected cases), two-way portal messaging
  (customer → admin Portal Inbox → reply → customer sees it),
  request-list filtering, and cross-customer ownership boundary
  (403/"not found" on another customer's request id) all verified.
- Admin Settings, Notifications ("mark all read"), and Activity Log
  verified read/write correctly.

Content added this pass (admin-authored, from client-supplied
flyer/concept-note artwork, published via the existing News &
Resources CMS and, for the shared groundbreaking date, the existing
Smart Schools concept page)
- News: "2028 Ghana National Gold and Mining Engineering Youth
  Employable Skills Training Workshop"
- News: "Jemesross University College of Gold, Mining & Sustainable
  Engineering (JUCGMSE) — Official Launch & Sod-Cutting"
- News: "24 Hour Economy Mobile Market — Official Launch"
- smart-schools.php: added the "Official Launch & Sod-Cutting
  Ceremony" section for the pilot groundbreaking.

Outstanding
- Client logo file not yet supplied/wired in.
- Sitewide <label for=""> association sweep (item 7 above) not yet
  applied beyond the admin login sample.
- This regression pass ran against a local test database; a fresh
  production install (per README/PRODUCTION-CHECKLIST) is still
  required before go-live, including replacing local QA test
  accounts/records, which do not exist in a fresh install.

CUSTOMER PORTAL & ADMIN WORKFLOW REGRESSION — 2026-08-31
- Added and verified authenticated customer registration/sign-in, request claiming, new-request intake, profile management and ownership boundaries.
- Verified a live construction request from customer creation through admin receipt, two-way messaging, CRM status update to Quoted and customer progress display.
- Added and verified Admin > Customers and Admin > Portal Inbox.
- Rendered 26 primary admin routes: one H1 each, zero broken images and zero console warnings/errors.
- Rendered all authenticated customer routes with explicit empty, success, error, unauthorized and next-action states.
- PHP lint: 97/97 files passed. All four JavaScript bundles passed syntax checks.
- Database assertions confirmed the customer/request relationship, `customer_portal` source, Quoted state and both conversation messages.
- Customer portal CSS includes dedicated desktop, tablet (900px) and mobile (650px) layouts; navigation collapses to an accessible drawer, grids stack, forms become single-column and action rows reflow.

Coverage
- Real-browser desktop QA at 1440x1000 for 29 public routes and 29 admin routes.
- Real-browser mobile QA at 390x844 for the same public/admin route sets.
- Full-page screenshots were rendered for every tested route during visual review.
- Public navigation, mobile off-canvas navigation, admin mobile sidebar, tables, forms and empty/populated states tested.
- Construction, equipment, materials, tender and general-contact submissions persisted end to end.
- Equipment rental, supply and tender child records verified and updated from Admin.
- Enquiry qualification, priority, assignment, value and follow-up notes verified.
- Project, equipment, material, resource and administrator records created through browser workflows.
- Published project and resource listing/detail visibility verified publicly.
- Content Manager login and server-side 403 permission boundary verified.
- Notifications, reports, activity logs and private attachment download verified.
- Executable upload rejection and allowed PDF/JPEG private storage verified.
- Six-request/15-minute public rate limit verified with no seventh enquiry inserted.
- All PHP files linted; public/admin JavaScript syntax checked.

Defects corrected
1. Moved PHP sessions into protected application storage so login/CSRF/forms work when the host session directory is unavailable.
2. Carried a selected material from Supplies into the quote and saved supply items.
3. Fixed About and Contact descriptions that exposed unevaluated PHP source text.
4. Added canonical, robots, Open Graph, Twitter and home-page ConstructionBusiness structured data.
5. Added robots.txt and a dynamic XML sitemap, including published projects/resources.
6. Added noindex behavior for admin, confirmation and 404 pages.
7. Added accessible names to public/admin mobile navigation controls and runtime label associations.
8. Defaulted installation/base configuration to https://jemesrossconstruction.com.

Final browser regression
- 29/29 public routes: one H1, zero broken images, zero horizontal overflow, zero console warnings/errors.
- 29/29 admin routes: rendered at desktop/mobile with zero broken images, zero horizontal overflow, zero console warnings/errors.
- Indexable public routes expose canonical + Open Graph + index/follow metadata.
- Thank-you and missing detail routes expose noindex,follow.
- No PHP warnings are visible in rendered output.

Deployment requirements
- Install with production database credentials and keep base_url set to https://jemesrossconstruction.com.
- Force HTTPS, confirm mail/SMTP delivery, replace temporary imagery with approved client photography, and confirm legal copy/address/map details.
- Submit https://jemesrossconstruction.com/sitemap.xml in Google Search Console and Bing Webmaster Tools after DNS/HTTPS launch.
