# OZI-RIS Localhost Test Report

**Date:** 18 July 2026  
**Scope:** Development/localhost verification only  
**Commit tested:** `3255c69 Improve notification center dashboard UX`  
**Change policy:** No application fixes were applied.

## Executive summary

The application passes its existing automated functional suite and builds successfully. Database migrations, route uniqueness, Blade compilation, authentication boundaries, scheduling and the audit integrity chain are healthy. The principal gaps are production configuration, absent backup evidence, widespread formatter debt, Sass dependency deprecations, lack of browser/accessibility automation, and the difference between the SQLite/synchronous test environment and the MariaDB/asynchronous production architecture.

## Test results

| Check | Result | Evidence |
|---|---|---|
| PHP automated suite | PASS | 142 tests, 615 assertions, 11.68 seconds |
| Frontend production build | PASS with warnings | 836 modules transformed; CSS 502.80 kB, JS 368.84 kB |
| Blade compilation | PASS | View cache compiled successfully |
| Composer manifest | PASS | `composer.json` valid |
| Laravel Pint check | FAIL | Many existing files require formatting; no formatting applied |
| Database migrations | PASS | All migrations through batch 28 applied |
| Route inspection | PASS | 213 routes; no duplicate method/URI pairs |
| Scheduler | PASS | Notification Center collection registered every five minutes |
| Audit integrity | PASS | Audit hash chain verified |
| Production security gate | EXPECTED FAIL locally | Local environment, debug enabled, HTTP URL, insecure local session cookie |
| HTTP smoke test | PASS with module exception | `/up`, `/login`, `/` return 200; `/track` returns 404 because its module is disabled |
| Authentication boundary | PASS | Notification Center, exam requests, messaging and admin redirect unauthenticated users to login |
| Queue state | PASS | 0 pending jobs; 0 failed jobs |
| DICOM reconciliation state | PASS | 0 unresolved reconciliation issues; one active PACS node configured |
| Storage/build links | PASS | Public storage link and Vite manifest present |
| Backup evidence | FAIL | No `storage/app/backups` directory or local backup evidence found |
| Repository cleanliness | PASS before and after execution | No application source changes generated by tests/build |

## Environment observed

- Laravel 12.64.0
- PHP 8.2.12
- MariaDB 10.4.32
- Node.js 26.5.0
- npm 11.17.0
- Local environment with debug enabled
- Database-backed cache, queue and sessions in the local application
- PHPUnit uses SQLite `:memory:`, array cache and synchronous queue
- Notification Center module disabled locally
- Telegram module disabled intentionally pending real infrastructure

## Problems and risks

### High priority

1. **No local backup evidence**
   - The configured monitoring check has no backup artifact to verify.
   - A backup/restore exercise cannot currently be evidenced from the expected directory.

2. **Automated tests do not exercise the production database engine**
   - PHPUnit uses SQLite in memory while deployment uses MariaDB.
   - MariaDB-specific constraints, locking, deadlocks, date behavior and transaction isolation are not covered by the primary suite.

3. **Asynchronous queue behavior is not covered by the main suite**
   - Tests use the synchronous queue driver.
   - Worker crashes, retry timing, rate limiting, duplicate delivery and failed-job recovery remain unverified.

4. **Production security gate fails under current localhost configuration**
   - This is correct for local development, but deployment must be blocked until production uses HTTPS, disabled debug mode, secure cookies and production environment settings.

### Medium priority

5. **Code formatting check fails broadly**
   - Pint reports formatting changes across legacy models, controllers, migrations, seeders, routes and tests.
   - This increases review noise and makes future style enforcement difficult.

6. **Frontend build emits extensive Sass deprecation warnings**
   - The build reports deprecated `@import`, legacy `if()` and colour/global functions, mainly through Bootstrap/AdminLTE dependencies.
   - There were 389 repetitive warnings.

7. **No browser or accessibility automation**
   - No Playwright, Cypress, Axe or equivalent package was found.
   - Responsive behavior, keyboard navigation, focus handling, dark mode and screen-reader semantics are not automatically verified.

8. **No code-coverage measurement**
   - Xdebug/PCOV is not available.
   - The suite contains approximately 136 feature test methods but only 6 unit test methods, leaving service-level branch coverage unclear.

9. **Notification Center cannot be manually exercised while disabled**
   - The module is implemented and covered by automated tests, but local interactive validation requires it to be enabled deliberately.

### Lower priority

10. **Local response-time baseline is moderate**
    - Warm responses for `/up`, `/login` and `/` were approximately 0.35–0.40 seconds.
    - Local uncached/debug mode explains part of this, but performance budgets and production-like profiling are still needed.

11. **Dependency vulnerability state was not assessed**
    - Composer/npm vulnerability audits were not included because they may require current external advisory data.

12. **Real infrastructure was not tested**
    - No live modality MWL/MPPS, storage commitment, production PACS, SMTP/SMS, SSO, Telegram webhook or external monitoring integration was exercised.

## Recommended improvements

### Development test infrastructure

- Add a second integration-test job using MariaDB with production-equivalent constraints and transaction isolation.
- Add queue-worker integration tests using the database queue rather than only `sync`.
- Add concurrency tests for appointments, request acceptance, stock deduction, report finalization and alert deduplication.
- Install a coverage driver in development/CI and establish coverage targets for services and authorization policies.
- Add browser automation and Axe accessibility checks for core workflows and optional modules.
- Add visual regression checks for A4/PDF controlled forms.

### Reliability and operations

- Generate an encrypted local backup, restore it into a clean database and retain signed test evidence.
- Add explicit tests for queue retries, dead-letter behavior, worker termination and idempotency.
- Define health-check response-time thresholds and profile slow local/database requests.
- Test Notification Center escalation timers, automatic recovery and repeated monitor failures.

### Maintainability

- Plan a dedicated formatting-only change before enforcing Pint in CI.
- Track Bootstrap/AdminLTE Sass migration compatibility and remove deprecated imports/functions when dependencies support it.
- Pin and document supported PHP, Node, npm and database versions for development and deployment.
- Add dependency vulnerability audits to CI with an approved advisory-data workflow.

### Production-readiness boundary

- Keep Telegram disabled until public HTTPS, approved bot ownership, queue supervision and linked staff accounts exist.
- Run the production security check as a mandatory deployment gate.
- Complete real PACS/modality, backup recovery, browser/workstation and governance acceptance outside localhost.

## Conclusion

The existing localhost application is functionally stable under its current automated suite. The next development priority should be production-representative test infrastructure—MariaDB integration, asynchronous queues, concurrency, browser accessibility and backup restoration—rather than additional feature expansion.
