Phase 7 — Internal Use Only

KRIMS Production Readiness & Go-Live Audit

Final pre-launch quality assurance. 100 tests across 29 modules. Evidence-based statuses only — a test is PASS when the actual workflow was verified against the live database, not because a page exists.

Tested 2026-09-06 · Tester: Go-Live QA Agent (Base44) · Role: Super Admin · Method: Automated E2E backend workflow (23 steps), live data counts, schema/RLS review, code audit

Phase 7.1 — Validation & Regression Results

Tested 2026-09-07 · Tester: Phase 7.1 Validation Agent (Base44) · Role: Super Admin

PASS: 20 BLOCKED: 11

Automated E2E regression (20 assertions covering the 23-step chain), automation logic tests at API level, live data-integrity scan, schema/RLS deployment verification, code audit

Portal Security

Document Security

Role Escalation

Customer Portal

Vendor Portal

Automation (Event-Driven)

Automation (Scheduled/Background)

Quote ↔ Opportunity

Inventory Traceability

Legal Pages

Knowledge Centre

SEO Regression

E2E Regression

Data Integrity

Performance

Analytics

Email

Backup & DR

Custom Domain / SSL

Security Assurance

Final Security Matrix (deployed rule set)

Platform roles today are admin/user — SALES, ENGINEER, CUSTOMER, VENDOR are enforced through record-level RLS (ownership matching), not platform role values. Runtime verification with invited QA accounts is still BLOCKED; this matrix states the deployed rule set.

Feature	Admin	Sales	Engineer	Customer	Vendor
Public website (shop, catalogue, knowledge, legal pages)	ALLOW	ALLOW	ALLOW	ALLOW	ALLOW
Admin CMS (/admin)	ALLOW	DENY	DENY	DENY	DENY
Enterprise dashboard / CRM / ERP	ALLOW	DENY (no sales platform role — needs admin acct)	DENY	DENY	DENY
Inventory & stock movements	ALLOW	DENY	DENY	DENY	DENY
Procurement (RFQs, requisitions)	ALLOW	DENY	DENY	DENY	OWN RECORDS ONLY (own POs)
Engineering (service reports)	ALLOW	DENY	OWN RECORDS ONLY (assigned/created)	OWN RECORDS ONLY (own equipment)	DENY
Customer portal data (quotes, orders, contracts, hospitals)	ALLOW	DENY	DENY	OWN RECORDS ONLY (email-matched)	DENY
Vendor portal data (profile, own POs)	ALLOW	DENY	DENY	DENY	OWN RECORDS ONLY (email-matched)
Documents (DMS)	ALLOW	DENY	OWN RECORDS ONLY	OWN RECORDS ONLY (customer_email)	OWN RECORDS ONLY (vendor_email)
Notifications	ALLOW (all)	DENY	RECIPIENT ONLY	RECIPIENT ONLY	RECIPIENT ONLY
User management / roles	ALLOW	DENY	DENY	DENY	DENY
Audit logs / Go-Live Audit	ALLOW	DENY	DENY	DENY	DENY

Phase 7.1 Final Recommendation: READY WITH CONDITIONS — EXTERNAL CONFIGURATION REQUIRED

All security-critical and business-critical remediation items passed live verification: portal/document record-level authorization is deployed with portal keys backfilled (113 customer + 25 vendor records), the 23-step E2E chain re-passed on the new schemas with exact calculations and bidirectional Quote↔Opportunity traceability, inventory movements now carry system-computed before/after balances, all four event-driven notifications fire with duplicate suppression, legal pages and per-page SEO are live, and the Knowledge Centre shows only real CMS content. Remaining items are external dependencies — QA account runtime verification, Builder-plan scheduled automation, email provider/custom domain, backup restore drill, GA4/Search Console, custom domain/SSL and penetration testing — none of which are claimed as done.

1. Invite the 5 labelled QA accounts (TEST — ADMIN / SALES / ENGINEER / CUSTOMER / VENDOR) via the dashboard Users page and run the permission matrix + portal isolation tests with real logins.
2. Upgrade to a Builder plan (or higher) to activate scheduled/background automation for maintenance-due and low-stock sweeps.
3. Connect the custom domain + SSL (DNS via dashboard Domains settings) and configure a paid-plan email provider — then verify transactional email delivery.
4. Document backup frequency/retention with the platform and perform a supervised restore drill (see the DR guide in the Documentation centre).
5. Provide the GA4 Measurement ID and verify the domain in Google Search Console.
6. Commission an independent penetration test before public launch.
7. Delete the labelled TEST — QA VALIDATION records immediately before go-live (safe, one-step purge by the TEST- prefix).

The Phase 7 audit evidence below is preserved unchanged as the historical baseline.

Phase 7.2 — Runtime Security Acceptance Test Protocol →

67%

Overall Readiness

PASS ÷ applicable tests (97 of 100)

PASS

FAIL

BLOCKED

NOT APPLICABLE

Fixed

during this audit

Total Tests

100

Open Issues by Severity (excluding fixed)

S. Recommended Launch Decision: READY WITH CONDITIONS

Core commerce, catalogue, CRM, ERP, inventory, engineering and planning workflows verified against the live database (23/23 E2E steps passed, calculations exact, records correctly linked). Two HIGH severity frontend defects found during this audit were fixed immediately (unguarded Admin CMS, lost RFQ quote list). Launch is conditionally approved: the remaining HIGH issues (portal RLS read gaps, notification/low-stock/maintenance automation, document read permissions) and the BLOCKED operational items (email provider, custom domain, backups, analytics) must be resolved or formally accepted before public go-live.

I. Security Findings

• Admin CMS was exposed to any visitor at /admin — FIXED (admin-role guard added; backend RLS already blocked writes).
• Document entity read rule is open to all users — latent HIGH risk once contracts/invoices are stored. Restrict before use.
• Customer & Vendor portals: RLS read rules (admin-only) block the portals' own users from reading their data — HIGH.
• No secrets in frontend; auth platform-managed; entity RLS verified across 12 schemas.
• Penetration testing NOT performed — required before security assurance claims.

J. SEO Findings

• Sitemap/robots/hreflang (5 languages + x-default) and canonicals: implemented.
• Per-page unique titles/meta descriptions: missing (MEDIUM) — implement dynamic head tags.
• JSON-LD structured data: missing (LOW).
• Knowledge Centre renders sample articles with 0 CMS records (MEDIUM).

K. Performance Findings

• Catalogue pagination verified (24/page over 371 products).
• Product detail page uses raw <img> instead of the optimized Image component (MEDIUM).
• No evidence of unbounded queries on public pages.

L. Mobile Findings

• Responsive patterns (overlays, accordions, grids) verified in code across shop, portals and admin.
• Physical-device UAT recommended before launch (no broken tables/overlaps found in review).

M. Data Integrity Findings

• E2E TEST chain: all relationships persisted correctly (23/23).
• Quotation has no opportunity_id link (MEDIUM); StockMovement lacks before/after quantities (MEDIUM).
• Legacy records use name-based linking; backfill IDs (LOW).
• Entities with 0 live records: Quotation (pre-test), Shipment, RFQ, Newsletter, BlogPost, Document — modules unused in production yet.

N. Role/Permission Findings

• Entity RLS solid; Admin route guard fixed this phase.
• Customer/Vendor portal read-access gaps (HIGH) — portals cannot serve their audience until RLS conditions are added.
• SALES role not enforced server-side (admin/user only) — MEDIUM.

O. Integration Findings

• WhatsApp, AI (InvokeLLM), file uploads, push/email SDK: present; email delivery to non-users BLOCKED (custom domain + paid plan).
• GA4/Search Console: BLOCKED (not configured).
• Payment gateway: NOT APPLICABLE by design (B2B RFQ model).

P. Backup/Disaster Recovery Findings

• Platform-managed backups exist but frequency/retention/recovery not documented and restore not tested — PENDING configuration and a restore drill.

Q. Compliance Readiness Findings

• No false certification claims found; 'compliance-ready architecture' language used correctly.
• Privacy Policy / Terms / Cookie Policy pages missing (MEDIUM) — required before launch.
• Retention & deletion procedures undocumented; DPO ownership to be assigned if processing personal data at scale.

R. Remaining Pre-Launch Tasks (in priority order)

1. Fix Customer/Vendor portal RLS read rules (HIGH) — portals are unusable for their users today.
2. Restrict Document entity read access before storing any contracts (HIGH).
3. Automate Low-Stock, Maintenance-Due, New-Quote and New-Customer notifications (HIGH).
4. Connect custom domain + SSL; verify email sending (BLOCKED).
5. Verify backups + perform a restore drill; publish DR procedure (BLOCKED).
6. Publish Privacy Policy, Terms of Use, Cookie Policy pages (MEDIUM).
7. Populate Blog Posts via CMS; remove/label sample articles (MEDIUM).
8. Implement per-page SEO titles/meta + JSON-LD (MEDIUM/LOW).
9. Instrument 11 key analytics events; configure GA4 + Search Console (MEDIUM/BLOCKED).
10. Run engineer/customer/vendor portal UAT with dedicated accounts (BLOCKED).
11. Commission independent penetration testing before public security claims.
12. Delete TEST — QA VALIDATION records immediately before launch.