# MEGA™ v2.0 — Reporting and Accountability Test Report

**Release type:** Full-application deployment candidate for Afrihost staging.

## Tests actually executed
| Test | Result |
|---|---|
| `php -l` across all PHP files (including original installer, new modules and UI) | PASS |
| Built-in taxonomy / scoring test: 587 catalogue entries and sample factor arithmetic | PASS |
| Existing user-feedback checks (8 cases) | PASS |
| New reporting/accountability helper tests (13 cases) | PASS |
| Deterministic narrative agrees with synthetic input totals | PASS |
| No approved risk records → no invented risk assessment | PASS |
| Implementation without verification is not treated as verified | PASS |
| New progress after sign-off invalidates earlier verification | PASS |
| CSV formula prefix neutralised before Excel export | PASS |
| PHP council report template renders all ten sections from synthetic frozen data | PASS |
| Browser check with Chromium (`set_content`): council report opens and renders with stylesheet | PASS |
| ZIP CRC/integrity and all required source files present | PASS |
| Existing application configuration identical to v1.9 ZIP | PASS |

## NOT tested in this environment
| Area | Status |
|---|---|
| Connecting to MySQL/MariaDB, initial migration, live queries | NOT TESTED — server and PDO-MySQL missing |
| Owner account linking and acknowledgement with actual MySQL | NOT TESTED |
| Independent evidence review, escalation and resolution across real accounts | NOT TESTED |
| Report draft creation, approval and retrieval against live MySQL | NOT TESTED |
| Afrihost filesystem and SSL deployment behaviour | NOT TESTED |
| Multi-user/concurrent workshop + reporting under load | NOT TESTED |
| Full security and accessibility audit | NOT TESTED |

## Important operating limitations
- Reports use **approved risk data as it stands when prepared**; the selected reporting window is descriptive, and the system cannot reconstruct old risk ratings prior to the new frozen-snapshot feature. Previously issued v2.0 reports can be reproduced exactly.
- Narrative content is generated from fixed templates and database counts, not free-form AI. The generated prose does **not** independently verify whether objectives/KPIs were achieved.
- Verification of an implemented action is distinct from proof of residual-risk reduction; control-factor change remains subject to the existing effectiveness review with supporting evidence.
- Owner names are plain text; a Risk Officer must optionally link a staff account to allow that owner to acknowledge and update tasks. Automatic SMS/email notifications are not included. Overdue alerts appear when authorised users open the application.
- Report `issued` means internally finalised, **not** Council submission or Council approval. Independent preparer and issuer staff accounts are enforced.
- SHA-256 detects accidental changes to saved report content; it is not a cryptographic signature or a substitute for database security, backups or independent audit controls.
- This candidate has not passed full municipal production certification. Validate municipal risk scoring scales, role delegations, records handling and the Council report format before production deployment.

## Afrihost acceptance checklist
1. Back up current database and MEGA installation. Deploy the full application to staging without changing deployed `app/config.php`.
2. Sign in as admin and open Council reporting to create additive reporting tables. Confirm no SQL errors.
3. Prepare three approved fictional risks and actions in different departments.
4. Create an Action Owner login and link it to a test action; confirm another user cannot update it.
5. Test acknowledgement, progress update, evidence upload and Risk Officer verification by a **different uploader**.
6. Confirm overdue/near-due status and escalation resolution are correct.
7. Prepare a report; compare exact figures against the test risk register.
8. Confirm draft watermark, reviewer separation and issued document timestamp.
9. Change an underlying risk afterwards; verify the previously prepared report has unchanged figures and CSV exports.
10. Use Print / Save as PDF and check the Council report pages for legibility and page breaks.
11. Test CSV downloads safely in Excel and verify they do not execute formulas.
12. Test backing up and restoring a frozen report, risk records, supporting evidence and accountability history.