# MEGA™ v2.0 — Council Reporting & Accountability

## New navigation
- **Council reporting** — create frozen draft reports from approved risk records, review, issue, print/save as PDF and export CSV appendices.
- **Accountability & actions** — accountable risk/action owner account links, owner responses, overdue commitments, Risk Officer evidence verification, escalations and resolutions.

## Council report content
The report contains an executive summary, residual risk profile, departmental distribution, category distribution, ten highest recorded risk ratings, action-accountability figures, overdue commitments, evidence-review figures, risks and actions appendices, and an explicit data-coverage statement. Narrative paragraphs are generated by deterministic PHP templates using counts from database rows. **No LLM/AI text generation is used.** The source-data payload is frozen as JSON with a SHA-256 integrity check. New assessments do not rewrite previously prepared reports. A draft can be marked issued by an independent admin/manager (not its preparer); this does not mean the document was submitted to or adopted by Council.

## Critical data qualifications
- Current approved risk scores and action statuses are captured when the report is prepared. The selected start/end dates label the intended period; they do **not** reconstruct prior risk scores or action states. Older approved council reports remain available as frozen snapshots.
- Current scoring bands are MEGA's existing configuration: Low < 6, Medium 6–<15, High >=15. Validate with municipality's approved methodology.
- Action marked `implemented` is *awaiting evidence verification* until a Risk Officer approves implementation evidence. Residual risk is **not automatically reduced** when an action is completed. Existing evidence-based control-factor reviews remain the separate method for changing residual risk.
- Owners may remain plain text. To enable owner acknowledgement and restricted self-service updates, an authorised officer links an existing staff account to the corresponding risk or action. There is no employee master-data requirement. Automatic email, WhatsApp and SMS are **not** claimed; in-app accountability views require users to sign in.
- Council report exports are confidential. Access is restricted to admin/risk_officer/manager/viewer roles. Draft reports are clearly marked and should not be submitted to Council.

## Upgrade existing Afrihost deployment
1. Back up the full site and database. Apply changes first on staging with fictional data.
2. Extract this **full ZIP** in a private folder on your computer.
3. Upload the application files and keep the currently deployed `app/config.php` **unchanged**. Do not rerun `install.php`.
4. Open **Council reporting** once as an administrator. MEGA creates its new reporting and accountability tables using `CREATE TABLE IF NOT EXISTS`. Your MySQL account needs `CREATE TABLE` permission. If the error persists, ask your host/database administrator to review privileges.
5. Create at least two non-shared staff accounts for meaningful preparer/reviewer testing. Link an Action Owner account to a test action under **Accountability & actions**.
6. Test: owner accepts commitment; owner uploads implementation evidence and marks implemented; Risk Officer verifies or returns evidence; management escalates an overdue action; create council report draft, compare counts to register, issue it, print PDF and download both CSV appendices.
7. Confirm SQL export can be restored and that restricted user roles cannot view others' evidence or modify actions they do not own.

## Preservation
The packaged `app/config.php` is **byte-identical** to the one in the supplied v1.9 application. Do not replace your live site's `app/config.php` if local credentials differ. New code creates tables; existing table definitions and existing data are preserved.

## Testing boundaries
PHP lint and pure logic tests can run without MySQL. The provided environment does not have PDO-MySQL / a live MariaDB server, so full transaction, permission, concurrent-user, and Afrihost browser workflows remain **unverified** and require staging acceptance tests before a production launch.

## Council output
Use the **Print / Save as PDF** button in a modern browser. The report is print-styled for A4, with HTML appendices and CSV detail exports. The application does not require an external PDF service. The generated report is labelled Draft until independently issued.