iBilik Capital Master Source v1.0.1 Hardening Report

BASELINE
- Source: icapital.saibadns.com18082026-V1.0-full.zip
- Database reference: verified v2.1 dump
- Runtime target: PHP 8.0.30 / MySQL 5.7.44

FIXED CRITICAL ISSUES
1. A/B Compare HTTP 500
   Root cause: formula/compare.php called Access:: and Csrf:: without importing Ibilk\Access / Ibilk\Csrf.
   PHP imports are file-scoped and do not propagate from _common.php.
   Fixed imports and retained same-deal/same-engine validation.

2. Sensitivity HTTP 500
   Root cause: same missing Access/Csrf imports.
   Fixed imports.
   Upgraded sensitivity from point-only generator to executable Formula sensitivity flow:
   Base Calculation Run -> sensitivity-enabled parameter -> observed KPI -> point execution -> Calculation Runs -> persisted sensitivity points.

3. GoldenReferenceValidator schema mismatch
   Fixed obsolete expected_outputs_json / max_absolute_difference / differences_json references.
   Uses actual schema:
   expected_output_json, compared_output_count, passed_output_count, failed_output_count, validation_result_json, validated_at.

4. InvestorLiabilityService namespace mismatch
   Changed ICapital to Ibilk so the production autoloader can resolve the class.

5. Golden regression test namespace mismatch
   Updated to Ibilk\Formula and moved into protected tests/.

HARDENING CHANGES
6. Formula new/view/compare/sensitivity pages now explicitly import their own Access/Csrf dependencies.
7. Formula Workspace added to permission-aware Dashboard navigation.
8. health.php now requires Super Admin and no longer exposes document root/config path/database exceptions.
9. Internal src/config/lang/database/docs/tests directories deny direct HTTP access.
10. Root .htaccess blocks common backup/source artifacts including sql/txt/zip/bak/xlsx/json.
11. Calculation Run confirmation now records confirming User or Super Admin (requires DB v2.2).
12. Calculation Run numbering locks the Deal row first to serialize concurrent run-number allocation.
13. v2.2 conditionally adds UNIQUE(deal_id,run_no) when no historical duplicates exist.
14. Accepted migration history v1.0 through v2.2 is restored under database/migrations/ (v1.1 was credential bootstrap, not schema migration).
15. A schema manifest generated from verified v2.1 dump is stored in database/baseline without bundling live business/security data.

AUTOMATED CHECK RESULTS
- PHP lint: 54/54 passed.
- Formula autoload: core Formula classes and InvestorLiabilityService passed.
- Golden Formula regression: all four Excel model reference cases passed.
- Old ICapital namespace references in PHP: 0.

DEPLOYMENT ORDER
1. Back up current website and database.
2. Import database/ibilik_capital_database_v2.2_master_hardening.txt.
3. Verify migration completion and no duplicate-run warning.
4. Replace website files with this Full Build, preserving the live assets/config/config.php credentials if your upload process overwrites configuration.
5. Login as Super Admin.
6. Check /health.php.
7. Open Dashboard -> Formula Workspace.
8. Verify A/B Compare page loads.
9. Verify Sensitivity page loads and can select a completed Base Run.
10. Run full integrated testing before Production release.

STATUS
Suitable to freeze as Master Source v1.0.1 after v2.2 database migration and server smoke check.
