ALUMNI CONNECT 1.0.0 - VERIFICATION RECORD
Date: 12 October 2026

PASSED
- PHP syntax validation for 19 files, including all application, installer,
  command-line utility and integration-test PHP files.
- JavaScript syntax validation for the password visibility/confirmation UI.
- 49 integration assertions using real PHP 8.5 and SQLite PDO.
- 23 PHP 8.2 request/gate checks with separate guest, admin and member
  sessions. The HTTP-only redirect gate was exercised with controlled
  server variables because the embedded runtime normalises transport data.

ACCESS AND SECURITY BEHAVIOR CHECKED
- Public registration always produces a pending member, even if role=admin
  or status=approved is submitted by a modified client.
- Pending, rejected and suspended accounts cannot log in.
- Administrators can approve, reject, suspend, restore and reopen records.
- Ordinary members cannot access admin pages or submit admin mutations.
- The initial administrator cannot be suspended through member controls.
- Missing or incorrect CSRF tokens prevent state changes.
- Passwords are stored as one-way hashes; overlong bcrypt inputs are denied.
- Duplicate emails do not create multiple users.
- Reset tokens are hashed, expire after one hour and work once.
- New recovery links invalidate earlier unused links.
- Password recovery never changes membership approval.
- Suspension and password reset invalidate existing sessions.
- Idle and absolute session limits are enforced.
- Session cookies are Secure, HttpOnly, SameSite=Lax and host-only.
- Frame denial, no-store responses and installer lock were checked.
- The directory omits private email addresses and application references.
- Opt-out removes a profile from the directory.
- User-entered names, profile content and posts are HTML-escaped.
- Rate-limit thresholds prevent additional attempts in a window.

APPLICATION BEHAVIOR CHECKED
- Profile persistence and community post creation.
- Event creation with Malaysia-time to UTC conversion.
- Idempotent RSVP creation and cancellation.
- Main member/admin views render without PHP errors.
- Account audit events are recorded.

NOT VERIFIED IN THIS ENVIRONMENT
- A live MySQL/MariaDB server. Integration and request tests use a SQLite
  fixture derived from the delivered MySQL schema. MySQL-specific DDL,
  rate-limit upserts and installer advisory locks need host validation.
- Apache/LiteSpeed .htaccess enforcement or cPanel settings.
- DNS, TLS certificate provisioning, server email delivery or spam handling.
- Real browser rendering, mobile visual layout or assistive technology.
- Live deployment. No changes were made to the existing 360S website.

This test record is not an external security audit or a guarantee that
deployment configuration is correct. The installation guide includes
host-side checks before inviting real alumni.
