# Phase 18 automated testing and quality assurance report

Date: 2026-07-19  
Runtime: PHP 8.5.8 CLI with PDO MySQL and PDO SQLite  
Automated database: isolated in-memory SQLite fixture  
Result: 79 automated checks passed, 0 failed

## Scope and results

The main regression suite completed 67 integration and unit scenarios in 5.23 seconds. It covers authentication and throttling, users and permissions, airport/route/fleet masters, schedule generation and conflicts, dispatch and completion, aircraft location updates, maintenance and grounding, immutable inventory, expenses and payments, revenue and budgets, fuel posting, crew assignment, documents and alerts, reports, API tokens, webhooks, administration, security headers, tenant isolation, and pagination.

The Phase 18 quality gate completed 12 static checks. It validates PHP syntax, CSRF coverage for every state-changing browser route, absence of unsafe deserialization and inline CSS injection, DECIMAL-safe migrations, tenant scoping, responsive layout contracts, escaped shell output, reusable UI state components, and compiled assets.

### New focused coverage

- Validator boundary behavior and UTC/local conversion across daylight-saving offsets.
- Completed-flight status regression protection.
- Permission boundaries for Administrator, Operations Manager, Fleet Manager, Maintenance Manager, Finance Manager, Crew Manager, Auditor, and Viewer profiles.
- Cross-airline denial through service detail and listing paths.
- Stable server pagination over 125 audit records.
- Desktop, tablet, and mobile layout checks using a deterministic 120-record browser fixture.

## Manual browser QA

The Codex in-app browser passed at 1440×900, 768×1024, and 390×844. Verified items were responsive sidebar behavior, forms, modal open/close, filters, pagination, CSV download, empty state, controlled error state, long values, 25-row rendering from a 120-record fixture, table containment, and absence of document-level horizontal overflow. No console errors or warnings were present.

Native Google Chrome, Apple Safari, Mozilla Firefox, and Microsoft Edge were not available from this execution environment. Their runs remain an explicit release-gate item in the [manual QA checklist](../tests/manual/MANUAL_QA_CHECKLIST.md); they are not represented as passed.

## Defects found and fixed

1. Numeric strings using `integer|min` or `numeric|max` were incorrectly compared by string length. The validator now selects numeric bound comparison whenever the field declares a numeric rule.
2. A completed or otherwise operational flight could be moved back to a schedule-editable state through the generic status service. Schedule editing now rejects transitions from operational and terminal statuses.
3. The QA CSV fixture emitted a PHP 8.5 `fputcsv` deprecation. The escape argument is now explicit and compatible with supported PHP versions.

## Security findings

- No unresolved high- or critical-severity finding was identified by this phase.
- Every state-changing server-rendered route declares CSRF protection directly or inherits it from a CSRF route group.
- Role and service authorization checks passed, including read-only profiles.
- Cross-airline service and listing access was denied.
- Output escaping, CSP/error pages, upload controls, API scopes, session behavior, webhook signatures, and secret-redacting logs retained passing regression coverage.
- Static review found no application use of unsafe PHP `unserialize()` and no migration use of floating-point SQL column types.

## Performance findings

- The 67-scenario application suite completed in 5.23 seconds locally.
- Pagination remained stable over 125 audit rows.
- The browser fixture rendered a 25-row page backed by 120 deterministic records without document-level horizontal overflow.
- This is functional/performance-smoke coverage, not a production load or concurrency benchmark. Query latency under production-scale MySQL data and simultaneous users remains unmeasured.

## Known limitations and recommended fixes

1. Add a CI job backed by MySQL 8 and run migrations, seeders, rollback/status, and the full integration suite there. The local `mysql` client/server was unavailable, so this execution used the existing SQLite compatibility fixture.
2. Execute and sign off the supplied checklist in current native Chrome, Safari, Firefox, and Edge builds.
3. Add a coverage driver such as PCOV or Xdebug in CI and establish line/branch thresholds; this environment did not provide code-coverage instrumentation.
4. Add production-like load tests for calendar queries, executive summaries, audit pagination, exports, inventory concurrency, and approval locks.
5. Split the single-process integration suite by domain when parallel CI is introduced, while retaining a final end-to-end workflow job.

## Commands

```bash
php tests/run.php
php tests/quality/static-analysis.php
```

The manual fixture is `tests/manual/qa-shell.php`; it is intentionally outside the production web root.