# VulaPrize + VulaPulse — Build and Validation Status

## Included in this package

- Frameworkless PHP application, PDO database layer, MySQL/MariaDB schema for phpMyAdmin, and cPanel setup instructions.
- Public contest pages, registration/login/password reset/email verification routes, participant account pages, contest entry/checkout structure, KW/streak/redeem flows, Request Hub, admin contest/user/order/redemption/support tools, result publishing, audit log, email queue, settings, webhooks, and cron scripts.
- Refined responsive UI styles, layered navy/amber/teal surfaces, motion, grain texture, vector illustrations, accessible FAQ accordions, and responsive informational pages.
- Individual UI/brand reference images in `DESIGN_REFERENCE/`. These are included as visual references and are **not** used as fake screenshots in the live interface.
- Real-money checkout remains disabled by default. Payment-provider credentials alone do not mean the integration is approved or ready for production.

## Checks performed for this build

- PHP syntax lint across all PHP files.
- Route-to-controller method mapping check.
- Presence of required application and installation files.
- Static review of the client KW view to ensure it does not show ZAR amounts.
- ZIP integrity check and archive size check.

## Checks that could not be completed here

The execution environment does not have the `pdo_mysql` PHP driver or a MySQL/MariaDB server/client. Therefore a real database import, browser-based end-to-end run, transaction concurrency test, payment sandbox callback, outgoing email delivery test, backup/restore test, and cPanel cron execution were **not** performed here. The system must not be described as independently verified 100% or production-ready on the strength of syntax lint alone.

## Required before live use

1. Install on a staging cPanel account with PHP 8.3+ and MySQL 8/MariaDB 10.6+.
2. Upload the ZIP to the cPanel home directory, extract it, create a dedicated database/user with ALL PRIVILEGES, then visit `/setup.php`. The web installer creates the schema on an empty database and creates the first administrator; no manual SQL import is required for a fresh install.
3. Run the test matrix in `MASTER_SPECIFICATION.md`, including two concurrent/duplicate webhook deliveries, entry-window boundaries, answer secrecy, winner tie-breaking, KW atomicity, support-ticket lock, role isolation, CSRF, and account lifecycle tests.
4. Configure mail and prove delivery using the actual hosting provider.
5. Keep `REAL_MONEY_ENABLED=false` until the operator has obtained appropriate South African legal advice and passed the payment provider's sandbox and live-readiness checks.
6. Replace the example support email, domain, and all other deployment-specific settings before launch.

## Scope and honesty note

The bundled UI reference images document the approved design direction; they are not proof that every mockup is implemented pixel-for-pixel. The legal pages are pre-launch drafts, not legal advice. This is a substantial code package, but hosting-specific verification and external provider credentials are inherently environment-dependent.


## Repair pass — 2026-10-13

- Reworked `public_html/setup.php` into a self-contained installer that validates database credentials, imports the schema on an empty database, detects incomplete/non-empty schemas without dropping data, writes private configuration, creates the first admin, and writes an installation lock. Manual phpMyAdmin import is no longer required for a fresh installation.
- Updated first-run error guidance to point to `/setup.php`.
- Added page-specific semantic SVG illustrations for the skill challenge, journey, VulaPulse, responsible participation and privacy pages. The generic KW coin is no longer used as the image for every information page.
- Added consistent public, participant and admin footers and removed the duplicate About link.
- Rebuilt settings UI into labelled groups with descriptions and typed controls. Server-side validation now uses a strict allow-list and validates the KW milestone JSON.
- Added a maintenance-mode page and request gate, plus more explicit system-health checks.

**Verification status:** PHP lint across 87 PHP files, Node syntax check, route-to-controller mapping, controller-to-view mapping, local asset checks, SVG XML parsing, SQL statement splitting, and local HTTP installer smoke tests were rerun after this patch. This environment still lacks `pdo_mysql` and a MySQL/MariaDB server, so database-backed installation and full end-to-end user journeys cannot be truthfully marked passed here. The included setup wizard must be exercised against an empty staging cPanel database before production use.


## Remaining scope gaps (not to be represented as complete)

- The current role model is `admin` and `client`; a full fine-grained role/permission editor and audited God View impersonation are not implemented in this package.
- Payment callbacks, email delivery, cron jobs, and database-backed workflows still require real staging verification with the selected providers and hosting environment.
- Legal documents remain pre-launch drafts and need operator/legal review.