# Code Package Notes

## Included

- Framework-free PHP application, PDO database access, CSRF and role guards, account flows, contest lifecycle and entry routes, VulaPulse KW/streak/redeem flows, Request Hub, admin contest/user/order/redemption/support pages, payment event/webhook structure, audit logging, email queue and cron scripts.
- One-time web installer at `public_html/setup.php`. It tests the PDO MySQL driver and database connection, creates the schema on an empty database, seeds default settings/rewards, writes private `.env` outside `public_html`, and creates the first administrator. Manual SQL import is optional. Delete `setup.php` immediately after success.
- Responsive custom styling, CSS grain/gradient/liquid effects, page-specific SVG illustrations with contextual alt text, consistent public/client/admin footers, grouped settings and individual UI reference screens in `DESIGN_REFERENCE/`.

## Operator-supplied / pre-launch requirements

- Live payments remain disabled by default. Do not enable until legal review, payment-provider sandbox tests, webhook signature verification and operational reconciliation have passed.
- The terms and privacy pages are explicitly pre-launch drafts, not legal advice or proof of completed South African legal review.
- Provider credentials, support mailbox and domain settings must be supplied by the operator.
- Yoco's current webhook format and PayFast ITN verification must be tested against the merchant account before production use.
- Automated refunds are not enabled without an approved refund policy and tested gateway operations.
- The package does not claim complete role-permission authoring, audited God View impersonation, MFA, bot-control integration, or verified off-server backup/restore as finished features.

## Security architecture present in the codebase

- PDO prepared statements, CSRF protection on state-changing browser routes, secure session defaults and session ID regeneration.
- Password hashing, application-level role guards, encrypted contest answers/sensitive fields, transactional KW ledger updates and idempotency-oriented payment event handling.
- Admin audit records for key actions, private storage directories, MIME-based image validation and non-guessable filenames.

## Verification boundary

PHP syntax lint, route/controller mapping checks, ZIP integrity and a local HTTP GET of the setup page were checked. A live MySQL/MariaDB import and database-backed end-to-end suite could not run in the build environment because `pdo_mysql` and a MySQL/MariaDB server/client are unavailable. See `BUILD_STATUS_AND_TESTS.md` and `VALIDATION_REPORT.txt`.