# SokoKilimo verification record

**Recorded:** 2026-10-24 (local workspace)  
**Disposition:** locally verified source/build candidate; **not a production release**.

## Checks that passed

| Area | Result | Scope / limits |
|---|---|---|
| PHP feature suite | PASS — 26 tests, 111 assertions | Executed on PHP 8.4.27 with PHPUnit 11.5.57; test database SQLite in-memory. The Composer dependency solver is configured for PHP 8.2 compatibility. |
| Fresh database migration and seeding | PASS | `DB_CONNECTION=sqlite DB_DATABASE=:memory: php artisan migrate:fresh --seed --force`; no production MySQL/MariaDB run. |
| Laravel production caches | PASS | `route:cache`, `config:cache`, `view:cache` succeeded with production environment variables; test caches were then cleared. |
| Dependency advisory scan | PASS | `composer audit --locked` reported no known advisories at check time. |
| Android debug compilation | PASS | `android/gradlew clean assembleDebug`; Gradle 8.10.2, Android SDK 35, JDK 21, test URL `https://example.tz/api/v1/`. This is not an Android release build, not signed with an owner key, and not tested on a physical device. |
| Source archive | PASS | ZIP integrity check passed; archive includes `composer.lock`, Gradle wrapper and `.env.example`; secrets and generated dependencies/build outputs are excluded. |

The GitHub Actions workflow in `.github/workflows/ci.yml` was added for repeatable CI, but has not run on a connected repository.

## Production release blockers

- **Domain/DNS:** the proposed `sokokilimo.sembosidigital.com` did not resolve when checked. The owner indicated it will change. Use the final domain only after DNS and valid HTTPS are configured; then rerun Android build and end-to-end smoke tests against that exact host.
- **Hosting:** cPanel was selected, but no cPanel deployment has been made or verified. A host account, PHP extensions/version, MySQL database, cron/queue capacity, TLS and private storage configuration must be prepared by the owner/host.
- **Database:** production MySQL/MariaDB migration, rollback and upgrade rehearsal remain untested; use a staging database matching the actual cPanel engine/version first.
- **External services:** payment is intended to remain manual at launch, with references subject to authorized human review. Live SMS credentials/routing/webhook signing, Firebase project and service credentials are not configured. OTP/SMS delivery is not verified; FCM is not active without project configuration.
- **Uploads:** production scanning must be configured and tested with a working ClamAV scanner; absent/unknown scanning fails closed.
- **Android:** current debug compilation is not an owner-signed AAB/APK. App owner must supply/hold signing credentials securely, final API domain, Firebase project config and Play Console ownership; perform device, accessibility, low-bandwidth and notification testing.
- **Legal and operations:** privacy/terms, data-retention/deletion, backups, restore, incident response, support contact, security/IDOR review, load testing and local user acceptance require owner/operator and qualified Tanzanian counsel review.

## Go-live decision

**NO-GO.** Passing local tests and compiling a debug APK establish source-level verification only. Do not describe this artifact as production-ready or deploy it with real customer data until every relevant launch blocker is resolved and the exact live environment has passed staging and production smoke tests. No production credentials, signing keys, or provider secrets should be sent in chat or committed to this repository.