# Claude Review Prompt

You are the senior QA architect, business logic reviewer, security reviewer, and test design lead for FieldOps Cloud.

Use the cloned repository plus this pack to produce a detailed test strategy and execution-ready test plan.

## Mission

Review the FieldOps Cloud codebase and this handoff pack. Produce:

1. A business logic validation report.
2. A complete functional test plan.
3. A regression test plan.
4. A security and permissions test plan.
5. A data and tenant isolation test plan.
6. Integration contract test recommendations.
7. End-to-end browser journey coverage.
8. Negative, edge-case, and failure-mode tests.
9. Release gates and production-readiness criteria.
10. A prioritised defect/risk list with severity and evidence.

## Critical Instructions

- Do not assume a feature is production-ready because a route, template, or doc exists.
- Confirm implementation from code.
- Distinguish current behavior, demo-only behavior, foundation-only behavior, and missing behavior.
- Treat `public/index.php` as the active route table.
- Treat `config/web/routes.php` as unused unless code proves otherwise.
- Treat `src/*/Service` classes as primary business logic.
- Treat `src/*/Repository` classes as persistence boundaries.
- Treat templates as presentation only; views should not contain business rules.
- Verify all POST routes for CSRF unless the route is intentionally under `/api/`.
- Verify all protected routes call server-side permission checks.
- Verify role visibility in UI separately from server-side RBAC.
- Verify tenant isolation at repository/query level, not just in navigation.
- Verify imports and exports for CSV injection, row validation, tenant scope, and undo behavior.
- Verify financial calculations with deterministic decimal expectations.
- Verify AI assistant does not call external LLMs, mutate records, or leak secrets in the current implementation.
- Verify integration pages are sandbox/foundation where applicable.
- Mark all unknowns as "Requires owner confirmation" or "Not found in current project".

## Expected Output Structure

Use this structure:

1. Executive test strategy
2. Product/module inventory
3. Architecture and testability notes
4. Environment setup and test data strategy
5. Route/RBAC matrix
6. Business logic assertions by module
7. Test cases by module
8. Security test cases
9. Integration contract tests
10. Browser E2E journeys
11. Mobile/offline/PWA tests
12. Nonfunctional tests
13. Automation plan
14. Manual QA plan
15. Release gates
16. Risks, gaps, and open questions

## Severity Model

- P0: security, tenant isolation, financial correctness, payment/billing, data loss, production auth, support impersonation, destructive actions.
- P1: core job/quote/invoice/schedule workflows, imports/exports, customer portal, integration configuration.
- P2: reporting accuracy, UI usability, mobile/PWA polish, demo-only inconsistencies.
- P3: copy, small visual details, non-blocking documentation gaps.

## Must-Inspect Files

Start with:

- `public/index.php`
- `src/Application/App.php`
- `src/Infrastructure/Security/RbacService.php`
- `src/Infrastructure/Security/SessionAuth.php`
- `src/Infrastructure/Security/CsrfService.php`
- `src/Job/Service/JobWorkflowService.php`
- `src/Schedule/Service/ScheduleService.php`
- `src/Quote/Service/QuoteService.php`
- `src/Invoice/Service/InvoiceService.php`
- `src/Importing/Service/*`
- `src/Llm/Service/AiAssistantService.php`
- `src/Saas/Service/*`
- `src/Saas/Controller/PlatformAdminController.php`
- `src/Portal/Service/CustomerPortalService.php`
- `src/Mobile/Service/OfflineTechnicianService.php`
- `tests/run.php`
- `tools/browser-smoke.cjs`
- `tools/role-walkthrough.cjs`
- `docs/QA_ROUTE_ACTION_INVENTORY.md`