# AARJAY GDP Portal — Remediation Gap & Impact Register

**Branch:** `remediation/gdp-hardening`  
**Migration floor:** **286**  
**App posture:** Hardened validation-candidate software controls (human/RP release still external)  
**Commercial track:** Commercial Pilot v1.0 — Phase **1.1** extended RBAC runtime enforcement landed (2026-07-19)

---

## Progress snapshot (software-only)

| Area | Status | Notes |
|------|--------|-------|
| Stock / Dispatch / GRN | **Closed (tech)** | Dual control now **mandatory** on dispatch release |
| Site / record auth | **Closed (tech)** | Fail-closed + downloads site-scoped for key folders |
| E-sign high-risk | **Closed (tech)** | Explicit bind required; MFA enrolled required for high-risk |
| Trade Gate | **Closed (tech)** | Timed overrides honoured; e-sign on new override |
| Extended RBAC runtime | **Closed (tech) — P1.1** | No CRUD fallback for extended flags; Admin ≠ approve/release/sign/override; wired on Dispatch/GRN/CAPA/void/export/Trade |
| E-sign TX bind | **Closed (tech) — P1.2** | `defer_write` + `finalizeDeferred` under row lock for Dispatch release, GRN accept, CAPA close, quarantine release; stale hash rejects without orphan approval |
| Universal Stock Ledger | **Closed (tech) — P1.3** | Recall / Defective / Falsified / NonSaleable route via `StockBatch::recordMovement`; static scan clean outside `StockLedgerService` |
| Dispatch duplicate batch | **Closed (tech) — P1.4** | Quantities aggregated per batch under `FOR UPDATE` before one ledger sale; overdraw on totals rejected |
| MFA login | **Optional (local)** | Login not forced; high-risk signing forced |
| Malware | **Env-gated** | Required automatically when `env` is staging/production |
| Experimental stubs | **Off** | cold-chain/AI/QR/accounting flags false |
| Audit append-only + chain lock | **Closed (tech)** | Triggers + FOR UPDATE tip lock |
| RP / org release | **External** | Not a software item |

### P1.1 operator note

Re-seed or refresh role permission templates after deploy so warehouse/viewer/manager rows match the new extended-flag matrix (`PermissionSeeder::seedForUser`). Existing users who previously relied on `can_edit` for release will be blocked until an RP grants the correct flags or they use an RP account/delegation.

Evidence: `scripts/tests/phase11_extended_rbac_test.php`

---

## Honest remaining app limits

- Perfect is impossible for a large living codebase — periphery modules may still have soft catches.
- Local malware scan soft-passes when ClamAV missing (`env=local`).
- Formal WCAG / full browser E2E not embedded as automated product proof.
- Commercial Pilot still incomplete: universal ledger, evidence versioning, onboarding, signed freeze package, etc. (see `docs/COMMERCIAL_PILOT_DIRECTIVE_PLAN.md`).

**Software claim:** materially hardened for GDP IT controls. **Not** “mathematically perfect / MHRA approved.”
