# Remediation — Executed Test Report

**Date:** 2026-07-19  
**Branch:** `remediation/gdp-hardening`  
**Migration floor:** 286  
**Posture:** Validation candidate — technical remediation executed. **Not** MHRA approved. **Not** production-released without RP signature.

## Executed results (this session)

| Check | Result |
|-------|--------|
| `php_lint_all.sh` | PASSED |
| `stock_ledger_remediation_test.php` | ALL PASSED |
| `dispatch_grn_atomicity_test.php` | ALL PASSED |
| `phase5e_remediation_test.php` (MFA/TOTP, append-only, delegation) | ALL PASSED |
| `prove_restore.sh` | RESTORE PROOF PASSED (153 tables) |
| `sign_manifest.sh` + `verify_release.sh` | Signature OK |
| Mig 286 applied | OK (MFA cols, authority_delegations, activity_log triggers) |

## Readiness statement

- **Software technical remediation (coding no-gos):** ready for controlled staging UAT at Testing status.  
- **Production go-live:** blocked until RP release authorization + target-env ClamAV/grants + executed UAT pack.  
- **MHRA inspection ready:** not claimable from code alone — requires GDP QMS evidence, trained staff, SOPs mapped to system use, and RP ownership.

## RP action required (minutes, not weeks of coding)

1. Enrol MFA on Profile (admin/RP accounts — forced when `mfa_optional_framework=false`).  
2. Run smoke UAT of buy→receive→dispatch with Trade Gate.  
3. Sign release authorization document.  
4. On production host: enable `malware_scan_required`, install ClamAV, apply app-user grants.
