# Engineering Standard — Commercial Pilot (brief)

Minimal standards for GDP Portal MVC changes during Commercial Pilot 1.0.0-pilot.

## Code

- PHP 8.1+ strict typing where touching new code; PSR-4 namespaces under `App\`.
- No secrets in repo; config via `app/config.php` (gitignored in customer deploys).
- GDP records: soft void, no hard delete; activity log on create/update/void.
- Uploads via `UploadHelper`; evidence under `storage/private/`; retain files on record delete (P1.6).
- RBAC via `requireAccess` / site scoping; admin-only global config.

## Database

- Forward-only migrations in `migrations/`; idempotent where possible.
- Fail-fast on non-idempotent migration errors in installer.
- Schema floor **287** for Commercial Pilot (evidence sha256, org/install tables).

## Security

- CSRF on POST; MFA for high-risk e-sign when enrolled.
- Malware scan when `malware_scan_required` or production/staging env.
- Session fixation guards; force password change on default creds.

## Release

- Bump `VERSION.txt`; update `MANIFEST.sha256` via `scripts/make_manifest.sh`.
- Sign releases per `scripts/sign_manifest.sh` / `verify_release.sh`.
- Run `scripts/regression_smoke_test.sh` and `prove_restore.sh` before tag.

## Documentation

- User-facing changes: note in `KNOWN_LIMITATIONS.md` or module PROGRESS if significant.
- Deployment: keep `HOSTED_DEPLOYMENT_SPEC.md` and runbooks current.

## Review checklist (PR / self-review)

- [ ] `php -l` on changed PHP files
- [ ] No hardcoded site names (use `site_profiles`)
- [ ] OrganisationConfig used for tenant branding where applicable
- [ ] Migration tested on disposable DB
