# Phase 5 exit evidence: Directs I

Brief section 13, Phase 5 exit criterion: **Release R2 pilot: 2 to 3 real branches post live data.**
Scope: brief 8.1 (provisioning, universal chart, HQ users, branch lifecycle), 8.3 (auditor mode) and
section 4's HQ roles.

The criterion is met in the field, not by tests. This document records:
1. what the automated tests prove the system does;
2. the full rehearsal on test data;
3. the pilot itself, filled in when it is done (from the signed
   [pilot checklist](../pilot/PILOT-CHECKLIST.md)).

Every test runs on MySQL/MariaDB (the default) and on SQLite, locally and in CI.

| Increment | Decision | Commit |
|---|---|---|
| 5A Directs area, branch register, lifecycle | D-048 | 8e3ae73 |
| 5B Provisioning wizard and go-live | D-049 | 36f70f1 |
| 5C Chart of accounts versions, HQ people | D-050 | 93e99dc |
| 5D Auditor mode, pilot pack, proof | D-051 | this commit |

## 1. The rehearsal

`DirectsProofTest::test_three_branches_go_live_and_headquarters_controls_them` takes one church through
Phase 5 on test data.

1. **Provision Ikeja, Lekki and Ajah** with the wizard (branch, new admin, chart, go-live, opening balances,
   licence, activation). Each opening journal is posted by a second person, and an admin activates by the
   link. Each branch's go-live checklist shows the opening balances posted.
2. **Each branch posts live data.**
3. **Lifecycle.**
   - A suspended branch refuses postings and resumes.
   - Ajah is merged into Ikeja and confirmed by HQ Finance: Ajah's balances are nil, Ikeja holds them, and the
     whole church's trial balance is identical before and after, and balanced.
4. **Auditor mode.** An auditor engaged for Ikeja only sees only Ikeja's journals, and is watermarked.
5. **Chart version.** A rename is published as version 2 with the old name kept, and the count and totals of
   posted lines are unchanged.

## 2. What each Phase 5 rule rests on

| Rule | Proved by |
|---|---|
| Directs is for HQ network roles only; everyone else gets "not found" | `BranchLifecycleTest::test_directs_is_for_headquarters_and_lists_every_branch` |
| A suspended branch cannot be changed by anyone, in any module; other branches carry on | `BranchLifecycleTest::test_a_suspended_branch_can_be_seen_but_not_changed_by_anyone` |
| A locked branch cannot sign in; Headquarters cannot be suspended or locked | `BranchLifecycleTest::test_a_locked_branch_cannot_sign_in_and_headquarters_cannot_be_locked` |
| A close moves every balance by one journal, confirmed by someone else typing the code | `BranchLifecycleTest::test_closing_moves_every_balance_by_one_journal_confirmed_by_someone_else` |
| A merge moves members, assets, bank accounts (with their sub-account detail) and open items | `BranchLifecycleTest::test_merging_moves_members_assets_bank_accounts_open_items_and_sub_account_detail` |
| The wizard end to end:<br>- opening balances balanced per fund and posted by someone else<br>- the activation link works once<br>- the go-live checklist | `ProvisioningWizardTest::test_the_wizard_sets_up_a_branch_end_to_end_and_its_admin_activates_by_link` |
| Opening balances import from Excel/CSV with every problem reported | `ProvisioningWizardTest::test_opening_balances_can_be_imported_from_a_spreadsheet` |
| The plan limits new branches; only HQ Administrators run the wizard | `ProvisioningWizardTest::test_the_plan_limits_new_branches_and_only_hq_administrators_run_the_wizard` |
| Chart changes wait in a draft and publish together:<br>- no switching off an account with a balance<br>- old names kept<br>- branches told<br>- opening the chart writes nothing | `ChartVersionsAndPeopleTest::test_headquarters_chart_changes_wait_in_a_draft_and_are_published_together` |
| A draft change can be taken out, and a draft discarded | `ChartVersionsAndPeopleTest::test_a_draft_change_can_be_taken_out_and_a_draft_discarded` |
| HQ changes roles and resets access across branches, and the branch sees it | `ChartVersionsAndPeopleTest::test_headquarters_looks_after_everyones_access_and_the_branch_sees_it` |
| An engagement limits an auditor to its branches and dates, including in reports and Directs | `AuditorModeTest::test_an_engagement_limits_the_auditor_to_its_branches_and_dates` |
| An ended or expired engagement keeps the auditor out | `AuditorModeTest::test_an_ended_engagement_keeps_the_auditor_out` |
| An auditor's downloads are marked "Auditor copy" | `AuditorModeTest::test_an_auditors_downloads_are_marked` |
| Auditors ask; the branch answers with documents; follow-up and close | `AuditorModeTest::test_the_auditor_asks_and_the_branch_answers_with_documents` |
| Every page an auditor opens and every download is logged (since Phase 0) | `RolesAndAuditTest` |
| Hard branch isolation still holds for every table, new ones included | `BranchIsolationTest` |

## 3. The pilot (to fill in)

| | |
|---|---|
| Pilot branches | |
| Went live on | |
| Weeks of live posting | |
| Sign-off date and names | |
| Problems found, and what was done | |

## Quality gates at exit

- 255 tests pass on MySQL and on SQLite.
- Larastan level 6: no new baseline entries during Phase 5.
- Pint clean.
- Manual scripts: `phase-5a-test-script.md` to `phase-5d-test-script.md`.
- Pilot pack: `docs/pilot/`.