OMIC PLATFORM V5 — INDEPENDENT AUDIT REPORT
============================================
Prepared for OMIC Investment Limited by Dash World Limited

HARDENED RELEASE ADDENDUM
  The packaged deployment candidate was subsequently completed with all six
  referenced brand assets, POST+CSRF logout, server-side session revocation,
  periodic session-id rotation, locked rate-limit file updates, hardened
  installer-session cookies, prevention of post-install token recreation, and
  an existing-V5 database migration. See DEPLOYMENT-ACCEPTANCE.txt. Runtime
  cPanel acceptance remains mandatory; no document may imply otherwise.

SOURCE
  OMIC Platform v4 - upload to public_html.zip

CONFIRMED HIGH-IMPACT V4 DEFECTS
  1. Root .htaccess contained an unmatched </If>. Apache could reject the
     file and return HTTP 500 before PHP ran.
  2. The admin "Tenants" page was read-only. No admin flow could create a
     tenant portal account or attach a tenancy.
  3. No admin flow could upload the private documents shown in the portal.
  4. No admin flow could record a verified bank/cash/POS payment while
     Paystack remained unavailable.
  5. Agent dashboards queried and exposed tenant/maintenance information even
     though those roles were blocked from the destination controllers.
  6. Published listings remained editable by agents, making unapproved live
     changes possible.
  7. The notification queue stopped after three failed sends despite a
     configured maximum of four.
  8. V4 documentation incorrectly suggested Paystack could go live through
     keys plus a setting even though the required endpoint did not exist.

V5 REMEDIATION
  - Repaired root .htaccess and moved authenticated cache headers to PHP.
  - Added manager/admin tenant + tenancy creation and maintenance.
  - Added secure private-document upload, archive and staff/tenant download.
  - Added transactional recording of verified offline payments and receipts.
  - Defaulted online payment to disabled and removed the missing live route.
  - Closed dashboard and published-property role gaps.
  - Hardened session identity separation, timeout renewal and tenant auditing.
  - Corrected queue retry accounting and clarified its delivery guarantee.
  - Added server-side length/range validation to exposed write paths.
  - Rewrote deployment guidance to describe the real state of Paystack.

STATIC VERIFICATION COMPLETED
  - ZIP source integrity: passed.
  - Database schema: 18 CREATE TABLE statements present.
  - PHP delimiter scan: 36 PHP files, zero unmatched (), [] or {} in PHP
    regions.
  - Internal PHP link/action target scan: zero missing targets.
  - Root/app/upload .htaccess container pairs: matched.
  - Destructive GET handlers: none found; listing filters remain read-only GET.
  - Paystack: unavailable by design; PAYSTACK_ENABLED defaults to false and
    payments_mode defaults to disabled.

NOT CLAIMED AS TESTED
  This audit environment did not contain a PHP interpreter, Apache or MySQL.
  Therefore php -l, schema execution and live HTTP behavior must be tested on
  the target cPanel server before public launch. Do not describe V5 as
  production-verified until the acceptance checklist below passes.

MANDATORY CPANEL ACCEPTANCE
  [ ] Confirm this package contains: omic-logo.png, omic-logo-white.png,
      omic-mark.png, omic-mark-white.png, favicon.ico, apple-touch-icon.png.
  [ ] Open the homepage and confirm no HTTP 500.
  [ ] Run PHP syntax checks from cPanel Terminal when available.
  [ ] Complete install.php using the one-time token; then delete install.php.
  [ ] Verify admin, manager and agent permission boundaries.
  [ ] Create two test tenants; prove each sees only their own private document.
  [ ] Verify a private document URL cannot be opened while signed out.
  [ ] Upload a renamed PHP payload as an image and confirm it is rejected.
  [ ] Record a verified offline test payment and confirm balance + receipt.
  [ ] Run all three cron commands manually and inspect app/error.log.
  [ ] Configure and verify mail delivery, SPF, DKIM and DMARC.
  [ ] Create a full files + database backup and prove the restore path.

DEFERRED BY DECISION
  - Live Paystack initialization, verification, webhook and reconciliation.
  - CSP rollout and HSTS until live HTTPS behavior is confirmed.
  - Landlord portal and landlord-management UI.
  - Real photography and full property inventory.
