# Acceptance gates — current status: NOT ACCEPTED

Passing unit/contract tests alone does not permit a production-ready label. Record operator, date, software versions and evidence for each staging gate. Never run `migrate:fresh` or the destructive integration suite against production.

| Gate | Current evidence | Required final evidence |
|---|---|---|
| Framework/dependencies/assets | Local boot, lockfiles, build and audits | Locked install on EA-PHP 8.3; no missing extensions |
| PHP application tests | Local PHPUnit SQLite + actual MySQL 8 suites | Same suite on isolated staging test DB |
| Atomic quotas | Real MySQL 20-process race passes | VPS staging concurrent attempts stay at configured limit |
| Redis workers/HTTP privacy/CSRF | Actual Redis and real HTTP pipeline tests pass for failure path | VPS workers process both scanner and email queues reliably |
| Real ClamAV | Actual binary detects EICAR, ignores benign text using an isolated HDB test fixture | Fresh official definitions + benign/EICAR through browser → Redis → restricted scanner → report |
| Real YARA | Actual compiled rules match EICAR/PHP pattern and ignore benign input | Both local engines return correct full-pipeline results under restricted account |
| Unix socket / systemd / SELinux | Not verified: build host forbids Unix sockets; one scanner test skipped | Scanner group access, no traversal, no network, no source/config writes, time/memory limits |
| Browser UX | Blade endpoints render and assets compile | Desktop + phone upload progress, tabs, filters/sorts, report refresh/exports, auth/settings/admin without JS errors; keyboard/focus review |
| VirusTotal | Contract fixtures for lookup/polling/errors | Appropriate commercial license, real file/URL/hash/poll/error/quota cases |
| MetaDefender | Contract fixtures for scan details | Licensed real file submit/poll/hash, account field mapping and quota behavior |
| MalwareBazaar | Contract fixture for permitted hash lookup | Valid Auth-Key and permitted live lookup; no sample upload |
| Stripe | Signed event/replay/canonical status/price/customer tests | Test-mode checkout, recurring renewal, failed payment, cancellation, duplicate/out-of-order webhook deliveries, then authorized live configuration |
| SMTP | Encrypted settings and form-preservation tests | Delivered verification/reset emails, signed link expiry, real SMTP connection test |
| Host hardening | Shell syntax and code checks | Correct public document root/TLS/permissions, Redis/DB not public, debug off, original samples inaccessible, backups/monitoring/restore tested |
| Retention/recovery | Automated expiry and queue failure tests | Timer runs, orphan/expired cleanup, queue restart/recovery, disk limits/alerts |
| Legal and operations | Default disclosure and operator fields included | Completed operator/contact/privacy/terms/billing/license review |

The browser installer has local unit and HTTP/MySQL/Redis evidence. Confirm its HTTPS behavior, cPanel account permissions, success page and permanent lock on the actual staging domain.

## Final sign-off

- Staging URL: __________
- VPS/WHM/cPanel/PHP/MySQL/Redis/ClamAV/YARA versions: __________
- Acceptance execution date / operator: __________
- Evidence locations for every gate: __________
- Outstanding failures: __________
- Production-ready label authorized only when every applicable gate above passes: __________

Provider-dependent modes can remain disabled if the operator explicitly excludes them from launch scope. They cannot be described as verified or generally available until their own gates pass.