# G-HRIS v1.2 remediation — 19 October 2026

## Outcome

Backend and web source defects from the supplied audit have been remediated and covered by executable checks. Mobile scaffold and missing-screen source defects are repaired; mobile dependency resolution and release validation remain unverified. This release is a corrected source package for staging validation, not a production or statutory-compliance certification.

## Audit finding disposition

| # | Finding | Resolution / evidence |
|---|---|---|
| 1 | Missing Laravel scaffold | Added entrypoints, bootstrap, provider, configuration, middleware, writable directories and command registration. Application boots. |
| 2 | Main API file lacks PHP tag | Restored tag; route registry and every app route handler checked. |
| 3 | Broken class autoload layout | Split grouped models, controllers, exports, jobs and commands; consolidated duplicate EmployeeTraining class; Composer discovery succeeds. |
| 4 | Missing controllers/seeders | Recovered CSC and other bundled controllers; added reset and ESS handlers plus seeders. Corrected training handler names and parameterized URLs. |
| 5 | Missing React build inputs | Added app entry, HTML, TypeScript and styling configuration. Fixed JSX/type errors and invalid dependency; production build passes. |
| 6 | Missing mobile sources/platforms | Added leave apply/detail, Android/iOS folders, optional Firebase initialization and configurable API base URL. Dart source parses; Flutter dependency/build validation pending. |
| 7 | Payroll locks other agencies | Attendance update now explicitly scopes through agency employees, inside posting transaction; two-agency regression passes. |
| 8 | YTD multiplied by 12 | Year-end tax uses posted taxable-compensation totals without multiplying again. Exact annual brackets and known-answer regression added. |
| 9 | Partial payroll can post | Computation failures roll back employee records, persist failed run details and prevent posting. Posting reconciles count and monetary totals. |
| 10 | Duplicate dispatch race | Lock period before state check and run creation; dispatch after commit; reject a second active run. Duplicate job delivery does not reopen a completed run. SQLite tests do not prove MySQL concurrency behavior. |
| 11 | Invalid Request::validated calls | Replaced all with captured validate() payload. Office creation regression passes. |
| 12 | Rejected leave can revive | Terminal-state checks, sequential levels, row locking and closure of remaining approvals. Rejection/sequence regressions pass. |
| 13 | Leave overcommitment | Employee lock serializes filings, pending requests reserve availability, and approval rechecks locked balance. No hidden clamp of excess usage. |
| 14 | Repeated accrual | Unique employee/type/year/month ledger, locked balance updates and nullable system actor. Repeat accrual regression passes. |
| 15 | Overbroad sensitive access | Module permissions separate payroll, personnel, SALN, documents, grievances and account management. Added tenant scopes, foreign-key ownership checks, user-search grouping and approver IPCR restrictions. Negative tests pass. |
| 16 | Invalid Docker setup | Correct build/volume paths, Dockerfile, FastCGI Nginx handling, shared worker/scheduler settings, authenticated Redis checks and persistent volumes. Docker engine execution remains unverified. |
| 17 | LWOP cutoff allocation | Computes working-day overlap for each cutoff; boundary regression passes. |
| 18 | Half-day charged whole | Single-date half-day validation and 0.5-day balance debit; regression passes. |
| 19 | Incomplete approval routing | Office-level ordered chain API, inactive/self/duplicate validation, explicit no-approver rejection and sequential activation. |
| 20 | No tests / reproducibility | Added backend regression suite, Composer lock, npm lock, built frontend and verification records. Mobile lock is not included because dependency resolution has not been validated. |

## Additional repairs discovered during execution

- Upgraded Laravel 11 to compatible Laravel 12.70 and upgraded PDF/Firebase/query-builder packages after Composer blocked original versions for security advisories. PHP 8.3+ is the tested runtime.
- Upgraded affected npm build/router/styling dependencies. Recorded Composer and npm audits report zero known advisories at validation time.
- Fixed payroll JSON field casting discovered by running an actual compute/post cycle.
- Fixed singular model table names, a MySQL index name exceeding 64 characters, the onboarding PHP syntax error, and portable recruitment-name backfill.
- Rebuilt opt-in demo seeding against the real schema. Default seeding does not install demo users, and production refuses the demo seeder.
- Fixed employee creation before number generation, unique account naming and assignment of the employee role.
- Added working forgot/reset web forms and tested the email-token reset cycle.
- Added missing PDF supporting schedules and repaired the service-record template contract; DTR, PDS and service-record PDF responses are tested.
- Fixed frontend recursive refresh and waiting-request handling; default production API path is same-origin `/api/v1`.

## Recorded checks

The latest exact test totals and build output are in `validation/`. Checks include PHP lint, Laravel package discovery, route enumeration/handler existence, all migrations against a new SQLite database, reference/demo seeding, backend regression tests, React TypeScript/Vite build, template compilation, dependency audits, and Dart source parsing/formatting.

## Remaining verification and pre-existing incomplete features

1. MySQL/MariaDB staging migration, actual simultaneous requests, deployment through Docker, SMTP delivery, Redis worker operations and real device behavior have not been executed here. No live server was modified.
2. A Flutter toolchain setup operation was rejected by automatic approval review because it attempted cloud metadata service access. Safer offline work restored platform files and parsed/formatted the source. Offline dependency resolution then failed because required mobile packages were not cached. Do not interpret source parsing as a successful analyzer or APK/IPA build.
3. Four original mobile screens remain unfinished: QR check-in, DTR dispute submission, pending-overtime actions and MFA entry. This patch repairs the audit's missing source files and connects core lists/password handling; it does not claim those original placeholders are complete.
4. Official Philippine salary schedules, statutory rates, benefit eligibility, form layouts and filing acceptance have not been certified. The original payroll configuration still requires review against the agency's approved rules. New BIR/PDS/SALN printouts are labelled supporting schedules/summaries rather than falsely presented as approved official filing forms.
5. Existing historical payroll runs need reconciliation before posting; the new posting checks intentionally refuse a run with unknown expected coverage. Existing leave approvals retain their stored chain. Configure new office approval chains before filing.
6. Android release signing and iOS signing/Firebase configuration belong to the deployment owner. No production keys, credentials, `.env`, database dumps or signing identities are shipped.

Original v1.1 source remains in the prior file version. The archive includes corrected source and backend vendor dependencies; node_modules and generated machine-specific mobile caches are excluded.