# Skulitech Full-System Validation Report

**Validation date:** 12 July 2026  
**Build:** Full-system integrated validation build

## Scope

The validation covered PHP syntax, local routes and resources, database schema and migrations, authentication and permissions, CSRF protection, form structure, academic data relationships, timetabling, examinations and results, student portal privacy, clearance, alumni lifecycle, finance/accounting references, HR, library, procurement, reporting exports and preservation of the existing marksheet and transcript layouts.

## Final automated results

| Validation area | Result |
|---|---:|
| PHP files checked | 165 passed, 0 failed |
| Module files in runtime smoke matrix | 127 checked, 0 auth/CSRF failures |
| Integration assertions | 46 passed, 0 failed |
| SQL files structurally checked | 10 passed |
| Core tables identified in full schema | 84 |
| Missing static PHP routes | 0 |
| Missing local resources | 0 |
| POST forms missing CSRF fields | 0 |
| Invalid nested HTML forms | 0 |
| Undefined custom function calls | 0 |
| Critical module guard gaps | 0 |
| Obsolete cross-module table references | 0 |
| Duplicate `CREATE TABLE` definitions | 0 |

## Confirmed corrections

### Security and form reliability

- Added CSRF fields to authenticated forms that could previously fail before processing.
- Added explicit CSRF protection to password recovery and password setup forms.
- Extended CSRF protection to destructive GET actions including delete, remove and lecturer unassignment.
- Corrected invalid nested forms in income, expense and library registers.
- Protected the runtime-health API and import-template route with permissions.
- Changed database connection errors to a generic browser response while retaining server logging.

### Academic, timetable, examinations and results integration

- Standardized the relationship chain: Department → Course → Course Year → Course Module → Curriculum Unit → Class → Class Unit → Lecturer → Timetable → Marks → Results.
- Added stable uniqueness for one unit per course module and one curriculum unit per class.
- Corrected lecturer uniqueness so the same lecturer may teach the same unit in different classes.
- Added migration logic that merges duplicate course-unit mappings and updates dependent class, lecturer, registration, marks, exam and timetable records before deleting duplicates.
- Added indexes for semester enrollment, student unit registration and marks lookups.
- Expanded runtime checks for missing or duplicate stable academic relationships.

### Cross-module accuracy

- Corrected outdated table references to the active finance, results, progression and timetable tables.
- Corrected analytics for reported students, monthly collections and lecturer workload.
- Updated backup-table coverage to include normalized academic and examination records.
- Corrected CSV headings that labelled both session and module as “Session.”
- Added database-consistency notes to the runtime checks page.

### Database portability and maintainability

- Removed duplicate procurement table declarations from the full installation schema.
- Moved procurement enhancement columns into the original table definitions for clean new installations.
- Replaced raw migration use of `ADD COLUMN IF NOT EXISTS` with information-schema checks for older shared-host compatibility.
- Added environment-variable support for database connection settings.
- Removed stale source backup files from the distributable package.

## Design preservation

SHA-256 comparison confirmed that these templates remain unchanged from the supplied build:

- `modules/exams/marksheet.php`
- `modules/transcripts/transcript.php`
- `modules/transcripts/transcript_pdf.php`
- `modules/transcripts/transcript_download.php`
- `modules/transcripts/bulk_transcripts.php`

The existing marksheet and transcript appearance, print structure and PDF layout were therefore preserved.

## Deployment

For an existing database that already has the course-year-module and exams/results migrations, run:

1. Back up the application files and database.
2. Replace the application files with this build.
3. Run `database_updates/system_integration_validation.sql`.
4. Sign in as System Admin.
5. Open **Settings → Runtime & Workflow Health Checks**.
6. Resolve live-data warnings such as legacy marks or registrations that still lack stable IDs.
7. Test one complete workflow: register student → enroll module → register units → allocate lecturer → publish timetable → enter marks → approve/release results → print marksheet/transcript → initiate clearance.

## Validation boundary

The automated validation was performed without the institution’s live MySQL database or a deployed browser session. Syntax, source integration, schema structure, route integrity and security patterns passed. Live record counts, hosting configuration, email/SMS delivery, uploads and browser printing must be confirmed on the target server using the included Runtime & Workflow Health Checks page and the deployment workflow above.
