# KarobariSuite — Requirements Coverage Checklist

**Last reviewed:** 2026-07-21  
**Scope:** Maps every requirement from `docs/Prompt.md` (Core Vision → Deliverables) to current implementation status.

### Status legend

| Symbol | Meaning |
| --- | --- |
| ✅ | Implemented and usable (API and/or Web) |
| 🟡 | Partial / MVP / stub / schema-only / design documented |
| 📋 | Designed in `Prompt.md` or architecture; not built yet |
| ❌ | Not started |
| 🔮 | Explicitly deferred (per Prompt.md roadmap) |

### Overall summary

| Area | Coverage |
| --- | --- |
| Core Vision | 🟡 Architecture supports it; scale limits not production-proven |
| Multi-Tenant SaaS | 🟡 Core isolation + branding; many per-tenant configs missing |
| User Types | 🟡 All types in schema; customer & staff depth limited |
| White Label | 🟡 Admin, POS, portal, storefront exist; many vendor-owned channels missing |
| Multi-Industry | 🟡 Modular architecture; no industry packs / module toggles UI |
| Required Modules (31) | 🟡 All have baseline API/Web; depth varies widely |
| Platform Architecture | 🟡 Modular monolith live; enterprise infra mostly deferred |
| Database Design | 🟡 Solid MVP schema; not yet billion-row / sharding ready |
| Security | 🟡 JWT + RBAC + ABAC MVP; enterprise security incomplete |
| AI Strategy | 🟡 Insights + forecast MVP only |
| Marketplace Vision | 🟡 Listing discovery MVP; full marketplace deferred |
| Deliverables (master doc) | 🟡 `Prompt.md` is the blueprint; this checklist tracks build vs design |

**Phases completed in code:** Phase 0 → Phase 4 (Foundation through Enterprise extensions).  
**First delivery focus (per Prompt):** APIs + Web App — **in progress**, not enterprise-complete.

---

## 1. Core Vision

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| White Label SaaS Platform | ✅ | Multi-tenant core, branding fields, storefront |
| One platform | ✅ | Single codebase (`public/index.php`, modular `src/`) |
| Unlimited Vendors (tenants) | 🟡 | No hard cap in schema; ops/scaling not proven at scale |
| Unlimited Customers | 🟡 | `customers` table + CRM APIs; no scale testing |
| Unlimited Stores | 🟡 | `stores` module + APIs |
| Unlimited Products | 🟡 | `products` CRUD + inventory |
| Unlimited Services | 🟡 | `services` CRUD |
| Unlimited Employees | 🟡 | `staff` module + `users` with `vendor_staff` type |
| Isolated vendor workspace | ✅ | `tenant_id` enforced; JWT carries tenant context |
| Centrally managed by platform owner | 🟡 | Platform APIs + super-admin web views on shared pages |
| Platform owner sells subscriptions | 🟡 | Plans seeded; billing is read-only MVP (no payment capture) |

---

## 2. Think Beyond Current Features

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| Enterprise architect mindset | 📋 | Captured in `docs/Prompt.md` |
| Add missing modules | 🟡 | Phases 0–4 added SLA, ABAC, residency, workflows, partners, monitoring, automation, AI, marketplace |
| Scalability decisions documented | 📋 | Shared DB + `tenant_id`; dedicated DB option stubbed (`/api/v1/settings/dedicated-db`) |
| Do not limit yourself | 📋 | Roadmap in Prompt.md extends beyond current build |

---

## 3. Multi-Tenant SaaS Requirements

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| Unlimited tenants | 🟡 | Schema supports; no shard/partition yet |
| Tenant isolation | ✅ | `tenant_id` on business tables; auth middleware |
| Shared infrastructure | ✅ | Single MySQL DB, shared app tier |
| Independent databases (future) | 🟡 | `data_residency_profiles` + dedicated-db settings API |
| Custom domains | 🟡 | `tenants.domain` column; DNS/SSL flow not automated |
| Custom branding | 🟡 | `logo_url`, `primary_color`, `secondary_color` |
| Custom themes | ❌ | No theme engine / template packs |
| Custom logos | ✅ | `tenants.logo_url` |
| Custom colors | ✅ | Primary/secondary on tenant |
| Custom fonts | ❌ | Not per-tenant |
| White-label mobile apps | 🔮 | Deferred in Prompt.md |
| White-label websites | 🟡 | `website_pages` + `public/site/` storefront |
| Tenant-specific configurations | 🟡 | `settings_json` on tenants; limited UI |
| Tenant-specific tax rules | 🟡 | Per-product/service `tax_rate` only |
| Tenant-specific payment gateways | ❌ | Integration endpoints table; no gateway wiring |
| Tenant-specific notification providers | 🟡 | `notification_outbox` + stub enqueue |
| Tenant-specific currencies | 🟡 | `tenants.currency` (single default) |
| Tenant-specific languages | 🟡 | `tenants.locale` |
| Tenant-specific time zones | 🟡 | `tenants.timezone` |
| Tenant-specific business hours | ❌ | Not implemented |
| Tenant-specific feature flags | ❌ | `features_json` on plans only; no per-tenant flags table |
| Tenant-specific subscription plans | 🟡 | Platform plans; tenant assigned `plan_code` |
| Tenant-specific storage | ❌ | R2 designed; not integrated |
| Tenant-specific analytics | ❌ | Basic reports only |
| Tenant-specific reports | 🟡 | Sales/growth reports per tenant |
| Tenant-specific APIs | 🟡 | API keys per tenant with scopes |
| Tenant-specific integrations | 🟡 | `integration_endpoints` CRUD |
| Tenant-specific workflows | ✅ | `erp_workflows` + instances |
| Tenant-specific automation | ✅ | `automation_rules` + runs |
| Tenant-specific AI configuration | ❌ | Global AI service; no tenant AI settings |
| Everything configurable per tenant | ❌ | Goal state; many gaps above |

---

## 4. User Types

### 4.1 Platform Super Admin

| Capability | Status | Evidence / Notes |
| --- | --- | --- |
| Manage vendors | ✅ | `/api/v1/platform/tenants`, dashboard/reports web |
| Manage subscriptions | 🟡 | View plans; no payment lifecycle |
| Approve vendors | 🟡 | Tenant `status` (pending/active/suspended) |
| Suspend vendors | ✅ | Update tenant status API |
| Manage plans | ✅ | `/api/v1/platform/plans` |
| Manage themes | ❌ | Not built |
| Manage templates | ❌ | Not built |
| View platform analytics | 🟡 | `platform/summary`, dashboard for super admin |
| Manage payments | ❌ | Not built |
| Manage feature flags | ❌ | Not built |
| Manage global settings | ❌ | Not built |
| Manage marketplace | 🟡 | Marketplace listings; no admin moderation UI |
| Manage support | 🟡 | Helpdesk exists; no platform-wide queue |
| Manage AI | 🟡 | AI module exists; no platform AI admin |
| Manage integrations | 🟡 | Per-tenant integrations only |
| Manage backups | ❌ | Not built |
| Manage security | 🟡 | ABAC policies; no security console |
| View audit logs | ❌ | Audit columns only; no audit log viewer |
| View all tenants | ✅ | Platform tenants API + web |
| View system health | ✅ | `/api/v1/platform/health`, monitoring page |
| Manage announcements | ❌ | Not built |
| Manage onboarding | 🟡 | Register flow; no guided onboarding |
| Manage billing | 🟡 | Plans view; no invoicing/dunning |
| Manage taxes | ❌ | Not at platform level |
| Manage emails | ❌ | SMTP designed; not admin UI |
| Manage SMS | ❌ | Not built |
| Manage push notifications | ❌ | Not built |
| Manage domains | 🟡 | Domain field on tenant |
| Manage CDN | ❌ | Not built |
| Manage API keys | 🟡 | `api_keys` table; no admin UI |
| Manage storage | ❌ | Not built |
| Manage jobs | ❌ | Cron/queue designed; no job admin |
| Manage queues | ❌ | Not built |
| Manage monitoring | ✅ | Monitoring alerts + scan |
| Manage fraud detection | ❌ | Not built |
| Manage partners | ✅ | Partners module (Phase 4) |

### 4.2 Vendor Owner

| Capability | Status | Evidence / Notes |
| --- | --- | --- |
| Manage business | 🟡 | Tenant settings partial |
| Manage employees | ✅ | Staff module |
| Manage products | ✅ | Products CRUD |
| Manage services | ✅ | Services CRUD |
| Manage customers | ✅ | CRM module |
| Manage suppliers | ✅ | Suppliers + POs |
| Manage inventory | ✅ | Stock + movements |
| Manage sales | ✅ | Orders + reports |
| Manage accounting | 🟡 | Journals, P&L, balance sheet, invoices |
| Manage reports | ✅ | Sales/growth reports |
| Manage website | 🟡 | Website pages builder (basic) |
| Manage marketing | 🟡 | Campaigns (stub send) |
| Manage loyalty | 🟡 | Points adjust |
| Manage automation | ✅ | Automation rules |
| Manage AI | 🟡 | Insights + forecast |
| Manage branches | 🟡 | Multi-store module |
| Manage orders | ✅ | Orders CRUD/checkout/cancel |
| Manage appointments | ✅ | Appointments CRUD |
| Manage delivery | ❌ | Not built |
| Manage integrations | ✅ | Integrations endpoints |
| Manage subscription | 🟡 | View plan via `/billing/me` |
| Manage settings | 🟡 | Partial (residency, dedicated-db) |

### 4.3 Vendor Staff

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| Permission-based access | ✅ | RBAC roles + permissions seeded |
| Role examples (Manager, Cashier, etc.) | 🟡 | `vendor_staff` role with subset permissions in seed |
| Staff-specific UI | 🟡 | Same portal; nav gated by permissions (partial) |

### 4.4 Customers

| Capability | Status | Evidence / Notes |
| --- | --- | --- |
| Register | 🟡 | Auth register (vendor flow primary) |
| Login | ✅ | JWT login |
| Browse products | 🟡 | Storefront catalog API |
| Browse services | 🟡 | Via catalog/storefront |
| Book appointments | 🟡 | Appointments API (vendor-admin heavy) |
| Place orders | ✅ | Checkout API |
| Track orders | 🟡 | Order detail API; portal basic |
| View invoices | 🟡 | Accounting invoices API |
| View loyalty points | 🟡 | Loyalty API |
| Write reviews | ❌ | Not built |
| Raise support tickets | 🟡 | Helpdesk (vendor-facing) |
| Chat | ❌ | Not built |
| Wishlist | ❌ | Not built |
| Wallet | ❌ | Not built |
| Membership | ❌ | Not built |
| Referral | 🟡 | Partner referral codes only |
| Notifications | 🟡 | Outbox stub |

---

## 5. White Label Requirements

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| Own Website | 🟡 | `public/site/` + website pages |
| Own Admin Panel | ✅ | `public/web/*` vendor admin |
| Own POS | ✅ | `public/web/pos.php` |
| Own Customer Portal | 🟡 | `public/web/portal.php` |
| Own Mobile App | 🔮 | Deferred |
| Own Branding | 🟡 | Logo + colors |
| Own Domain | 🟡 | Field exists; DNS not automated |
| Own Emails | ❌ | Not wired |
| Own SMS | ❌ | Not built |
| Own WhatsApp | ❌ | Not built |
| Own Payment Gateway | ❌ | Not built |
| Own SEO | 🟡 | Page slugs; no meta/SEO manager |
| Own Analytics | ❌ | Not built |
| Own Reports | 🟡 | Tenant reports |
| Own Theme | ❌ | Not built |
| Own Homepage | 🟡 | Website pages |
| Own Landing Pages | 🟡 | Website pages |
| Own Blog | ❌ | Not built |
| Own Policies | ❌ | Not built |
| Own Terms | ❌ | Not built |
| Own Privacy Policy | ❌ | Not built |
| Own Cookie Banner | ❌ | Not built |
| Own Contact Information | 🟡 | Can be in page content |
| Appears entirely vendor-owned | 🟡 | Storefront branding; admin shows KarobariSuite shell |

---

## 6. Multi-Industry Support

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| Multiple business types without code changes | 🟡 | Modular monolith; modules not industry-gated |
| Industry examples (Retail, Salon, Clinic, …) | 📋 | Listed in Prompt.md; marketing `solutions.php` |
| Enable only needed modules per industry | ❌ | No industry profile / module toggle system |
| Industry Modules (dedicated) | ❌ | Not separate module packs |

---

## 7. Required Modules (31)

For each module: **Objectives / submodules / workflows / etc.** are fully specified in `Prompt.md`. Below is **implementation** status only.

| # | Module | API | Web UI | Depth | Notes |
| --- | --- | --- | --- | --- | --- |
| 1 | Dashboard | ✅ | ✅ | 🟡 | Vendor pulse + platform summary |
| 2 | Product Management | ✅ | ✅ | 🟡 | CRUD, tax, SKU; no variants/bundles |
| 3 | Inventory | ✅ | ✅ | 🟡 | Stock, adjust, movements; no transfers/reservations |
| 4 | Sales | ✅ | ✅ | 🟡 | Orders; limited fulfillment states |
| 5 | POS | ✅ | ✅ | 🟡 | Web POS; no offline/cash drawer |
| 6 | Services | ✅ | ✅ | 🟡 | CRUD, duration, price |
| 7 | CRM | ✅ | ✅ | 🟡 | Customers CRUD; no pipeline/leads |
| 8 | Supplier | ✅ | ✅ | 🟡 | Supplier master |
| 9 | Purchase | ✅ | ✅ | 🟡 | PO create/receive |
| 10 | Staff | ✅ | ✅ | 🟡 | Staff list/create |
| 11 | Roles & Permissions | ✅ | 🟡 | 🟡 | RBAC in DB + seed; limited admin UI |
| 12 | Appointments | ✅ | ✅ | 🟡 | CRUD; no slots/no-show/deposits |
| 13 | Orders | ✅ | ✅ | 🟡 | Checkout, cancel |
| 14 | Accounting | ✅ | ✅ | 🟡 | COA, journals, P&L, BS, invoices |
| 15 | Reports | ✅ | ✅ | 🟡 | Sales, growth |
| 16 | Marketing | ✅ | ✅ | 🟡 | Campaigns; stub send |
| 17 | Customer Portal | 🟡 | 🟡 | 🟡 | Basic portal page |
| 18 | Vendor Website Builder | ✅ | ✅ | 🟡 | Pages CRUD; not visual builder |
| 19 | E-commerce | 🟡 | 🟡 | 🟡 | Storefront + catalog API |
| 20 | Notifications | 🟡 | ❌ | 🟡 | Outbox enqueue stub |
| 21 | Loyalty | ✅ | ✅ | 🟡 | Points adjust |
| 22 | Help Desk | ✅ | ✅ | 🟡 | Tickets + replies |
| 23 | Multi-store | ✅ | ✅ | 🟡 | Stores CRUD |
| 24 | SaaS Billing | 🟡 | 🟡 | 🟡 | Plans list; no payments/dunning |
| 25 | Integrations | ✅ | ✅ | 🟡 | Endpoint registry + webhooks stub |
| 26 | AI | ✅ | ✅ | 🟡 | Insights + revenue forecast |
| 27 | Mobile Apps | 🔮 | 🔮 | ❌ | Deferred |
| 28 | Security | 🟡 | 🟡 | 🟡 | JWT, RBAC, ABAC; see Security section |
| 29 | Automation | ✅ | ✅ | 🟡 | Rules + manual run |
| 30 | Industry Modules | ❌ | ❌ | ❌ | Not built |
| 31 | Marketplace | ✅ | ✅ | 🟡 | Listings + public discover |

### Per-module design depth (Prompt.md requirement)

| Design artifact | Status |
| --- | --- |
| Objectives, submodules, features | 📋 In Prompt.md |
| Workflows, user roles, permissions | 🟡 Partial in code |
| APIs | 🟡 Most modules have REST endpoints |
| Database entities & relationships | 🟡 Migrations 000001–000006 |
| Notifications, reports, KPIs | 🟡 Partial |
| AI / automation opportunities | 🟡 Basic only |
| Security considerations | 📋 In Prompt.md; partially applied |

---

## 8. Platform Architecture

| Component | Status | Evidence / Notes |
| --- | --- | --- |
| Frontend (PHP templates + JS) | ✅ | `public/web/` |
| Backend (Pure PHP monolith) | ✅ | `src/` modules |
| Admin Portal | 🟡 | Shared web shell + super-admin views |
| Vendor Portal | ✅ | Web admin pages |
| Customer Portal | 🟡 | `portal.php` |
| Mobile Apps | 🔮 | Deferred |
| API Gateway | 🟡 | Single `public/index.php` router |
| Authentication | ✅ | JWT + refresh tokens |
| Authorization | 🟡 | RBAC + ABAC evaluate |
| Tenant Resolution | 🟡 | JWT tenant_id; domain resolution partial |
| Storage | 📋 | R2 designed; not integrated |
| CDN | ❌ | Not built |
| Caching | ❌ | Not built |
| Queues | 📋 | Designed; notification outbox only |
| Notifications | 🟡 | Stub outbox |
| Realtime | ❌ | Not built |
| Search | 🟡 | LIKE-based search API |
| AI | 🟡 | Basic service |
| Analytics | ❌ | Not built |
| Monitoring | ✅ | Alerts + scan |
| Logging | 📋 | Monolog designed; minimal in repo |
| Backup | ❌ | Not built |
| Disaster Recovery | 📋 | Documented in Prompt only |
| Scalability | 📋 | Sharding future; shared DB now |
| Rate Limiting | ❌ | Not implemented |
| Audit | 🟡 | Audit columns; no audit service |
| API Versioning | ✅ | `/api/v1` |
| CI/CD | ❌ | Not in repo |
| Infrastructure / Deployment | 📋 | Nginx + PHP-FPM in README |
| Cloud Architecture | 📋 | In Prompt.md |

---

## 9. Database Design

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| Production-grade normalization | 🟡 | MVP-normalized across 6 migrations |
| Scale: millions/billions (design goal) | 📋 | Not load-tested or sharded |
| Primary keys | ✅ | On all tables |
| Foreign keys | 🟡 | Most relations; not exhaustive |
| Indexes | 🟡 | Key indexes present |
| Soft delete | 🟡 | `deleted_at` on most business tables |
| Audit columns | 🟡 | `created_by`, `updated_by` on many; `deleted_by` inconsistent |
| TenantId | 🟡 | On business tables; platform tables excepted |
| CreatedBy / UpdatedBy / DeletedBy | 🟡 | Partial coverage |
| Versioning | ❌ | No row versioning |
| History tables | ❌ | Not built |
| Future sharding support | 📋 | `tenant_id` enables; no shard key |

**Migrations:** `database/migrations/20260720_000001` through `000006`.

---

## 10. Security

| Requirement | Status | Evidence / Notes |
| --- | --- | --- |
| OAuth | ❌ | Not implemented |
| JWT | ✅ | `JwtService`, Bearer auth |
| Refresh Tokens | ✅ | `refresh_tokens` table |
| RBAC | ✅ | Roles, permissions, user_roles |
| ABAC | ✅ | Policies + evaluate API |
| Multi-Factor Authentication | ❌ | Not built |
| Session Management | 🟡 | JWT expiry; no server sessions |
| Audit Logs | ❌ | Columns only |
| Encryption | 🟡 | Password hashing; no field-level encryption |
| Secrets Management | 🟡 | `.env` for JWT/DB |
| Tenant Isolation | ✅ | Enforced in services |
| Rate Limiting | ❌ | Not implemented |
| DDoS Protection | ❌ | Infrastructure-level |
| OWASP | 🟡 | Basic validation; no formal hardening |
| GDPR | 📋 | Residency profiles stub |
| Data Privacy | 📋 | Prompt.md; minimal implementation |

---

## 11. AI Strategy

| AI Feature | Status | Notes |
| --- | --- | --- |
| Inventory Forecasting | 🟡 | Low-stock in insights |
| Sales Prediction | 🟡 | 14–90 day forecast from historical orders |
| Dynamic Pricing | ❌ | Not built |
| AI Reports | ❌ | Not built |
| Smart CRM | ❌ | Not built |
| Marketing Generator | ❌ | Not built |
| Invoice OCR | ❌ | Not built |
| Receipt OCR | ❌ | Not built |
| Voice Ordering | ❌ | Not built |
| Voice Search | ❌ | Not built |
| Product Recommendation | ❌ | Not built |
| Fraud Detection | ❌ | Not built |
| Customer Segmentation | ❌ | Not built |
| Demand Forecasting | 🟡 | Revenue forecast endpoint |
| Business Advisor | 🟡 | Rule-based tips in insights |
| AI Assistant | ❌ | Not built |

---

## 12. Marketplace Vision

| Capability | Status | Notes |
| --- | --- | --- |
| Discover Vendors | 🟡 | `GET /api/v1/marketplace` |
| Compare Vendors | ❌ | Marketing compare page only (static) |
| Compare Products / Services | ❌ | Not built |
| Book Services | 🟡 | Per-vendor appointments |
| Purchase Products | 🟡 | Per-vendor checkout |
| Track Delivery / Service | ❌ | Not built |
| Leave Reviews | ❌ | Not built |
| Pay Online | ❌ | No payment integration |
| Multi-vendor Cart | ❌ | Not built |
| Marketplace Checkout | ❌ | Not built |
| Vendor Ranking | ❌ | Not built |
| Vendor Verification | ❌ | Not built |
| Nearby Vendors | ❌ | City field only |
| Location Based Search | ❌ | Not built |
| AI Recommendations | ❌ | Not built |

---

## 13. Deliverables (Master Design Document)

| Deliverable | Status | Location |
| --- | --- | --- |
| Vision | ✅ | `docs/Prompt.md` |
| Product Strategy | ✅ | `docs/Prompt.md` (Scope, business model) |
| SaaS Architecture | ✅ | `docs/Prompt.md` + this checklist |
| White Label Architecture | 🟡 | Prompt + partial implementation |
| Multi-Tenant Architecture | 🟡 | Phase 0 migration + services |
| User Roles | ✅ | Prompt + `users.user_type` + RBAC |
| Complete Feature Breakdown | ✅ | Prompt.md modules section |
| Module Hierarchy | ✅ | `src/` bounded contexts |
| User / Vendor / Customer / Admin Flows | 🟡 | Web pages exist; flows not fully documented separately |
| Database Design | 🟡 | SQL migrations (not ER diagram doc) |
| API Design | 🟡 | `openapi/openapi.json` + routes in `public/index.php` |
| Security Architecture | 📋 | Prompt.md; partial code |
| AI Architecture | 📋 | Prompt.md; MVP service only |
| Marketplace Architecture | 📋 | Prompt.md; listing MVP |
| Mobile Strategy | ✅ | Deferred in Prompt.md |
| Deployment Architecture | 🟡 | README local dev |
| Scaling Strategy | 📋 | Prompt.md |
| Disaster Recovery | 📋 | Prompt.md |
| Monitoring | 🟡 | Monitoring module |
| Logging | 📋 | Designed, minimal code |
| Analytics | ❌ | Not built |
| Billing System | 🟡 | Plans only |
| Subscription Management | 🟡 | Plan assignment; no lifecycle |
| Roadmap (MVP → Enterprise) | ✅ | Prompt.md phases 0–4 |
| Risks & Mitigations | 📋 | Prompt.md (implicit) |
| Future Enhancements | ✅ | Prompt.md deferred table |
| **This coverage checklist** | ✅ | `docs/Requirements-Coverage-Checklist.md` |

---

## 14. Billing & Subscription (Prompt.md extended requirements)

| Requirement | Status |
| --- | --- |
| Plans (Free / Starter / Growth / Enterprise) | ✅ Seeded |
| Feature gating per plan | 🟡 `features_json`; not enforced in middleware |
| Trial period | ❌ |
| Monthly / yearly billing | 🟡 Prices in DB; no charging |
| Usage limits (seats, stores, etc.) | ❌ |
| Payment gateways (Razorpay, Stripe, PayPal) | ❌ |
| Subscription invoices & receipts | ❌ |
| Proration | ❌ |
| Dunning / failed payment retries | ❌ |
| Grace → suspend → archive | 🟡 Manual tenant status |
| Coupons & promo codes | ❌ |
| Tax on subscription invoices | ❌ |
| Marketplace commission | 🟡 Partner commissions table |
| Billing webhooks & reconciliation | 🟡 Webhook route stub |
| Self-serve upgrade / downgrade | ❌ |
| Super Admin override | 🟡 Manual plan/status update |
| Platform billing vs vendor commerce payments | 📋 Documented; vendor payments not built |

---

## 15. Web App Surfaces (P0)

| Surface | Status | Path |
| --- | --- | --- |
| Marketing site | ✅ | `/web/`, product, solutions, pricing, compare, faq |
| Login / Register | ✅ | `/web/login.php` |
| Platform Super Admin (in shared shell) | 🟡 | Dashboard, reports, monitoring, partners |
| Vendor Admin | ✅ | Full module nav |
| POS (Web) | ✅ | `/web/pos.php` |
| Customer Portal | 🟡 | `/web/portal.php` |
| Vendor Website / Storefront | 🟡 | `/public/site/` |

---

## 16. Testing & Documentation

| Item | Status |
| --- | --- |
| PHPUnit tests | 🟡 | `tests/SqliteDisabledTest.php` only |
| Tenant isolation tests | ❌ | Required by Prompt; not present |
| OpenAPI / Swagger | 🟡 | `openapi/openapi.json` |
| API route coverage | ✅ | 80+ routes in `public/index.php` |

---

## 17. Gap Priority (recommended next work)

### P0 — Required for “sellable SaaS” MVP

1. Subscription billing lifecycle (Stripe/Razorpay) + feature gating enforcement  
2. Tenant branding UI (domain, theme, policies)  
3. Customer portal end-to-end (browse, book, buy, track)  
4. Audit log service + viewer  
5. PHPUnit tenant isolation + core API tests  

### P1 — White-label completeness

1. Per-tenant email/SMS notification providers  
2. Payment gateway per tenant (customer checkout)  
3. Website SEO + policy pages + cookie banner  
4. Industry module toggles  
5. Staff role management UI  

### P2 — Scale & enterprise

1. Rate limiting, caching, queue workers  
2. MFA, OAuth, secrets vault  
3. Full marketplace (cart, checkout, reviews, geo)  
4. Advanced AI (OCR, recommendations, assistant)  
5. Dedicated DB provisioning automation  
6. CI/CD, backups, disaster recovery runbooks  

---

## 18. Quick answer: “Did we cover all of these?”

**No — not fully.**  

What **is** covered:

- Multi-tenant foundation (Phases 0–4)  
- API-first modular monolith with 31 module **baselines**  
- Web admin, POS, portal, storefront, and marketing site  
- JWT, RBAC, ABAC, platform admin flows on shared pages  
- Enterprise **stubs** (SLA, residency, workflows, partners, monitoring, automation, AI insights, marketplace listings)  

What is **not** covered yet (major gaps):

- Per-tenant everything (themes, fonts, business hours, feature flags, gateways, analytics)  
- Full white-label (email, SMS, WhatsApp, blog, legal pages, cookie banner)  
- Customer features (reviews, chat, wishlist, wallet, membership)  
- Enterprise security (OAuth, MFA, audit logs, rate limiting)  
- Full billing (payments, dunning, proration, trials)  
- Full marketplace vision  
- Full AI strategy  
- Industry module packs  
- Mobile apps  
- Production ops (CI/CD, backups, CDN, caching, sharding)  
- Complete master design **document** beyond `Prompt.md` (flows, ER diagrams, runbooks)  

Use this file as the living checklist: update status as phases ship.