# Development Roadmap

Each phase is a gated vertical slice. Completion requires migrations, models, actions
or services, validation, policies, interfaces, audit behavior, factories/seeders,
tests, documentation, and a clean test run. A phase report must list changes,
commands, manual checks, limitations, and the next proposed phase.

## Milestones

| Phase | Deliverable | Exit criteria |
|---|---|---|
| 1 | Requirements and architecture | architecture, model, risks, roadmap, README reviewed |
| 2 | Project initialization | app boots, auth shell and frontend build, CI/test baseline pass |
| 3 | Institutional structure | tenant-scoped organization/calendar CRUD and isolation tests |
| 4 | Authentication and RBAC | verified login, lifecycle controls, scoped roles/policies, login audit |
| 5 | Admissions | end-to-end application, review, offer, acceptance, onboarding |
| 6 | Student and staff | secure profiles, documents, IDs, status histories |
| 7 | Curriculum and registration | versioned curricula, rules engine, approvals, overrides |
| 8 | LMS | classrooms, materials, assignments, discussions, progress, live-class links |
| 9 | CBT | question bank through secure attempt, autosave, submission, marking, moderation |
| 10 | Results and GPA | configurable grading, approvals, publication, GPA/CGPA, broadsheets |
| 11 | Finance | fees, invoices, ledger, gateways, receipts, reconciliation |
| 12 | Transcripts and certificates | request, payment, approved generation, QR verification/revocation |
| 13 | Clearance and graduation | configurable clearance and eligibility/graduation outputs |
| 14 | Theology and postgraduate | protected formation plus thesis/supervision/defence workflows |
| 15 | Reports, CMS, communications | role dashboards, exports, public CMS, notification channels |
| 16 | Security and optimization | threat review, authorization matrix, performance, a11y, full regression |
| 17 | Documentation and deployment | manuals, production config, backup/restore and deployment rehearsal |

## Cross-cutting work in every phase

- Update the permission catalogue and tenant-isolation test matrix.
- Add audit events for sensitive reads and writes.
- Update data classification and retention notes.
- Verify responsive UI and keyboard accessibility.
- Review indexes with representative query plans.
- Update seed data without putting development credentials into production paths.
- Run formatting, static analysis, frontend checks, and automated tests.

## Phase 2 proposed scope (not started)

1. Verify local PHP, Composer, Node, MySQL, and Redis capabilities.
2. Initialize Laravel 12 without overwriting Phase 1 documentation.
3. Add authentication foundation and Livewire/Tailwind base layout.
4. Add testing, code style, static analysis, and CI configuration.
5. Establish environment examples, private storage, secure headers, and health checks.
6. Create architecture tests enforcing domain boundaries.
7. Confirm application, asset build, queue connection, and test suite run locally.

## Major dependencies and decision gates

- Tenant routing/domain strategy must be selected before Phase 3.
- Registration rule configurability must be agreed before Phase 7.
- CBT concurrency and recovery load tests are mandatory before Phase 9 acceptance.
- Finance chart-of-accounts depth and gateway merchant structure must be agreed before
  Phase 11.
- Transcript/certificate visual and signature requirements must be agreed before
  Phase 12.
- Applicable privacy, financial, and education regulations must be identified before
  production data is introduced.

## Definition of done

A feature is not complete unless it has real persistence and relationships, input
validation, authorization, tenant isolation, error behavior, audit coverage where
sensitive, a usable interface/API, automated tests, and documentation. External
integrations must include verified sandbox tests and failure/retry behavior.