# SokoKilimo acceptance-test plan (execution required)

**Status:** This is a test plan, not test evidence. No Laravel/PHP test, MySQL migration, Android build/device, SMS/FCM provider, malware scanner, backup restore, or deployment scenario below has been completed in this workspace. Record environment, build revision, operator, evidence, result, and defects for every run. Do not mark a test passed based on source inspection alone.

## Test matrix

| ID | Scenario | Expected result / evidence | Existing automation |
|---|---|---|---|
| A01 | Register a farmer with valid +255 phone, password and consent | Farmer role/profile and consent record are created; phone remains unverified until OTP succeeds | `MarketplaceContractTest` registration test (not run) |
| A02 | Register a buyer | Buyer role/profile is created; no farmer privileges | No dedicated test |
| A03 | Submit invalid, duplicate, or non-Tanzanian phone | Validation fails without creating another account | No dedicated test |
| A04 | Assisted registration | Farmer's number remains the account number; helper phone/consent is stored separately; helper cannot sign in as farmer | `MarketplaceContractTest` (not run) |
| A05 | Request and confirm phone OTP | Valid one-time code verifies only that account; wrong, expired, replayed and over-attempt codes fail; stored outbox payload is encrypted | `SecurityChallengeTest` (not run); expiry/attempt cases need expansion |
| A06 | Request password reset for existing and unknown phones | Both receive equivalent non-enumerating responses; valid reset updates password and revokes tokens; code replay fails | `SecurityChallengeTest` (not run); unknown-number equivalence needs expansion |
| A07 | Login rate limiting and privileged login | Limits apply; privileged account cannot sign in without TOTP/recovery; one-time recovery code is consumed | `PrivilegedMfaTest` (not run); rate-limit coverage needs expansion |
| A08 | Privileged API token scope | Legacy/user-scoped token cannot access privileged endpoints; enrolled MFA token can; disabling enrollment invalidates privileged scope | `PrivilegedMfaTest` (not run) |
| A09 | Submit a farmer listing with approved photo | Listing remains private/pending until review; accepted photo appears only after review and active listing | No dedicated full-flow test |
| A10 | Public search/filter | Only active, non-expired listings appear; filters, pagination, price/quantity sorting and empty results are correct | `MarketplaceContractTest` (not run); expiry test added |
| A11 | Buyer role and own-listing restrictions | Only buyers can create offers; farmer cannot offer on their own listing | `MarketplaceContractTest`, `OfferOrderFlowTest` (not run) |
| A12 | Offer idempotency | Repeated request key returns the same offer; key cannot be reused by another buyer or with conflicting data | Partial test only; conflict variants needed |
| A13 | Negotiation alternation | Only the party whose turn it is can accept/reject/counter; repeated decisions do not create extra orders | `OfferOrderFlowTest` (not run); counter variants needed |
| A14 | Stock-safe acceptance under contention | Two concurrent acceptances cannot oversell; total stock decrement equals accepted quantities | Sequential test exists; real concurrent MySQL test required |
| A15 | Cancellation and stock release | Valid cancellation releases stock once; expired/archived listings stay unavailable; active payment review or dispute blocks cancellation | No complete test; verify on target DB |
| A16 | Delivery, inspection and transport | Participants can plan delivery, follow allowed transitions, record inspections and exchange quotes; outsiders are denied | No dedicated full-flow test |
| A17 | Order completion and reviews | Order completes only after both participants confirm delivery; only completed counterparties can review, once each | `OfferOrderFlowTest` (not run); review cases need expansion |
| A18 | Messages and reports | Only counterparties (or properly authorized MFA support) can view relevant messages; reports are private and auditable | No dedicated test |
| A19 | Private business documents | Uploads remain private; owner and authorized MFA verification officer can access; unrelated users receive 404/denial | No dedicated full-flow test |
| A20 | Malware scanning | Clean file accepted in staging; infected file rejected; scanner missing/timeout/error fails closed in production | Requires ClamAV integration test; not run |
| A21 | Payment evidence and review | Evidence upload does not mark payment verified; only finance/admin role with MFA can decide; all decisions are audited | No dedicated full-flow test |
| A22 | Dispute flow | Only an order participant opens the case; evidence/actions stay private; support actions and participant appeals have correct visibility | Support-order denial test added; not run; full flow needs expansion |
| A23 | Trust tiers | Criteria, reviewer reason, event history and notices are correct; override is super-admin-only; no paid plan grants trust | No dedicated test |
| A24 | Market observations | Public endpoint displays only reviewed observations with source/date/area; never implies confirmed sale or guarantee | No dedicated test |
| A25 | Account deletion review | Request suspends only on approved decision; open orders/disputes/payments block erasure; dry-run is read-only; records retained/anonymized per approved policy | No dedicated test; legal retention review required |
| A26 | Erasure privacy audit | Inspect remaining PII in messages, reports, assisted registrations, uploaded evidence, audit and backups; prove approved deletion scope and retention holds | Manual legal/privacy review; not run |
| A27 | SMS dispatch semantics | Safe default sends nothing; provider acceptance is `submitted`; timeout is `unknown`; definite failures retry idempotently | Outbox tests exist; no provider test |
| A28 | SMS callback security | Bad HMAC rejected; duplicate event ignored; stale event recorded without rolling state backwards; provider signing scheme is validated | `SmsWebhookTest` (not run); provider mapping not supplied |
| A29 | Preference and consent behavior | Opt-out suppresses supported channels; required security messages remain protected; consent, language and support contact are accurate | Preference test needed; provider not configured |
| A30 | FCM device lifecycle | Device token encrypted at rest and indexed by digest; owner-only removal; token refresh, logout, permission denial and notification delivery work | Device-token test exists; Android/provider not built/tested |
| A31 | Admin queues and audit | All moderation decisions require reasons and authorized MFA; audit record is complete, searchable and safe from tampering | No full UI/API suite |
| A32 | Profile and language | Kiswahili/English settings persist across web/mobile sessions; no profile field leaks to public listing endpoints | No dedicated test |
| A33 | Android basic marketplace | Build with JDK 17/SDK 35; register/login, browse, farmer listing, buyer offer, offer response and order status work on supported phones | Source only; no build/device test |
| A34 | Low-bandwidth and accessibility | Slow/intermittent network, screen readers, large text, keyboard/focus, validation and local-language instructions remain usable | Field-device/manual testing required |
| A35 | MySQL and SQLite migration/restore | Clean migration/seed, rollback policy, foreign keys, indexing, stock locks and backup/restore work with actual PHP extensions and target database versions | Not run |
| A36 | Deployment and incident recovery | TLS, cron/worker, private storage, monitoring, key backup/rotation, rollback, alerting and incident process are rehearsed on target host | Not run; environment/provider decisions pending |

## Exit criteria

- Every scenario is marked **pass** with evidence, **fail** with an issue, or **blocked** with the responsible external dependency. No blank rows at launch review.
- Resolve all authorization, oversell, duplicate payment, privacy/retention and secret-handling findings before accepting live customer data.
- At minimum, execute `php artisan migrate:fresh --seed` and `php artisan test` under the pinned production PHP and database versions, plus an Android release build and physical-device acceptance suite.
- An external security reviewer and qualified Tanzanian counsel sign off on security boundaries, privacy notice, retention/legal hold, communications and payment workflows. Their review cannot be replaced by these code checks.