# Validation Report — Release 02.01.00

Validation performed on **21 August 2026** before packaging.

## Static validation

- All PHP files passed `php -l` syntax validation.
- Shell installer passed `bash -n` validation.
- Release JSON passed JSON parsing.
- No `.env`, log record, session file or generated secret is included in the package.
- The installer was executed in an isolated copy; it created `.env`, generated `APP_KEY` and applied mode `0600` successfully.

## Automated tests

```text
PASS  APP_KEY generation and validation
PASS  Environment file parsing
PASS  Container singleton resolution
PASS  Router dispatches parameters and HEAD
PASS  Router emits HTTP 405 with Allow header
PASS  Security middleware adds critical headers
PASS  Response blocks header injection

Tests: 7 passed, 0 failed.
```

## HTTP integration tests

A local HTTP integration run verified:

- foundation page: HTTP 200
- liveness endpoint: HTTP 200
- readiness without database credentials: HTTP 503 as designed
- CSRF-token endpoint: HTTP 200 plus `HttpOnly; SameSite=Lax` session cookie
- untrusted Host header: HTTP 400
- state-changing request without CSRF token: HTTP 419
- valid session cookie and CSRF header pass middleware and reach routing
- CSRF token supplied only in the query string is rejected
- security headers and request IDs appear on normal and error responses
- JSON access logs are written without tokens/cookies
- HTTP 4xx diagnostic entries contain no stack traces after the final logging adjustment

## Deployment validation still required

The package was linted and integration-tested in an available PHP 8.4 environment using syntax compatible with PHP 8.5. The release deliberately requires PHP 8.5 and must pass `app:check`, PDO MySQL connectivity, Apache rewrite, AutoSSL and PHP-FPM header tests on the ExamCert VPS before Step 02.1 is marked deployed.