# Phase 1 Build Plan — Architecture Close-out + Foundation (Weeks 1–10)

Team: 1 Architect, 2 Laravel, 1 Frontend, 1 UX, 1 QA, 1 DevOps (BRD CON-R-01)
Gate: M2 — Foundation Complete (BRD §11.1)

## Week 1 — Walking Skeleton
- DevOps: repo + branch protection, this kit merged, CI green on both DBs,
  staging droplet auto-deploys `main`.
- Architect: ADR-001..003 ratified; module registry conventions demo.
- QA: tenancy suite adopted as the release-gate harness.
- Exit: "hello tenant" page deployable; CI matrix green.

## Weeks 2–3 — Tenancy + Identity
- companies/users/company_user complete (DBD §3.1), signup + email verify,
  login, lockout (SR-FND-010), sessions + policy (SR-FND-012).
- Adversarial suite: cross-tenant read/write/relationship/export cases.
- Exit: two tenants demonstrably isolated under attack tests.

## Weeks 3–4 — RBAC + 2FA
- roles/permissions catalog + role_permission + per-membership roles
  (SR-FND-020/021), authorization service + policy integration, TOTP 2FA
  with recovery codes (SR-FND-011), step-up re-auth middleware (SR-FND-013).
- Exit: permission matrix demo; UI+API enforce identically (SR-FND-022).

## Weeks 4–5 — Settings, Flags, Entitlements
- settings hierarchy resolver (SR-FND-040/041), feature_flags + rules +
  entitlement service (SR-FND-050/051), kill-switch path (SR-FND-052).
- Exit: module visibility switchable per tenant without deploy.

## Weeks 5–6 — Audit + Activity + Notifications
- audit_entries with hash chain (SR-FND-030/032), activity projections,
  notification center in-app + mail with preferences (SR-FND-070),
  profile-aware realtime vs polling (SR-FND-071).
- Exit: every mutation visibly audited; chain verifier job scheduled.

## Weeks 6–7 — Approvals, Sequences, Files, Dashboards
- approval engine core (SR-FND-080..082), number_sequences with
  FOR UPDATE allocation (SR-FND-085), files service + quotas (SR-FND-087),
  dashboard framework + first widgets (SR-FND-088/089).

## Weeks 7–8 — Branding, Localization, Operator Console v0
- white-label branding storage + theming tokens (SR-FND-102), en/hi locale
  packs + RTL-ready layout tokens (SR-FND-061/062), operator console:
  tenant directory, flags, audited impersonation (SR-FND-103).

## Weeks 8–10 — Hardening + M2 Gate + Posting Engine Spike
- Load test vs NFR-PRF-01 reference profile; Compatibility-profile smoke env.
- PARALLEL (per RK-02): Laravel dev #2 starts the Finance posting engine
  (journals, balanced-entry, posting_batches idempotency) test-first against
  DBD §3.7 — 2-week spike, CA-reviewed fixtures.
- Exit: M2 acceptance criteria (BRD §11.1) demoed end-to-end via UI AND API.

## Definition of Done (every ticket, from Week 1)
Code + Pest tests + adversarial case if endpoint + PHPStan level 6 clean +
Pint clean + API parity (SR-API-001) + audit events verified + docs note.