# Verification report — 29 October 2026

## Completed

- TypeScript check passed with `tsc --noEmit`.
- Initial Vinext production build passed. Final build is performed again by the publication workflow on the final source state.
- 13 backend integration checks passed against an isolated SQLite database through a D1-compatible test adapter:
  1. Real submission handler writes the request, destination and independent source-country fields and issues a reference.
  2. Repeated request ID does not create a second record.
  3. Missing/invalid origin, consent, headcount and honeypot violations are rejected.
  4. Anonymous CRM read/update/export requests are denied.
  5. Owner can update status/assignee and store an audit note.
  6. Viewer can read but cannot update requests or grant roles.
  7. Partner publication requires evidence and explicit permission attestation.
  8. Disguised invalid image upload is rejected.
  9. Private attachments cannot be fetched through the public media route or by anonymous callers; authorised download and cleanup work.
  10. CSV export neutralises spreadsheet formula prefixes.
  11. All three languages and 21 unique country briefs are populated.
  12. Full backup requires owner access and excludes runtime secrets.
  13. Conversion metrics join consented sessions with saved enquiries and do not count opted-out requests in the conversion numerator.

## Browser verification

- Desktop home page visually inspected: navy/gold identity, generated hero image, navigation, industry cards and contact actions.
- Malaysia country page and its three-step form exercised through the browser using synthetic `QA TEST` data and example.com email.
- Saved request reference appeared: AMI-20261029-0A4CD504. Local D1 read verified destination Malaysia, source `/en/markets/malaysia`, source country malaysia, submitted role and 12 workers. Email status correctly remained `not_configured`.
- A client compatibility error from crypto.randomUUID on an insecure local preview origin was found and repaired with a crypto.getRandomValues UUID fallback. The form then completed successfully.
- English, Arabic and Bengali home pages visually inspected in 390px-wide test frames. Arabic HTML language and RTL were confirmed; clientWidth and scrollWidth were both 375px (390px frame minus scrollbar), with no horizontal overflow.
- Arabic mobile navigation opened and displayed its links.
- XML sitemap route rendered the multilingual base page, country and sector URLs. Canonical generation was subsequently aligned to the framework’s paths without a trailing slash, and custom-language alternates were limited to published versions.
- Temporary mobile QA page removed before packaging. Synthetic browser enquiry exists only in local preview state, not in production migrations.

## Not verified / not configured

- External email provider credentials, sender verification, inbox delivery and bounce handling.
- Live Google Analytics, Search Console or Bing ownership/collection.
- Custom-domain DNS/TLS and public search indexing on almurisintl.com.
- Live production customer traffic, field Core Web Vitals and conversion performance.
- Real-world recruiting licence, destination authorisations, partner relationships, deployment records and actual company photographs.
- Complete restore of a production backup; automatic backup scheduling.
- An external penetration test, antivirus scanning and native-speaker commercial approval of translations.

The isolated backend tests emulate trusted platform identity headers. Production relies on Sites to verify and inject those headers; they are not accepted directly from an untrusted public visitor by the platform. No test authentication bypass is included in the application.