# Release Notes — Version 1.0.0

**Aumni AMS** — Asset Management System for Aumni Techworks LLP.
**Release status:** Release Candidate 1 (RC1), pending final approval before
Version 1.0.0 is declared.

This is the first release. Everything below has been built, reviewed and
tested; nothing described here is a promise about a future version.

---

## What Aumni AMS does

A single internal system covering the full life of a company asset — from
the day it's bought to the day it's disposed of — and the roster of
employees it's issued to:

- **Asset register** — the complete inventory: identity, technical
  specifications, purchase information, free-form notes, and a computed age.
  Every asset carries an automatically generated tag (e.g. `AUM-LAP-0042`),
  never typed by hand.
- **Assign / Return** — a governed two-step custody workflow. Only one
  active assignment can exist for an asset at a time, and the condition
  recorded at return automatically routes a damaged item to Under Repair or
  Damaged instead of silently back into the available pool.
- **Bulk import** — bring an existing spreadsheet of assets in at once, with
  a mandatory preview step before anything is written, per-row validation
  using the exact same rules as the manual form, and a downloadable error
  report for anything that didn't pass.
- **Warranty management** — coverage periods per asset (manufacturer
  warranty, extended warranty, AMC, insurance), renewal that preserves the
  old record rather than overwriting it, document attachments, and a daily
  expiry-digest email.
- **QR labels** — a scannable code per asset that opens straight to its
  detail page, downloadable individually or as a bulk, print-ready A4 label
  sheet across two layouts.
- **Employees** — the roster assets are issued against, with a reporting
  hierarchy and a status lifecycle that governs who can currently receive an
  asset.
- **Dashboard** — KPIs, charts and operational worklists (awaiting return,
  upcoming warranty expiry, recent activity), cached for responsiveness.
- **Reports** — 22 reports across five categories (Inventory, Employees,
  Assignments, Warranty, Audit), each filterable, sortable and exportable to
  Excel and PDF from one shared definition, so the on-screen table and both
  exports can never disagree.
- **Audit log** — a complete, tamper-evident history of who changed what and
  when, open to every signed-in user, with configurable retention and a
  permanent exemption for chain-of-custody events.
- **Application Settings** — company branding, system preferences, asset
  tag format, import limits, notification recipients and security policy,
  all editable from one screen without touching a config file.
- **User management** — account creation with one-time generated passwords,
  forced password change, password reset, and the guarantee that the last
  master-user account can never be locked out.

Full field-by-field usage instructions: **`docs/USER_GUIDE.md`** (every
signed-in user) and **`docs/ADMIN_GUIDE.md`** (master-user-only areas).

---

## About this release: RC1

Every module above was built and approved module-by-module across Phases
0–10. Before calling this Version 1.0.0, the whole application went through
one more pass — RC1 — aimed at production-readiness rather than new
capability: a full functional QA sweep, a UI/UX consistency review across
desktop, tablet and mobile, a security review, a performance review, and a
code-quality review of everything not already covered in earlier phases. No
new features were added; the only changes are what that review found.

### Fixed

- **QR bulk label selection had no upper limit.** Selecting an extremely
  large number of assets for one label run had no cap, unlike the
  equivalent Reports PDF export — a genuine resource-exhaustion risk on
  shared hosting, even though it had not caused a problem yet. A single run
  is now capped at 500 assets (about 21 sheets on the standard template);
  a clear message explains the limit and suggests splitting the run.
- **A layout inconsistency on the Warranty page.** Its five summary cards
  wrapped awkwardly, leaving one card alone on its own row on wider screens.
  Now lays out evenly at every screen size, matching every other summary
  row in the application.
- **A latent (not yet triggered) bug in a shared date-filter component**
  that would have caused two date-range filters on the same page to
  interfere with each other. No page currently does this, but the component
  is now safe against it.

### Investigated and confirmed safe

- A Laravel framework feature that could, in principle, expose files on the
  application's private storage (warranty documents, import files) via a
  raw, unauthenticated URL was investigated in depth. Testing against a real
  uploaded file confirmed the framework's own signature requirement already
  blocked unauthenticated access — this was not an active vulnerability. The
  setting was switched off anyway as a precaution, so the application no
  longer depends on that framework safeguard to stay protected.

### Reviewed with no issues found

Authentication, CSRF protection, session security, mass-assignment
protection, SQL injection surface, N+1 database queries, missing indexes,
and the application's caching layers were all re-verified against the
current codebase. No issues were found in any of these areas.

### Added

- **`docs/USER_GUIDE.md`** and **`docs/ADMIN_GUIDE.md`** — this release's
  first end-user documentation, written directly against the current code.
- **This document.**

---

## Known limitations

These are deliberate design decisions carried from the approved
architecture (`docs/ARCHITECTURE.md` §1), not gaps to be fixed later:

- No email-based password reset — a master user resets a forgotten password
  directly.
- No mobile app — the web application is fully responsive and usable on a
  phone browser, but there is no native app or offline mode.
- No barcode scanning beyond QR — assets are identified by QR code or by
  typing the asset tag/serial number into search.
- No multi-company / multi-tenant support — this is a single-company,
  single-instance system by design.
- Imports and the warranty digest run synchronously (no background queue);
  a very large import file is capped (configurable, 2,000 rows by default)
  specifically to keep this workable without one.
- Consumables (cables, mice, headsets) are tracked as individual assets, not
  bulk quantities.

---

## Deployment

See **`docs/DEPLOYMENT.md`** for the production release procedure and
pre-launch checklist, and **`docs/BACKUP.md`** for the backup and restore
runbook. Both were written during Phase 10 and re-verified during RC1.

---

## Recommendation

RC1 found two minor, real defects (neither previously known, neither with
evidence of having caused a problem in practice), fixed both, investigated
one potential security concern to a confirmed-safe conclusion and hardened
it anyway, and found the application's security, performance and code
quality otherwise already in order across a from-scratch re-review. 491
automated tests pass, along with Laravel Pint (formatting) and Larastan
level 5 (static analysis).

**Aumni AMS is recommended for Version 1.0.0 release**, pending final
sign-off.
