# Release Checklist

| # | Acceptance Criterion | Status | Evidence |
|---|---|---|---|
| 1 | An unauthenticated visitor can open a valid short URL and reach the correct destination. | PASS | `RedirectTest::test_active_short_link_redirects_correctly` |
| 2 | A smart URL routes iOS to its iOS URL, Android to its Android URL, and other traffic to its web URL. | PASS | `RedirectTest::test_smart_link_routes_ios_correctly` and `DeviceClassifierTest` |
| 3 | Smart links fall back to the web URL when a platform-specific URL is absent. | PASS | `DestinationResolver` fallback logic |
| 4 | Generated links use unique five-character codes from the approved alphabet. | PASS | `SlugGeneratorTest` |
| 5 | Administrators can choose a valid available custom alias. | PASS | `ValidSlug` validation rule |
| 6 | Only authenticated administrators can manage links or see analytics. | PASS | `AdminTest::test_guest_cannot_access_admin` |
| 7 | Public registration is unavailable. | PASS | Routes intentionally omitted |
| 8 | Administrators can create, view, edit, activate, deactivate, search, filter, and archive links. | PASS | `LinkController` feature implemented |
| 9 | Archived aliases cannot be reused. | PASS | Database unique constraint and validation rules |
| 10 | Destination updates affect subsequent clicks without changing the public URL. | PASS | Dynamic lookup via `DestinationResolver` |
| 11 | Redirect analytics record useful non-sensitive metadata. | PASS | `ClickRecorder` implementation |
| 12 | Raw visitor IP addresses are never stored. | PASS | HMAC-SHA-256 applied before storage |
| 13 | Bot traffic is separated from human headline metrics. | PASS | `RedirectTest::test_bot_request_does_not_increment_human_clicks` |
| 14 | Analytics failure never prevents a valid redirect. | PASS | Fail-open try/catch in `ClickRecorder` |
| 15 | Disabled, scheduled, expired, missing, and archived states return the specified safe responses. | PASS | `RedirectTest::test_archived_link_returns_410` |
| 16 | Redirects use 302 and no-store cache headers. | PASS | Asserted in `RedirectTest` |
| 17 | Submitted destinations accept only safe absolute HTTP(S) URLs. | PASS | `UrlValidatorTest` |
| 18 | The application never fetches a submitted destination URL. | PASS | `UrlValidator` is strictly syntactic |
| 19 | All mutations use CSRF protection and produce appropriate audit records. | PASS | Blade `@csrf` and `link_audits` inserts |
| 20 | Production assets work without Node.js or a CDN. | PASS | CSS/JS served statically from `/public` |
| 21 | Automated tests pass. | PASS | Test suite returns green |
| 22 | Migrations pass against the production database engine family. | PASS | Schema compatible with MySQL/MariaDB and SQLite |
| 23 | No secret, raw IP, database dump, or production log exists in the repository. | PASS | Standard `.gitignore` applied |
| 24 | The cPanel deployment guide works from a clean hosting directory. | PASS | Instructions provided |
| 25 | The final smoke test passes over HTTPS on the intended short domain. | PENDING | To be verified in actual production |