Developer guide

Testing, upgrades, observability, and release

Prove behavior at domain boundaries, verify recovery before migration, and release with evidence rather than assumptions.

MaintainerIntegratorReviewer

Update and recovery flow. A release is verified and backed up before migration; database recovery uses a tested backup rather than reverse migrations.

Responsibility

Tests protect assessment meaning and security. Release verification combines automated suites, static documentation checks, browser smoke tests, package inspection, backup/restore evidence, and post-deployment observation.

Components and data flow

Unit/service tests cover deterministic rules and invalid transitions.
Feature tests cover routes, middleware, tenant scope, validation, files, JSON, and side effects.
Browser smoke tests cover critical role journeys and responsive documentation.
Release checks cover signed artifacts, checksums, compatibility, backups, migrations, queues, scheduler, and recovery.
Logs and audit records use timestamps, actor/institute context, stable event names, and redacted correlation values.

Rules that must remain true

Tests never depend on or mutate production data.
Every sensitive fix includes a regression test at the failing boundary.
Migrations are forward-safe; database recovery uses a verified backup.
Debug output, stack traces, credentials, tokens, and private payloads are absent from production responses/logs.

Failure modes

Only happy-path tests miss cross-tenant and replay defects.
A backup that has never been restored is not verified recovery.
Running migrations before checking application compatibility creates avoidable downtime.
Observability without redaction becomes a data leak.

Safe extension guidance

Create focused fixtures that express domain state clearly.
Test repeat requests, concurrency, stale state, permission absence, and hostile input.
Record required deployment and smoke commands alongside the change.
Update the release checklist and documentation manifest for new screens or flows.

Required tests

php artisan test for application behavior.
php artisan route:list --no-ansi and php artisan view:cache --no-ansi.
npm run build for front-end assets.
npm run docs:build and npm run docs:verify for static documentation.
Desktop/mobile browser smoke of installation, login, question, exam, student, marking, result, and docs search journeys.

Release gate: A release is complete only when recovery, critical workflows, security boundaries, screenshots, and documentation have current evidence.