{
  "audit": "Baltique OS Core 2.10.1 static release audit",
  "generated_at": "2026-07-14T14:16:50.196Z",
  "root": "C:\\Users\\szych\\Documents\\Codex\\2026-07-14\\utw-rz\\work\\Baltique_OS_2_8_1_Full_Code",
  "counts": {
    "files": 2620,
    "php": 1110,
    "public_php": 673,
    "js": 40,
    "css": 156,
    "sql": 274
  },
  "checks": {
    "javascript_syntax": {
      "ok": true,
      "errors": []
    },
    "php_lexical_balance": {
      "ok": true,
      "errors": [],
      "limitation": "Not a replacement for php -l; PHP CLI was unavailable in the build environment."
    },
    "static_app_requires": {
      "ok": true,
      "missing": []
    },
    "required_2100_files": {
      "ok": true,
      "missing": []
    },
    "active_map_references": {
      "ok": true,
      "findings": []
    },
    "clinical_safety_gates": {
      "ok": true,
      "gates": {
        "imported_products_pending": true,
        "automatic_ordering_off": true,
        "automatic_prescribing_off": true,
        "hallera_two_consult_rooms": true,
        "hallera_one_or": true,
        "hallera_two_recovery_rooms": true,
        "hallera_legacy_rooms_consolidated": true,
        "bed_release_requires_reason": true,
        "no_automatic_clinical_decision": true,
        "command_center_fast_helpers_present": true,
        "official_import_resumable": true,
        "official_import_durable_checkpoints": true,
        "official_import_host_rate_limited": true,
        "official_import_permanent_update_centre": true,
        "official_import_future_csv_chunked": true,
        "official_import_private_storage": true,
        "official_import_dynamic_provenance": true,
        "official_import_does_not_block_core_upgrade": true,
        "official_import_reference_only": true,
        "catalog_functional_grouping": true,
        "catalog_server_pagination": true,
        "catalog_direct_page_and_initial_filter": true,
        "catalog_admin_crud": true,
        "catalog_delete_is_audited_soft_archive": true,
        "master_data_exact_dedup_audited": true,
        "ambiguous_identity_review_only": true,
        "duplicate_dashboard_uses_lightweight_count": true,
        "hospital_assortment_separate_selection": true,
        "hospital_reorder_thresholds_per_location": true,
        "hospital_reorder_draft_only": true,
        "hospital_reorder_supplier_governed": true,
        "hospital_reorder_supplier_handoff": true,
        "hospital_reorder_cron_opt_in": true,
        "location_selector_deduplicated": true,
        "official_rpl_checksum_verified": true,
        "official_rhf_checksum_verified": true,
        "official_data_profile_complete": true,
        "runtime_results_expandable": true,
        "runtime_history_bounded": true,
        "legacy_replacements_use_cumulative_repair": true
      }
    },
    "public_post_csrf_heuristic": {
      "ok": true,
      "unreviewed": [],
      "reviewed": [
        {
          "file": "public_html/communication_consent_portal.php",
          "model": "Public bearer link scoped to one patient consent context."
        },
        {
          "file": "public_html/communication_inbound_webhook.php",
          "model": "Fail-closed shared-secret webhook."
        },
        {
          "file": "public_html/communication_portal_reply.php",
          "model": "Public bearer reply link scoped to a communication context."
        },
        {
          "file": "public_html/deliverability_webhook.php",
          "model": "Fail-closed shared-secret webhook."
        },
        {
          "file": "public_html/partials/patient_identity_fields.php",
          "model": "Form partial; does not process a request."
        },
        {
          "file": "public_html/patient_home.php",
          "model": "Reads a POST token for compatibility but does not mutate on POST."
        },
        {
          "file": "public_html/pay.php",
          "model": "Public high-entropy payment bearer link; gateway performs its own signed flow."
        },
        {
          "file": "public_html/provider_normalization_webhook.php",
          "model": "Fail-closed provider/global shared-secret webhook."
        },
        {
          "file": "public_html/set_locale.php",
          "model": "Low-impact locale preference endpoint; accepts GET by design."
        },
        {
          "file": "public_html/supplier_order_portal.php",
          "model": "Public high-entropy supplier bearer link with response throttling."
        },
        {
          "file": "public_html/system_pro_milestone.php",
          "model": "POST is protected inside balt240_handle_post via balt_verify_csrf."
        }
      ],
      "limitation": "Heuristic plus explicit review of token, webhook, partial and delegated-CSRF routes."
    },
    "public_debug_exposure": {
      "ok": true,
      "warnings": []
    }
  },
  "route_coverage": {
    "patient": {
      "found": [
        "public_html/patient_home.php",
        "public_html/intake.php",
        "public_html/booking.php",
        "public_html/communication_consent_portal.php",
        "public_html/operative_portal.php"
      ],
      "candidates": [
        "public_html/patient_home.php",
        "public_html/intake.php",
        "public_html/booking.php",
        "public_html/communication_consent_portal.php",
        "public_html/operative_portal.php"
      ]
    },
    "reception": {
      "found": [
        "public_html/clinic_calendar.php",
        "public_html/intake_admin.php",
        "public_html/consultation_day.php",
        "public_html/clinic_architect.php"
      ],
      "candidates": [
        "public_html/clinic_calendar.php",
        "public_html/intake_admin.php",
        "public_html/consultation_day.php",
        "public_html/clinic_architect.php"
      ]
    },
    "clinical": {
      "found": [
        "public_html/system_hospital_command_center.php",
        "public_html/operative_case.php"
      ],
      "candidates": [
        "public_html/system_hospital_command_center.php",
        "public_html/operative_case.php"
      ]
    },
    "supply": {
      "found": [
        "public_html/system_perioperative_supply_chain.php",
        "public_html/system_clinical_catalog_2100.php",
        "public_html/system_hospital_assortment_2101.php",
        "public_html/system_master_data_duplicate_review_2101.php",
        "public_html/system_official_registry_updates_2101.php"
      ],
      "candidates": [
        "public_html/system_perioperative_supply_chain.php",
        "public_html/system_clinical_catalog_2100.php",
        "public_html/system_hospital_assortment_2101.php",
        "public_html/system_master_data_duplicate_review_2101.php",
        "public_html/system_official_registry_updates_2101.php"
      ]
    }
  },
  "runtime_not_executed": [
    "PHP syntax/runtime (PHP CLI unavailable)",
    "database migrations",
    "authenticated browser E2E",
    "mail/SMS/WhatsApp",
    "payments",
    "backup restore",
    "load and failover"
  ],
  "summary": {
    "passed": 8,
    "failed": 0,
    "failed_checks": []
  }
}