HEBROTECH PAYROLL — HEBROTECH.CO.KE HOSTING PREPARATION
Prepared 4 November 2026. Based on the existing Online Deployable v8 source.
STATUS: TRIAL/STAGING ONLY. Not deployed. No live database was accessed.

TARGET
https://payroll.hebrotech.co.ke (recommended dedicated subdomain).
Root-relative application links require a dedicated document root, not /payroll on the main website.

HOSTING REQUIREMENTS
Apache-compatible hosting with .htaccess and mod_rewrite; PHP 8.2 or newer with PDO MySQL, sessions and password_hash; MySQL/MariaDB; valid SSL certificate.
No build pipeline or Composer dependencies are supplied by the original package.

INSTALLATION
1. Back up any existing website and database. Use a NEW, empty trial database.
2. Create payroll.hebrotech.co.ke in hosting Domains. Point DNS to your hosting provider's supplied address and enable AutoSSL. Do not guess an IP.
3. Select PHP 8.2+ and enable pdo_mysql. Upload CONTENTS of app/ to the subdomain document root (including hidden .htaccess files).
4. Edit config/config.php on the server: supply database name, database user and password. Grant the user access only to this database. Restrict config.php to 600 or 640 where supported.
5. In phpMyAdmin import database/schema.sql, then v4_reporting_controls.sql, v5_employee_year_finalpay.sql, v6_hr_controls.sql and v7_production.sql in that order. These are NEW INSTALL scripts, not an existing-data upgrade.
6. During controlled setup only, set enable_install to true; visit /install.php over HTTPS; create the company and a unique temporary Superadmin password. Do not leave the installer publicly enabled while waiting.
7. Immediately set enable_install to false and remove install.php. Change the temporary password on first login.
8. Check /system_check.php, login/logout, role access, reports and database connection. Confirm direct requests to /config/config.php and /database/schema.sql return 403.
9. Keep deployment_mode as trial. Use fictitious employees only. Configure backups and test restoration.

CHANGES IN THIS PACKAGE
Domain configured for payroll.hebrotech.co.ke; blank server credential placeholders; directory listing disabled; HTTPS redirect; direct web access blocked for internal directories and source/data archives; installer disabled by default; trial warning displayed; live payroll run blocked in this release.

RELEASE BLOCKERS FOUND IN SOURCE — REVIEW BEFORE LIVE USE
- SHA source currently checks gross >300 instead of applying a verified KSh300 contribution floor.
- NSSF defaults are flat KSh200 each; obtain and approve the applicable legal schedule and period-specific calculation before live use.
- Permanent salary divides by calendar days, rather than the specified working-day basis.
- Attendance calculation reads COMPILED/CLOSED entries only: validate immediate-posting and supervisor compile workflows.
- Payroll run writes P9 history while still draft. Validate finalization, reruns and historical protection.
- Review CSRF enforcement across all forms, login throttling, password-reset/email behavior, tenant isolation and backup authorization. Existing source is not a completed security audit.
- Reconcile P9A and statutory exports with current official formats; test employer contributions and final-pay rules.

VALIDATION LIMITS
Archive integrity and package contents checked locally. PHP and MySQL runtimes are unavailable here: PHP syntax, migrations, browser workflows, SMTP and end-to-end payroll have NOT been executed. Hosting credentials, DNS and certificate state have not been verified. No statutory calculation was changed or approved by this packaging task.

TRIAL ACCEPTANCE
Post ordinary attendance and piecework for fictitious employees; compile supervisor entries; calculate and compare manual earnings; reconcile payslips, payroll summary, banks and exports; test tenant/role restrictions, closure/reopening and backups. Resolve all release blockers before preparing a separate live release.
