# Implementation status — initial deliverable

This source package is an early-stage vertical slice, **not a finished medical booking service**. The check marks below refer to code written, not verified production behavior.

| Feature | Source present | Framework executed here? | Status |
|---|---|---|---|
| Browser `install.php` central setup | Yes | PHP syntax only | Requires Composer vendor directory and working MySQL host; no end-to-end run |
| Responsive approved green/navy/red UI | Yes | No | Blade and CSS templates |
| Public clinic directory and location query | Yes | No | Basic search, no doctor-wide search |
| Clinic doctor and schedule entries | Yes | No | Basic weekly sessions; no exceptions |
| Appointment slot generation | Yes | No | Generation for 21 days |
| Patient booking with minimal details | Yes | No | Name + phone only |
| Concurrent slot row locking | Yes | No | Needs real parallel-load tests |
| Unique request idempotency | Yes | No | Database unique constraint; needs tests |
| Booking confirmation token | Yes | No | Random 256-bit bearer token, hashed database storage |
| Private per-clinic MySQL schema | Yes | No | Provisioned via DBA + CLI |
| Tenant-scoped clinic sessions | Yes | No | Needs isolation security tests |
| Clinic appointment status updates | Yes | No | Some statuses implemented |
| Platform clinic status operations | Yes | No | CLI provisioning; UI approve/suspend |
| Platform aggregated usage | Yes | No | Counts-only scheduled snapshot |
| Super-admin patient access forbidden by routes | Yes | No | Needs automated access test / privilege audit |
| Patient self-service reschedule/cancel | No | — | Clinic contact only |
| Complete staff permissions / role lifecycle | Partial | No | Three simple roles; missing full management |
| Full SaaS subscriptions, plan enforcement | No | — | Plan metadata only |
| Privacy notice, DPA drafts | Draft only | — | Requires Sri Lanka legal review |
| MFA / password reset / verified SMS | No | — | Before production |
| Backup, data retention deletion, audit | Partial | No | Security operations incomplete |
| Automated tests | Domain unit test only | PHPUnit not run | Standalone smoke check passed |

See `tests/README.md`, `docs/ARCHITECTURE.md`, and `docs/PRIVACY-AND-SECURITY.md`.