# Crakey v2 requirements map

Source review: Crakey master prompt, current and prior `AUDIT-AND-RESULTS`, Full Features, Phase 1 KYC/security patch, financial/security patch, storefront patch, deployment/recovery notes, migrations, services, route contracts, and supplied dashboard/KYC references.

## Reimplement

| Domain | Required behavior | Acceptance direction |
| --- | --- | --- |
| Identity | Buyer/seller accounts, secure sessions, verified email, password reset, optional MFA | Server-side sessions, rotation/revocation, throttling, generic reset responses |
| Seller KYC | ID front/back, selfie holding ID and handwritten “Crakey” plus current configured-timezone date | Private evidence, immutable submissions, stale-date rejection, audited review/resubmission |
| Seller eligibility | Only latest approved KYC permits listing creation/activation | Enforced by policy, service and database transaction—not UI alone |
| Catalog/listings | Modular product types, regions, servers, delivery capabilities and inventory | Category-specific schemas and admin-controlled capability flags |
| Digital inventory | Available → Reserved → Sold/Funded → Delivered → Completed | Encrypted secrets, buyer ownership checks, unique allocation and row locking |
| Checkout/orders | Server-priced cart/order snapshots | Never trust browser amount, fee, currency, seller or inventory state |
| Escrow | Fund, deliver, required star rating, release/refund/dispute | Explicit state machine, locks, idempotency keys, immutable events |
| Wallet/accounting | Append-only balanced ledger in minor units | Unique references, balanced journals, reconciliation, no float math |
| Payments | PayPal sandbox first | Signed/provider-verified callbacks, amount/currency/merchant binding, replay defense |
| Payouts | Manual review initially; automatic disabled | Balance reservation, idempotency, exact-balance support, reconciliation |
| Trust | Transaction-bound reviews, disputes, evidence and support | Ownership/eligibility checks; evidence/history retained |
| Notifications | KYC approved/rejected and new-sale email | Transactional outbox, retries, safe content; never include keys/KYC/secrets |
| Staff | Owner plus configurable least-privilege roles | Deny-by-default permission checks on every HTML/API route and action |
| Audit/recovery | Append-only security/financial events and tested backup process | Never claim off-site/PITR/restore PASS without execution evidence |
| UX | Original premium dark navy, purple and blue Crakey system | Responsive, accessible, real database data, honest empty states |

## Improve rather than reproduce

| Legacy pattern | v2 approach |
| --- | --- |
| Controllers/templates containing financial rules | Domain/application services with transactional repository ports |
| User balance columns incremented directly | Balanced append-only ledger; cached balance is non-authoritative |
| Mixed payment gateway surface | Provider registry; disabled until adapter-specific sandbox acceptance |
| Route/menu permission coupling | Named permissions and centralized deny-by-default authorization |
| Mutable single KYC record | Immutable submission/evidence history plus current status projection |
| Public-path upload defenses via `.htaccess` | Private object storage with authenticated streaming and no public key namespace |
| Theme duplication | One component/token system with role-specific layouts |
| Scattered fee values | Versioned fee engine with immutable order calculation snapshots |

## Do not carry forward

- Gamers Arena source, naming, database compatibility tables, branding, artwork, templates, duplicated light/dark views, backup files, or vendor assets.
- Legacy Blockchain callback and raw-card Authorize.Net implementations.
- Untested gateways or automatic payout callbacks.
- Floating-point authoritative amounts, direct wallet mutation, browser-provided financial state, or delete-and-rewrite financial history.
- Public infrastructure routes for migrations, scheduler, queue workers, cache clearing or maintenance commands.
- Menu-hidden-only staff authorization, broad admin middleware, public/enumerable KYC files, secrets in URLs/logs, or unscoped numeric-resource access.
- Fabricated marketplace metrics, reviews, deals, inventory, provider availability, exchange rates or game licenses.

## Critical evidence inherited from the audit

- The latest staging audit remains **FAIL** for production readiness.
- Restricted dashboard-only staff accessed KYC, private KYC images, users, payments, payouts, listings, disputes, configuration and role/staff pages. V2 treats this as a release-blocking authorization regression suite.
- Legacy financial history/double-entry migration, provider reconciliation, automatic payouts, recovery/PITR, full KYC transitions and concurrency tests were not production-verified.
- Local legacy patch tests reported 46 tests/145 assertions, but they do not prove MySQL/provider/infrastructure behavior.

## Phase gates

Each phase records `PASS`, `FAIL`, or `NOT TESTED`. A rendered page is never sufficient for PASS. Production remains blocked until all Phase 9 acceptance gates and provider/infrastructure tests pass.