1. System Overview & Testing Credentials
The platform is configured with full Role-Based Access Control (RBAC) across thirteen staff roles (sixteen seeded accounts), executive management, and eight customer portal accounts. Every credential below was confirmed by signing in over real HTTP against a freshly seeded database on 2026-09-04 — see docs/RUNBOOK.md for the full technical runbook.
Verified Demo Testing Credentials — staff password for every row below: Rusukh#Staff2026
| Role |
Name |
Email |
Access Desk URL |
| Super Root Admin |
Rusukh Root |
root@rusukh.pk |
/admin/orders |
| Management / Director |
Tariq Jamil |
tariq.jamil@rusukh.pk |
/admin/analytics/dashboard |
| Customer Service / CRM |
Nadia Iqbal |
nadia.iqbal@rusukh.pk |
/admin/orders |
| Operations Coordinator |
Rehan Aziz |
rehan.aziz@rusukh.pk |
/admin/shipping/manifests |
| Finance & Administration |
Shahid Kamal |
shahid.kamal@rusukh.pk |
/admin/finance/ledger |
| Master Cutter |
Yousuf Dawood |
yousuf.dawood@rusukh.pk |
/admin/production/cutting |
| QC Officer |
Naveed Anwar |
naveed.anwar@rusukh.pk |
/admin/production/quality |
| Patron / Customer (separate login, separate password) |
Ahmed Raza |
ahmed.raza@gmail.com |
/account |
Staff sign in at /login. Patrons sign in separately at /customer/login with password Rusukh#Client2026 — eight seeded patrons in total. Root, Management and Finance are redirected to mandatory two-factor enrolment on every sign-in until they enrol; this is deliberate. The full sixteen-staff / eight-patron roster is in the Operations Manual companion document.
2. Super Root Admin Impersonation & Security SOP
The Super Root Admin (root@rusukh.pk) is the only account that may bypass a stage gate, and may impersonate any staff or customer account.
- Impersonation: Visit
/admin/identity/impersonation (or the User table at /admin/identity/users) to view any staff member or customer's exact interface and permissions.
- Dual-Actor Audit: The system logs all actions during impersonation under both the Super Root's ID and the impersonated user's ID.
- Bypass Logging: Only Root may bypass a stage gate, and only with a stated reason. Every bypass writes an audit row naming the gate, the reason, and which criteria were still unmet at the time.
3. 25-Status Order Lifecycle & 13 Stage Gates
[Inquiry Received] → [Appointment Confirmed] → [Measurement Completed]
→ [Awaiting Customer Confirmation] → [Order Confirmed (G4)]
→ [Advance Received] → [Fabric Pending] → [Fabric Received]
→ [Fabric Inspection Completed (G5)] → [Cutting Pending] → [Cutting Completed (G7)]
→ [Tailor Assigned] → [Stitching In Progress (G8)] → [Accessories Pending]
→ [Initial QC (G9)] → [Finishing In Progress]
→ [Final QC] → [Ready for Packing] → [Packing Completed (G10)]
→ [Balance Payment Pending] → [Delivery Scheduled] → [Out for Delivery (G11)]
→ [Delivered (G12) — 15-Day Fit Guarantee Starts] → [Customer Approval Pending] → [Order Closed (G13)]
Three further states sit outside this happy path and can be reached from most of it: Alteration Required (a failed QC sends the garment back), On Hold, Cancelled, and Refunded. Gates G7, G9, G10 and G12 require an actual attached artefact — not just a ticked checkbox — and G10 is the only two-person gate. Only root@rusukh.pk may bypass any gate, and never without a stated reason.
4. Workshop, Dual QC & 2-Person Packing Rules
- Straight vs Kali Cut: Straight Cut is selected for crisp classic drape; Kali Cut introduces a multi-panel flared silhouette with extra fabric calculation.
- 12-Step Construction Sequence: from front placket & pocket preparation through collar fusing, sleeve attachment, hemming, buttonholing, shalwar assembly and final press — tracked step-by-step at the Tailoring Station.
- 6-Point Fabric Inspection: colour/shade match, length & width, weave, stains & holes, dye evenness, and shrinkage — a lot failing any check is quarantined rather than issued to production.
- Dual Independent QC Invariant: The inspector who performs Initial QC or Final QC cannot be the artisan who stitched the garment (enforced strictly at code level).
- 2-Person Packing Verification: One person recording both halves of the packing sign-off is refused outright, not merely warned.
5. Financial Accounting & Daily Safe Closings
- Double-Entry Ledger: All payments, COGS, and wages post balanced journal entries across 31 seeded accounts on the standard Pakistani Chart of Accounts (1000s Assets through 5000s Expenses).
- Revenue Recognition: a customer's advance sits in the Deferred Revenue liability account and is only recognised as earned revenue the moment the order is delivered — a separate clock from the 15-day commission window below.
- Daily Cash Register Closings: Cashiers reconcile daily physical cash counts against opening balance and receipts, with variance flagged for review.
- Tiered Commission Engine: 3% Pre-Sale + 2% Post-Sale, plus a 1% manager override up to two reporting levels deep, mature automatically 15 days post-delivery (PKR 1,000 payout minimum).
6. Patron Portal & 15-Day Fit Guarantee (/account)
Patrons have complete self-service control through the customer portal:
- Order Tracker: Visual status journey from fabric inspection to courier delivery, at
/account/orders.
- Self-Measurement Studio:
/account/measurements lists saved profiles; /account/measurements/new is the guided studio itself — the 14 required Pakistani body dimensions, one per step, with a diagram guide on each. (A fuller 24-point profile is captured separately, in person, by a Measurement Representative.)
- 15-Day Fit Guarantee: alteration booking for sleeves, collar, waist, or trouser (mori) adjustments at
/account/alterations.
Two things worth knowing before go-live: PayFast currently runs in fake mode, so no real payment is taken until the client's live merchant credentials are configured; and all customer communication is strictly email — there is no SMS or WhatsApp channel anywhere in the system, by design.