# Corporate Module Status After Phase 5.5

## Completed

The Corporate module now includes:

- Public B2B lead capture via `/b2b` and `/corporate`.
- B2B lead lifecycle and admin queue.
- Organization as the canonical B2B tenant model.
- Corporate proposals with private PDFs.
- Corporate agreements with generated/signed private files.
- Corporate cohorts from active agreements.
- Corporate trainee manual add/import.
- Corporate session scheduling reuse.
- Corporate attendance records.
- Corporate reports, final delivery PDFs, and safe finance summary.
- Organization portal summaries for programs and reports.

## Tested

Corporate test coverage now includes:

- Phase 1 foundation and tenancy.
- Phase 2 proposals.
- Phase 3 agreements and private files.
- Phase 4 corporate cohorts, import, and attendance.
- Phase 5 reports and safe finance.
- Phase 5.5 regression and route/security hardening.

Key command:

`php artisan test tests/Feature/Corporate tests/Unit/Corporate --stop-on-failure`

## Current Security Position

- Admin routes are protected by `auth` and permissions/policies.
- Organization portal routes are protected by `auth`, `org_portal`, and `tenancy`.
- Corporate report downloads enforce organization scoping.
- Financial report values require `corporate_finance.view`, except for `super_admin`.
- Private files are not exposed via public storage.
- New development continues to avoid `companies`, `users.company_id`, and `agreement_path`.

## Current Limitations

- No full invoicing engine yet.
- No receivables aging for corporate agreements yet.
- No payment reconciliation for corporate invoices yet.
- No signed delivery report acceptance workflow yet.
- No expiring public download links for institutions; portal/protected download remains the safe mode.

## Safe To Enter Phase 6

The module is ready for Corporate Phase 6 Invoicing if Phase 6 follows these rules:

- Use `Organization` as the customer account.
- Link invoices to `corporate_agreements` and optionally corporate cohorts.
- Store invoice PDFs privately.
- Use policies for all downloads and actions.
- Keep finance visibility controlled by explicit permissions.
- Do not modify individual enrollment/payment flows unless an integration point is explicitly required.

## Phase 6 TODO

- Corporate invoices table and lifecycle.
- Invoice line items.
- Receivable status and due dates.
- Payment allocation/reconciliation.
- Admin invoice UI.
- Organization portal invoice list/download.
- Invoice PDF template.
- Notification templates.
- Tests for invoice IDOR, private downloads, and finance permissions.