### 🧪 Testing Guide & Scenarios

Once you run this SQL script, you can test the system using the following credentials. 
**Password for ALL users:** `password`

#### Scenario 1: The Full Audit Lifecycle (Auditor Role)
1. **Login:** `auditor@iams.gov.my` / `password`
2. **Audit Universe:** Go to *Audit Universe* -> *RAT Planner*. Notice you can see the plans, but you cannot click "Endorse" or "Approve".
3. **Engagement:** Go to *Engagement* -> *Senarai Pelaksanaan Audit*. Click "Surat" on the BAHE audit to generate the PDF Notice.
4. **Working Papers:** Click "Senarai Semak" to see the pre-filled JSON checklists. Then go to *Kertas Kerja Audit (KKA)*. Open `WP-BAHE-01`. Notice the 4C fields are filled. Click "Hantar untuk Semakan".
5. **Queries:** Go to *Kuiri Audit*. Notice `KUERI-BAHE-01` is marked **OVERDUE** (Red badge) because its deadline was 5 days ago.

#### Scenario 2: The Isolated Auditee Portal (Auditee Role)
1. **Logout** and **Login:** `ppd.bahe@iams.gov.my` / `password`
2. **Dashboard:** You will only see a restricted dashboard.
3. **Maklum Balas Portal:** Go to *Queries* -> *Portal Maklum Balas*. You will *only* see queries for BAHE (Entity ID 1). You will see `KUERI-BAHE-01` requires a reply.
4. **CAP Portal:** Go to *Queries* -> *Portal CAP*. You will see the overdue CAP for BAHE. Click "Kemaskini", upload a dummy PDF, and mark it as "Selesai".

#### Scenario 3: The Approval Workflow (Head of IA & Audit Committee)
1. **Login as Head of IA:** `kad@iams.gov.my` / `password`
2. **KKA Review:** Go to *Kertas Kerja Audit*. Open `WP-BAHE-01`. You will see the "Tindakan Semakan" card. Add comments and click "Tandakan Sebagai Disemak".
3. **RAT Endorsement:** Go to *RAT Planner*. You will see the "Sokong" button for the Kewangan audit.
4. **Login as Audit Committee:** `aup@iams.gov.my` / `password`. Go to *RAT Planner* and click "Lulus" (Approve).

#### Scenario 4: Executive & Audit Committee Reporting (Controlling Officer)
1. **Login as KSU:** `ksu@iams.gov.my` / `password`
2. **AGD Dashboard:** Go to *Reports* -> *Papan Pemuka Eksekutif*. Select the BAHE engagement. You will see the Traffic Light status (Red, because there is 1 open High-Risk query).
3. **Accountability Index:** Go to *Reports* -> *Penilaian AI*. Select "Bahagian Hal Ehwal Eksekutif". You will see it gets a **3-Star Rating** based on the seeded 63.33% compliance.
4. **Audit Committee Deck:** Go to *Remediation* -> *Laporan Jawatankuasa Audit*. This will render the beautiful, print-ready PS 3.2 deck showing the aging analysis of the overdue High-Risk CAP.

#### Scenario 5: Tamper-Evident Audit Logs
1. Log in as any user and perform a few actions (e.g., update a KKA, approve a RAT).
2. Check the `audit_logs` table in your database. You will see the `record_hash` column chaining every single action together, proving the system's compliance with the Audit Act 1957 for tamper-evident logging.