# Unanym WordPress setup trial report

Status: NOT CONDUCTED

Date:
Tester alias:
Observer alias:
Operator alias:
Staging site reference (no credentials):
Source revision:
Companion version and ZIP SHA-256:
WordPress version:
PHP version / Sodium available:
OpenID Connect Generic Client version:
Browser / device:
Other active plugins and cache:
Private report location:

## Prerequisites

| Item | Ready / blocked / not checked | Note |
| --- | --- | --- |
| Staging WordPress and native administrator sign-in | | |
| Staging identity service and operator handoff | | |
| Test organisation and separately signed-in organiser | | |
| Delivery to participant-controlled test inboxes | | |
| Current guides and companion ZIP | | |

## Tasks

Use PASS UNAIDED, PASS WITH HELP, FAIL, BLOCKED or NOT ATTEMPTED.

| Task | Outcome | Minutes | Help needed / observed problem |
| --- | --- | --- | --- |
| Install plugins and request registration | NOT ATTEMPTED | | |
| Save connection and confirm fingerprint / organisation | NOT ATTEMPTED | | |
| Select the private Rehearsal notes page | NOT ATTEMPTED | | |
| Deny signed-out visitor; retain native admin access | NOT ATTEMPTED | | |
| Member shares choir membership and opens page | NOT ATTEMPTED | | |
| Withhold membership; deny page; share again | NOT ATTEMPTED | | |
| Organiser withdraws approval; deny next page request | NOT ATTEMPTED | | |
| Approve again; connect; disconnect; deny access | NOT ATTEMPTED | | |
| Explicitly link an existing subscriber; preserve account | NOT ATTEMPTED | | |

## Understanding

Write the member's answer before explaining it.

What did the website receive and not receive?

Who can see connections across websites?

Where would you change sharing or disconnect?

What happens to copies already received after access ends?

## Follow-ups

| Observation | Type: setup / wording / site integration / other | Smallest correction | Owner, if agreed |
| --- | --- | --- | --- |
| | | | |

Overall result and remaining blockers:

Do not include emails, client secrets, sign-in codes, keys, cookies or private
member records. Store the completed report privately. This record does not
establish independent security review or production readiness.