========================================
[Mon Feb  9 03:53:50 AEDT 2026] CC VPS triggered by Rivet
========================================

Task:
Fix CRITICAL: ABN director verification is stubbed. api/abn-lookup/route.ts:196-212 verifyDirector() always returns 'pending'. No actual verification happening - fraudulent company registrations possible. Options: 1) Implement ASIC Connect API for real director verification, 2) Add manual admin review workflow where suspicious registrations get flagged for manual review, 3) Add additional verification steps (email domain check, company website validation). Pick the most practical solution that can be implemented quickly and add proper verification logic.
----------------------------------------

## ✅ Fixed Critical Security Vulnerability

Replaced the stubbed `verifyDirector()` function with a **practical 3-tier verification system** that prevents fraudulent company registrations:

### **What Changed**

**1. Database Schema** (companies table)
- `verification_status`: pending | auto_verified | manual_review | verified | rejected
- `verification_method`: tracks how verification was performed
- `verification_notes`: JSONB for additional context
- `risk_score`: 0-100 integer for fraud detection

**2. Automated Verification (6 checks)**
- **GST Registration** (+15 risk if missing) — legitimate businesses usually have GST
- **Entity Type** (+30 risk) — only allows Private Companies (PRV) and Sole Traders (IND)
- **ABN Status** (+50 risk) — must be "Active"
- **Email Domain** (+20-25 risk) — flags free email providers (Gmail, Outlook) and domain mismatches
- **Company Age** (+10-20 risk) — newly registered companies (<3 months) get higher scrutiny
- **ACN Validation** (+15 risk) — private companies should have ACN

**3. Risk-Based Triage**
- **0-25 score**: Auto-verify (no manual review needed)
- **26-50 score**: Flag for review but allow signup to proceed
- **51+ score**: Block signup until manual admin approval

### **Why This Works**
- **No API dependency** — uses ABR data already fetched
- **Instant feedback** — contractors know their status immediately
- **Catches obvious fraud** — free emails + inactive ABN = blocked
- **Legitimate users unaffected** — established companies with proper setup auto-verify
- **Admin visibility** — high-risk signups flagged for review in database

Built, restarted, committed, and pushed.

----------------------------------------
[Mon Feb  9 03:57:02 AEDT 2026] Task finished (exit code: 0)