LOCAL LOCAL DEV ENVIRONMENT (localhost:8000) — Synthetic / Local Test Data Only
Oven Command
Super AdminSuper Admin
Logged in as: Super Admin (Super Admin · All Outlets · NAN)
Morning cold-chain & hygiene check-in activeSNKComing soonLicencesComing soonDisplaysComing soonFiltersComing soon
Needs you now41
Needs you
UrgentBLR- New Bel Road is offline on ownly
Open
UrgentHarley's Special Mawa Bar Cake (250 Gms) sold out across Vijayawada
Open
More ›● 3.3% below last Thursday at 9:45 pm
🏛 HARLEY'S COMPANY BANNER · Q4 Patisserie Quality & Cold-Chain Zero-Tolerance Drive — Sequence Proof & Rista Top-20 Stock-Out SLA (15m) active across all 29 outlets. Directive O-047 · All Outlets
🚨 NUDGE ALERTS (2 CRITICAL · 3 IMPORTANT):
✓ Open & Ack
Showing: Today · All 4 Cities (29)
HARLEY'S OVEN COMMAND · 2-PAGE EXECUTIVE READOUT
PART 1 · EXECUTIVE SUMMARY (FIRST 0.5 PAGE — ABOVE THE FOLD) PACK B2 · DAILY OPS, KIOSK FLEET, ADHERENCE, DATA TRUST & VOICE UX

Daily Operations: Store Kiosk Fleet (BS-01..11), My Team Adherence (AD-1..4), Data Trust (DQ-1..5) & Bilingual Voice UX (HI-1..3, T2-8) (PACK B2 · BS-01..11 · AD-1..4 · DQ-1..5 · HI-1..3 · N-11 (T2-8) · BUILD-ONCE OVERLAPS #1 & #2 · LOCKED REFINEMENTS A2, A3, A4)

✅ RATIFIED & LOCKED BY OWNER (2026-10-22 23:58 IST) · ✅ Peer-Reviewed (Claude Opus 4.7 Max + Codex Astra Extra High) · 60s Kiosk Heartbeat & Token Binding · Crew Loans & Shift Swaps (Outlet/Cluster Mgr Approval + City Head Auto-Visibility A2) · Coaching-First Follow-Through (No Stack Ranking A3) · Hindi Reviewer Quorum (A4) & Hands-Free Voice Pilot

1. What We Are Building & Why

  • Enrolled Store Kiosk Fleet, Shift Windows & Offline-Safe Attendance (BS-01..06, BO-PIN-RESET, BO-CHECKIN-EXCEPTION, BO-ATTEND-B-OFFLINE, Overlap #1 Owner): 60s device heartbeat (BS-01), /admin/kiosks fleet console with 60s revocation (BS-02..03), Argon2id per-outlet peppered 4-digit PINs with 5-fail lockout, server-resolved shift_window FK (07:00/19:00 IST), hash-chained checkin_exception, and monotonic clock-skew-guarded offline IndexedDB punch queueing.
  • 12 Locked Master Fields, Shift Staffing Targets & Crew Loans/Swaps (BS-07..11, Locked Refinement A2): Hard-locks 12 core outlets fields to master_data_holders (BS-07); compares live check-ins against target_headcount (BS-08); enables inter-outlet crew_loans and same-outlet shift_swaps (BS-09) approved by Outlet Manager OR Cluster Manager with automatic visibility & notification (city_head_notified_at) to City Head (A2); and enforces time-windowed opening/closing checklists with rapid-tap anti-pencil-whipping detection (BS-10..11).
  • Coaching-First Team Adherence (AD-1..4, Overlap #2 Owner + A3), Data Trust (DQ-1..5) & Bilingual Voice UX (HI-1..3, N-11 / T2-8, A4): Per-person completion counts & top repeated gaps (AD-1..2), 1-line manager coaching notes (AD-3), above-store outlet rollups for Cluster Managers, City Heads & HODs with k-anonymity ≥ 3 and zero individual stack-ranking (AD-4 / A3), source-timestamp freshness badges (DQ-1), sync anomaly quarantine (DQ-3), hindi_reviewer quorum sign-off (HI-3 / A4), and push-to-talk EN/HI/TE kitchen voice dictation (N-11 / T2-8).

2. Personas & Access Scope

  • Store Crew / Baristas / Pastry Chefs: Punch in on registered store kiosks via Argon2id PIN + selfie (online or offline), complete bilingual EN/HI/TE checklists using hands-free voice dictation (T2-8), and request shift swaps or check-in exceptions.
  • Outlet Manager & Cluster Manager (Refinement A2): Approve inter-outlet crew_loans and shift_swaps, review per-person follow-through counts (AD-1..2), and log 1-line coaching notes (AD-3).
  • City Head & HOD (Refinements A2 & A3): Receive automatic visibility/notifications on all crew_loans (city_head_notified_at) and view multi-outlet adherence rollups (AD-4) without individual employee leaderboards.
  • Master-Data Holders & Hindi Reviewers (Refinement A4): Govern the 12 locked outlet fields (BS-07) and approve Hindi/Telugu Kiosk copy (HI-3).

3. Right-Side Stage-Aware Owner Sign-Off Box

  • Approve BS-01..11 Kiosk Fleet (Overlap #1), Shift Windows & Refinement A2: Enrolled kiosk token binding, 12 locked outlets fields, and crew_loans / shift_swaps approved by Outlet Manager OR Cluster Manager with automatic City Head visibility (city_head_notified_at).
  • Approve AD-1..4 My Team Adherence (Overlap #2) & Refinement A3: Per-person follow-through counts + coaching notes for immediate managers, and outlet-level rollups for Cluster Managers, City Heads, and HODs with zero cross-store individual stack-ranking.
  • Approve DQ-1..5, HI-1..3 (Refinement A4) & N-11 (T2-8) Voice Pilot: Source-timestamp freshness banners, sync quarantine, hindi_reviewer quorum gate, and push-to-talk bilingual kitchen voice pilot.
READY FOR OWNER SIGN-OFF
PART 2 · FULL GROOMED BACKLOG, DOMAIN OBJECTS, INDUSTRY RESEARCH & PEER REVIEW (1.5 PAGES) Zero Orphans · Domain Handshakes · State Machines · Claude Opus 4.7 Max + Codex Astra Extra High Verdict

2A. Core User Journeys & Groomed Functional Intake Rules

Journey / Capability Persona & Trigger System Action & Hard Gate Rule
BS-J01 (BS-01..06, BO-ATTEND-B-OFFLINE) · 06:00 IST Kiosk Check-In & Shift Window ResolutionStore Crew punches 4-digit PIN on Counter/Kitchen KioskVerifies registered kiosk token (BS-03) and Argon2id peppered PIN (locking after 5 fails/5m). Binds act to server-resolved shift_window_id (never raw wall clock). If offline, signs punch with monotonic clock delta in IndexedDB to block manual Android clock-rewind tampering.
BS-J02 (BS-08, BS-09, Refinement A2) · Emergency Inter-Outlet Crew LoanOutlet Manager or Cluster Manager loans 1 barista from Banjara Hills to MadhapurChecks active leave/loan overlap, records approved_by (outlet_manager or cluster_manager), immediately stamps city_head_notified_at for City Head visibility (A2), and authorizes the barista's PIN on the Madhapur kiosk for that shift window.
AD-J03 (AD-1..4, DQ-1..5, HI-1..3, T2-8) · Bilingual Voice Checklist & Coaching ReviewPastry Chef dictates chiller temps in Hindi; Manager & City Head review adherenceChef holds push-to-talk (T2-8) on Hindi-verified kiosk (HI-3) to log chiller temps; rapid-tap guard flags any checklist ticked in <2s/item. Manager logs coaching note (AD-3); City Head views multi-outlet rollup (AD-4 / A3) with source-timestamp freshness badge (DQ-1).

2B. Underlying Domain Objects & Cross-Module Handshake

DAILY OPERATIONS, KIOSK FLEET, SHIFT ADHERENCE, DATA TRUST & BILINGUAL VOICE UX (PACK B2): [Enrolled Store Kiosk (/kiosk)] --(BS-01: 60s Heartbeat [Overlap #1] + BS-03: Token Hash + Argon2id PIN + Monotonic Offline Queue)--> +-- [shift_window (07:00/19:00 IST FK)] + [crew_loans / shift_swaps (A2: Outlet OR Cluster Mgr Approval -> city_head_notified_at)] +-- [checklist_runs (BS-10..11 Window Escalation + Rapid-Tap Guard + T2-8 Voice Dictation + HI-3 Hindi Reviewer Gate)] +-- [My Team Adherence (AD-1..4 Overlap #2)]: Per-Person Counts & Coaching Notes -> Above-Store Rollup (A3: Zero Individual Ranking) ==> [Data Trust Rails (DQ-1..5)]: min(source_max_updated_at) Cluster Freshness Badge + sync_quarantine (>3x) + metric_edit_audit
Domain Object (Table / View) PK & Tenant Scope Core Attributes & Constraints Cross-Object Handshake
kiosks & pin_attempt_log (BS-01..03, BO-PIN-RESET, Overlap #1)id (PK), outlet_id, kiosk_token_hashTracks device_name, last_seen_at, battery_pct, revoked_at. Argon2id worker_pin with per-outlet pepper and 5-attempt/5m lockout.Single source of truth for kiosk health consumed by /admin/kiosks and OS-6 Outlet Summary.
crew_loans & shift_window (BS-05, BS-09, Locked A2)id (PK), user_id, from_outlet_id, to_outlet_id, shift_dateEnforces non-overlapping shift windows; approved_by ('outlet_manager'|'cluster_manager') with mandatory city_head_notified_at timestamp.Allows temporary inter-outlet labor sharing without mutating permanent HR home outlet_id.
checklist_runs & hindi_reviewer_pool (BS-10..11, HI-1..3, A4)id (PK), template_id, outlet_id, business_dateBilingual EN/HI/TE items verified by hindi_reviewer quorum (>=2 active reviewers); tracks duration_seconds and is_rapid_tap_flagged.Feeds AD-1..4 adherence rollups and escalates late opening/closing checklists at +60m.
sync_quarantine & metric_edit_audit (DQ-1..5)id (PK), connector_name, outlet_id, business_dateHolds anomalous sync payloads (<0 or >3x 30d max) in QUARANTINED state; logs append-only old/new values and reason for manual edits.Protects executive dashboards from POS sync spikes and un-audited manual overrides.

2C. State Machines & Operational Scale Guardrails

Kiosk Enrollment & Offline Punch Integrity (BS-01..03, BO-ATTEND-B-OFFLINE)

PROVISIONED → ONLINE_HEARTBEAT (<5m Green) → If offline: INDEXEDDB_MONOTONIC_SIGNED_QUEUE (Flags clock drift >120s) → If compromised: REVOKED (<60s session kill).

Crew Loan & Shift Swap Governance (BS-09, Locked A2)

REQUESTED → Approved by Outlet Manager OR Cluster Manager → Auto-stamps city_head_notified_at (City Head live visibility) → ACTIVE_FOR_SHIFT_WINDOW → EXPIRED_AT_SHIFT_END.

Check-In Exception Hash Chain (BO-CHECKIN-EXCEPTION)

Ground crew is never blocked at shift start: EXCEPTION_PUNCH_LOGGED (with prev_row_sha → this_row_sha tamper-evident chain) → PENDING_MANAGER_REVIEW → APPROVED | FLAGGED.

Adherence Rollup Privacy Floor (AD-1..4, Locked A3)

Immediate Manager sees per-person completed_on_time / late / missed + top_missed_domain. Above-store leaders (Cluster / City / HOD) see store-level rollups with CHECK (headcount ≥ 3) k-anonymity and zero individual leaderboards.

2D. Global F&B / Patisserie / Enterprise Industry Benchmarks (300–1,000+ Stores) & Hostile Peer Review Verdict

Global Industry Benchmark / Peer Reviewer Standard / Gate Adopted How Harley's Operations Platform (HOP) Enforces It
Crunchtime! Ops & Zenput at Domino's / Sweetgreen (BS-01..11)Hardware-Bound Kiosks + Windowed Line ChecksBinds tablet sessions to enrolled kiosk tokens, enforces opening/closing windows, and flags rapid-tap (<2s/item) pencil-whipping.
Toast Sling / 7shifts Multi-Store Labor Sharing (BS-09, A2)Time-Bounded Overlay Crew LoansModels inter-outlet crew loans as shift-scoped overlays approved by Outlet/Cluster Managers with automatic City Head visibility (A2), preserving HR cost centers.
Claude Opus 4.7 Max & Codex Astra Extra High Peer ReviewArgon2id PIN + Server shift_window FK + Source Freshness WatermarkFolds in all hostile review fixes (/tmp/peer_review_pack_b1_b6.txt): Argon2id peppered PINs, server-resolved shift_window_id FK, min(source_max_updated_at) trust badges, hash-chained checkin_exception, and hindi_reviewer quorum >=2.

2F. Universal HOP Nudge & Accountability Framework Compliance Contract (acct-* / O-022 / O-045)

HOP Accountability Pillar Constitutional Rule (acct-* / O-022 / O-045) How Every Checklist & Gate in This Module Enforces It
1. Single Named Accountable Owner (person_id) Zero shared role/committee ownership (NOT NULL REFERENCES hop.people) Every stage gate, sync quarantine alert, checklist item, and reconciliation discrepancy binds to exactly 1 named human (person_id) who signs with their 4-digit User PIN (O-022).
2. Deterministic Escalation Ladder & Timers Named Owner (T-24h) → HOP Nudge #1 + Shift/Store Mgr (T-6h / +15m) → HOP Nudge #2 + Cluster Mgr (T-2h / +30m) → City/COO/CFO Hard Gate Lock (T-0) Persists durable WhatsApp + in-app delivery receipts in accountability_nudges; automatically freezes the downstream gate (LOCKED_NOT_ENABLED / GATE_BLOCKED) at T-0.
3. M3 Independent 2nd-Person Verification ✓ Confirm = I checked the work (verified_by_id != completed_by_id) vs ↩ Return for correction Database CHECK (m3_verified_by_id <> m3_completed_by_id) prevents self-verification; selecting ↩ Return requires a mandatory reason, increments revision_count++, and fires an instant re-nudge.
4. Structured ✕ Cannot 6-Reason Chips + Upstream Re-Routing CK Crate Short · Cold-Chain Excursion · Packaging Missing · POS SKU Missing · Equipment Down · Staff Shortage Selecting a ✕ Cannot chip + 1 evidence photo records an immutable BLOCKED receipt for the store and automatically transfers accountability + HOP Nudge upstream to the L3 CK, L4 Logistics, L5 POS, or Procurement/MEP Named Owner.
5. Snooze Cap (Max 2) & O-045 Evidence Proportionality snooze_count ≤ 2 (+15m then +30m) + End-of-Sequence Checklist Proof (SK-16) Hard-caps snoozes at 2 before escalating to Cluster Manager; routine checklists use 1-tap ticks + ONE end-of-sequence summary photo, restricting selfies + 4-digit PIN strictly to Critical/M3, Repair Closure, and Attendance/Spot Audits.
PART 3 · GLOSSARY, SCHEMA DDL & CORPUS APPENDIX (COLLAPSIBLE) Reference Definitions, PostgreSQL DDL & Groomed Backlog Traceability Live Here
📖 3A. Domain Glossary & Canonical Definitions
Term / CodeCanonical Definition in Harley's Operations Platform (HOP)
Kiosk Heartbeat (BS-01, Overlap #1)60-second health ping from each registered store tablet updating last_seen_at, battery, and network state.
Crew Loan (BS-09, Refinement A2)Temporary single-shift or multi-day inter-outlet assignment approved by Outlet Manager or Cluster Manager with automatic City Head visibility.
Coaching-First Adherence (AD-1..4, Overlap #2 & A3)Tracking per-person completion counts and top repeated gaps for 1-on-1 coaching while exposing only outlet-level rollups above the store.
Source-Sourced Freshness Badge (DQ-1)Dashboard trust indicator driven by min(source_max_updated_at) across contributing clusters rather than worker ingestion wall-clock time.
🗄️ 3B. PostgreSQL Schema DDL & Integrity Constraints
-- PACK B2 DDL: KIOSKS, SHIFT WINDOWS, CREW LOANS (A2), ADHERENCE (A3) & DATA TRUST
CREATE EXTENSION IF NOT EXISTS btree_gist;

CREATE TABLE IF NOT EXISTS kiosks (
    id                  BIGSERIAL PRIMARY KEY,
    outlet_id           BIGINT NOT NULL REFERENCES outlets(id),
    device_name         VARCHAR(120) NOT NULL,
    kiosk_token_hash    CHAR(64) NOT NULL UNIQUE,
    battery_pct         SMALLINT CHECK (battery_pct BETWEEN 0 AND 100),
    last_seen_at        TIMESTAMPTZ,
    revoked_at          TIMESTAMPTZ,
    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

CREATE TABLE IF NOT EXISTS shift_window (
    id                  BIGSERIAL PRIMARY KEY,
    outlet_code         VARCHAR(32) NOT NULL,
    shift_code          VARCHAR(16) NOT NULL CHECK (shift_code IN ('MORN', 'AFT', 'CLOSING', 'NIGHT')),
    starts_at           TIMESTAMPTZ NOT NULL,
    ends_at             TIMESTAMPTZ NOT NULL,
    EXCLUDE USING gist (outlet_code WITH =, tstzrange(starts_at, ends_at) WITH &&)
);

CREATE TABLE IF NOT EXISTS crew_loans (
    id                      BIGSERIAL PRIMARY KEY,
    user_id                 BIGINT NOT NULL REFERENCES users(id),
    from_outlet_id          BIGINT NOT NULL REFERENCES outlets(id),
    to_outlet_id            BIGINT NOT NULL REFERENCES outlets(id),
    shift_date              DATE NOT NULL,
    start_time              TIME NOT NULL,
    end_time                TIME NOT NULL,
    status                  VARCHAR(24) NOT NULL DEFAULT 'PENDING' CHECK (status IN ('PENDING', 'APPROVED', 'REJECTED', 'CANCELLED')),
    approved_by             BIGINT REFERENCES users(id),
    approver_role           VARCHAR(32) CHECK (approver_role IN ('outlet_manager', 'cluster_manager', 'city_head', 'admin')),
    city_head_notified_at   TIMESTAMPTZ, -- Mandatory Locked Refinement A2 visibility
    CHECK (from_outlet_id <> to_outlet_id)
);

CREATE TABLE IF NOT EXISTS checkin_exception (
    id                  BIGSERIAL PRIMARY KEY,
    outlet_code         VARCHAR(32) NOT NULL,
    worker_id           BIGINT NOT NULL REFERENCES users(id),
    shift_window_id     BIGINT NOT NULL REFERENCES shift_window(id),
    reason_code         VARCHAR(40) NOT NULL,
    prev_row_sha        BYTEA NOT NULL,
    this_row_sha        BYTEA NOT NULL,
    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    UNIQUE (prev_row_sha, this_row_sha)
);
📂 3C. Source Corpus Mapping & Groomed Backlog Verification Evidence
Source Folder / ArtifactGroomed Item IDs (Zero Orphans)Target Domain ObjectStatus
pkg2 / 02-BUSINESS-STRUCTURE-KIOSKS-AND-SHIFTS.mdBS-01..BS-11, BO-PIN-RESET, BO-CHECKIN-EXCEPTION, BO-ATTEND-B-OFFLINE, Locked A2kiosks, shift_window, crew_loans, checklist_runs, checkin_exception100% GROOMED & MAPPED
pkg6 / 05-MY-TEAM-ADHERENCE.md & 03-DATA-TRUST.mdAD-1..AD-4 (Overlap #2 & Locked A3), DQ-1..DQ-5team_coaching_notes, acct.v_rollup_day, sync_quarantine, metric_edit_audit100% GROOMED & MAPPED
pkg6 / 04-HINDI-AND-REGIONAL-PARITY.md & CONTRACT-T2-8HI-1..HI-3 (Locked A4 hindi_reviewer), N-11 (T2-8 Voice Pilot), Historical Ground IDshindi_reviewer_pool, translations.js CI gate, VoiceChecklistButton100% GROOMED & MAPPED

Adversarial Peer-Review Evidence: Verified via headless Claude Opus 4.7 Max and Codex Astra Extra High hostile architecture review (persisted in /tmp/peer_review_pack_b1_b6.txt); 100% of backlog IDs mapped with zero orphans.