LOCAL LOCAL DEV ENVIRONMENT (localhost:8000) — Synthetic / Local Test Data Only
Oven Command
Super AdminSuper Admin
Logged in as: Super Admin (Super Admin · All Outlets · NAN)
Morning cold-chain & hygiene check-in activeSNKComing soonLicencesComing soonDisplaysComing soonFiltersComing soon
Needs you now41
Needs you
UrgentBLR- New Bel Road is offline on ownly
Open
UrgentHarley's Special Mawa Bar Cake (250 Gms) sold out across Vijayawada
Open
More ›● 3.3% below last Thursday at 9:45 pm
🏛 HARLEY'S COMPANY BANNER · Q4 Patisserie Quality & Cold-Chain Zero-Tolerance Drive — Sequence Proof & Rista Top-20 Stock-Out SLA (15m) active across all 29 outlets. Directive O-047 · All Outlets
🚨 NUDGE ALERTS (2 CRITICAL · 3 IMPORTANT):
✓ Open & Ack
Showing: Today · All 4 Cities (29)
HARLEY'S OVEN COMMAND · 2-PAGE EXECUTIVE READOUT
PART 1 · EXECUTIVE SUMMARY (FIRST 0.5 PAGE — ABOVE THE FOLD) PACK B3 · ENABLEMENT REGISTRY, TELEMETRY, VALUE LEDGER & AI GATEWAY

Enablement Registry (EN-01..19), Counts-Only Telemetry, V0–V4 Value Ledger & Zero-PII Slot-Validated AI Gateway (AI-01..12) (PACK B3 · EN-01..19 · AI-01..12 · VALUE-LEDGER V0..V4 · A507/A308 · BO-LEARN · BO-DEMO-USER · BO-BAKEBOT-SIDE · OVERLAP #5 CONSUMER)

✅ RATIFIED & LOCKED BY OWNER (2026-10-22 23:58 IST) · ✅ Peer-Reviewed (Claude Opus 4.7 Max + Codex Astra Extra High) · Fail-Closed Feature Registry with 15m LKG Ceiling · Two-Person Kill Switch · Counts-Only Adoption Telemetry · Atomic IST 20/Day + Spend Budget AI Cap · Row-PK Slot-Bound Figure Validator

1. What We Are Building & Why

  • Fail-Closed Feature Registry, Role-Surface vs Event-Path Split & Two-Person Kill Switch (EN-01..15, A507/A308): setup_registry_enablement governs module rollout across cohorts with a 15-minute last-known-good snapshot ceiling so brief DB blips never blind-kill store tablets. Pausing a UI surface (A507) never pauses background ingestion or critical A308 stock-out alerts (EN-02), and emergency kill switches require a Two-Person Co-Sign Rule (requested_by <> co_signed_by within 15m).
  • Counts-Only Telemetry, 12-Check Pre-Flight, Sandbox /learn & V0–V4 Value Ledger (EN-03, EN-16..19, BO-LEARN, BO-DEMO-USER): hop.adoption_daily stores strictly counts-only usage (zero email, IP, phone, or prompt text); /admin/day-test-ready runs 12 live pre-flight checks (EN-16); /learn provides a 6-step sandbox cohort (EN-17); /walkthrough serves a public zero-PII tour (EN-18); and hop.value_ledger tracks every feature from V0 Idea → V1 Built → V2 Enabled → V3 Used (1x) → V4 Outcome Banked (2x).
  • Zero-PII Allowlisted AI Gateway & Row-PK Slot-Bound Figure Validator (AI-01..12, BO-BAKEBOT-SIDE, Overlap #5 Consumer): Outbound serializer restricts LLM context strictly to ai_outbound_allowlist schema fields (bucket/ratio/rank/enum with k_floor ≥ 3) plus multi-script digit/PII stripping; enforces an atomic IST 20 calls/day + token spend budget reservation (ai_cost_counter); validates every numeric literal and dimensional phrase against ai_response_fact(source_row_pk, source_dimension_fingerprint) (AI-05); and falls back to a deterministic SQL sentence (AI-06) on any mismatch.

2. Personas & Access Scope

  • Owner / Product & Ops Leadership: Tracks V0 → V4 Value Ledger conversion, runs the 12-check /admin/day-test-ready gate before pilot expansion, and queries <BakeBotDrawer> with 100% fact-grounded numbers.
  • Super Admins (Two-Person Rule): Manage progressive cohort enablement (PILOT_5 → CITY → ALL) and co-sign emergency kill switches (EN-15).
  • New Store Crew & External Stakeholders: Practice daily workflows safely in /learn (BO-LEARN) and explore synthetic zero-PII demos in /walkthrough (BO-DEMO-USER).

3. Right-Side Stage-Aware Owner Sign-Off Box

  • Approve EN-01..15 Fail-Closed Feature Registry & Two-Person Kill Switch: 15-minute LKG snapshot resilience, A507/A308 UI-surface vs event-pipeline separation, and mandatory 2-person co-sign on kill switches.
  • Approve EN-03, EN-16..19 Counts-Only Telemetry, Pre-Flight & Value Ledger: Zero-PII hop.adoption_daily, 12-check /admin/day-test-ready page, /learn sandbox, zero-PII /walkthrough, and V0 → V4 Value Ledger.
  • Approve AI-01..12 Zero-PII AI Gateway & Slot-Bound Figure Validator: Outbound schema allowlist + k-anonymity ≥ 3, atomic IST 20/day + token budget cap, row-PK ai_response_fact validator, deterministic SQL fallback, and 400d/180d retention probe.
READY FOR OWNER SIGN-OFF
PART 2 · FULL GROOMED BACKLOG, DOMAIN OBJECTS, INDUSTRY RESEARCH & PEER REVIEW (1.5 PAGES) Zero Orphans · Domain Handshakes · State Machines · Claude Opus 4.7 Max + Codex Astra Extra High Verdict

2A. Core User Journeys & Groomed Functional Intake Rules

Journey / Capability Persona & Trigger System Action & Hard Gate Rule
EN-J01 (EN-01..02, EN-16) · 12-Check Pre-Flight & Progressive Cohort EnablementOps Director opens /admin/day-test-ready before enabling a module for HyderabadExecutes 12 live readiness checks (Rista sync <15m, Kiosks online, Shift windows seeded, Hindi reviewer verified, etc.). Toggling UI surface OFF for a role (A507) leaves event ingestion and A308 stock-out alerts 100% active.
EN-J02 (EN-17..19, BO-LEARN, BO-DEMO-USER) · Crew Sandbox Practice & V0->V4 Value ProgressionNew barista completes 6-step /learn cohort; Value Ledger evaluates daily adoptionAll /learn actions write to isolated sandbox partition. Nightly job aggregates counts-only hop.adoption_daily; when >=70% of enabled outlets use a feature daily, stage advances V2 -> V3, and 2-week KPI improvement advances V3 -> V4.
AI-J03 (AI-01..10, BO-BAKEBOT-SIDE) · Slot-Validated BakeBot Query with Deterministic FallbackCity Head asks BakeBot: 'Compare Banjara Hills and Jubilee Hills Net Sales today'Atomically reserves 1 call and token budget in ai_cost_counter (IST day). Serializes only allowlisted OV-1 facts (k >= 3). Validator checks every number and outlet label against ai_response_fact(source_dimension_fingerprint); if the LLM swaps Banjara and Jubilee numbers, serves deterministic SQL sentence.

2B. Underlying Domain Objects & Cross-Module Handshake

ENABLEMENT REGISTRY, COUNTS-ONLY TELEMETRY, VALUE LEDGER & ZERO-PII AI GATEWAY (PACK B3): [setup_registry_enablement (15m LKG Snapshot)] --(A507 UI Surface vs A308 Event Pipeline Split + Two-Person kill_switch_action)--> +-- [/admin/day-test-ready (12 Checks)] + [/learn 6-Step Sandbox (BO-LEARN)] + [/walkthrough Public Zero-PII Tour (BO-DEMO-USER)] +-- [hop.adoption_daily (Zero-PII Counts Only)] ==> [hop.value_ledger (V0 Idea -> V1 Built -> V2 Enabled -> V3 Used -> V4 Banked)] ==> [Zero-PII AI Gateway (ai_live)]: Atomic IST ai_cost_counter (20/day + token cap) -> ai_outbound_allowlist (k>=3) -> Row-PK Slot-Bound Validator (ai_response_fact) -> Deterministic SQL Fallback Sentence (AI-06)
Domain Object (Table / View) PK & Tenant Scope Core Attributes & Constraints Cross-Object Handshake
setup_registry_enablement & kill_switch_action (EN-01..15)(feature_key, role_code, outlet_cohort) PKSeparates ui_surface_enabled from event_pipeline_enabled; 15m snapshot_valid_until; kill switch requires requested_by <> co_signed_by within 15m.Prevents single-admin sabotage and ensures UI toggles never silence A308 stock-out alerts.
hop.adoption_daily & hop.value_ledger (EN-03, EN-19)(day_ist, outlet_code, role_code, feature_key, event_type) PKStores integer event_count only (zero PII columns); tracks V0..V4 stage timestamps and baseline vs banked KPI values.Proves which built features actually deliver store adoption (V3) and P&L impact (V4).
ai_cost_counter & ai_outbound_allowlist (AI-02..04)(user_id, day_ist) PK / field_path PKAtomic ON CONFLICT counter capping calls_count <= 20 and token_budget_inr per IST day; allowlist enforces dtype in ('bucket','ratio','rank','enum') and k_floor >= 3.Eliminates concurrent race conditions on AI spend and blocks raw free-text PII egress.
ai_response_fact (AI-05, Overlap #5 Consumer)(response_id, slot_label) PKBinds number_value, metric_code (OV-1), source_query_sha, source_row_pk, and source_dimension_fingerprint.Blocks both hallucinated numbers and same-magnitude outlet/slot swaps in LLM prose.

2C. State Machines & Operational Scale Guardrails

Value Ledger Lifecycle (EN-19 V0 -> V4)

V0_GROOMED → V1_BUILT (Merged & Gated) → V2_ENABLED (Live in Cohort) → V3_USED (≥1x/day Adoption) → V4_BANKED (2-Week Verified KPI Improvement).

AI Request & Slot-Bound Validation Pipeline (AI-01..06)

ATOMIC_BUDGET_RESERVE (IST Day) → ALLOWLIST_SERIALIZE (k≥3) → LLM_DRAFT → ROW_PK_SLOT_VALIDATOR → Pass: RENDER_WITH_CITATIONS | Fail/Timeout/429: DETERMINISTIC_SQL_SENTENCE.

Registry Outage Resilience (EN-01)

LIVE_DB_READ → If DB unreachable: SERVE_LKG_SNAPSHOT (≤15m) → After 15m: SAFE_DEFAULT_MODE (Never blind-off for ground check-in).

Retention Prune Readiness Enforcement (AI-11..12)

Daily pruner deletes aggregate AI logs >400d and PII-adjacent logs >180d; readiness probe fn_ai_retention_check() pages SRE if any expired row exists.

2D. Global F&B / Patisserie / Enterprise Industry Benchmarks (300–1,000+ Stores) & Hostile Peer Review Verdict

Global Industry Benchmark / Peer Reviewer Standard / Gate Adopted How Harley's Operations Platform (HOP) Enforces It
LaunchDarkly / Uber Flipr Ring Deployments at Starbucks (EN-01..16)Ring Cohort Enablement + 12-Check Pre-FlightGates every store rollout behind /admin/day-test-ready and separates UI surface switches from background event pipelines.
Stripe & Adyen Privacy-By-Design Telemetry (EN-03)Write-Time Counts-Only AggregationEliminates DPDP Act PII liability by aggregating usage into (day_ist, outlet_code, role_code, feature_key, count) with zero personal identifiers.
Claude Opus 4.7 Max & Codex Astra Extra High Peer ReviewAllowlist Serializer + Atomic IST Cap + Row-PK Slot FingerprintFolds in all hostile review fixes (/tmp/peer_review_pack_b1_b6.txt): replaces regex-only redaction with ai_outbound_allowlist, enforces atomic ON CONFLICT IST caps (calls + spend), prevents Bandra/Juhu slot swaps via source_dimension_fingerprint, and requires 2-person kill-switch co-signing.

2F. Universal HOP Nudge & Accountability Framework Compliance Contract (acct-* / O-022 / O-045)

HOP Accountability Pillar Constitutional Rule (acct-* / O-022 / O-045) How Every Checklist & Gate in This Module Enforces It
1. Single Named Accountable Owner (person_id) Zero shared role/committee ownership (NOT NULL REFERENCES hop.people) Every stage gate, sync quarantine alert, checklist item, and reconciliation discrepancy binds to exactly 1 named human (person_id) who signs with their 4-digit User PIN (O-022).
2. Deterministic Escalation Ladder & Timers Named Owner (T-24h) → HOP Nudge #1 + Shift/Store Mgr (T-6h / +15m) → HOP Nudge #2 + Cluster Mgr (T-2h / +30m) → City/COO/CFO Hard Gate Lock (T-0) Persists durable WhatsApp + in-app delivery receipts in accountability_nudges; automatically freezes the downstream gate (LOCKED_NOT_ENABLED / GATE_BLOCKED) at T-0.
3. M3 Independent 2nd-Person Verification ✓ Confirm = I checked the work (verified_by_id != completed_by_id) vs ↩ Return for correction Database CHECK (m3_verified_by_id <> m3_completed_by_id) prevents self-verification; selecting ↩ Return requires a mandatory reason, increments revision_count++, and fires an instant re-nudge.
4. Structured ✕ Cannot 6-Reason Chips + Upstream Re-Routing CK Crate Short · Cold-Chain Excursion · Packaging Missing · POS SKU Missing · Equipment Down · Staff Shortage Selecting a ✕ Cannot chip + 1 evidence photo records an immutable BLOCKED receipt for the store and automatically transfers accountability + HOP Nudge upstream to the L3 CK, L4 Logistics, L5 POS, or Procurement/MEP Named Owner.
5. Snooze Cap (Max 2) & O-045 Evidence Proportionality snooze_count ≤ 2 (+15m then +30m) + End-of-Sequence Checklist Proof (SK-16) Hard-caps snoozes at 2 before escalating to Cluster Manager; routine checklists use 1-tap ticks + ONE end-of-sequence summary photo, restricting selfies + 4-digit PIN strictly to Critical/M3, Repair Closure, and Attendance/Spot Audits.
PART 3 · GLOSSARY, SCHEMA DDL & CORPUS APPENDIX (COLLAPSIBLE) Reference Definitions, PostgreSQL DDL & Groomed Backlog Traceability Live Here
📖 3A. Domain Glossary & Canonical Definitions
Term / CodeCanonical Definition in Harley's Operations Platform (HOP)
Role-Surface vs Event-Path Split (EN-02, A507/A308)Disabling a screen for a user role hides only the UI view while keeping background POS syncs and critical stock-out alerts running.
Value Ledger (V0..V4, EN-19)5-stage feature accountability tracker measuring progression from V1 Built to V3 Used (1x) and V4 Business Outcome Banked (2x).
Slot-Bound Figure Validator (AI-05)Post-generation verifier ensuring every number in an AI response matches both the SQL value and the exact dimensional fingerprint (outlet, date, metric) of its surrounding phrase.
k-Anonymity Floor (AI-04)Privacy rule refusing any AI summary over an employee or customer group smaller than 3 people.
🗄️ 3B. PostgreSQL Schema DDL & Integrity Constraints
-- PACK B3 DDL: ENABLEMENT REGISTRY, VALUE LEDGER & ZERO-PII AI GATEWAY
CREATE SCHEMA IF NOT EXISTS hop;

CREATE TABLE IF NOT EXISTS setup_registry_enablement (
    feature_key             VARCHAR(80) NOT NULL,
    role_code               VARCHAR(40) NOT NULL DEFAULT 'ALL',
    outlet_cohort           VARCHAR(40) NOT NULL DEFAULT 'ALL',
    ui_surface_enabled      BOOLEAN NOT NULL DEFAULT FALSE,
    event_pipeline_enabled  BOOLEAN NOT NULL DEFAULT TRUE,
    snapshot_valid_until    TIMESTAMPTZ NOT NULL DEFAULT (NOW() + INTERVAL '15 minutes'),
    PRIMARY KEY (feature_key, role_code, outlet_cohort)
);

CREATE TABLE IF NOT EXISTS kill_switch_action (
    id                  BIGSERIAL PRIMARY KEY,
    switch_name         VARCHAR(64) NOT NULL,
    requested_by        BIGINT NOT NULL REFERENCES users(id),
    requested_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    co_signed_by        BIGINT NOT NULL REFERENCES users(id),
    co_signed_at        TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    active              BOOLEAN NOT NULL DEFAULT TRUE,
    CHECK (co_signed_by <> requested_by),
    CHECK (co_signed_at BETWEEN requested_at AND requested_at + INTERVAL '15 minutes')
);

CREATE TABLE IF NOT EXISTS ai_cost_counter (
    user_id             BIGINT NOT NULL REFERENCES users(id),
    day_ist             DATE NOT NULL DEFAULT ((NOW() AT TIME ZONE 'Asia/Kolkata')::DATE),
    calls_count         INTEGER NOT NULL DEFAULT 0 CHECK (calls_count BETWEEN 0 AND 20),
    spend_paise         INTEGER NOT NULL DEFAULT 0 CHECK (spend_paise BETWEEN 0 AND 5000),
    PRIMARY KEY (user_id, day_ist)
);

CREATE TABLE IF NOT EXISTS ai_response_fact (
    response_id                     UUID NOT NULL,
    slot_label                      VARCHAR(120) NOT NULL,
    number_value                    NUMERIC(14,2) NOT NULL,
    source_query_sha                BYTEA NOT NULL,
    source_row_pk                   JSONB NOT NULL,
    source_dimension_fingerprint    BYTEA NOT NULL,
    PRIMARY KEY (response_id, slot_label)
);
📂 3C. Source Corpus Mapping & Groomed Backlog Verification Evidence
Source Folder / ArtifactGroomed Item IDs (Zero Orphans)Target Domain ObjectStatus
pkg4 / 04-ENABLEMENT-TELEMETRY-AND-WALKTHROUGH.mdEN-01..EN-19, VALUE-LEDGER V0..V4, A507, A308, BO-LEARN, BO-DEMO-USERsetup_registry_enablement, kill_switch_action, hop.adoption_daily, hop.value_ledger100% GROOMED & MAPPED
pkg1 / 01-AI-INTEGRATION-SPEC.mdAI-01..AI-12, BO-BAKEBOT-SIDE, Overlap #5 Consumerai_cost_counter, ai_outbound_allowlist, ai_response_fact, fn_ai_retention_check100% GROOMED & MAPPED
02-BUILT-AND-BACKLOG.mdA167, A209, A288, A310, A412, A508, S194Consolidated into Enablement & AI Gateway schema100% GROOMED & MAPPED

Adversarial Peer-Review Evidence: Verified via headless Claude Opus 4.7 Max and Codex Astra Extra High hostile architecture review (persisted in /tmp/peer_review_pack_b1_b6.txt); 100% of backlog IDs mapped with zero orphans.