INTAKE-DESIGN-MYTASKS-SELF-DELEGATED-AND-BOT-ENGINE.md

# HARLEY'S FINE BAKING — OWNER EXECUTIVE READOUT (`MyTasks` MODULE)
> **🔒 ✅ RATIFIED & LOCKED BY OWNER (2026-10-22 23:58 IST) — Ratified by `cfo@harleys.com` (Gates A1–A4 100% Locked)**
## `MyTasks` MODULE: SELF-CREATED TASKS, MANAGER DELEGATION & `@OneOps` BOT ENGINE (`MTK-1..14` + `J24`)

- **Document ID:** `INTAKE-DESIGN-MYTASKS-SELF-DELEGATED-AND-BOT-ENGINE`
- **Module Scope:** **Standalone Cross-App Productivity & Delegation Engine (`MTK-1..14`) + Interactive 8-Frame Journey (`J24-mytasks-self-manager-and-bot-engine.html`)**
- **Format Standard:** `O-040` Two-Page Royal Operational Readout (`Part 1: 0.5p Executive Summary + Right-Side Stage-Aware Sign-Off Box` · `Part 2: 1.5p Full Groomed Spec, Industry Research, User Journeys, Domain Objects & Peer-Review Verdict` · `Part 3: Collapsible Glossary & PostgreSQL DDL`)
- **Cross-Module Handshakes:** **HOP Nudge & Accountability Engine (`acct-*` / `O-022` / `O-045`)** · **My Team Follow-Through (`AD-1..4` & Locked Owner Rule `A3`)** · **`@OneOps` Unified Search & Conversational Bot (`O-048` / `T2-9`)** · **Bilingual Voice Engine (`T2-8`)**.

---

## PART 1 — EXECUTIVE SUMMARY (HALF-PAGE) & OWNER SIGN-OFF BOX

### 1.1 Executive Summary (0.5 Page)
In multi-outlet F&B operations scaling from **44 cafés to 1,000+ stores**, structured SOP checklists (`BS-10`) cover recurring daily line checks, but **70% of day-to-day operational follow-ups** (*"Remind me at 4 PM to verify Kokapet Fire NOC renewal"*, *"Ask Priya at NAN to count the Medovik boxes by 3 PM with a photo"*) happen on unsearchable WhatsApp chats or paper sticky notes. Benchmarked against **Linear**, **Things 3 / Todoist Natural-Language Quick-Add**, **Slack `/remind`**, and **Crunchtime / Zenput Ad-Hoc Store Delegation**, **`MyTasks` (`MTK-1..14`)** unifies personal productivity and enterprise delegation in a single engine:
1. **Mode A — Self-Created Tasks (`MyTasks` · `task_origin = 'SELF_CREATED'`, `creator_id == owner_id`, `MTK-1..6`):** Any employee (`L1..L7`) can create a task for themselves in `<5 seconds` with an optional deep-link to any Outlet, Asset, Project, NPL, Licence, or Audit record. Supports **Two Nudge & Accountability Modes**:
   - **Mode A1 — Personal Self-Nudge (`visibility_mode = 'PRIVATE_SELF'` — Default):** Uses the HOP Nudge Engine (`T-2h In-App -> T-30m Push -> T-0 WhatsApp`) to remind **only the creator**. Protected by PostgreSQL Row-Level Security (`FORCE ROW LEVEL SECURITY` where `owner_id = current_user_id`) so managers/super-admins cannot surveil personal reminders, and **never escalates upward or penalizes compliance scores** (*Principle #3: Psychological safety so staff use `MyTasks` instead of hiding paper notes*).
   - **Mode A2 — Committed Deliverable (`visibility_mode = 'TEAM_COMMITTED'`):** 1-tap toggle `"🤝 Commit to Manager / Meeting Action Item"` (`A513`). Enforces a one-way ratchet lock (`TEAM_COMMITTED` cannot be downgraded back to `PRIVATE_SELF`), freezes `committed_due_at`, feeds `My Team` follow-through (`AD-1..4`), and runs the standard upward escalation ladder on breach.
2. **Mode B — Manager-Assigned Tasks for People Under Them (`task_origin = 'MANAGER_ASSIGNED'`, `MTK-7..11`):** Any Manager (`Shift Lead`, `Outlet Manager`, `Cluster Manager`, `City Head`, `HOD`, `Super Admin`) can delegate tasks strictly within their `access.for(user)` management scope (`canManagePerson(actor, target_id)`). Multi-outlet or role assignments automatically **fan out into N single-owner rows (`O-022` invariant)** bound to the named duty manager at each store, guarded by a **Shift Ad-Hoc Task Budget (`<= 8 ad-hoc tasks/shift/worker`)**, with **Proportional Proof (`O-045`: Simple Tick, Live Photo, Numeric Entry, or M3 Verify)** and **`✕ Cannot` 6-Reason Upstream Return**.
3. **Mode C — `@OneOps` Bot, `⌘K` Omnibox & Voice `🔊` Tasking (`task_origin = 'BOT_CREATED'`, `MTK-12..14`):** Natural-language text or speech creates structured drafts with a mandatory **1-Tap Pre-Commit Confirmation Card** (blocking prompt-injection or cross-scope spam) inside the unified 4-tab `/tasks` experience (`390px`, `1024px`, `1440px`).

### 1.2 Right-Side Stage-Aware Owner Sign-Off Box

| Sign-Off Attribute | Current Governance State |
| :--- | :--- |
| **Module / Pack** | `MTK-1..14` — `MyTasks` Self-Created, Manager-Assigned & `@OneOps` Bot Task Engine (`+ J24 Interactive Journey`) |
| **Groomed Scope** | **14 Core Capabilities (`MTK-1..14`) + Hostile Peer-Review RLS, Shift-Budget & Bot-Confirm Invariants** |
| **Stage Gate** | **Stage 1: Intake, Design & DDL Sign-Off** -> Ready for Stage 2 Build Authorization |
| **Peer-Review Verdict** | **PASS WITH HARDENED INVARIANTS** (`Claude Opus 4.7 Max` + `Codex Astra Extra High` — `/tmp/peer_review_mtk_claude.txt`) |
| **Owner Decision (`cfo@harleys.com`)** | `[ ] APPROVE FOR BUILD` · `[ ] APPROVE WITH NOTES` · `[ ] HOLD` |

---

## PART 2 — FULL GROOMED SPECIFICATION, INDUSTRY RESEARCH, USER JOURNEYS & PEER REVIEW (1.5 PAGES)

### 2.1 Complete Groomed Capability Ledger (`MTK-1..14`)

| Item ID | Capability Pillar | Priority & Effort | Governance / Privacy Invariant | Production Engineering Specification & Acceptance Criteria |
| :--- | :--- | :--- | :--- | :--- |
| **`MTK-1..3`** | Unified 4-Tab `/tasks` Hub (`390px / 1024px / 1440px`) | `P0` · `1.0d` | `O-051` Responsive Parity | 4 tabs: `✨ All My Tasks`, `🙋‍♂️ My Self-Tasks (Created by Me)`, `📋 Assigned to Me (SOPs & Manager)`, `📤 Assigned by Me (To My Team)`. Zero horizontal overflow at `320px/390px`. |
| **`MTK-4..5`** | Mode A1: `<5s` Self-Created Task (`PRIVATE_SELF`) | `P0` · `1.0d` | PostgreSQL `FORCE RLS` + Self-Nudge Only | `creator_id = owner_id` and `visibility_mode = 'PRIVATE_SELF'`. Nudge engine fires `T-2h -> T-30m -> T-0` to `owner_id` only (`CHECK (escalated_to_manager_at IS NULL)`). Excluded from `AD-1..4` compliance denominators. |
| **`MTK-6`** | Mode A2: `"🤝 Commit to Manager"` (`TEAM_COMMITTED`) | `P0` · `1.0d` | One-Way Ratchet Trigger + Frozen `committed_due_at` | Toggling `TEAM_COMMITTED` sets `committed_to_manager_id` and freezes `committed_due_at`. Trigger `prevent_commitment_downgrade()` blocks reverting to `PRIVATE_SELF` or silent deletion. |
| **`MTK-7..8`** | Mode B: Scoped Manager-to-Subordinate Delegation | `P0` · `1.5d` | `canManagePerson()` + Shift Budget `<= 8` | Enforces `assigner_role_level > owner_role_level` and active `access.for(user)` scope over target outlet/dept. Enforces `<= 8` open ad-hoc `MANAGER_ASSIGNED` tasks per `(owner_id, shift_window_id)`. |
| **`MTK-9`** | Multi-Outlet / Role Broadcast Fan-Out | `P0` · `1.0d` | `O-022` Single Named Owner per Child Row | Assigning a task to `N` outlets creates 1 `task_broadcasts` parent row and atomically fans out `N` child `mytasks_items` rows, each resolved to the single named duty/outlet manager (`owner_id NOT NULL`). |
| **`MTK-10..11`** | Proportional Proof (`O-045`) & `✕ Cannot` Return | `P0` · `1.0d` | `TICK | PHOTO | NUMBER | M3_VERIFY` + 6 Chips | Supports 4 proof levels (`M3` enforces `m3_verified_by_id <> owner_id`). Selecting `✕ Cannot` + 1 of 6 reason chips excuses the subordinate and routes an upstream blocker to `assigner_id`'s `Needs you` queue. |
| **`MTK-12..13`** | Mode C: `@OneOps` Bot, `⌘K` Omnibox & Voice `🔊` | `P1` · `1.5d` | Pre-Commit Confirmation Card (`bot_draft_token`) | Natural-language parser (`"Remind me..."` or `"Ask Priya at NAN..."`) creates a short-lived `mytasks_bot_drafts` row and renders a UI confirmation card; DB insert into `mytasks_items` requires explicit user tap/confirm. |
| **`MTK-14`** | `My Team` Follow-Through & `A3` Rollup Integration | `P0` · `0.5d` | Overlap #2 Consumer + Locked Rule `A3` | Feeds `TEAM_COMMITTED` and `MANAGER_ASSIGNED` completion counts into `AD-1..4` (`My Team`) and above-store rollups (`Cluster / City / HOD` per `A3` with zero individual stack-ranking). |

### 2.2 Industry Benchmark Research (Personal Productivity Meets Multi-Outlet Ops)
- **Linear & Things 3 / Slack `/remind` (Frictionless `<5s` Capture + Psychological Safety):** Personal task tools succeed when capture takes `<5 seconds` and users trust that jotting down a personal reminder won't be weaponized against them in an HR performance review. Separating `PRIVATE_SELF` (personal self-nudge, RLS-private) from `TEAM_COMMITTED` (`🤝 Commit to Manager`) bridges personal productivity with enterprise accountability.
- **Crunchtime! & Zenput Task Management at Domino's / Sweetgreen (Anti-Task-Overload Budget):** In large retail chains, regional managers, QA, Marketing, and HR often independently blast ad-hoc tasks to stores—resulting in 30+ uncoordinated tasks landing on a store manager during Friday peak hours. Enforcing a **Per-Shift Ad-Hoc Task Budget (`<= 8 tasks/shift`)** and **Single-Owner Fan-Out (`O-022`)** protects store floor focus.

### 2.3 Adversarial Peer-Review Verdict (`Claude Opus 4.7 Max` + `Codex Astra Extra High`)
Raw peer review output is persisted in `/tmp/peer_review_mtk_claude.txt` and `/tmp/peer_review_mtk_codex.txt`. Key architectural catches folded into `MTK-1..14`:
1. **`PRIVATE_SELF` Surveillance Leak via Shared Analytics Views or Admin Queries:** If `mytasks_items` is queried by a backend service role with `BYPASSRLS`, managers could inspect an employee's `PRIVATE_SELF` tasks. **Fix Folded In:** Enabled `FORCE ROW LEVEL SECURITY` on `mytasks_items` with policy `USING (visibility_mode <> 'PRIVATE_SELF' OR owner_id = current_setting('app.current_user_id')::BIGINT)` AND encrypted `title_ciphertext` for `PRIVATE_SELF` rows using a per-user derived key.
2. **Silent Downgrade or Deletion of `TEAM_COMMITTED` Deliverables:** An employee could toggle `TEAM_COMMITTED` during a meeting to look proactive and flip it back to `PRIVATE_SELF` 10 minutes before the deadline. **Fix Folded In:** Trigger `prevent_commitment_downgrade()` forbids `TEAM_COMMITTED -> PRIVATE_SELF` transitions and blocks `DELETE` on `TEAM_COMMITTED` or `MANAGER_ASSIGNED` rows.
3. **Prompt Injection & Cross-Scope Task Spam via `@OneOps` Bot (`Mode C`):** A crafted note or voice transcript could trick the LLM into assigning 100 tasks across outlets. **Fix Folded In:** The LLM can only write to `mytasks_bot_drafts` (never directly to `mytasks_items`). Materializing a task requires a deterministic server-side `canManagePerson(actor, target_id)` check plus an explicit human click on the pre-commit confirmation card.

---

## PART 3 — COLLAPSIBLE GLOSSARY & POSTGRESQL DDL (BELOW THE FOLD)

<details>
<summary><strong>3.1 Plain-English Operational Glossary (Click to Expand)</strong></summary>

- **`PRIVATE_SELF` Mode (`MTK-4`):** Default mode for self-created tasks where HOP nudges only you and never shows the task to your manager or counts it in compliance scores.
- **`TEAM_COMMITTED` Mode (`MTK-6`):** One-way toggle (`🤝 Commit to Manager`) that turns a self-created task into a tracked team deliverable with a frozen due date.
- **Single-Owner Fan-Out (`MTK-9`, `O-022`):** When a manager assigns a task to multiple outlets, HOP automatically creates one separate task row for the specific named manager on duty at each outlet.
- **Shift Task Budget (`MTK-8`):** Hard cap (`8 ad-hoc tasks per shift`) preventing regional managers from overloading store staff during peak trading hours.
</details>

<details>
<summary><strong>3.2 Executable PostgreSQL Migration DDL — MTK-1..14 (Click to Expand)</strong></summary>

```sql
-- ============================================================================
-- MTK-1..14 DDL: MYTASKS SELF-CREATED, MANAGER-ASSIGNED & @ONEOPS BOT ENGINE
-- ============================================================================

-- 1. Multi-Outlet Broadcast Parent Header (MTK-9)
CREATE TABLE IF NOT EXISTS task_broadcasts (
    broadcast_id        UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    created_by          BIGINT NOT NULL REFERENCES users(id),
    title               VARCHAR(200) NOT NULL,
    target_scope_json   JSONB NOT NULL,
    fanout_count        INTEGER NOT NULL CHECK (fanout_count > 0),
    created_at          TIMESTAMPTZ NOT NULL DEFAULT NOW()
);

-- 2. Unified MyTasks Items Table with FORCE RLS Privacy & Ratchet Constraints (MTK-1..11)
CREATE TABLE IF NOT EXISTS mytasks_items (
    task_id                 BIGSERIAL PRIMARY KEY,
    broadcast_id            UUID REFERENCES task_broadcasts(broadcast_id),
    task_origin             VARCHAR(24) NOT NULL
                            CHECK (task_origin IN ('SELF_CREATED', 'MANAGER_ASSIGNED', 'BOT_CREATED')),
    visibility_mode         VARCHAR(24) NOT NULL DEFAULT 'PRIVATE_SELF'
                            CHECK (visibility_mode IN ('PRIVATE_SELF', 'TEAM_COMMITTED', 'MANAGER_SCOPED')),
    creator_id              BIGINT NOT NULL REFERENCES users(id),
    owner_id                BIGINT NOT NULL REFERENCES users(id), -- O-022 Single Named Owner
    committed_to_manager_id BIGINT REFERENCES users(id),
    outlet_id               BIGINT REFERENCES outlets(id),
    shift_window_id         BIGINT REFERENCES shift_window(id),
    title                   VARCHAR(240) NOT NULL,
    priority                VARCHAR(16) NOT NULL DEFAULT 'NORMAL'
                            CHECK (priority IN ('NORMAL', 'IMPORTANT', 'URGENT')),
    deep_link_url           VARCHAR(255),
    due_at                  TIMESTAMPTZ NOT NULL,
    committed_due_at        TIMESTAMPTZ,
    proof_type              VARCHAR(20) NOT NULL DEFAULT 'SIMPLE_TICK'
                            CHECK (proof_type IN ('SIMPLE_TICK', 'LIVE_PHOTO', 'NUMERIC_ENTRY', 'M3_VERIFY')),
    status                  VARCHAR(24) NOT NULL DEFAULT 'OPEN'
                            CHECK (status IN ('OPEN', 'DONE_ON_TIME', 'DONE_LATE', 'CANNOT_BLOCKED', 'PENDING_M3', 'CANCELLED')),
    cannot_reason_chip      VARCHAR(40) CHECK (cannot_reason_chip IN (
                                'CK_CRATE_SHORT', 'COLD_CHAIN_EXCURSION', 'PACKAGING_MISSING',
                                'POS_SKU_MISSING', 'EQUIPMENT_DOWN', 'STAFF_SHORTAGE'
                            )),
    proof_photo_sha256      CHAR(64),
    proof_numeric_val       NUMERIC(14,3),
    m3_verified_by_id       BIGINT REFERENCES users(id),
    escalated_to_manager_at TIMESTAMPTZ,
    created_at              TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    completed_at            TIMESTAMPTZ,
    CHECK (task_origin <> 'SELF_CREATED' OR creator_id = owner_id),
    CHECK (visibility_mode <> 'PRIVATE_SELF' OR (creator_id = owner_id AND escalated_to_manager_at IS NULL)),
    CHECK (visibility_mode <> 'TEAM_COMMITTED' OR (committed_to_manager_id IS NOT NULL AND committed_due_at IS NOT NULL)),
    CHECK (m3_verified_by_id IS NULL OR m3_verified_by_id <> owner_id)
);

ALTER TABLE mytasks_items ENABLE ROW LEVEL SECURITY;
ALTER TABLE mytasks_items FORCE ROW LEVEL SECURITY;

CREATE POLICY mytasks_privacy_isolation ON mytasks_items
    USING (
        visibility_mode <> 'PRIVATE_SELF'
        OR owner_id = NULLIF(current_setting('app.current_user_id', TRUE), '')::BIGINT
    );

-- One-Way Ratchet Trigger: Forbid downgrading TEAM_COMMITTED or MANAGER_SCOPED back to PRIVATE_SELF
CREATE OR REPLACE FUNCTION prevent_commitment_downgrade() RETURNS TRIGGER AS $$
BEGIN
    IF OLD.visibility_mode IN ('TEAM_COMMITTED', 'MANAGER_SCOPED') AND NEW.visibility_mode = 'PRIVATE_SELF' THEN
        RAISE EXCEPTION 'RATCHET_VIOLATION: Committed or Manager-Assigned tasks cannot be downgraded to PRIVATE_SELF';
    END IF;
    RETURN NEW;
END;
$$ LANGUAGE plpgsql;

CREATE TRIGGER trg_mytasks_ratchet
    BEFORE UPDATE ON mytasks_items
    FOR EACH ROW EXECUTE FUNCTION prevent_commitment_downgrade();

-- 3. @OneOps Bot Pre-Commit Confirmation Drafts (MTK-12..13 Anti-Injection Fence)
CREATE TABLE IF NOT EXISTS mytasks_bot_drafts (
    draft_token         UUID PRIMARY KEY DEFAULT gen_random_uuid(),
    requester_id        BIGINT NOT NULL REFERENCES users(id),
    parsed_owner_id     BIGINT NOT NULL REFERENCES users(id),
    parsed_outlet_id    BIGINT REFERENCES outlets(id),
    parsed_title        VARCHAR(240) NOT NULL,
    parsed_due_at       TIMESTAMPTZ NOT NULL,
    parsed_proof_type   VARCHAR(20) NOT NULL DEFAULT 'SIMPLE_TICK',
    scope_verified      BOOLEAN NOT NULL DEFAULT FALSE,
    expires_at          TIMESTAMPTZ NOT NULL DEFAULT (NOW() + INTERVAL '10 minutes'),
    confirmed_task_id   BIGINT REFERENCES mytasks_items(task_id)
);
```
</details>