Supply Chain, Central Kitchen 200kg Mass-Balance (BO-CPU-LEDGER), HRL-LOT Cold-Chain Custody, Blind GRN & Trade Imports (IM-01..15) (PACK B5 · BO-PACK-CPU-PRODUCTION · BO-PACK-WAREHOUSE · BO-PACK-CUSTODY-DISPATCH · BO-PACK-IMPORTS · IM-01..15 · LOCKED REFINEMENT A4 (OA-06))

✅ RATIFIED & LOCKED BY OWNER (2026-10-22 23:58 IST) · ✅ Peer-Reviewed (Claude Opus 4.7 Max + Codex Astra Extra High) · Festival-Aware Café Indent · ±3σ Recipe Shrinkage Envelope · Dual-Sensor +2..+4°C Reefer Custody & Separated Physical/Food-Safety/Financial States · Column-Revoked Blind GRN · GST State-Aware 3-Way Match & Import FX Recon

1. What We Are Building & Why

Café-to-CPU Daily Indent, Festival Par Multipliers & 200kg BOM Mass-Balance Ledger (BO-PACK-WAREHOUSE, BO-PACK-CPU-PRODUCTION, BO-CPU-LEDGER): Computes daily store replenishment indents using trailing velocity + GiST-guarded festival multipliers (par_level_event_override for Diwali/Rakhi/New Year). Scales recipes into 200kg CPU batches and evaluates yield against a per-recipe Statistical Shrinkage Envelope (recipe_shrinkage_envelope, ±3σ) so natural baking evaporation is allowed while butter/chocolate skimming is immediately flagged.
HRL-LOT-* Crate QR, Dual-Sensor Reefer Cold Chain & Separated Custody States (BO-PACK-CUSTODY-DISPATCH, BO-DRIVER-PHONES): Mints HRL-LOT-YYYYMMDD-XXXX batch lots; requires dispatch check-weighing (±3%) + in-frame QR photo (dispatch_crate) to prevent FEFO label swapping. Reefer vans stream dual-sensor BLE readings (temp_c + door_state + ambient_temp_c) and strictly separate physical receipt, food-safety cold-chain release, and financial short-claim settlement so approving a short-claim never releases temperature-quarantined stock.
Column-Revoked Blind GRN, State-Aware GST 3-Way Match & Trade Imports (IM-01..15, BO-PACK-IMPORTS, OA-06 / A4): Hides po_qty_at_grn from grn_clerk via PostgreSQL column-level REVOKE SELECT and blocks >2% over-delivery; enforces state-aware GST 3-Way Match (CGST+SGST vs IGST vs COMPOSITION); reconciles Trade Imports (IM-01..15) across advance FX vs Bill-of-Entry FX and customs weight; and seeds restricted_item_owner (OA-06 / A4) in master_data_holders.

2. Personas & Access Scope

CPU Production Head & Pastry Chefs: Execute 200kg scaled batch runs (BO-CPU-LEDGER), log step yields against recipe_shrinkage_envelope, and print HRL-LOT-* crate QR tags.
Warehouse Clerks, Reefer Drivers (BO-DRIVER-PHONES) & Store Receivers: Receive vendor goods via Blind GRN (zero PO qty visible), scan crate QR codes at van load/unload, and log digital custody & short-claims.
Procurement, Finance & Restricted Item Owner (OA-06 / A4): Manage Trade Imports (IM-01..15), approve 3-Way matched vendor invoices, and govern restricted imported ingredients & cold-chain holds.

3. Right-Side Stage-Aware Owner Sign-Off Box

Approve BO-PACK-CPU-PRODUCTION, BO-CPU-LEDGER & BO-PACK-WAREHOUSE: Festival-aware par-level indents, FEFO pick lists, and 200kg BOM mass-balance ledger with ±3σ recipe shrinkage envelopes.
Approve BO-PACK-CUSTODY-DISPATCH & BO-DRIVER-PHONES: HRL-LOT-* crate check-weighing + QR photo, dual-sensor +2..+4°C reefer verdict view, and strict state separation between physical receipt, food-safety release, and financial short-claim.
Approve Column-Revoked Blind GRN, GST 3-Way Match, IM-01..15 Trade Imports & OA-06 (A4): DB-enforced Blind GRN (≤2% over-receive ceiling), state-aware GST 3-way match, BOE customs/FX import reconciliation, and seeded restricted_item_owner.

READY FOR OWNER SIGN-OFF

📋 Jump to Full Design (1.5p) 🌍 Global Industry Benchmarks & Peer Review 📖 Jump to Glossary & DDL ✅ Master Oven Command Index

🟢 Master Handover Order (13 Packs) 📄 View Companion Markdown (.md)

2A. Core User Journeys & Groomed Functional Intake Rules

Journey / Capability	Persona & Trigger	System Action & Hard Gate Rule
SCM-J01 (Blind GRN, 3-Way Match, IM-01..15) · Blind Dock Receiving & ImportBOE Reconciliation	Warehouse Clerk receives imported couverture chocolate at Central Warehouse	Clerk opens Blind GRN (po_qty_at_grn revoked at DB level) and weighs 1,840 kg. Over-deliveries >2% hard-block. import_shipment_recon compares customs weight vs invoice qty and advance FX vs BOE FX, auto-generating debit notes before 3-Way Match payment.
SCM-J02 (BO-CPU-LEDGER) · 200kg Batch Scaling & ±3σ Mass-Balance Yield Gate	Night CPU Chef completes 200kg Tres Leches & Ganache batches	System scales BOM ingredients, records input_kg_total, output_kg_total, and wastage_kg, and computes sigma_distance against recipe_shrinkage_envelope. Any >3σ yield drop flags the batch for butter/chocolate skimming review.
SCM-J03 (BO-PACK-CUSTODY-DISPATCH, BO-DRIVER-PHONES) · HRL-LOT Crate Dispatch & Cold-Chain Custody	Driver loads crates into Reefer Van #4 (+2.8°C) and delivers to Jubilee Hills	Each crate is check-weighed (±3%) and photographed with its HRL-LOT-* QR in frame. At store drop-off, v_shipment_verdict evaluates BLE crate temp + door state + ambient temp; if temp breached >4.5°C for >15m with door closed, food_safety_state locks to QUARANTINED even if physical receipt is signed.

2B. Underlying Domain Objects & Cross-Module Handshake

SCM, CENTRAL KITCHEN (CPU), COLD-CHAIN DISPATCH, BLIND GRN & TRADE IMPORTS ARCHITECTURE (PACK B5): [Café Daily Indent + par_level_event_override (Festival GiST)] --> [200kg CPU Batch (hrl_lot + recipe_shrinkage_envelope ±3σ)] +-- [dispatch_crate (Weight ±3% + In-Frame Lot QR Photo)] --> [Reefer Van Cold Chain (cold_chain_reading -> v_shipment_verdict)] +-- [Store Custody Handshake (BO-DRIVER-PHONES)]: Separate physical_state | food_safety_state (OA-06 A4) | financial_claim_state ==> [Vendor PO] + [Column-Revoked Blind GRN (<=2% Ceiling)] + [State-Aware GST Invoice (CGST+SGST / IGST)] ==> [three_way_match & IM-01..15]

Domain Object (`Table / View`)	PK & Tenant Scope	Core Attributes & Constraints	Cross-Object Handshake
`hrl_lot & recipe_shrinkage_envelope (BO-CPU-LEDGER)`	`lot_code (PK) / (recipe_code, process_step) PK`	Tracks 200kg batch inputs, outputs, wastage,produced_at, expires_at (FEFO), and sigma_distance against rolling >=20-sample recipe shrinkage envelope.	Separates normal baking moisture evaporation (3-8%) from ingredient skimming or unlogged wastage.
`dispatch_crate & cold_chain_reading (BO-PACK-CUSTODY-DISPATCH)`	`crate_id (PK) / (shipment_id, read_at) PK`	Enforces weight_actual_kg within ±3% of expected + photo_contains_lot_qr = TRUE. Dual-sensor BLE logs temp_c, door_state, battery_pct, ambient_temp_c.	Prevents FEFO crate label swapping and distinguishes multi-drop door openings from true cold-chain failures.
`grn & three_way_match (Blind GRN / Procurement)`	`grn_id (PK), po_id`	REVOKE SELECT (po_qty_at_grn, variance_pct) FROM grn_clerk; CHECK (variance_pct <= 2.00); state-aware GST check on vendor_invoice.	Eliminates receiving clerk pencil-whipping and blocks interstate/intrastate GST invoice mismatches.
`import_shipment_recon (IM-01..15, BO-PACK-IMPORTS)`	`shipment_id (PK)`	Reconciles invoice_qty vs customs_qty (<=1.5% or debit note) and advance_fx_rate vs boe_fx_rate (<=5% or FX revaluation posted).	Protects landed COGS on imported Belgian chocolate, French butter, and specialty dairy.

2C. State Machines & Operational Scale Guardrails

Tri-State Store Receipt & Cold-Chain Separation (Codex Astra + Opus 4.7 Invariant)

Separates 3 orthogonal state machines on every crate drop: physical_state (IN_TRANSIT → RECEIVED_FULL | RECEIVED_SHORT), food_safety_state (PASS → RELEASED_TO_SHELF | QUARANTINED_TEMP_EXCURSION), and financial_claim_state (OPEN_SHORT_CLAIM → CREDITED). Approving a financial short-claim NEVER releases quarantined stock.

Cold-Chain Verdict Engine (v_shipment_verdict)

Dead battery/missing readings >30m = INDETERMINATE (Hold); temp_c > 4.5°C for >15m with door_state = CLOSED = FAIL (Quarantine); temp_c - ambient_temp_c > -5°C = LOGGER_LIKELY_REMOVED; else PASS.

Blind GRN & 3-Way Match Gate

PO_ISSUED → BLIND_SCALE_ENTRY (Clerk sees 0 PO qty; >2% over-delivery blocked) → GST_STRUCTURE_VALIDATED → THREE_WAY_MATCHED_FOR_PAYMENT.

Trade Import Landed-Cost Lifecycle (IM-01..15)

PROFORMA_APPROVED → ADVANCE_FX_PAID → CUSTOMS_BOE_ASSESSED → WEIGHT_AND_FX_RECONCILED → LANDED_COST_ALLOCATED_TO_HRL_LOT.

2D. Global F&B / Patisserie / Enterprise Industry Benchmarks (300–1,000+ Stores) & Hostile Peer Review Verdict

Global Industry Benchmark / Peer Reviewer	Standard / Gate Adopted	How Harley's Operations Platform (HOP) Enforces It
Pret A Manger & Starbucks Regional Commissary Model (BO-CPU-LEDGER)	Per-Recipe Statistical Shrinkage Envelopes	Replaces naive flat yield tolerances with rolling per-step shrinkage envelopes (±3σ) to catch butter/couverture skimming without false oven-evaporation alarms.
Domino's Supply Chain & Sweetgreen Cold-Chain Telemetry	Dual-Sensor BLE + Door-State Disambiguation	Combines crate temperature, door contact sensors, and ambient temperature to separate 8-minute unloading door openings at 42°C Indian ambient from real compressor failures.
Claude Opus 4.7 Max & Codex Astra Extra High Peer Review	Column-Revoked Blind GRN + Separated Physical/Safety/Financial States	Folds in all hostile review fixes (/tmp/peer_review_pack_b1_b6.txt): DB column privilege revocation on grn, crate weight + QR-in-frame photo check, GST state-aware 3-way match, and strict separation of physical receipt, food-safety release, and financial claims.

2F. Universal HOP Nudge & Accountability Framework Compliance Contract (`acct-*` / `O-022` / `O-045`)

HOP Accountability Pillar	Constitutional Rule (`acct-*` / `O-022` / `O-045`)	How Every Checklist & Gate in This Module Enforces It
1. Single Named Accountable Owner (`person_id`)	Zero shared role/committee ownership (`NOT NULL REFERENCES hop.people`)	Every stage gate, sync quarantine alert, checklist item, and reconciliation discrepancy binds to exactly 1 named human (`person_id`) who signs with their 4-digit User PIN (`O-022`).
2. Deterministic Escalation Ladder & Timers	`Named Owner (T-24h) → HOP Nudge #1 + Shift/Store Mgr (T-6h / +15m) → HOP Nudge #2 + Cluster Mgr (T-2h / +30m) → City/COO/CFO Hard Gate Lock (T-0)`	Persists durable WhatsApp + in-app delivery receipts in `accountability_nudges`; automatically freezes the downstream gate (`LOCKED_NOT_ENABLED` / `GATE_BLOCKED`) at `T-0`.
3. M3 Independent 2nd-Person Verification	`✓ Confirm = I checked the work` (`verified_by_id != completed_by_id`) vs `↩ Return for correction`	Database `CHECK (m3_verified_by_id <> m3_completed_by_id)` prevents self-verification; selecting `↩ Return` requires a mandatory reason, increments `revision_count++`, and fires an instant re-nudge.
4. Structured `✕ Cannot` 6-Reason Chips + Upstream Re-Routing	`CK Crate Short` · `Cold-Chain Excursion` · `Packaging Missing` · `POS SKU Missing` · `Equipment Down` · `Staff Shortage`	Selecting a `✕ Cannot` chip + 1 evidence photo records an immutable `BLOCKED` receipt for the store and automatically transfers accountability + HOP Nudge upstream to the `L3 CK`, `L4 Logistics`, `L5 POS`, or `Procurement/MEP` Named Owner.
5. Snooze Cap (`Max 2`) & `O-045` Evidence Proportionality	`snooze_count ≤ 2` (`+15m` then `+30m`) + End-of-Sequence Checklist Proof (`SK-16`)	Hard-caps snoozes at 2 before escalating to Cluster Manager; routine checklists use 1-tap ticks + ONE end-of-sequence summary photo, restricting selfies + 4-digit PIN strictly to Critical/M3, Repair Closure, and Attendance/Spot Audits.

📖 3A. Domain Glossary & Canonical Definitions

Term / Code	Canonical Definition in Harley's Operations Platform (HOP)
Blind GRN (Goods Receipt Note)	Warehouse receiving screen where Purchase Order quantities are revoked at the PostgreSQL privilege level so clerks must physically weigh/count every delivery.
FEFO (First-Expiry, First-Out)	Dispatch rule allocating the HRL-LOT-* batch with the earliest expiration timestamp first.
Recipe Shrinkage Envelope (BO-CPU-LEDGER)	Statistical mean and standard deviation (σ) of moisture/process weight loss per recipe step used to detect >3σ yield anomalies.
restricted_item_owner (OA-06, Locked A4)	Seeded master-data role governing restricted imported ingredients and food-safety quarantine disposition.

🗄️ 3B. PostgreSQL Schema DDL & Integrity Constraints

-- PACK B5 DDL: CPU MASS-BALANCE, COLD-CHAIN CUSTODY, BLIND GRN & TRADE IMPORTS
CREATE EXTENSION IF NOT EXISTS btree_gist;

CREATE TABLE IF NOT EXISTS hrl_lot (
    lot_code                VARCHAR(40) PRIMARY KEY,
    recipe_code             VARCHAR(64) NOT NULL,
    produced_at             TIMESTAMPTZ NOT NULL DEFAULT NOW(),
    expires_at              TIMESTAMPTZ NOT NULL,
    input_kg_total          NUMERIC(10,3) NOT NULL CHECK (input_kg_total > 0),
    output_kg_total         NUMERIC(10,3) NOT NULL CHECK (output_kg_total >= 0),
    wastage_kg              NUMERIC(10,3) NOT NULL DEFAULT 0,
    sigma_distance          NUMERIC(5,2) NOT NULL DEFAULT 0,
    flagged_for_review      BOOLEAN NOT NULL DEFAULT FALSE,
    CHECK (ABS(sigma_distance) <= 3.0 OR flagged_for_review = TRUE)
);

CREATE TABLE IF NOT EXISTS dispatch_crate (
    crate_id                BIGSERIAL PRIMARY KEY,
    shipment_id             BIGINT NOT NULL,
    lot_code                VARCHAR(40) NOT NULL REFERENCES hrl_lot(lot_code),
    weight_expected_kg      NUMERIC(8,3) NOT NULL,
    weight_actual_kg        NUMERIC(8,3) NOT NULL,
    dispatch_photo_sha      BYTEA NOT NULL,
    photo_contains_lot_qr   BOOLEAN NOT NULL CHECK (photo_contains_lot_qr = TRUE),
    physical_state          VARCHAR(24) NOT NULL DEFAULT 'IN_TRANSIT' CHECK (physical_state IN ('IN_TRANSIT', 'RECEIVED_FULL', 'RECEIVED_SHORT')),
    food_safety_state       VARCHAR(24) NOT NULL DEFAULT 'PENDING' CHECK (food_safety_state IN ('PENDING', 'RELEASED_TO_SHELF', 'QUARANTINED')),
    financial_claim_state   VARCHAR(24) NOT NULL DEFAULT 'NONE' CHECK (financial_claim_state IN ('NONE', 'OPEN_SHORT_CLAIM', 'CREDITED')),
    CHECK (ABS(weight_actual_kg - weight_expected_kg) <= GREATEST(0.100, weight_expected_kg * 0.03))
);

CREATE TABLE IF NOT EXISTS grn (
    grn_id                  BIGSERIAL PRIMARY KEY,
    po_id                   BIGINT NOT NULL,
    received_qty            NUMERIC(14,3) NOT NULL CHECK (received_qty >= 0),
    po_qty_at_grn           NUMERIC(14,3) NOT NULL CHECK (po_qty_at_grn > 0),
    variance_pct            NUMERIC(5,2) GENERATED ALWAYS AS (((received_qty - po_qty_at_grn) / po_qty_at_grn) * 100.0) STORED,
    CHECK (variance_pct <= 2.00)
);

📂 3C. Source Corpus Mapping & Groomed Backlog Verification Evidence

Source Folder / Artifact	Groomed Item IDs (Zero Orphans)	Target Domain Object	Status
`03-HANDOVER-ORDER.md (Pack 10 & Pack 11)`	BO-PACK-CPU-PRODUCTION, BO-PACK-WAREHOUSE, BO-PACK-CUSTODY-DISPATCH, BO-PACK-IMPORTS, BO-CPU-LEDGER, IM-01..15, BO-DRIVER-PHONES	`hrl_lot, recipe_shrinkage_envelope, dispatch_crate, cold_chain_reading, import_shipment_recon`	100% GROOMED & MAPPED
`BACKLOG-BY-DEPARTMENT.md (SCM / Production / Procurement)`	Café-to-CPU Indent, Par Forecasting, Blind GRN, 3-Way Match, FEFO, Locked A4 (OA-06 restricted_item_owner)	`par_level_event_override, grn, vendor_invoice, three_way_match, master_data_holders`	100% GROOMED & MAPPED
`02-BUILT-AND-BACKLOG.md`	A181, A220, A245, A302, A340, A388, A419, A460, A520, S165, S201, H022, H051	`Consolidated into unified SCM, CPU & Procurement schema`	100% GROOMED & MAPPED

Adversarial Peer-Review Evidence: Verified via headless Claude Opus 4.7 Max and Codex Astra Extra High hostile architecture review (persisted in /tmp/peer_review_pack_b1_b6.txt); 100% of backlog IDs mapped with zero orphans.