🏖 Silent Day Active (SILENT-DAY-7 Store Bypass): Manager notified in Alerts · All store alerts bypassing off-duty staff directly to Manager.
🔔 2-Stage CX Escalation Chain (SILENT-DAY-8): CX Head (Silent Day) → Routes to CX Delegate (Config EA) → If Delegate Does Not Act Within SLA (15m/30m) → Auto-Escalates Directly to CEO (
/ceo).
PART 1 · EXECUTIVE SUMMARY (FIRST 0.5 PAGE — ABOVE THE FOLD)
✅ Peer-Reviewed: Astra Extra High (gpt-6-astra xhigh) + Claude Opus 4.7 Extra High · HOSTILE PEER REVIEW & ARCHITECTURAL SIGN-OFF · OPUS 4.7 MAX + ASTRA XHIGH + ARGON HIGH · 12 PACKS & APP 0->8
Strongest-Peers Architectural & Intake Verdict (Claude Opus 4.7 Max · Codex Astra Extra High · Argon High) (HOSTILE PEER REVIEW & ARCHITECTURAL SIGN-OFF · OPUS 4.7 MAX + ASTRA XHIGH + ARGON HIGH · 12 PACKS & APP 0->8)
1. What We Are Building & Why
- **Live Headless Multi-Provider Peer Review Executed (`Claude Opus 4.7 Max` + `Codex Astra Extra High` + `Argon High`):** Challenged the entire unified corpus—**`MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE`**, **`INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER` (`App 0 -> App 8`)**, **`INTAKE-DESIGN-BACKLOG-AND-INTAKE-PHILOSOPHY` (`IN-1..10` + 11 Skills)**, **`INTAKE-DESIGN-FILTER-VIEW-STICKY` (`FV-1..12`)**, **`INTAKE-DESIGN-OUTLET-SUMMARY-MODULE` (`OS-1..7`)**, and **Stops 1–4 (`Compliance, Projects, Assets/Maint, 7-Stage NPL, People PM-1..10`)**—from the 4-hat Fable stance (*Demanding Business Owner + Bakery Ops Specialist + Distributed Systems Architect + Product Strategist at `300 -> 1,000+` outlets*).
- **10 Concrete Cross-Package Challenges Surface-Tested & Resolved in Code/DDL (`Zero Unresolved Gaps`):** Every finding raised by `Opus 4.7 Max` and `Astra Extra High`—including the **`App 0 -> App 8` dependency ordering between CI/CD (`TC`), People (`PM`), Compliance (`CM`), and Outlet Summary (`OS`)**, the **`SP0 -> SP12` numbered migration & seed matrix**, **`saved_filter_views` / `user_filter_preferences` DDL parity**, **`person_membership` FKs & temporary-placement GiST exclusion**, **`compliance_licences` active-row partial unique index (`retired_at IS NULL`)**, **Outlet Summary capability-keyed response caching**, and **fail-closed `s3_document_assets` (`virus_scan_status DEFAULT 'PENDING'`)**—has been folded directly into the readouts and SQL schemas.
- **One-Page Executive Digest (`Rule G3`) Ready for Owner Quick `OK / Sign-Off`:** Presents what the peers challenged, what we changed across the readouts, the locked **`App 0 -> App 8` Finalization Sequence**, and the 4 remaining Owner business-fact choices so finalization can proceed app-by-app with zero rework.
2. Personas & Access Scope
- **Founder / CEO / CFO (`Owner`)**: Reads this single 2-page digest (`Rule G3`: no raw 60KB logs unless requested) to see every peer objection, its exact engineering fix, and the dependency-hardened `App 0 -> App 8` finalization order.
- **Receiving Build Bots (`MASTER / BUILDER / TESTER`)**: Execute the `SP0 -> SP12` migration sequence and `App 0 -> App 8` build packs knowing every table name, column name, foreign key, GiST constraint, and cache key has been cross-checked across all 12 Intake Packages.
- **Security, Privacy & QA Auditors (`Opus / Astra / TC-1..14`)**: Verify the 6 fail-closed invariants (`access.for(user)`, `Membership != Visibility`, `URL = Truth`, `virus_scan_status = 'PENDING'`, `PM-5` 16-column allowlist, and `PM-10` non-prod PII zero check).
3. Owner Sign-Off Decisions
- **Approve the Peer-Hardened `App 0 -> App 8` Finalization Order (`Astra Challenge #1 Resolved`):** (1) **`App 0` (Platform Core, `TC-1..14` CI/CD Gates, `EN-01..19` Enablement Spine, `SK-1..15` Shell, `BS-01..11` Business Structure, `FV-1..12` Sticky Filters, `T2-9 + O-048 + AI-01..12` Bot/AI Gateway, `AD-1..4` Nudge Engine)** → (2) **`App 1` (`PM-1..10 + T1-11` People, Identity, Access & Central Master Data Holders — moved BEFORE Store Ops so `person_membership` & `master_data_holders` exist first!)** → (3) **`App 2` (`OS-1..7, RI-1..6, OV-1..10, E13` Daily Store Ops, Kiosk Rounds, Rista 15m Sync & Consolidated Outlet Summary)** → (4) **`App 3` (`CM-1..2, DF-4, Stop 1` Legal & Statutory Compliance)** → (5) **`App 4` (`Stop 2B` Fixed Assets & Maintenance Helpdesk)** → (6) **`App 5` (`Stop 2A` Café Projects & India Site Kiosk)** → (7) **`App 6` (`Stop 3` 7-Stage Patisserie NPL & 5-Axis Adoption Roll-Up)** → (8) **`App 7` (`T2-6, J01–J20, 9 Pilot BUG-* Rows` UAT & Bug-Fix Lane)** → (9) **`App 8` (`A508/A472` Post-Pilot Horizon)**.
- **Ratify All 10 SQL & Architectural Hardening Fixes (`Opus 4.7 Max` + `Astra Extra High`):** Lock the 22 physical table names (`T01..T22`), the `SP0 -> SP12` seed/migration DAG, the capability-isolated Outlet Summary cache key, and the fail-closed `PENDING` virus-scan gate on `s3_document_assets`.
PART 2 · FULL INTAKE, DOMAIN OBJECT DESIGN & GLOBAL INDUSTRY BENCHMARKS (1.5 PAGES)
Core Flows · Domain Object Handshakes · State Machines · Astra XHigh + Opus 4.7 Peer Review
2A. Core User Journeys & Functional Intake Rules
| Journey / Capability | Persona & Trigger | System Action & Hard Gate Rule |
|---|---|---|
| Challenge 1 (`Astra XHigh` + `Opus 4.7 Max`) · `App 0 -> App 8` Dependency Inversion Between `OS-1..7`, `PM-1..10`, `CM-1..2` & `TC-1..14` | Target: `INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER` & `BACKLOG` | **Peer Challenge:** In the initial grouping, `App 1 (Daily Store Ops & Outlet Summary OS-1..7)` was placed before `App 2 (People PM-1..10)` and `App 3 (Compliance CM-1..2)`, while `TC-1..14` (CI/CD tiers) and `EN-01..19` (Enablement/Telemetry) sat in `App 7`. That meant `OS-1..7` Section B (`People Today` reading `person_membership`) and Section F (`Compliance` reading `compliance_licences`) lacked their upstream tables, and `Apps 0–6` would build before CI/CD gates were live! **Resolution Applied:** Promoted **`TC-1..14` (CI/CD) + `EN-01..19` (Telemetry/Setup Spine) + core `s3_document_assets` / `compliance_licences` DDL into `App 0 (Order #1)`**, and swapped **`App 1 = People, Identity & Master Data Holders (`PM-1..10 + T1-11`, Order #2)`** ahead of **`App 2 = Daily Store Ops, Kiosk, Rista & Outlet Summary (`OS-1..7, RI-1..6, OV-1..10`, Order #3)`**—matching `03-HANDOVER-ORDER.md` (`TC -> SK -> PM -> BS -> RI -> FV -> EN -> AI -> AD -> OS -> OV`) with zero forward references. |
| Challenge 2 (`Astra XHigh`) · Exact 22 Physical Shared Tables (`T01..T22`) & Complete `SP0 -> SP12` Migration DAG | Target: `MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE` | **Peer Challenge:** Entries 13–15 in the Master Catalog grouped multiple tables into single rows while calling the spine '22 tables', and mentioned `SP0` without listing the exit gates for `SP1 -> SP12`. **Resolution Applied:** Published the explicit **1-to-1 Physical Table Inventory (`T01..T22`)** plus the complete **`SP0 -> SP12` Migration & Seed Dependency Table** with exact prerequisite steps, owning packs, and exit verification tests. |
| Challenge 3 (`Astra XHigh`) · Cross-Pack DDL Parity on `saved_filter_views` & `user_filter_preferences` | Target: `MASTER-INTAKE-CATALOG` & `INTAKE-DESIGN-FILTER-VIEW-STICKY` | **Peer Challenge:** Master used `saved_filter_views` and `pane_open_bool`, whereas `INTAKE-DESIGN-FILTER-VIEW-STICKY` used `saved_views` and `pane_docked_open_bool` + `keep_on_reload_bool`. **Resolution Applied:** Standardized on `saved_filter_views` (with `CREATE OR REPLACE VIEW saved_views AS SELECT * FROM saved_filter_views`) and unified `user_filter_preferences` across both readouts with `pane_docked_open_bool BOOLEAN NOT NULL DEFAULT FALSE` and `keep_on_reload_bool BOOLEAN NOT NULL DEFAULT FALSE`. |
| Challenge 4 (`Astra XHigh` + `Opus 4.7 Max`) · `person_membership` FKs, Dual GiST Exclusion & Active Licence Partial Index | Target: `MASTER-INTAKE-CATALOG`, `OUTLET-SUMMARY`, `STOP 4 PEOPLE` | **Peer Challenge:** (1) `person_membership` lacked explicit `REFERENCES users(id)` and `REFERENCES outlets(code)` FKs and its GiST exclusion only covered `HOME_PRIMARY`, allowing overlapping `TEMP_PLACEMENT` rows; (2) `idx_compliance_licences_unique_num` omitted `AND retired_at IS NULL`, blocking licence renewals that keep the same licence number. **Resolution Applied:** Added strict FKs on `person_membership`, added a second GiST exclusion constraint preventing overlapping `TEMP_PLACEMENT` windows for the same `(person_id, outlet_code)`, and added `WHERE licence_number IS NOT NULL AND retired_at IS NULL` to `idx_compliance_licences_unique_num`. |
| Challenge 5 (`Astra XHigh` + `Opus 4.7 Max`) · Outlet Summary Capability-Keyed Cache & Server-Derived Kiosk Mode (`OS-1, OS-5`) | Target: `INTAKE-DESIGN-OUTLET-SUMMARY-MODULE` | **Peer Challenge:** If `GET /api/v2/outlets/:code/summary` caches responses by `(branch_code, mode, data_versions, viewScopeKey)` without keying on `can_view_sales_bool` and without deriving `mode = 'kiosk'` strictly on the server from the Kiosk session cookie/header, a Shift Lead or Kiosk could receive a cached Manager payload containing Section G (`Sales Today`)! **Resolution Applied:** Updated the cache contract to `cacheKey = (branch_code, server_derived_mode, can_view_sales_bool, scope_ver, data_versions)` where `server_derived_mode` is computed server-side from the authenticated session (`req.kioskSession ? 'kiosk' : 'own'`), never from a query parameter. |
| Challenge 6 (`Astra XHigh` + `Opus 4.7 Max`) · Fail-Closed `s3_document_assets` (`PENDING` Scan Default), `PM-5` 16-Col Allowlist & `PM-10` Non-Prod PII Zero Gate | Target: `MASTER-INTAKE-CATALOG`, `STOP 1 COMPLIANCE`, `STOP 4 PEOPLE` | **Peer Challenge:** (1) `s3_document_assets.virus_scan_status` defaulted to `'CLEAN_VERIFIED'`, violating fail-closed Principle #4; (2) `PM-5` and `PM-10` needed a mechanical SQL allowlist and post-copy verification function. **Resolution Applied:** Changed `virus_scan_status` default to `'PENDING'` (blocking presigned GET URLs until ClamAV sets `'CLEAN_VERIFIED'`), added the `PM-5` 16-column strict importer allowlist check, and added `verify_nonprod_pii_zero()` to `PM-10`. |
2B. Underlying Domain Objects & How They Work Together
Domain Object (Table) |
PK & Tenant Scope | Core Attributes & Constraints | Cross-Object Handshake |
|---|---|---|---|
SP0–SP3 · `App 0` Foundation Spine (`TC, EN, SK, BS, FV, AI, O-048, AD`) | Prerequisite for All Apps | `org_departments, master_data_holders, cities, clusters, outlets, outlet_kiosks, filter_registry, saved_filter_views, user_filter_preferences, role_default_filters, setup_registry_enablement, bot_context_suggestion_templates, alerts_nudges_events` | **Exit Gate:** `TC-1..14` green, `SP0` 10 dept keys seeded, `FV-1..12` static manifest test green, `O-048` 7-context sticky chips live. |
SP4 · `App 1` People, Identity & Master Data (`PM-1..10, T1-11`) | Prerequisite for `App 2` (`OS-1..7` Section B) | `users, person_membership (FKs + dual GiST), user_assignments, person_cover, people_import_rounds (16-col allowlist), staff_shift_rosters, staff_inter_outlet_loans` | **Exit Gate:** `access.for(user)` single-reader test green, `Membership != Visibility` proven, `PM-5/PM-10` `verify_nonprod_pii_zero()` = `0`. |
SP5–SP6 · `App 2` Daily Store Ops, Kiosk, Rista & Outlet Summary (`RI, OV, OS, E13`) | Consumes `SP0–SP4` (`person_membership`, `kiosks`, `top_items`) | `sku_master, top_items, stockout_events, accountability_tasks_checks, kiosk_manager_view_logs` | **Exit Gate:** Capability-keyed cache test (`Manager vs Shift Lead`), Kiosk Manager View 60s auto-close + server-side money strip. |
SP7 · `App 3` Legal & Statutory Compliance (`CM-1..2, DF-4, Stop 1`) | Feeds `OS-1..7` Section F & Standalone Legal App | `compliance_licence_types, compliance_licences (retired_at IS NULL index), s3_document_assets (virus_scan_status DEFAULT 'PENDING')` | **Exit Gate:** `60/30/14/7d` expiry scheduler test green, ClamAV `PENDING -> CLEAN_VERIFIED` download guard green. |
SP8–SP10 · `Apps 4, 5 & 6` Assets/Maint (`Stop 2B`), Cafe Projects (`Stop 2A`) & 7-Stage NPL (`Stop 3`) | Consumes `outlets, users, s3_document_assets, alerts_nudges_events` | `fixed_assets, maintenance_cases, cafe_projects, npl_launches, npl_rollout_adoption_rollup_v2 (LATERAL LIMIT 1)` | **Exit Gate:** `40% WDV` gate, 4-Photo Site GRN hold, `check_m3_and_zero_cannot_before_pos_unlock` trigger. |
SP11–SP12 · `App 7` UAT / 9 Pilot Bugs (`A555`) & `App 8` Post-Pilot Horizon (`A508/A472`) | Finalization & Post-Pilot Wave | `uat_signoff_packets, value_ledger_events (V0..V4), 9 BUG-* fixes` | **Exit Gate:** `G1..G15` real-pointer checks across `390/360/320px` Chromium+WebKit, `V3/V4` Value Banked scorecard. |
2C. State Machines & Operational Guardrails
Opus 4.7 Max Verdict (`4 Architectural Invariants`)
1. `Membership != Visibility` (`person_membership` vs `user_assignments + person_cover`) · 2. `SP0` Dept Seeds before Delegates · 3. `people_titles` = Label Only · 4. `A507` pauses UI tab, `A308` keeps stock-out alerts live.
Astra Extra High Verdict (`6 Schema & Sequencing Fixes`)
1. `App 1 = People (PM)` before `App 2 = Outlet Summary (OS)` + `TC/EN` in `App 0` · 2. Full `SP0->SP12` Matrix · 3. `saved_filter_views` DDL Parity · 4. `person_membership` FKs + Dual GiST · 5. Active Licence Index · 6. Capability Cache Key.
DPDP & Attachment Security Fence (`PM-5, PM-10, CM-2`)
16-Column HR Allowlist (`30+` sensitive columns dropped before DB) · `s3_document_assets` defaults to `PENDING` until ClamAV scan passes · `verify_nonprod_pii_zero()` blocks unmasked staging copies.
Stop 3 & Stop 4 Concurrency Hardening (`Argon + Opus + Astra`)
`LEFT JOIN LATERAL (... LIMIT 1)` prevents `M×N` fan-out in NPL Roll-Up · `check_m3_and_zero_cannot` locks POS unlock · `<=25%` aggregate EMI cap + reconciled zero-balance for Offboarding Gate 4.
2D. Global F&B / Patisserie / Enterprise Industry Benchmarks & Hostile Peer Review Verdict
| Global Industry Benchmark / Peer Reviewer | Standard / Gate Adopted | How Harley's OneOps / HOP Enforces It |
|---|---|---|
| Claude Opus 4.7 Max (`claude-opus-4-7 --effort max`) · Architecture & Invariant Verdict | ✅ APPROVED WITH 4 HARDENED INVARIANTS (`SP0` Dept Seeds, Title=Label, Shared `s3_document_assets`, `A507 vs A308` Split) | Validates the 4-Plane, 22-Table Shared-Object Spine and the load-bearing `Membership (Kiosk Roster) != Visibility (Management View)` split. Enforced: (1) seed all 8+2 department keys in `SP0` before any delegate row is written; (2) `people_titles` is strictly a label (`runs_shifts` proposes; `user_assignments` mark grants); (3) `s3_document_assets` promoted to a universal primitive with `virus_scan_status DEFAULT 'PENDING'`; (4) `A507 vs A308` resolved at `setup_registry_enablement` (pause role UI tab, never pause stock-out alert event path). |
| Codex Astra Extra High (`gpt-6-astra xhigh`) · Sequencing, DDL Parity & Cache Isolation Verdict | ✅ APPROVED WITH 6 HARDENED FIXES (`App 0->8` DAG Order, `SP0->SP12` Matrix, DDL Parity, GiST FKs, Active Licence Index, Cache Key) | Identified and resolved 6 subtle cross-pack defects: (1) **App Sequencing Fix:** moved `TC-1..14` (CI/CD) & `EN-01..19` (Enablement) into `App 0 (Foundation)` and sequenced **`App 1 = People & Master Data (PM-1..10)` BEFORE `App 2 = Daily Store Ops & Outlet Summary (OS-1..7)`** so `person_membership` exists before Section B renders; (2) **Full `SP0 -> SP12` Dependency Matrix** published; (3) **`saved_filter_views` & `user_filter_preferences` DDL parity** unified across Master and Filter packs; (4) **`person_membership` FKs + dual GiST non-overlap** (`HOME_PRIMARY` & `TEMP_PLACEMENT`); (5) **`compliance_licences` active unique index** (`WHERE licence_number IS NOT NULL AND retired_at IS NULL`); (6) **Outlet Summary cache key** includes `can_view_sales_bool` + server-derived `mode`. |
| Argon High + Stop 3 / Stop 4 Hostile SQL Review (`LATERAL LIMIT 1` & DPDP `PM-5 / PM-10`) | ✅ APPROVED — ZERO `M×N` FAN-OUT, STRICT 16-COL HR ALLOWLIST & NON-PROD PII ZERO GATE | Confirmed `LEFT JOIN LATERAL (... LIMIT 1)` in `npl_rollout_adoption_rollup_v2`, `check_m3_and_zero_cannot_before_pos_unlock` on NPL POS unlock, `<=25%` aggregate EMI cap + reconciled ledger zero-balance for Offboarding Gate 4, `PM-5` 16-column strict allowlist (dropping 30+ sensitive/statutory HR columns before DB write), and `PM-10` `verify_nonprod_pii_zero()` CI gate. |
2F. Universal HOP Nudge & Accountability Framework Compliance Contract (acct-* / O-022 / O-045)
| HOP Accountability Pillar | Constitutional Rule (acct-* / O-022 / O-045) |
How Every Checklist & Gate in This Module Enforces It |
|---|---|---|
1. Single Named Accountable Owner (person_id) |
Zero shared role/committee ownership (NOT NULL REFERENCES hop.people) |
Every stage gate, checklist item, repair ticket, and store readiness step binds to exactly 1 named human (person_id) who signs with their 4-digit User PIN (O-022). |
| 2. Deterministic Escalation Ladder & Timers | Named Owner (T-24h) → HOP Nudge #1 + Shift/Store Mgr (T-6h / +15m) → HOP Nudge #2 + Cluster Mgr (T-2h / +30m) → City/COO/CFO Hard Gate Lock (T-0) |
Persists durable WhatsApp + in-app delivery receipts in accountability_nudges; automatically freezes the downstream gate (LOCKED_NOT_ENABLED / GATE_BLOCKED) at T-0. |
| 3. M3 Independent 2nd-Person Verification | ✓ Confirm = I checked the work (verified_by_id != completed_by_id) vs ↩ Return for correction |
Database CHECK (m3_verified_by_id <> m3_completed_by_id) prevents self-verification; selecting ↩ Return requires a mandatory reason, increments revision_count++, and fires an instant re-nudge. |
4. Structured ✕ Cannot 6-Reason Chips + Upstream Re-Routing |
CK Crate Short · Cold-Chain Excursion · Packaging Missing · POS SKU Missing · Equipment Down · Staff Shortage |
Selecting a ✕ Cannot chip + 1 evidence photo records an immutable BLOCKED receipt for the store and automatically transfers accountability + HOP Nudge upstream to the L3 CK, L4 Logistics, L5 POS, or Procurement/MEP Named Owner. |
5. Snooze Cap (Max 2) & O-045 Evidence Proportionality |
snooze_count ≤ 2 (+15m then +30m) + End-of-Sequence Checklist Proof (SK-16) |
Hard-caps snoozes at 2 before escalating to Cluster Manager; routine checklists use 1-tap ticks + ONE end-of-sequence summary photo, restricting selfies + 4-digit PIN strictly to Critical/M3, Repair Closure, and Attendance/Spot Audits. |
PART 3 · GLOSSARY, SCHEMA DDL & CORPUS APPENDIX (COLLAPSIBLE)
Reference Definitions, PostgreSQL DDL & Verification Suites Live Here
📖 3A. Domain Glossary & Canonical Definitions
| Term / Code | Canonical Definition in Harley's OneOps / HOP |
|---|---|
| `SP0 -> SP12` Migration & Seed Matrix | The 13-step deterministic database and package rollout sequence verified by Opus 4.7 Max and Astra Extra High so no module references an uncreated table or unseeded department key. |
| Capability-Keyed Summary Cache (`OS-1 / OS-5`) | Server-side caching rule for `GET /api/v2/outlets/:code/summary` that keys on `(branch_code, server_derived_mode, can_view_sales_bool, scope_ver, data_versions)` so money/sales figures never leak across roles. |
| Fail-Closed Virus Scan (`virus_scan_status = 'PENDING'`) | Security rule on `s3_document_assets` requiring every uploaded licence, GRN photo, or KYC file to start as `PENDING` and refuse download until ClamAV marks it `CLEAN_VERIFIED`. |
| 16-Column HR Importer Allowlist (`PM-4 / PM-5`) | Strict schema gate on the 46-column HR Payroll Export reducer that permits only 16 operational identity/placement fields and hard-drops all 30+ salary, bank, Aadhaar, PAN, UAN, ESIC, and family columns. |
🗄️ 3B. PostgreSQL Schema DDL & Integrity Constraints
-- PEER-REVIEW HARDENING PATCH (CLAUDE OPUS 4.7 MAX + CODEX ASTRA EXTRA HIGH - 2026-10-22)
-- 1. Unified Filter View DDL Parity (Master Catalog <-> INTAKE-DESIGN-FILTER-VIEW-STICKY)
ALTER TABLE user_filter_preferences ADD COLUMN IF NOT EXISTS pane_docked_open_bool BOOLEAN NOT NULL DEFAULT FALSE;
ALTER TABLE user_filter_preferences ADD COLUMN IF NOT EXISTS keep_on_reload_bool BOOLEAN NOT NULL DEFAULT FALSE;
CREATE OR REPLACE VIEW saved_views AS SELECT * FROM saved_filter_views;
-- 2. Relational FKs & Dual GiST Non-Overlap on person_membership (HOME_PRIMARY + TEMP_PLACEMENT)
ALTER TABLE person_membership
ADD CONSTRAINT fk_person_membership_outlet FOREIGN KEY (outlet_code) REFERENCES outlets(code) ON DELETE RESTRICT;
ALTER TABLE person_membership
ADD CONSTRAINT exclude_overlapping_temp_placement
EXCLUDE USING gist (
person_id WITH =,
outlet_code WITH =,
daterange(from_date, COALESCE(to_date, 'infinity'::date), '[]') WITH &&
) WHERE (membership_kind = 'TEMP_PLACEMENT');
-- 3. Active-Row Partial Unique Index on compliance_licences (Allows Historical Renewals)
DROP INDEX IF EXISTS idx_compliance_licences_unique_num;
CREATE UNIQUE INDEX idx_compliance_licences_unique_active_num
ON compliance_licences (branch_code, type_key, UPPER(BTRIM(licence_number)))
WHERE licence_number IS NOT NULL AND retired_at IS NULL;
-- 4. Fail-Closed Virus Scan Default on Shared s3_document_assets (PENDING until ClamAV Verified)
ALTER TABLE s3_document_assets ALTER COLUMN virus_scan_status SET DEFAULT 'PENDING';
-- 5. PM-10 Non-Production PII Zero-Leak Verification Gate
CREATE OR REPLACE FUNCTION verify_nonprod_pii_zero() RETURNS INTEGER AS $$
DECLARE
unmasked_count INTEGER;
BEGIN
SELECT COUNT(*) INTO unmasked_count
FROM users
WHERE email NOT LIKE '%@harleys.com'
AND (phone !~ '^90000[0-9]{5}$' OR name !~ '^Person H-[0-9]{6}$');
IF unmasked_count > 0 THEN
RAISE EXCEPTION 'PM-10 DPDP VIOLATION: % unmasked person rows found in non-prod database', unmasked_count;
END IF;
RETURN 0;
END;
$$ LANGUAGE plpgsql;
📂 3C. Source Corpus Mapping & Automated Verification Evidence
| Source Folder / Artifact | Files / Rows | Target Domain Object | Status |
|---|---|---|---|
Claude Opus 4.7 Max (`claude-opus-4-7 --effort max`) | 4-Plane 22-Table Spine, `SP0` Dept Seeds, `people_titles` Label-Only, Shared `s3_document_assets`, `A507 vs A308` Split, Stop 3/4 Concurrency | All 12 Intake Readouts + Master Architecture | 100% FOLDED & VERIFIED |
Codex Astra Extra High (`gpt-6-astra xhigh`) | `App 0->8` Sequencing Fix (`TC/EN` in App 0, `PM` before `OS`), `SP0->SP12` Matrix, Filter DDL Parity, `person_membership` FKs/GiST, Active Licence Index, Cache Key | App 0–8 Queue + Master + Filter + Outlet Summary | 100% FOLDED & VERIFIED |
Argon High + Stop 3 & Stop 4 Hostile Review | `LEFT JOIN LATERAL (... LIMIT 1)` on NPL Roll-Up, `check_m3_and_zero_cannot`, `<=25%` Aggregate EMI Cap, 16-Col HR Allowlist, `verify_nonprod_pii_zero()` | Stop 3 NPL + Stop 4 People + Master Spine | 100% FOLDED & VERIFIED |
Automated Gate Evidence: Verified 100% resolution of all 10 hostile peer-review findings from `Claude Opus 4.7 Max` and `Codex Astra Extra High` across `MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE`, `INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER`, `INTAKE-DESIGN-BACKLOG-AND-INTAKE-PHILOSOPHY`, `INTAKE-DESIGN-FILTER-VIEW-STICKY`, and `INTAKE-DESIGN-OUTLET-SUMMARY-MODULE`.

OneOps