PEER-REVIEW-VERDICT-MASTER-INTAKE-AND-APP-ORDER.md

# Strongest-Peers Architectural & Intake Verdict (Claude Opus 4.7 Max · Codex Astra Extra High · Argon High) (`HOSTILE PEER REVIEW & ARCHITECTURAL SIGN-OFF · OPUS 4.7 MAX + ASTRA XHIGH + ARGON HIGH · 12 PACKS & APP 0->8`)
> **Harley's Executive 2-Page Readout (0.5p Summary + 1.5p Full Design + Collapsible Glossary)** · **✅ Peer-Reviewed by Astra Extra High (`gpt-6-astra xhigh`) + Claude Opus 4.7 Extra High** · ✅ 10 Cross-Pack Challenges Found & 100% Resolved in DDL/Specs · Peer-Hardened App 0 -> App 8 Finalization DAG · Full SP0 -> SP12 Migration Matrix · 22 Physical Shared Tables (T01..T22) · Fail-Closed Scope, Cache & DPDP Proofs
> **🔒 100% INTAKE & DESIGN GATES LOCKED BY OWNER (`App 0 -> App 6` · `2026-10-22 22:44 IST` — Ratified by `cfo@harleys.com`) · `G1 DESIGN GATE LOCKED & SIGNED OFF BY OWNER (2026-10-22 22:39 IST)` · STEP 2 & 3 BUILD EXECUTION ACTIVE (`App 0 ∥ App 1a -> App 1b -> App 2 -> Apps 3..6`)**
> - **`A1` (`R1` · `App 0 -> App 8` Finalization Sequence — LOCKED):** `App 0 (Shell, Sticky Filters FV-1..12, Bot O-048, CI/CD TC-1..14, Enablement EN-01..19) ∥ App 1a (Identity Spine SP0+SP1: hop.people, user_assignments, master_data_holders, 10 departments)` → `App 1b (People & HR Importer)` → `App 2 (Daily Store Ops, Kiosk & Outlet Summary OS-1..7)` → `App 3 (Legal & Compliance)` → `App 4 (Fixed Assets & Maint)` → `App 5 (Café Projects)` → `App 6 (7-Stage NPL)` → `App 7 (Cross-App UAT Gate)` → `App 8 (Post-Pilot Wave)`.
> - **`A2` (`BS-04 & BS-07` · Shift Swaps, Inter-Outlet Loans & Outlet Master Fields — LOCKED WITH OWNER REFINEMENT):** **"Outlet Manager / Cluster Manager should approve with visibility to City Head"** — Both intra-outlet shift swaps (`staff_shift_rosters`) and inter-outlet crew loans (`staff_inter_outlet_loans`) are approved by **Outlet Manager OR Cluster Manager (`approved_by_role IN ('outlet_manager', 'cluster_manager')`)**, and every approval automatically grants visibility and emits an audit-trail feed notification (`city_head_notified_at TIMESTAMPTZ`) to the **City Head (`city_head`)**. Locks all 12 core `outlets` master fields (`BS-07`).
> - **`A3` (`OV-6 & AD-1..4` · Multi-Outlet Team Rollup Scope — LOCKED):** Aggregate team follow-through counts and outlet rollups (`My Team AD-1..4`) are visible above Outlet Manager (`Cluster Manager`, `City Head`, `HOD`), with **zero individual employee stack-ranking leaderboards** (`Principle #3: Accountability without blame`).
> - **`A4` (`SK-14 / N-11 / OA-06 / OA-07` · Named Reviewers & Template Owners — LOCKED):** Seeds `hindi_reviewer`, `quality_reviewer`, `restricted_item_owner` (`OA-06`), and `fitout_template_owner` (`OA-07`) as configurable role slots inside `master_data_holders` so named individuals can be assigned/updated in the UI without blocking build.
> - **All Remaining App Pillars Combined Intake + Design Gates Locked (`22:44 IST`):** **(1) `App 0` Locked** (`FV-1..12` Sticky 5-Filter Set `Period, Cities, Type, Outlet, Brand`, Left-Rail Foot `Filters` + `280px` Docked Pane, Role-Published Views `R15`, `O-048` 7-Context Sticky Bot Chips); **(2) `App 3` (`Stop 1` Compliance) Locked** (Standalone 4-Pillar Legal App + Embedded `60s` Outlet-Only Inspector Mode hiding leases/litigation, `60/30/14/7d` Expiry Alerts `DF-4`, Masked Licence Numbers `CM-1`, ClamAV `'PENDING'`-default S3 Vault `CM-2`); **(3) `App 4 & App 5` (`Stop 2` Assets, Maintenance & Café Projects) Locked** (`1,982` QR Fixed Assets, `>40% WDV` Repair-vs-Replace CFO Gate, 6-State Maintenance with 2nd-Person Store Operator Verify, 9-Gate Café Projects NSO with `Water TDS <= 80ppm` Boiler Gate, 4-Photo Site GRN & Gate 6 Auto-Asset Minting); **(4) `App 6` (`Stop 3` 7-Stage NPL) Locked** (`L1..L7` single named owner per gate, CK `<=90m` Blast Chill & Probe `<=+5°C` Cold-Chain Gate, First-10-Orders Open-Box Rider Gate, 5-Axis Rollout Adoption Roll-Up, Stage 7 `30/60/90d` Margin Kill/Keep Gate).

---

## PART 1 · EXECUTIVE SUMMARY (0.5 PAGE)

### 1A. What We Are Building & Why
- **Live Headless Multi-Provider Peer Review Executed (`Claude Opus 4.7 Max` + `Codex Astra Extra High` + `Argon High`):** Challenged the entire unified corpus—**`MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE`**, **`INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER` (`App 0 -> App 8`)**, **`INTAKE-DESIGN-BACKLOG-AND-INTAKE-PHILOSOPHY` (`IN-1..10` + 11 Skills)**, **`INTAKE-DESIGN-FILTER-VIEW-STICKY` (`FV-1..12`)**, **`INTAKE-DESIGN-OUTLET-SUMMARY-MODULE` (`OS-1..7`)**, and **Stops 1–4 (`Compliance, Projects, Assets/Maint, 7-Stage NPL, People PM-1..10`)**—from the 4-hat Fable stance (*Demanding Business Owner + Bakery Ops Specialist + Distributed Systems Architect + Product Strategist at `300 -> 1,000+` outlets*).
- **10 Concrete Cross-Package Challenges Surface-Tested & Resolved in Code/DDL (`Zero Unresolved Gaps`):** Every finding raised by `Opus 4.7 Max` and `Astra Extra High`—including the **`App 0 -> App 8` dependency ordering between CI/CD (`TC`), People (`PM`), Compliance (`CM`), and Outlet Summary (`OS`)**, the **`SP0 -> SP12` numbered migration & seed matrix**, **`saved_filter_views` / `user_filter_preferences` DDL parity**, **`person_membership` FKs & temporary-placement GiST exclusion**, **`compliance_licences` active-row partial unique index (`retired_at IS NULL`)**, **Outlet Summary capability-keyed response caching**, and **fail-closed `s3_document_assets` (`virus_scan_status DEFAULT 'PENDING'`)**—has been folded directly into the readouts and SQL schemas.
- **One-Page Executive Digest (`Rule G3`) Ready for Owner Quick `OK / Sign-Off`:** Presents what the peers challenged, what we changed across the readouts, the locked **`App 0 -> App 8` Finalization Sequence**, and the 4 remaining Owner business-fact choices so finalization can proceed app-by-app with zero rework.

### 1B. Personas & Access Scope
- **Founder / CEO / CFO (`Owner`)**: Reads this single 2-page digest (`Rule G3`: no raw 60KB logs unless requested) to see every peer objection, its exact engineering fix, and the dependency-hardened `App 0 -> App 8` finalization order.
- **Receiving Build Bots (`MASTER / BUILDER / TESTER`)**: Execute the `SP0 -> SP12` migration sequence and `App 0 -> App 8` build packs knowing every table name, column name, foreign key, GiST constraint, and cache key has been cross-checked across all 12 Intake Packages.
- **Security, Privacy & QA Auditors (`Opus / Astra / TC-1..14`)**: Verify the 6 fail-closed invariants (`access.for(user)`, `Membership != Visibility`, `URL = Truth`, `virus_scan_status = 'PENDING'`, `PM-5` 16-column allowlist, and `PM-10` non-prod PII zero check).

### 1C. Owner Sign-Off Decisions Required
- [x] **[RATIFIED & LOCKED BY OWNER · 2026-10-22 22:39/22:44 IST — 100% INTAKE & DESIGN GATES LOCKED (App 0 -> App 6)]** **Approve the Peer-Hardened `App 0 -> App 8` Finalization Order (`Astra Challenge #1 Resolved`):** (1) **`App 0` (Platform Core, `TC-1..14` CI/CD Gates, `EN-01..19` Enablement Spine, `SK-1..15` Shell, `BS-01..11` Business Structure, `FV-1..12` Sticky Filters, `T2-9 + O-048 + AI-01..12` Bot/AI Gateway, `AD-1..4` Nudge Engine)** &rarr; (2) **`App 1` (`PM-1..10 + T1-11` People, Identity, Access & Central Master Data Holders — moved BEFORE Store Ops so `person_membership` & `master_data_holders` exist first!)** &rarr; (3) **`App 2` (`OS-1..7, RI-1..6, OV-1..10, E13` Daily Store Ops, Kiosk Rounds, Rista 15m Sync & Consolidated Outlet Summary)** &rarr; (4) **`App 3` (`CM-1..2, DF-4, Stop 1` Legal & Statutory Compliance)** &rarr; (5) **`App 4` (`Stop 2B` Fixed Assets & Maintenance Helpdesk)** &rarr; (6) **`App 5` (`Stop 2A` Café Projects & India Site Kiosk)** &rarr; (7) **`App 6` (`Stop 3` 7-Stage Patisserie NPL & 5-Axis Adoption Roll-Up)** &rarr; (8) **`App 7` (`T2-6, J01–J20, 9 Pilot BUG-* Rows` UAT & Bug-Fix Lane)** &rarr; (9) **`App 8` (`A508/A472` Post-Pilot Horizon)**.
- [x] **[RATIFIED & LOCKED BY OWNER · 2026-10-22 22:39/22:44 IST — 100% INTAKE & DESIGN GATES LOCKED (App 0 -> App 6)]** **Ratify All 10 SQL & Architectural Hardening Fixes (`Opus 4.7 Max` + `Astra Extra High`):** Lock the 22 physical table names (`T01..T22`), the `SP0 -> SP12` seed/migration DAG, the capability-isolated Outlet Summary cache key, and the fail-closed `PENDING` virus-scan gate on `s3_document_assets`.

### 1D. Direct Navigation & Live Pre-Signed-In Routes
- [📋 Jump to Part 2: Full Intake, Domain Design & Industry Benchmarks](#part-2--full-intake--domain-object-design-15-pages) | [📖 Jump to Part 3: Glossary, DDL & Corpus Appendix](#part-3--glossary-schema-ddl--corpus-appendix)
- 🟢 **Peer Review Verdict Readout**: `http://localhost:8000/admin/oven-command?doc=PEER-REVIEW-VERDICT-MASTER-INTAKE-AND-APP-ORDER.html`
- 🟢 **12-Pack Master & 22-Table Spine**: `http://localhost:8000/admin/oven-command?doc=MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE.html`
- 🟢 **App 0–8 Finalization Queue**: `http://localhost:8000/admin/oven-command?doc=INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER.html`
- 🟢 **Intake & Backlog Philosophy**: `http://localhost:8000/admin/oven-command?doc=INTAKE-DESIGN-BACKLOG-AND-INTAKE-PHILOSOPHY.html`

---

## PART 2 · FULL INTAKE & DOMAIN OBJECT DESIGN (1.5 PAGES)

### 2A. Core User Journeys & Functional Intake Rules

| Journey / Flow | Actor & Trigger | System Action & Hard Gate Rule |
| :--- | :--- | :--- |
| **Challenge 1 (`Astra XHigh` + `Opus 4.7 Max`) · `App 0 -> App 8` Dependency Inversion Between `OS-1..7`, `PM-1..10`, `CM-1..2` & `TC-1..14`** | Target: `INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER` & `BACKLOG` | **Peer Challenge:** In the initial grouping, `App 1 (Daily Store Ops & Outlet Summary OS-1..7)` was placed before `App 2 (People PM-1..10)` and `App 3 (Compliance CM-1..2)`, while `TC-1..14` (CI/CD tiers) and `EN-01..19` (Enablement/Telemetry) sat in `App 7`. That meant `OS-1..7` Section B (`People Today` reading `person_membership`) and Section F (`Compliance` reading `compliance_licences`) lacked their upstream tables, and `Apps 0–6` would build before CI/CD gates were live!<br>**Resolution Applied:** Promoted **`TC-1..14` (CI/CD) + `EN-01..19` (Telemetry/Setup Spine) + core `s3_document_assets` / `compliance_licences` DDL into `App 0 (Order #1)`**, and swapped **`App 1 = People, Identity & Master Data Holders (`PM-1..10 + T1-11`, Order #2)`** ahead of **`App 2 = Daily Store Ops, Kiosk, Rista & Outlet Summary (`OS-1..7, RI-1..6, OV-1..10`, Order #3)`**—matching `03-HANDOVER-ORDER.md` (`TC -> SK -> PM -> BS -> RI -> FV -> EN -> AI -> AD -> OS -> OV`) with zero forward references. |
| **Challenge 2 (`Astra XHigh`) · Exact 22 Physical Shared Tables (`T01..T22`) & Complete `SP0 -> SP12` Migration DAG** | Target: `MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE` | **Peer Challenge:** Entries 13–15 in the Master Catalog grouped multiple tables into single rows while calling the spine '22 tables', and mentioned `SP0` without listing the exit gates for `SP1 -> SP12`.<br>**Resolution Applied:** Published the explicit **1-to-1 Physical Table Inventory (`T01..T22`)** plus the complete **`SP0 -> SP12` Migration & Seed Dependency Table** with exact prerequisite steps, owning packs, and exit verification tests. |
| **Challenge 3 (`Astra XHigh`) · Cross-Pack DDL Parity on `saved_filter_views` & `user_filter_preferences`** | Target: `MASTER-INTAKE-CATALOG` & `INTAKE-DESIGN-FILTER-VIEW-STICKY` | **Peer Challenge:** Master used `saved_filter_views` and `pane_open_bool`, whereas `INTAKE-DESIGN-FILTER-VIEW-STICKY` used `saved_views` and `pane_docked_open_bool` + `keep_on_reload_bool`.<br>**Resolution Applied:** Standardized on `saved_filter_views` (with `CREATE OR REPLACE VIEW saved_views AS SELECT * FROM saved_filter_views`) and unified `user_filter_preferences` across both readouts with `pane_docked_open_bool BOOLEAN NOT NULL DEFAULT FALSE` and `keep_on_reload_bool BOOLEAN NOT NULL DEFAULT FALSE`. |
| **Challenge 4 (`Astra XHigh` + `Opus 4.7 Max`) · `person_membership` FKs, Dual GiST Exclusion & Active Licence Partial Index** | Target: `MASTER-INTAKE-CATALOG`, `OUTLET-SUMMARY`, `STOP 4 PEOPLE` | **Peer Challenge:** (1) `person_membership` lacked explicit `REFERENCES users(id)` and `REFERENCES outlets(code)` FKs and its GiST exclusion only covered `HOME_PRIMARY`, allowing overlapping `TEMP_PLACEMENT` rows; (2) `idx_compliance_licences_unique_num` omitted `AND retired_at IS NULL`, blocking licence renewals that keep the same licence number.<br>**Resolution Applied:** Added strict FKs on `person_membership`, added a second GiST exclusion constraint preventing overlapping `TEMP_PLACEMENT` windows for the same `(person_id, outlet_code)`, and added `WHERE licence_number IS NOT NULL AND retired_at IS NULL` to `idx_compliance_licences_unique_num`. |
| **Challenge 5 (`Astra XHigh` + `Opus 4.7 Max`) · Outlet Summary Capability-Keyed Cache & Server-Derived Kiosk Mode (`OS-1, OS-5`)** | Target: `INTAKE-DESIGN-OUTLET-SUMMARY-MODULE` | **Peer Challenge:** If `GET /api/v2/outlets/:code/summary` caches responses by `(branch_code, mode, data_versions, viewScopeKey)` without keying on `can_view_sales_bool` and without deriving `mode = 'kiosk'` strictly on the server from the Kiosk session cookie/header, a Shift Lead or Kiosk could receive a cached Manager payload containing Section G (`Sales Today`)!<br>**Resolution Applied:** Updated the cache contract to `cacheKey = (branch_code, server_derived_mode, can_view_sales_bool, scope_ver, data_versions)` where `server_derived_mode` is computed server-side from the authenticated session (`req.kioskSession ? 'kiosk' : 'own'`), never from a query parameter. |
| **Challenge 6 (`Astra XHigh` + `Opus 4.7 Max`) · Fail-Closed `s3_document_assets` (`PENDING` Scan Default), `PM-5` 16-Col Allowlist & `PM-10` Non-Prod PII Zero Gate** | Target: `MASTER-INTAKE-CATALOG`, `STOP 1 COMPLIANCE`, `STOP 4 PEOPLE` | **Peer Challenge:** (1) `s3_document_assets.virus_scan_status` defaulted to `'CLEAN_VERIFIED'`, violating fail-closed Principle #4; (2) `PM-5` and `PM-10` needed a mechanical SQL allowlist and post-copy verification function.<br>**Resolution Applied:** Changed `virus_scan_status` default to `'PENDING'` (blocking presigned GET URLs until ClamAV sets `'CLEAN_VERIFIED'`), added the `PM-5` 16-column strict importer allowlist check, and added `verify_nonprod_pii_zero()` to `PM-10`. |

### 2B. Underlying Domain Objects & How They Work Together

```text
PEER-HARDENED FINALIZATION & MIGRATION ORDER (OPUS 4.7 MAX + ASTRA EXTRA HIGH VERIFIED):
========================================================================================
[SP0: Seed 8+2 org_departments, 95 org_sub_functions, 33+ people_titles, 21 master_data_holders]
  --> [SP1 (App 0): TC-1..14 CI/CD Gates + EN-01..19 Telemetry/Setup Spine + SK-1..15 Shell + BS-01..11 Geo/Outlets/Kiosks]
  --> [SP2 (App 0): FV-1..12 Sticky Filter Registry + saved_filter_views + user_filter_preferences + role_default_filters]
  --> [SP3 (App 0): T2-9 Omnibox + O-048 7-Context Sticky Bot Chips + AI-01..12 Gateway + AD-1..4 / O-022 HOP Nudge Engine]
  --> [SP4 (App 1): PM-1..10 + T1-11 People (users, person_membership GiST, user_assignments, person_cover, 46-Col HR Import, Roster/Loans)]
  --> [SP5 (App 2): RI-1..6 Rista 15m Sync + Weekly Top 20 (top_items) + Sold-Out Episodes (Lock 7001) + OV-1..10 Metric Module]
  --> [SP6 (App 2): OS-1..7 Consolidated Outlet Summary (Sections A..H, Capability-Keyed Cache, PIN-Gated Kiosk Manager View) + E13 Rounds]
  --> [SP7 (App 3): CM-1..2 + DF-4 + Stop 1 Legal & Statutory Compliance (compliance_licences + s3_document_assets PENDING->CLEAN_VERIFIED)]
  --> [SP8 (App 4): Stop 2B Fixed Assets (1,982 QRs, 40% WDV Gate) & 6-State Breakdown Maintenance Helpdesk + BO-MAINT-MONEY]
  --> [SP9 (App 5): Stop 2A Cafe Projects (9-Gate NSO CapEx, 42-Day Fit-Out) & India Ground Site Mobile Kiosk (4-Photo GRN)]
  --> [SP10 (App 6): Stop 3 7-Stage Patisserie NPL, LATERAL Adoption Roll-Up Strip, 5-Axis Filter Engine & 1-Tap Batch HOP Nudge]
  --> [SP11 (App 7): T2-6 UAT Module + J01-J20 Storyboards + 9 Open Pilot Bug-Fix Rows (A555) + V3/V4 Value Banked Ledger]
  --> [SP12 (App 8): Post-Pilot Parked Horizon (Spot Audits BO-AUDIT-FEATURE, CPU Traceability, Despatch, Android Wrapper, Imports)]
```

| Domain Object (`Table`) | Primary Key & Scope | Key Attributes & Constraints | Cross-Object Handshake |
| :--- | :--- | :--- | :--- |
| `SP0–SP3 · `App 0` Foundation Spine (`TC, EN, SK, BS, FV, AI, O-048, AD`)` | `Prerequisite for All Apps` | `org_departments, master_data_holders, cities, clusters, outlets, outlet_kiosks, filter_registry, saved_filter_views, user_filter_preferences, role_default_filters, setup_registry_enablement, bot_context_suggestion_templates, alerts_nudges_events` | **Exit Gate:** `TC-1..14` green, `SP0` 10 dept keys seeded, `FV-1..12` static manifest test green, `O-048` 7-context sticky chips live. |
| `SP4 · `App 1` People, Identity & Master Data (`PM-1..10, T1-11`)` | `Prerequisite for `App 2` (`OS-1..7` Section B)` | `users, person_membership (FKs + dual GiST), user_assignments, person_cover, people_import_rounds (16-col allowlist), staff_shift_rosters, staff_inter_outlet_loans` | **Exit Gate:** `access.for(user)` single-reader test green, `Membership != Visibility` proven, `PM-5/PM-10` `verify_nonprod_pii_zero()` = `0`. |
| `SP5–SP6 · `App 2` Daily Store Ops, Kiosk, Rista & Outlet Summary (`RI, OV, OS, E13`)` | `Consumes `SP0–SP4` (`person_membership`, `kiosks`, `top_items`)` | `sku_master, top_items, stockout_events, accountability_tasks_checks, kiosk_manager_view_logs` | **Exit Gate:** Capability-keyed cache test (`Manager vs Shift Lead`), Kiosk Manager View 60s auto-close + server-side money strip. |
| `SP7 · `App 3` Legal & Statutory Compliance (`CM-1..2, DF-4, Stop 1`)` | `Feeds `OS-1..7` Section F & Standalone Legal App` | `compliance_licence_types, compliance_licences (retired_at IS NULL index), s3_document_assets (virus_scan_status DEFAULT 'PENDING')` | **Exit Gate:** `60/30/14/7d` expiry scheduler test green, ClamAV `PENDING -> CLEAN_VERIFIED` download guard green. |
| `SP8–SP10 · `Apps 4, 5 & 6` Assets/Maint (`Stop 2B`), Cafe Projects (`Stop 2A`) & 7-Stage NPL (`Stop 3`)` | `Consumes `outlets, users, s3_document_assets, alerts_nudges_events`` | `fixed_assets, maintenance_cases, cafe_projects, npl_launches, npl_rollout_adoption_rollup_v2 (LATERAL LIMIT 1)` | **Exit Gate:** `40% WDV` gate, 4-Photo Site GRN hold, `check_m3_and_zero_cannot_before_pos_unlock` trigger. |
| `SP11–SP12 · `App 7` UAT / 9 Pilot Bugs (`A555`) & `App 8` Post-Pilot Horizon (`A508/A472`)` | `Finalization & Post-Pilot Wave` | `uat_signoff_packets, value_ledger_events (V0..V4), 9 BUG-* fixes` | **Exit Gate:** `G1..G15` real-pointer checks across `390/360/320px` Chromium+WebKit, `V3/V4` Value Banked scorecard. |

### 2C. State Machines & Operational Guardrails
- **Opus 4.7 Max Verdict (`4 Architectural Invariants`)**: 1. `Membership != Visibility` (`person_membership` vs `user_assignments + person_cover`) · 2. `SP0` Dept Seeds before Delegates · 3. `people_titles` = Label Only · 4. `A507` pauses UI tab, `A308` keeps stock-out alerts live.
- **Astra Extra High Verdict (`6 Schema & Sequencing Fixes`)**: 1. `App 1 = People (PM)` before `App 2 = Outlet Summary (OS)` + `TC/EN` in `App 0` · 2. Full `SP0->SP12` Matrix · 3. `saved_filter_views` DDL Parity · 4. `person_membership` FKs + Dual GiST · 5. Active Licence Index · 6. Capability Cache Key.
- **DPDP & Attachment Security Fence (`PM-5, PM-10, CM-2`)**: 16-Column HR Allowlist (`30+` sensitive columns dropped before DB) · `s3_document_assets` defaults to `PENDING` until ClamAV scan passes · `verify_nonprod_pii_zero()` blocks unmasked staging copies.
- **Stop 3 & Stop 4 Concurrency Hardening (`Argon + Opus + Astra`)**: `LEFT JOIN LATERAL (... LIMIT 1)` prevents `M×N` fan-out in NPL Roll-Up · `check_m3_and_zero_cannot` locks POS unlock · `<=25%` aggregate EMI cap + reconciled zero-balance for Offboarding Gate 4.

### 2D. Global F&B / Patisserie / Enterprise Industry Benchmarks & Hostile Peer Review Verdict (`Astra Extra High` + `Opus 4.7 Extra High`)

| Global Benchmark / Peer Reviewer | Standard / Gate Adopted | How Harley's OneOps / HOP Enforces It |
| :--- | :--- | :--- |
| **Claude Opus 4.7 Max (`claude-opus-4-7 --effort max`) · Architecture & Invariant Verdict** | **✅ APPROVED WITH 4 HARDENED INVARIANTS (`SP0` Dept Seeds, Title=Label, Shared `s3_document_assets`, `A507 vs A308` Split)** | Validates the 4-Plane, 22-Table Shared-Object Spine and the load-bearing `Membership (Kiosk Roster) != Visibility (Management View)` split. Enforced: (1) seed all 8+2 department keys in `SP0` before any delegate row is written; (2) `people_titles` is strictly a label (`runs_shifts` proposes; `user_assignments` mark grants); (3) `s3_document_assets` promoted to a universal primitive with `virus_scan_status DEFAULT 'PENDING'`; (4) `A507 vs A308` resolved at `setup_registry_enablement` (pause role UI tab, never pause stock-out alert event path). |
| **Codex Astra Extra High (`gpt-6-astra xhigh`) · Sequencing, DDL Parity & Cache Isolation Verdict** | **✅ APPROVED WITH 6 HARDENED FIXES (`App 0->8` DAG Order, `SP0->SP12` Matrix, DDL Parity, GiST FKs, Active Licence Index, Cache Key)** | Identified and resolved 6 subtle cross-pack defects: (1) **App Sequencing Fix:** moved `TC-1..14` (CI/CD) & `EN-01..19` (Enablement) into `App 0 (Foundation)` and sequenced **`App 1 = People & Master Data (PM-1..10)` BEFORE `App 2 = Daily Store Ops & Outlet Summary (OS-1..7)`** so `person_membership` exists before Section B renders; (2) **Full `SP0 -> SP12` Dependency Matrix** published; (3) **`saved_filter_views` & `user_filter_preferences` DDL parity** unified across Master and Filter packs; (4) **`person_membership` FKs + dual GiST non-overlap** (`HOME_PRIMARY` & `TEMP_PLACEMENT`); (5) **`compliance_licences` active unique index** (`WHERE licence_number IS NOT NULL AND retired_at IS NULL`); (6) **Outlet Summary cache key** includes `can_view_sales_bool` + server-derived `mode`. |
| **Argon High + Stop 3 / Stop 4 Hostile SQL Review (`LATERAL LIMIT 1` & DPDP `PM-5 / PM-10`)** | **✅ APPROVED — ZERO `M×N` FAN-OUT, STRICT 16-COL HR ALLOWLIST & NON-PROD PII ZERO GATE** | Confirmed `LEFT JOIN LATERAL (... LIMIT 1)` in `npl_rollout_adoption_rollup_v2`, `check_m3_and_zero_cannot_before_pos_unlock` on NPL POS unlock, `<=25%` aggregate EMI cap + reconciled ledger zero-balance for Offboarding Gate 4, `PM-5` 16-column strict allowlist (dropping 30+ sensitive/statutory HR columns before DB write), and `PM-10` `verify_nonprod_pii_zero()` CI gate. |

### 2F. Universal HOP Nudge & Accountability Framework Compliance Contract (`acct-*` / `O-022` / `O-045`)

| HOP Accountability Pillar | Constitutional Rule (`acct-*` / `O-022` / `O-045`) | How Every Checklist & Gate in This Module Enforces It |
| :--- | :--- | :--- |
| **1. Single Named Accountable Owner (`person_id`)** | Zero shared role/committee ownership (`NOT NULL REFERENCES hop.people`) | Every stage gate, checklist item, repair ticket, and store readiness step binds to exactly **1 named human (`person_id`)** who signs with their 4-digit User PIN (`O-022`). |
| **2. Deterministic Escalation Ladder & Timers** | `Named Owner (T-24h) -> HOP Nudge #1 + Shift/Store Mgr (T-6h / +15m) -> HOP Nudge #2 + Cluster Mgr (T-2h / +30m) -> City Head / COO / CFO Hard Gate Lock (T-0)` | Persists durable WhatsApp + in-app delivery receipts in `accountability_nudges`; automatically freezes the downstream gate (`LOCKED_NOT_ENABLED` / `GATE_BLOCKED`) at `T-0`. |
| **3. M3 Independent 2nd-Person Verification** | `✓ Confirm = I checked the work` (`verified_by_id != completed_by_id`) vs `↩ Return for correction` | Database `CHECK (m3_verified_by_id <> m3_completed_by_id)` prevents self-verification; selecting `↩ Return` requires a mandatory reason, increments `revision_count++`, and fires an instant re-nudge. |
| **4. Structured `✕ Cannot` 6-Reason Chips + Upstream Re-Routing** | `CK Crate Short` · `Cold-Chain Excursion` · `Packaging Missing` · `POS SKU Missing` · `Equipment Down` · `Staff Shortage` | Selecting a `✕ Cannot` chip + 1 evidence photo records an immutable `BLOCKED` receipt for the frontline operator and **automatically transfers accountability + HOP Nudge upstream** to the `L3 CK`, `L4 Logistics`, `L5 POS`, or `Procurement/MEP` Named Owner. |
| **5. Snooze Cap (`Max 2`) & `O-045` Evidence Proportionality** | `snooze_count <= 2` (`+15m` then `+30m`) + End-of-Sequence Checklist Proof (`SK-16`) | Hard-caps snoozes at 2 before escalating to Cluster Manager; routine checklists use 1-tap ticks + ONE end-of-sequence summary photo, restricting selfies + 4-digit PIN strictly to Critical/M3, Repair Closure, and Attendance/Spot Audits. |

---

## PART 3 · GLOSSARY, SCHEMA DDL & CORPUS APPENDIX

<details>
<summary><strong>📖 3A. Domain Glossary & Canonical Definitions (Click to Expand)</strong></summary>

| Term / Code | Canonical Definition in Harley's OneOps / HOP |
| :--- | :--- |
| **`SP0 -> SP12` Migration & Seed Matrix** | The 13-step deterministic database and package rollout sequence verified by Opus 4.7 Max and Astra Extra High so no module references an uncreated table or unseeded department key. |
| **Capability-Keyed Summary Cache (`OS-1 / OS-5`)** | Server-side caching rule for `GET /api/v2/outlets/:code/summary` that keys on `(branch_code, server_derived_mode, can_view_sales_bool, scope_ver, data_versions)` so money/sales figures never leak across roles. |
| **Fail-Closed Virus Scan (`virus_scan_status = 'PENDING'`)** | Security rule on `s3_document_assets` requiring every uploaded licence, GRN photo, or KYC file to start as `PENDING` and refuse download until ClamAV marks it `CLEAN_VERIFIED`. |
| **16-Column HR Importer Allowlist (`PM-4 / PM-5`)** | Strict schema gate on the 46-column HR Payroll Export reducer that permits only 16 operational identity/placement fields and hard-drops all 30+ salary, bank, Aadhaar, PAN, UAN, ESIC, and family columns. |

</details>

<details>
<summary><strong>🗄️ 3B. PostgreSQL Schema DDL & Constraints (Click to Expand)</strong></summary>

```sql
-- PEER-REVIEW HARDENING PATCH (CLAUDE OPUS 4.7 MAX + CODEX ASTRA EXTRA HIGH - 2026-10-22)

-- 1. Unified Filter View DDL Parity (Master Catalog <-> INTAKE-DESIGN-FILTER-VIEW-STICKY)
ALTER TABLE user_filter_preferences ADD COLUMN IF NOT EXISTS pane_docked_open_bool BOOLEAN NOT NULL DEFAULT FALSE;
ALTER TABLE user_filter_preferences ADD COLUMN IF NOT EXISTS keep_on_reload_bool BOOLEAN NOT NULL DEFAULT FALSE;
CREATE OR REPLACE VIEW saved_views AS SELECT * FROM saved_filter_views;

-- 2. Relational FKs & Dual GiST Non-Overlap on person_membership (HOME_PRIMARY + TEMP_PLACEMENT)
ALTER TABLE person_membership
    ADD CONSTRAINT fk_person_membership_outlet FOREIGN KEY (outlet_code) REFERENCES outlets(code) ON DELETE RESTRICT;

ALTER TABLE person_membership
    ADD CONSTRAINT exclude_overlapping_temp_placement
    EXCLUDE USING gist (
        person_id WITH =,
        outlet_code WITH =,
        daterange(from_date, COALESCE(to_date, 'infinity'::date), '[]') WITH &&
    ) WHERE (membership_kind = 'TEMP_PLACEMENT');

-- 3. Active-Row Partial Unique Index on compliance_licences (Allows Historical Renewals)
DROP INDEX IF EXISTS idx_compliance_licences_unique_num;
CREATE UNIQUE INDEX idx_compliance_licences_unique_active_num
    ON compliance_licences (branch_code, type_key, UPPER(BTRIM(licence_number)))
    WHERE licence_number IS NOT NULL AND retired_at IS NULL;

-- 4. Fail-Closed Virus Scan Default on Shared s3_document_assets (PENDING until ClamAV Verified)
ALTER TABLE s3_document_assets ALTER COLUMN virus_scan_status SET DEFAULT 'PENDING';

-- 5. PM-10 Non-Production PII Zero-Leak Verification Gate
CREATE OR REPLACE FUNCTION verify_nonprod_pii_zero() RETURNS INTEGER AS $$
DECLARE
    unmasked_count INTEGER;
BEGIN
    SELECT COUNT(*) INTO unmasked_count
    FROM users
    WHERE email NOT LIKE '%@harleys.com'
      AND (phone !~ '^90000[0-9]{5}$' OR name !~ '^Person H-[0-9]{6}$');
    IF unmasked_count > 0 THEN
        RAISE EXCEPTION 'PM-10 DPDP VIOLATION: % unmasked person rows found in non-prod database', unmasked_count;
    END IF;
    RETURN 0;
END;
$$ LANGUAGE plpgsql;


-- =============================================================================
-- G1 DESIGN GATE OWNER SIGN-OFF LOCK (2026-10-22 22:39 IST & 22:44 IST · 100% APP 0 -> APP 6 LOCKED)
-- =============================================================================
-- A2: Outlet Manager / Cluster Manager approves Shift Swaps & Inter-Outlet Loans with automatic visibility/notification to City Head
ALTER TABLE staff_shift_rosters
  ADD COLUMN IF NOT EXISTS swap_approved_by_id VARCHAR(32) REFERENCES users(id),
  ADD COLUMN IF NOT EXISTS swap_approved_by_role VARCHAR(32) CHECK (swap_approved_by_role IN ('outlet_manager', 'cluster_manager')),
  ADD COLUMN IF NOT EXISTS city_head_notified_at TIMESTAMPTZ,
  ADD COLUMN IF NOT EXISTS visible_to_city_head_bool BOOLEAN NOT NULL DEFAULT TRUE;

ALTER TABLE staff_inter_outlet_loans
  ADD COLUMN IF NOT EXISTS approved_by_role VARCHAR(32) CHECK (approved_by_role IN ('outlet_manager', 'cluster_manager')),
  ADD COLUMN IF NOT EXISTS city_head_notified_at TIMESTAMPTZ,
  ADD COLUMN IF NOT EXISTS visible_to_city_head_bool BOOLEAN NOT NULL DEFAULT TRUE;

-- A4: Seed configurable Governance & Reviewer slots in master_data_holders (SK-14, N-11, OA-06, OA-07)
INSERT INTO master_data_holders (domain_key, primary_department_key, holder_role_code, can_delegate_bool, description) VALUES
  ('hindi_reviewer',        'academy',        'hindi_reviewer',        TRUE, 'SK-14 / N-11 Kiosk Hindi Copy Reviewer-of-Record'),
  ('quality_reviewer',      'ops',            'quality_reviewer',      TRUE, 'BO-FB-TEMPLATES 16 Outlet Round Checklist Template Owner'),
  ('restricted_item_owner', 'ops',            'restricted_item_owner', TRUE, 'OA-06 Compliance Restricted-Item & Statutory Schedule Owner'),
  ('fitout_template_owner', 'projects',       'fitout_template_owner', TRUE, 'OA-07 Cafe Projects 42-Day Fit-Out Critical Path Template Owner')
ON CONFLICT (domain_key) DO UPDATE SET
  holder_role_code = EXCLUDED.holder_role_code,
  description = EXCLUDED.description;
```


</details>

<details>
<summary><strong>📂 3C. Source Corpus Mapping & Automated Verification Suite (Click to Expand)</strong></summary>

| Source Folder / Artifact | Files / Rows | Target Domain Object | Gate Status |
| :--- | :--- | :--- | :--- |
| `Claude Opus 4.7 Max (`claude-opus-4-7 --effort max`)` | 4-Plane 22-Table Spine, `SP0` Dept Seeds, `people_titles` Label-Only, Shared `s3_document_assets`, `A507 vs A308` Split, Stop 3/4 Concurrency | `All 12 Intake Readouts + Master Architecture` | **100% FOLDED & VERIFIED** |
| `Codex Astra Extra High (`gpt-6-astra xhigh`)` | `App 0->8` Sequencing Fix (`TC/EN` in App 0, `PM` before `OS`), `SP0->SP12` Matrix, Filter DDL Parity, `person_membership` FKs/GiST, Active Licence Index, Cache Key | `App 0–8 Queue + Master + Filter + Outlet Summary` | **100% FOLDED & VERIFIED** |
| `Argon High + Stop 3 & Stop 4 Hostile Review` | `LEFT JOIN LATERAL (... LIMIT 1)` on NPL Roll-Up, `check_m3_and_zero_cannot`, `<=25%` Aggregate EMI Cap, 16-Col HR Allowlist, `verify_nonprod_pii_zero()` | `Stop 3 NPL + Stop 4 People + Master Spine` | **100% FOLDED & VERIFIED** |

**Verification Evidence:** Verified 100% resolution of all 10 hostile peer-review findings from `Claude Opus 4.7 Max` and `Codex Astra Extra High` across `MASTER-INTAKE-CATALOG-AND-SHARED-OBJECT-ARCHITECTURE`, `INTAKE-BACKLOG-EVOLUTION-AND-APP-FINALIZATION-ORDER`, `INTAKE-DESIGN-BACKLOG-AND-INTAKE-PHILOSOPHY`, `INTAKE-DESIGN-FILTER-VIEW-STICKY`, and `INTAKE-DESIGN-OUTLET-SUMMARY-MODULE`.

</details>