{
  "reviewed": "2026-10-15",
  "basis": "Verified implementation evidence plus sanitized requirements from the August 27\u201328 and October 12 operator discussions and POS comparison. Private chat text, attachments, customer records and credentials are excluded. Available describes implemented scope; partial entries name the missing production workflow.",
  "production": "SER8/Incus runs SQLite 3.53.2 with conservative job concurrency. This catalog describes code scope; deployment and recovery verification are recorded in the repository release receipts.",
  "phases": [
    {
      "id": "0",
      "name": "Now \u00b7 reliable SQLite operations",
      "goal": "Ship the feature catalog, planner maintenance and conservative worker concurrency. Reconcile production documentation.",
      "acceptance": "Both adapter CI jobs pass; authenticated catalog renders; diagnostics contain no customer data; Pages links and mobile layout verified."
    },
    {
      "id": "1",
      "name": "Next \u00b7 inventory execution",
      "goal": "Complete native stock coverage and exact location/identity count comparisons; extend reviewed gram recipes, lot consumption, exception review, scanner counts and reservations. Then add material/Sheets reconciliation, transfers and backorders. Payment and terminal execution have separate acceptance gates.",
      "acceptance": "Tenant/role isolation, exact source identities, completeness, replay and concurrent stock/mapping tests pass; counts use one verified source/location pool. Overlap commissions award 1% independently to each worker. Primary POS requires demonstrated taxes, tender/tip/refund/settlement, hardware and operator acceptance before cutover."
    },
    {
      "id": "2",
      "name": "Then \u00b7 fulfillment and channels",
      "goal": "Returns/exchanges, carrier labels, lot/serial traceability and marketplace listing adapters.",
      "acceptance": "Sandbox round trips cover partial fulfillment, cancellation, duplicate events and failed payments; no automatic equalization of independent inventories."
    },
    {
      "id": "3",
      "name": "Then \u00b7 trusted financial operations",
      "goal": "Double-entry ledger, reconciliation, open books, forecasts, profit sharing and payroll exports.",
      "acceptance": "Trial balance balances, closed periods reject edits, source-to-report totals reconcile, compensation permissions pass and provider exports reconcile."
    },
    {
      "id": "4",
      "name": "Later \u00b7 broader ERP",
      "goal": "Manufacturing, CRM/marketing, public integrations, offline mobile work and multi-company reporting.",
      "acceptance": "Each module has an owner, data contract, migration, tenant/security tests, operational runbook and a measured capacity check before release."
    }
  ],
  "features": [
    {
      "id": "F01",
      "area": "Commerce",
      "name": "Shopify + Square mirror",
      "status": "Available",
      "scope": "Read-only source sync; independent location stock, no automatic equalization.",
      "evidence": "web/app/services/sync_engine.rb",
      "phase": "0"
    },
    {
      "id": "F02",
      "area": "Commerce",
      "name": "SwipeSimple sales import",
      "status": "Available",
      "scope": "Reviewed, tenant-scoped Rupert line-item CSV imports with explicit paid status, timestamp, currency and tender; whole-file validation, atomic writes and unchanged replay safety. Native SwipeSimple reports may need conversion; refunds, split tenders, tax/tips/fees and direct API access are not supported.",
      "evidence": "web/app/services/swipesimple_importer.rb",
      "phase": "0"
    },
    {
      "id": "F03",
      "area": "Commerce",
      "name": "Sales journal",
      "status": "Available",
      "scope": "Hourly/location sales pivot and order details.",
      "evidence": "web/app/controllers/sales_controller.rb",
      "phase": "0"
    },
    {
      "id": "F04",
      "area": "Commerce",
      "name": "Register settlement",
      "status": "Available",
      "scope": "Local cash sessions, recorded tender totals and physical closing-count audit; processor settlement, payouts and bank deposits are not performed.",
      "evidence": "web/app/modules/sales/pos_session.rb",
      "phase": "0"
    },
    {
      "id": "F05",
      "area": "Commerce",
      "name": "Customer directory",
      "status": "Available",
      "scope": "Unified customer history and search; not a marketing CRM pipeline.",
      "evidence": "web/app/controllers/customers_controller.rb",
      "phase": "0"
    },
    {
      "id": "F06",
      "area": "Commerce",
      "name": "Invoices and packing slips",
      "status": "Available",
      "scope": "Printable documents for existing orders.",
      "evidence": "web/app/controllers/orders_controller.rb",
      "phase": "0"
    },
    {
      "id": "F07",
      "area": "Commerce",
      "name": "Fulfillment and tracking",
      "status": "Available",
      "scope": "Record tracking and fulfillment transitions; carrier label purchasing is planned separately.",
      "evidence": "web/app/modules/core/fulfillment.rb",
      "phase": "0"
    },
    {
      "id": "F08",
      "area": "Commerce",
      "name": "Refund recording",
      "status": "Partial",
      "scope": "Local refund workflow; verify platform settlement separately.",
      "evidence": "web/app/modules/core/refund.rb",
      "phase": "0"
    },
    {
      "id": "F09",
      "area": "Stock",
      "name": "Location inventory",
      "status": "Available",
      "scope": "Inventory workspace with filtered, paginated source/location pools, signed observations, local and warehouse holds, advisory availability, incoming transfers, waiting demand and complete CSV export. Native Shopify/C-Trax comparison retains source freshness and identity gates; physical reference stock is never summed across sources.",
      "evidence": "docs/ops/shared-stock-comparison.md",
      "phase": "0"
    },
    {
      "id": "F10",
      "area": "Stock",
      "name": "Catalog identity links",
      "status": "Available",
      "scope": "One-to-one normalized-SKU auto matching with protected manual mappings and persistent explicit unlink decisions. Ambiguous automatic claims remain unresolved; local decisions serialize per tenant. Channel stock remains independent.",
      "evidence": "web/app/services/square_syncer.rb",
      "phase": "0"
    },
    {
      "id": "F11",
      "area": "Stock",
      "name": "Count approval workflow",
      "status": "Available",
      "scope": "Local prepare/submit/approve/reject/reopen audit flow. New Shopify comparisons use the exact native on-hand location snapshot with shop/catalog epoch and freshness checks; C-Trax retains native store/variant snapshots. Missing or ambiguous evidence has no delta; prior submitted bases stay frozen. Approval does not write source stock.",
      "evidence": "web/app/services/inventory_count_comparison.rb",
      "phase": "0"
    },
    {
      "id": "F12",
      "area": "Stock",
      "name": "Reorder advice",
      "status": "Available",
      "scope": "Sales pace, days of cover and suggested reorder quantities; advice only.",
      "evidence": "web/app/services/restock_advisor.rb",
      "phase": "0"
    },
    {
      "id": "F13",
      "area": "Stock",
      "name": "Size families",
      "status": "Available",
      "scope": "Root/member derivation with explicit approval for outbound platform changes.",
      "evidence": "web/app/controllers/size_families_controller.rb",
      "phase": "0"
    },
    {
      "id": "F14",
      "area": "Purchasing",
      "name": "Vendors and purchase orders",
      "status": "Available",
      "scope": "Supplier records, draft/place/receive lifecycle, whole-unit partial deliveries, immutable receipt deltas, monotonic cumulative totals and replay-safe receiving. Draft edits and receiving serialize with placement/cancellation; receipts do not mutate source stock.",
      "evidence": "web/app/controllers/purchasing/purchase_orders_controller.rb",
      "phase": "0"
    },
    {
      "id": "F15",
      "area": "Wholesale",
      "name": "Vendor catalog and cart",
      "status": "Available",
      "scope": "Token-gated warehouse catalog, bulk tiers, cart and checkout.",
      "evidence": "web/app/controllers/warehouse_checkouts_controller.rb",
      "phase": "0"
    },
    {
      "id": "F16",
      "area": "Wholesale",
      "name": "Card payment integration",
      "status": "Partial",
      "scope": "Authorize.net integration exists; credentials and end-to-end settlement must be verified per deployment.",
      "evidence": "web/app/services/authorize_net_client.rb",
      "phase": "0"
    },
    {
      "id": "F17",
      "area": "Finance",
      "name": "Expenses and vendor payments",
      "status": "Available",
      "scope": "Money-out records, payable balances and reversible soft deletion.",
      "evidence": "web/app/controllers/finance/vendor_payments_controller.rb",
      "phase": "0"
    },
    {
      "id": "F18",
      "area": "Finance",
      "name": "Chart of accounts and reporting",
      "status": "Available",
      "scope": "Account classification, receivables/payables, a double-entry general ledger and financial statements.",
      "evidence": "web/app/modules/finance/account.rb",
      "phase": "0"
    },
    {
      "id": "F19",
      "area": "People",
      "name": "Staff directory",
      "status": "Available",
      "scope": "Departments, positions, status lifecycle and HR records.",
      "evidence": "web/app/modules/people/employee.rb",
      "phase": "0"
    },
    {
      "id": "F20",
      "area": "People",
      "name": "Timesheets and PTO",
      "status": "Available",
      "scope": "Top-level submitted-hours review queue for admins, managers and least-privileged shift leaders; approve/return with audit history and no self-review. Timesheets links to all available retained Square and C-Trax history, with reviewer/all-employee filters including inactive, open, unmatched and unassigned records, latest clock/break punches, original evidence and immutable C-Trax observation history. Exact native identities and consolidation preserve staff history; formula-safe CSV respects own-worker/workspace boundaries. Source-history implementation deployed and complete source reads succeeded on October 17, 2026; authenticated access/render and pre/post-deployment recovery verification passed. Automatic C-Trax labor refresh has workspace opt-in, revision/actor/connection checks, safe attempt/freshness status and 15-minute server dispatch at minutes 02/17/32/47; enabled and verified for Herbal Healers on SER8 on October 17, 2026. Square retains its existing opt-in schedule. Approval rechecks retained entries, active employment, changed imported hours and pending clock corrections. No automatic approvals, additive cross-source totals or payroll posting; staff self-service, payroll locks and PTO remain available.",
      "evidence": "web/test/integration/timesheet_reviews_test.rb",
      "phase": "0"
    },
    {
      "id": "F21",
      "area": "People",
      "name": "Payroll calculations",
      "status": "Partial",
      "scope": "Pay runs and payslips; no claim of tax filing, direct deposit or statutory compliance.",
      "evidence": "web/app/modules/people/pay_run.rb",
      "phase": "0"
    },
    {
      "id": "F22",
      "area": "Work",
      "name": "Projects and tasks",
      "status": "Available",
      "scope": "Project/task transitions and tracking.",
      "evidence": "web/app/modules/projects/task.rb",
      "phase": "0"
    },
    {
      "id": "F23",
      "area": "Work",
      "name": "Goals and KPIs",
      "status": "Available",
      "scope": "Goal lifecycle, KPI readings and history.",
      "evidence": "web/app/modules/goals/kpi.rb",
      "phase": "0"
    },
    {
      "id": "F24",
      "area": "System",
      "name": "Role and tenant permissions",
      "status": "Available",
      "scope": "Tenant-scoped roles, permissions and user overrides.",
      "evidence": "web/app/models/user.rb",
      "phase": "0"
    },
    {
      "id": "F25",
      "area": "System",
      "name": "Login and Google OAuth",
      "status": "Available",
      "scope": "Password login and configured Google domains.",
      "evidence": "web/app/controllers/oauth_controller.rb",
      "phase": "0"
    },
    {
      "id": "F26",
      "area": "System",
      "name": "Audit and access history",
      "status": "Available",
      "scope": "Activity and access-log views.",
      "evidence": "web/app/controllers/access_logs_controller.rb",
      "phase": "0"
    },
    {
      "id": "F27",
      "area": "System",
      "name": "Global search",
      "status": "Available",
      "scope": "SQLite FTS5 trigram or PostgreSQL search, tenant-scoped results.",
      "evidence": "web/app/services/search_sql.rb",
      "phase": "0"
    },
    {
      "id": "F28",
      "area": "System",
      "name": "Sync and worker monitoring",
      "status": "Available",
      "scope": "Sync history, system page and host freshness watcher.",
      "evidence": "deploy/ser8/rupert-sync-watch.sh",
      "phase": "0"
    },
    {
      "id": "F29",
      "area": "System",
      "name": "SQLite backup and restore",
      "status": "Available",
      "scope": "Consistent snapshots and restore tooling; off-host recovery needs a separate drill.",
      "evidence": "bin/backup.sh",
      "phase": "0"
    },
    {
      "id": "F30",
      "area": "System",
      "name": "Features and roadmap",
      "status": "Available",
      "scope": "Signed-in feature catalog; shared with the public Pages site.",
      "evidence": "web/app/controllers/roadmap_controller.rb",
      "phase": "0"
    },
    {
      "id": "F31",
      "area": "System",
      "name": "SQLite planner maintenance",
      "status": "Available",
      "scope": "Configuration/space diagnostics and explicit bounded PRAGMA optimize.",
      "evidence": "web/app/services/sqlite_maintenance.rb",
      "phase": "0"
    },
    {
      "id": "F32",
      "area": "System",
      "name": "SQLite concurrency defaults",
      "status": "Available",
      "scope": "One background job thread by default on SQLite; configurable for measured workloads.",
      "evidence": "web/config/queue.yml",
      "phase": "0"
    },
    {
      "id": "F33",
      "area": "Stock",
      "name": "Barcode scanning and labels",
      "status": "Partial",
      "scope": "Exact SKU and imported native barcode scan-to-count, replay-safe draft entry and audit receipts; C-Trax native-ID worksheets cover missing SKUs. Shopify missing-SKU worksheets, scan-to-receive, label printing and camera/offline support remain separate work.",
      "evidence": "web/app/services/inventory_count_scan.rb",
      "phase": "1"
    },
    {
      "id": "F34",
      "area": "Stock",
      "name": "Transfers, reservations and backorders",
      "status": "Partial",
      "scope": "Exact source/item/location reservations, transfers with held allocation, confirmed dispatch, partial receipts, and backorders with demand/allocation/fulfillment/cancellation. Immutable actor/event history, replay protection, freshness/identity gates and shared warehouse/local capacity. Source-enforced reservations, C-Trax transfer execution, automatic source writes and partial backorder allocation remain planned.",
      "evidence": "web/app/services/stock_request_workflow.rb",
      "phase": "1"
    },
    {
      "id": "F35",
      "area": "Stock",
      "name": "Serial, lot and expiry tracking",
      "status": "Partial",
      "scope": "Raw-material lot receipts, movements and selected-lot sale-use receipts are implemented. Finished-good serials, expiry/recall and broader receipt-to-return traceability remain planned.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "2"
    },
    {
      "id": "F36",
      "area": "Commerce",
      "name": "Carrier rates and label purchase",
      "status": "Planned",
      "scope": "Rate comparison, approved label purchase, void/refund and tracking webhooks.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "2"
    },
    {
      "id": "F37",
      "area": "Commerce",
      "name": "Returns and exchanges",
      "status": "Planned",
      "scope": "Return authorization, inspection, restock and separately confirmed payment settlement.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "2"
    },
    {
      "id": "F38",
      "area": "Commerce",
      "name": "Marketplace listings and channels",
      "status": "Planned",
      "scope": "Amazon/eBay/Etsy/WooCommerce adapters with identity mapping and replay-safe imports.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "2"
    },
    {
      "id": "F39",
      "area": "Finance",
      "name": "Double-entry ledger and close",
      "status": "Available",
      "scope": "Balanced journal entries with idempotent posting from sales, expenses and vendor payments; manual entries; trial balance, income statement and balance sheet with CSV export; and ledger period locks that block edits to closed periods.",
      "evidence": "web/app/services/finance/posting.rb",
      "phase": "3"
    },
    {
      "id": "F40",
      "area": "Finance",
      "name": "Bank reconciliation and accounting exports",
      "status": "Available",
      "scope": "Statement-to-GL matching workbench (sign/amount/date) with confirm and difference reporting, duplicate-line review with ignore, and QuickBooks IIF / CSV ledger export.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "3"
    },
    {
      "id": "F41",
      "area": "Finance",
      "name": "Open-book profitability",
      "status": "Planned",
      "scope": "Permissioned COGS/labor/margin by channel and product, traceable to source records.",
      "evidence": "docs/plans/PUBLIX_MODEL_6PERSON.md",
      "phase": "3"
    },
    {
      "id": "F42",
      "area": "Finance",
      "name": "Budgets and forecast vs actual",
      "status": "Planned",
      "scope": "Versioned assumptions, monthly variance and explainable inventory demand forecasts.",
      "evidence": "docs/plans/PUBLIX_MODEL_6PERSON.md",
      "phase": "3"
    },
    {
      "id": "F43",
      "area": "People",
      "name": "Profit-share distribution ledger",
      "status": "Planned",
      "scope": "Owner-approved formula versions, accruals and payout records; individual compensation stays permissioned.",
      "evidence": "docs/plans/PUBLIX_MODEL_6PERSON.md",
      "phase": "3"
    },
    {
      "id": "F44",
      "area": "People",
      "name": "Shift scheduling and payroll export",
      "status": "Planned",
      "scope": "Shift coverage and approved payroll provider export with reconciliation.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "3"
    },
    {
      "id": "F45",
      "area": "Production",
      "name": "BOM, kits and manufacturing",
      "status": "Planned",
      "scope": "Component consumption, yield, costing and assembly reversals.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "4"
    },
    {
      "id": "F46",
      "area": "CRM",
      "name": "Leads, loyalty and marketing",
      "status": "Planned",
      "scope": "Lead stages, consent records, segmentation and reviewed campaign drafts.",
      "evidence": "docs/research/SOCIAL_AUTOMATION_OPTIONS.md",
      "phase": "4"
    },
    {
      "id": "F47",
      "area": "System",
      "name": "Public API and integrations",
      "status": "Partial",
      "scope": "Versioned tenant-scoped read API for catalog, inventory and roadmap; scoped, expiring, revocable hashed tokens. Provider setup and KORONA/Cova read checks are separate from write APIs, webhooks and business-data adapters still planned.",
      "evidence": "docs/api-v1.md",
      "phase": "1"
    },
    {
      "id": "F48",
      "area": "System",
      "name": "Native and offline mobile workflows",
      "status": "Planned",
      "scope": "Optional native client and conflict-aware offline count/receive queue. Responsive web access exists; no native or offline client is enabled.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "4"
    },
    {
      "id": "F49",
      "area": "System",
      "name": "Multi-company consolidation",
      "status": "Planned",
      "scope": "Cross-company consolidation separated from existing tenant isolation.",
      "evidence": "docs/data/product-roadmap.json",
      "phase": "4"
    },
    {
      "id": "F50",
      "area": "Stock",
      "name": "Bulk raw material tracking",
      "status": "Partial",
      "scope": "Integer-milligram lot ledger, exact Shopify variant recipes with immutable effective versions, reviewed one-time whole-sale-line deductions against a selected lot, shortage/replay protection and receipt CSV. Automatic consumption/refunds, split-lot or multi-material recipes and owner-selected Google Sheets sync remain planned.",
      "evidence": "web/app/services/bulk_sale_consumption.rb",
      "phase": "1"
    },
    {
      "id": "F51",
      "area": "Commerce",
      "name": "Image-based POS cart",
      "status": "Partial",
      "scope": "C-Trax native catalog with exact website image links; paired private tip confirmation, real cash sales/change/receipts/register totals, native item tax checks, local stock allocations and paid-sale stock outbox. Optional verified Authorize.net hosted-card checkout with read-only recovery; live card activation requires merchant credentials. Demo simulates both tenders. Discounts, split tenders, refunds, source order creation and PAX/TRX terminals remain outside scope.",
      "evidence": "docs/ctrax-retail.md",
      "phase": "1"
    },
    {
      "id": "F52",
      "area": "People",
      "name": "POS, inventory and reporting roles",
      "status": "Available",
      "scope": "Cashier/POS, inventory staff member, reporting and admin presets; tenant-scoped role assignment, protected super-admin role and deactivated-session rejection.",
      "evidence": "web/app/models/user.rb",
      "phase": "0"
    },
    {
      "id": "F53",
      "area": "People",
      "name": "Remote clock-in and corrections",
      "status": "Available",
      "scope": "Linked active workers clock in/out remotely and request time corrections; permissioned reviewers approve/reject with audit history. No automatic timesheet or payroll posting.",
      "evidence": "web/app/services/time_clock_service.rb",
      "phase": "1"
    },
    {
      "id": "F54",
      "area": "People",
      "name": "Overlapping-shift commission preview",
      "status": "Partial",
      "scope": "A separate 1% estimate for every worker present at an eligible sale, including overlaps; selected source/currency and disclosed imported-data basis. Final policy, refund reconciliation and payouts remain pending.",
      "evidence": "web/app/services/commission_preview.rb",
      "phase": "1"
    },
    {
      "id": "F55",
      "area": "Commerce",
      "name": "Customer tipping",
      "status": "Partial",
      "scope": "Private paired customer display with explicit no-tip, percentage or custom confirmation, invalidated when the cart changes. Implemented cash and conditional hosted-card checkout include confirmed tips. PAX terminal tipping, tip reversal/refunds and actual merchant acceptance remain pending.",
      "evidence": "docs/ctrax-retail.md",
      "phase": "1"
    },
    {
      "id": "F56",
      "area": "Commerce",
      "name": "Daily register summaries",
      "status": "Partial",
      "scope": "Event-dated canonical register detail and CSV plus native C-Trax source sales/tax/discount/tip/tender controls and local review. Missing/open/cross-day cash evidence remains unknown. Source register closing, complete refund/fee coverage and payout-to-bank reconciliation remain separate.",
      "evidence": "docs/ctrax-retail.md",
      "phase": "0"
    },
    {
      "id": "F57",
      "area": "Commerce",
      "name": "Processor and terminal integration",
      "status": "Partial",
      "scope": "Conditional Authorize.net hosted-browser capture and read-only uncertain-outcome recovery, plus NMI sandbox-only tokenized checkout; NMI production charging is blocked. PAX/EMV/contactless commands, refund/void execution and vendor-connected/live acceptance remain incomplete. Correct store merchant scope must be confirmed.",
      "evidence": "docs/ctrax-retail.md",
      "phase": "1"
    },
    {
      "id": "F58",
      "area": "System",
      "name": "POS and payment account setup",
      "status": "Available",
      "scope": "Encrypted provider-specific account preparation and explicit credential/read checks, separate from per-store checkout activation. C-Trax and SwipeSimple source readers exist independently. Saved setup and checks do not prove payment/terminal/settlement readiness or this merchant account\u2019s gateway mapping.",
      "evidence": "web/app/controllers/pos_connections_controller.rb",
      "phase": "1"
    },
    {
      "id": "F59",
      "area": "Stock",
      "name": "Inventory exception review",
      "status": "Available",
      "scope": "Bounded read-only queue for stored stock/identity issues, unverifiable or excess local holds, incomplete Shopify source orders, pending counts and depleted bulk lots; source/location filters, pagination and coverage limits. Does not repair stock or recover missing source provenance.",
      "evidence": "web/app/services/inventory_exceptions.rb",
      "phase": "0"
    },
    {
      "id": "F60",
      "area": "System",
      "name": "Private owner checklist",
      "status": "Available",
      "scope": "Store-admin-only private domain/owner contacts and an encrypted service register: purposes, support contacts, renewal/review cadence and actual next dates, owner-reported MFA, ordinary HTTPS login shortcuts and vault item labels. Feature attestations require scoped evidence/dates; encrypted immutable history, stale-edit/scope protection and authenticated private printing preserve the local record. Owner attestations and manual follow-ups do not automate tests, vendor approvals, credential renewal or messages.",
      "evidence": "web/app/controllers/owner_checklists_controller.rb",
      "phase": "0"
    },
    {
      "id": "F61",
      "area": "System",
      "name": "Private company workspace signup",
      "status": "Available",
      "scope": "Google-verified company-email requests enter a private platform review queue. Explicit platform-admin approval atomically creates an isolated workspace, first store administrator, allowed email domain and finance defaults; rejection and replay/version protections preserve history. New public Google accounts and approved workspaces receive the configured referral attribution. Email verification is not proof of domain ownership; domain-owner review, common consumer-domain exclusion and per-workspace credentials remain required. No DNS, provider connection or payment activation is performed.",
      "evidence": "web/app/controllers/signups_controller.rb",
      "phase": "0"
    },
    {
      "id": "F62",
      "area": "System",
      "name": "Private instance and signup dashboard",
      "status": "Available",
      "scope": "Fresh active platform-super-admin access to instance-wide workspace/account totals, new setup and signup review counts, referral attribution, bounded setup listings and read-only database/job diagnostics. Configured deployment label identifies the instance; backup records describe recorded uploads rather than a restore guarantee. Account and applicant details remain in the authenticated application; no host shell, Incus management socket or database SQL console is exposed.",
      "evidence": "web/app/controllers/platform_controller.rb",
      "phase": "0"
    },
    {
      "id": "F63",
      "area": "System",
      "name": "Compact role-aware navigation and access boundaries",
      "status": "Available",
      "scope": "Named work areas, local accessible icons, permitted-tools disclosures and role-labelled account menus reduce header clutter. Search categories, dashboard widgets/queries and cached responses follow business permissions. Reader defaults exclude personnel/payroll; staff member pay/time/leave sections have separate gates. Workspace user/permission administration and host/instance utilities require their respective administrator roles; size-membership edits require settings write. Existing explicit business permission overrides remain supported.",
      "evidence": "web/app/models/module_registry.rb",
      "phase": "0"
    },
    {
      "id": "F64",
      "area": "Finance",
      "name": "Long-term Valmar and Authorize.net integrations",
      "status": "Partial",
      "scope": "Long-term Valmar/Authorize.net objective with implemented separate Authorize.net reporting and portal-evidence paths, SwipeSimple website evidence and deposit/reconciliation workflows. Exact merchant/gateway mapping, supported vendor entitlement and complete payment-to-bank matching remain unverified. Legacy SwipeSimple CSV inbox stays disabled without an approved producer; working website reads are separate.",
      "evidence": "docs/ops/money-reconciliation.md",
      "phase": "3"
    },
    {
      "id": "F65",
      "area": "Marketing",
      "name": "Community thread and reply review",
      "status": "Available",
      "scope": "Optional tenant-scoped topic-search links and manual thread intake/triage; existing group-code records with dated merchant evidence, versioned reply approval, eligibility checks and manual publication/removal history. No automated crawling/posting, merchant code activation, influencer CMS or conversion attribution.",
      "evidence": "web/app/services/marketing/reply_workflow.rb",
      "phase": "4"
    },
    {
      "id": "F66",
      "area": "Commerce",
      "name": "C-Trax daily sales and register reconciliation",
      "status": "Partial",
      "scope": "Encrypted native store/day order, payment and per-unit line snapshots; independent source report checks, conservative register cash variance, CSV and digest-bound local review. Opt-in scheduled today/yesterday reads. Detailed refunds, cash-tip drawer handling, settlement and terminal execution remain unverified or separate.",
      "evidence": "web/app/services/ctrax/sales_sync.rb",
      "phase": "1"
    },
    {
      "id": "F67",
      "area": "System",
      "name": "Master credentials and sync repair",
      "status": "Partial",
      "scope": "One permission-scoped setup desk with encrypted named forms, credential completeness, explicit checks/reads and structured source-attempt receipts. Separate acquisition/source timestamps, typed failure repair guidance, C-Trax stock/sales channels, safe queue/worker evidence and in-page stale/failure alerts. Historical unknowns remain unknown; verified event coverage, outbound alerts and ownership/rotation remain planned. No automatic credential or source-schedule changes.",
      "evidence": "docs/ops/master-credentials-and-sync.md",
      "phase": "1"
    },
    {
      "id": "F68",
      "area": "Marketing",
      "name": "Influencer collaborations and product gifting",
      "status": "Available",
      "scope": "Tenant-scoped influencer directory and encrypted contacts; collaborations, reviewed product gifts and manual shipment history; explicitly reviewed Shopify percentage/fixed code creation with expiry, usage limits, exact store/terms readback and recoverable creation intents; discount-applying UTM referral links, existing-code records and versioned documents. Separate contacts/discount permissions and encrypted audits. Shopify app access is required. No outreach, inventory/order writes, conversion tracking or commissions.",
      "evidence": "web/app/services/marketing/gift_workflow.rb",
      "phase": "4"
    }
  ]
}