bu1 ad email config

This commit is contained in:
phaichayon
2026-07-07 14:37:17 +07:00
parent 3b5fede134
commit 62762fc70c
8 changed files with 2183 additions and 52 deletions

View File

@@ -448,3 +448,572 @@ Phase R.1 may begin when:
1. this blueprint is accepted as the business baseline
2. terminology conflicts are treated as governance backlog instead of hidden assumptions
3. capability audit work references this document explicitly
## 20. Activity Blueprint Freeze
### Purpose
Activity is the governed operational work record for business execution across marketing, sales, customer relationship work, quotation chasing, manager follow-through, and future service coordination.
Frozen rule:
- `Activity` is the source-of-truth work record.
- `Audit Log` is immutable system history.
- `Notification`, `Reminder`, `Calendar`, and `Timeline` are projections from activity state and business events, not parallel activity records.
### Activity Definition
An Activity represents one planned, in-progress, completed, rescheduled, or cancelled unit of work performed by or assigned to a user.
Examples:
- follow-up call
- customer meeting
- site visit
- site survey
- presentation
- internal task
- document chase
- reminder-backed action item
### Activity Ownership
- One activity has one accountable owner.
- One activity may also have one assignee when work is delegated.
- Owner is responsible for ensuring the activity reaches a terminal outcome.
- Assignee is responsible for execution when assigned.
- Customer owner, lead owner, opportunity owner, quotation salesman, or manager may create activities, but activity ownership must still resolve to one user.
### Activity Entity Relationships
Every activity must support:
- one required primary reference
- zero or more related references
Allowed primary reference targets:
- Customer
- Contact
- Lead
- Opportunity
- Quotation
- PO / Won Project
- Internal Only
Allowed related references:
- Customer + Contact
- Customer + Opportunity
- Opportunity + Quotation
- Lead + Customer
- Quotation + Opportunity + Customer
Frozen rule:
- Activity may span business context, but only one primary reference governs default visibility, ownership inheritance, and calendar placement.
### Activity Families
Shared activity families are:
- Follow-up
- Meeting
- Visit
- Phone Call
- Email Follow-up
- Site Survey
- Presentation
- Internal Task
- Reminder-Driven Action
- Other
### Activity Priority Freeze
Priority levels are:
- Critical
- High
- Normal
- Low
Priority is determined from:
- business deadline
- customer commitment date
- forecast sensitivity
- approval dependency
- manager escalation
Frozen rule:
- `Hot Project` is not the same thing as `Critical Activity`.
- Hot Project may increase suggested activity priority, but does not force it automatically.
### Activity Status Freeze
Primary status set:
- Planned
- In Progress
- Completed
- Cancelled
Derived operational views:
- Due Today
- Upcoming
- Overdue
- Completed Today
Frozen rules:
- `Overdue` is a derived operational condition, not a separate lifecycle state.
- `Rescheduled` is an activity event and timeline event, not a standalone terminal status.
### Activity State Machine Freeze
```text
Planned -> In Progress -> Completed
Planned -> Cancelled
Planned -> Overdue (derived view only, returns to Planned after reschedule)
In Progress -> Completed
In Progress -> Cancelled
```
### Activity Completion Rules
- Completion requires an outcome summary.
- Completion may optionally create a next activity suggestion.
- Follow-up completion should encourage explicit next action when the related lead, opportunity, or quotation remains open.
- Cancelled activities must capture cancellation reason when the activity was already scheduled with customer-facing commitment.
- Activities linked to lost or closed records may still be completed for documentation, but no new forward-driving activity should be auto-created from a terminal-lost record without user intent.
### Activity Visibility Freeze
Activity visibility inherits from the primary related record plus assignment.
Rules:
- Owner and assignee can always view the activity.
- Users who can access the primary record may view the activity unless the activity is marked internal-only.
- Internal-only activities are visible only to creator, owner, assignee, managers, and authorized admins.
- Contact-level sensitivity follows parent customer/contact access rules.
- Pricing-sensitive notes remain subject to quotation pricing visibility when activity content exposes commercial amounts.
### Activity Permission Freeze
Minimum governed permissions:
- Activity Read
- Activity Create
- Activity Update
- Activity Complete
- Activity Cancel
- Activity Delete
- Activity Reassign
Frozen rule:
- Activity authorization must follow resolved CRM access patterns and never bypass record scope rules.
### Follow-up Strategy Freeze
- Follow-up remains the first operational activity subtype.
- Existing lead, opportunity, and quotation follow-up records are the current implementation seam.
- Future unification should map those records into the shared activity model without changing business meaning.
- A follow-up should always answer: what happened, what is next, and when the next touch should happen.
### Reminder Strategy Freeze
- Reminder is not a separate business master entity from activity in the future target model.
- Reminder is a time-based prompt attached to an activity or milestone event.
- Users may receive multiple reminders for one activity without creating duplicate work records.
### Automation Strategy Freeze
Future automation may:
- suggest follow-up creation
- suggest priority increases
- suggest Hot Project activity escalation
- generate reminder prompts
- escalate manager visibility for overdue work
Frozen rule:
- Automation may propose or publish derived signals, but must not silently fabricate completed business work.
### Calendar Synchronization Freeze
- Scheduled activities appear in calendar.
- Reminder prompts appear in calendar only when configured as visible reminder events.
- Opportunity milestone dates and quotation milestone dates appear as milestone events, not as activity rows.
- Reschedule, cancel, and complete actions must update the calendar projection.
### Timeline Synchronization Freeze
- Activity created
- activity assigned
- activity rescheduled
- activity completed
- activity cancelled
- outcome summary captured
All create timeline entries on the related records.
### Notification Synchronization Freeze
Notifications may be created for:
- assignment
- due soon
- overdue
- manager escalation
- reminder prompt
- linked approval dependency
Frozen rule:
- Notification inbox is a delivery surface, not the system-of-record for work.
## 21. Workspace Interaction Blueprint Freeze
### Workspace Philosophy
Workspace means a role-oriented working surface over shared governed records.
Frozen rule:
- navigation should move users by decision context, not by raw table ownership alone.
### Daily Operating Pattern
The standard operating day is:
```text
My Day -> Customer / Lead / Opportunity / Quotation Workspace -> Calendar / Timeline check -> Follow-up completion -> Manager / Executive review
```
### Marketing Workflow
1. Review My Day for overdue and due-today lead activities.
2. Open Lead workspace to qualify new demand and capture follow-up outcome.
3. Escalate or convert demand into sales-ready handoff.
4. Confirm next touch date before leaving the record.
### Sales Workflow
1. Start in My Day for urgent follow-up, meetings, and quotation chases.
2. Move into Opportunity workspace for qualification, forecast, and customer coordination.
3. Enter Quotation workspace when pricing, revision, or approval work is required.
4. Return to Customer workspace when relationship context or cross-project view is needed.
5. End the day by closing completed work and scheduling next actions.
### Manager Workflow
1. Review Manager workspace for team overdue work, idle opportunities, approvals, and Hot Projects.
2. Jump into Team Calendar for schedule conflicts and near-term commitments.
3. Intervene on stalled records through assignment, escalation, and forecast review.
4. Finish with tomorrow-risk review rather than only historical KPI review.
### Executive Workflow
1. Review pipeline, revenue outlook, and strategic account movement.
2. Use customer relationship and manager signals for exception review.
3. Drill into customer, opportunity, or quotation only when escalation or business risk requires it.
## 22. Customer Workspace Blueprint Freeze
### Customer Workspace Philosophy
Customer is the relationship anchor and must become the main relationship workspace, not only a master-data form.
### Required Sections
- Overview
- Contacts
- Activities
- Timeline
- Leads
- Opportunities
- Quotations
- PO / Won History
- Files
- Notes / Relationship Summary
- Upcoming Activities
- Recent Visits / Meetings
### Customer 360 View Freeze
Customer 360 must answer:
- who owns the relationship
- who the active contacts are
- what work is next
- what open demand exists
- what quotation and revenue motion is active
- what history and risk the team should know before contacting the customer
### Relationship Health Freeze
Relationship health is a business assessment derived from:
- recency of meaningful contact
- number of overdue activities
- open opportunities without next action
- strategic account importance
- ownership clarity
Status bands:
- Healthy
- Watch
- At Risk
### Follow-up Health Freeze
Follow-up health is derived from:
- next scheduled activity exists
- overdue work count
- activity completion discipline
- follow-up gap age
### Customer Timeline Freeze
Customer timeline is generated from:
- customer updates
- contact updates
- lead events
- opportunity events
- quotation events
- activity events
- PO / outcome events
- file / document events
Frozen rule:
- Customer timeline is the relationship history view across all related work, not a separate manually maintained log.
## 23. Calendar Workspace Blueprint Freeze
### Calendar Philosophy
Calendar is the time-based operational workspace across roles.
### Calendar Lenses
- Personal Calendar
- Team Calendar
- Manager Calendar
- Executive Calendar
### Calendar Sources
- Activities
- Meetings
- Visits
- Site Surveys
- Follow-up commitments
- Reminder prompts
- Expected Award Date milestone
- Expected Delivery Date milestone
- Approval due / escalation events
- Quotation expiration / validity milestone
Frozen rules:
- milestone dates can appear in calendar without becoming standalone activities
- milestone events must be visually distinct from owned work
### Calendar Filters
- user
- team
- branch
- customer
- lead
- opportunity
- quotation
- activity type
- priority
- status
- Hot Project only
### Calendar Color Strategy
- Follow-up / task work
- Meeting / visit work
- Reminder prompts
- Opportunity milestone
- Quotation milestone
- Approval due event
Frozen rule:
- colors communicate event family, not authorization level.
### Calendar Views
- Day
- Week
- Month
- Agenda
Agenda view is the default manager-friendly review surface for operational workload.
## 24. My Day Blueprint Freeze
### Purpose
My Day is the personalized operational home screen for action-taking users.
### Required Modules
- Today's Activities
- Overdue Activities
- Upcoming Meetings
- Pending Approvals
- Hot Projects Requiring Action
- Today's Follow-up
- Urgent Quotations
- Relationship Alerts
### Priority Ordering Freeze
My Day orders work by:
1. overdue customer-facing commitments
2. due-today committed meetings / visits
3. urgent quotation and approval blockers
4. Hot Project follow-up gaps
5. scheduled upcoming work
### Urgency Rules
Urgency increases when:
- customer commitment date is today or missed
- expected award date is near
- quotation validity is near expiry
- manager escalated the record
- no next action exists on an open record
Frozen rule:
- My Day should guide the next best operational action, not become a passive report dashboard.
## 25. Manager Workspace Blueprint Freeze
### Purpose
Manager Workspace is the operational control tower for team execution quality.
### Required Sections
- Team Calendar
- Team Activities
- Overdue Activities
- Idle Opportunities
- Forecast Review
- Hot Projects
- Approval Queue
- Workload Balance
- Relationship Risk Alerts
### Daily Management Workflow
1. Review overdue and unowned work.
2. Review Hot Projects without recent activity.
3. Review expected-award opportunities with no next step.
4. Review approval queue and quotation blockers.
5. Rebalance assignments and escalate risks.
6. Review tomorrow's team calendar load.
### Manager Output Freeze
Manager workspace should enable:
- coaching
- escalation
- reassignment
- forecast challenge
- workload balancing
It is not only a KPI readout surface.
## 26. Business Event Blueprint Freeze
### Event Philosophy
Business events are immutable facts emitted from operational changes. One event may fan out to timeline, notification, dashboard, audit, and future automation.
### Business Event Matrix
| Event | Timeline | Notification | Reminder | Dashboard / Workspace | Audit Log | Future Automation |
| --- | --- | --- | --- | --- | --- | --- |
| Activity Created | Yes | Optional assignment notice | Optional | Yes | Yes | Yes |
| Activity Reassigned | Yes | Yes | Optional | Yes | Yes | Yes |
| Activity Completed | Yes | Optional | Close outstanding reminders | Yes | Yes | Yes |
| Activity Cancelled | Yes | Optional | Close reminders | Yes | Yes | Yes |
| Activity Overdue | Optional derived marker | Yes | Yes | Yes | No | Yes |
| Lead Created | Yes | Optional | Optional | Yes | Yes | Yes |
| Lead Assigned / Handoff Ready | Yes | Yes | Optional | Yes | Yes | Yes |
| Opportunity Created | Yes | Optional | Optional | Yes | Yes | Yes |
| Opportunity Reassigned | Yes | Yes | Optional | Yes | Yes | Yes |
| Expected Award Date Changed | Yes | Optional | Yes | Yes | Yes | Yes |
| Hot Project Flagged | Yes | Yes | Optional | Yes | Yes | Yes |
| Quotation Created | Yes | Optional | Optional | Yes | Yes | Yes |
| Quotation Sent | Yes | Optional | Optional | Yes | Yes | Yes |
| Quotation Pending Approval | Yes | Yes | Yes | Yes | Yes | Yes |
| Quotation Approved / Rejected / Returned | Yes | Yes | Close or move reminders | Yes | Yes | Yes |
| Quotation Expiring Soon | Optional | Yes | Yes | Yes | No | Yes |
| Opportunity Marked Won | Yes | Optional | Close forward-chasing reminders | Yes | Yes | Yes |
| Opportunity Marked Lost | Yes | Optional | Close forward-chasing reminders | Yes | Yes | Yes |
| PO Received | Yes | Optional | Optional | Yes | Yes | Yes |
Frozen rules:
- Audit log records mutation truth.
- Timeline records business-readable chronology.
- Dashboard / workspace metrics consume aggregated event effects, not raw notification counts.
## 27. Workspace Navigation Diagram Freeze
```text
My Day
|- Customer Workspace
| |- Contacts
| |- Activities
| |- Timeline
| |- Leads
| |- Opportunities
| |- Quotations
|
|- Lead Workspace
| |- Qualification
| |- Follow-up
| |- Handoff
|
|- Opportunity Workspace
| |- Execution
| |- Follow-up
| |- Forecast
| |- Outcome
|
|- Quotation Workspace
| |- Pricing
| |- Revision
| |- Approval
| |- Customer Package
|
|- Calendar Workspace
| |- Personal
| |- Team
| |- Manager
| |- Executive
|
|- Manager Workspace
| |- Team Activities
| |- Forecast
| |- Hot Projects
| |- Approval Queue
|
`- Executive Workspace
|- Pipeline
|- Revenue Outlook
`- Strategic Accounts
```
## 28. Customer 360 Diagram Freeze
```text
Customer
|- Ownership
|- Contacts
|- Relationship Health
|- Activities / Upcoming Work
|- Timeline
|- Leads
|- Opportunities
|- Quotations
|- PO / Won History
|- Files / Documents
`- Notes / Relationship Summary
```
## 29. Daily User Journey Freeze
### Marketing
```text
My Day -> Lead Queue -> Lead Detail -> Follow-up -> Handoff Ready -> Next Scheduled Action
```
### Sales
```text
My Day -> Opportunity Workspace -> Customer Context -> Quotation Workspace -> Next Activity -> Calendar Check
```
### Manager
```text
Manager Workspace -> Team Calendar -> Overdue / Idle Review -> Forecast Challenge -> Reassignment / Escalation
```
### Executive
```text
Executive Workspace -> Strategic Customer Review -> Pipeline / Revenue Review -> Exception Drill-down
```
## 30. Current-System Alignment Notes
Current implementation signals already supporting this blueprint:
- customer detail already behaves as relationship context plus related opportunity / quotation bridge
- opportunity and quotation already contain follow-up, Hot Project, forecast-related date fields
- dashboard already aggregates follow-up and Hot Project signals
- notification foundation already exists, but current production rules focus mainly on approval events
Current gaps still intentionally unresolved:
- no shared production `Activity` entity yet
- no dedicated calendar workspace yet
- no My Day workspace yet
- manager workspace is not yet implemented as a first-class operational surface
- current `workspaces` navigation still refers to organization / team administration, not business role workspaces
## 31. Freeze Outcome For BU-R.0.1
This pass extends the original blueprint without changing previously frozen principles.
Newly frozen business architecture in this pass:
- Activity as governed shared work model
- Customer Workspace as the relationship execution hub
- Calendar Workspace as cross-role time-based operating surface
- My Day as user action home screen
- Manager Workspace as execution control tower
- Business Event Matrix as the fan-out rule for timeline, notification, dashboard, reminder, and audit behavior

View File

@@ -0,0 +1,71 @@
# Task BU-R.0.1 Implementation Report - 2026-07-07
## Scope
- continue BU-R.0 by freezing the remaining business architecture for Activity, Workspace Interaction, Customer Workspace, Calendar Workspace, My Day, Manager Workspace, and Business Event fan-out
- update the main relationship and sales business blueprint without changing previously frozen BU-R.0 principles
- keep the task documentation-only with no schema, API, UI, service, permission, or ADR changes
## Review Summary
Reviewed before drafting:
- [AGENTS.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/AGENTS.md)
- [plans/task-bu-r.0.1.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/plans/task-bu-r.0.1.md)
- [plans/task-bu-r.0.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/plans/task-bu-r.0.md)
- [docs/standards/task-contract-template.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/task-contract-template.md)
- [docs/standards/task-catalog.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/task-catalog.md)
- [docs/standards/project-foundations.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/project-foundations.md)
- [docs/standards/architecture-rules.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/architecture-rules.md)
- [docs/standards/ui-ux-rules.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/ui-ux-rules.md)
- [docs/standards/task-review-checklist.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/task-review-checklist.md)
- [docs/business/crm-terminology.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/business/crm-terminology.md)
- [docs/business/relationship-sales-workspace-blueprint-v1.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/business/relationship-sales-workspace-blueprint-v1.md)
- [docs/security/crm-authorization-boundaries.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/security/crm-authorization-boundaries.md)
- [docs/adr/0015-customer-ownership-contact-sharing.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/adr/0015-customer-ownership-contact-sharing.md)
- [docs/adr/0016-won-lost-lifecycle-governance.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/adr/0016-won-lost-lifecycle-governance.md)
- [docs/adr/0017-report-foundation.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/adr/0017-report-foundation.md)
- [docs/adr/0018-lead-enquiry-domain-separation.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/adr/0018-lead-enquiry-domain-separation.md)
- [docs/implementation/task-bu-r.0-business-blueprint-freeze-2026-07-07.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/implementation/task-bu-r.0-business-blueprint-freeze-2026-07-07.md)
- [docs/implementation/task-d.6-crm-activity-foundation-audit-log-separation-2026-07-01.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/implementation/task-d.6-crm-activity-foundation-audit-log-separation-2026-07-01.md)
- current CRM customer, opportunity, quotation, dashboard, notification, and workspace implementations under `src/features/**`, `src/app/dashboard/**`, and `src/db/schema.ts`
## Current-State Findings Used For The Freeze
1. Customer detail already behaves as a relationship context surface with contacts plus linked opportunities and quotations, but it is not yet governed as the official Customer Workspace.
2. Opportunity and quotation features already store follow-up rows, Hot Project flags, and forecast-related dates, which makes them valid current seams for the future shared activity and calendar model.
3. Dashboard already aggregates follow-up and Hot Project signals, but those signals are still oriented around dashboards rather than a broader My Day, Calendar Workspace, or Manager Workspace philosophy.
4. The notification foundation is production-ready, but current event publishing is mainly approval-driven, so activity-driven notification fan-out still needed business governance before implementation.
5. Existing `/dashboard/workspaces` navigation currently means organization/team administration, not the future business-role workspace model. That distinction had to be frozen explicitly to avoid naming drift.
## Documentation Changes
- Expanded [relationship-sales-workspace-blueprint-v1.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/business/relationship-sales-workspace-blueprint-v1.md) with:
- Activity Blueprint Freeze
- Workspace Interaction Blueprint Freeze
- Customer Workspace Blueprint Freeze
- Calendar Workspace Blueprint Freeze
- My Day Blueprint Freeze
- Manager Workspace Blueprint Freeze
- Business Event Matrix
- Activity State Machine
- Workspace Navigation Diagram
- Customer 360 Diagram
- Daily User Journey for Marketing, Sales, Manager, and Executive
- Current-system alignment notes for Phase R.1 audit readiness
## Freeze Decisions Added In This Pass
- Activity is now the officially governed shared work model and remains distinct from Audit Log.
- Calendar is frozen as a workspace projection over activities and milestone events, not a detached scheduling module.
- My Day is frozen as the personalized action home screen prioritized by urgency and commitment risk.
- Manager Workspace is frozen as an execution-control workspace, not only a KPI dashboard.
- Business events are frozen as the common fan-out source for timeline, notification, reminder, dashboard, audit, and future automation behavior.
- Customer Workspace is frozen as the main relationship execution hub and Customer 360 surface.
## Verification
- Documentation-only change.
- No schema, API, UI, service, permission, ADR, or migration files changed.
- No build or test command was required for this pass.
## Outcome
BU-R.0.1 now closes the major business architecture gaps left outside BU-R.0 and leaves Phase R.1 with a clearer audit target for:
- follow-up-to-activity unification
- workspace and navigation semantics
- calendar and reminder projections
- activity-driven notification design
- manager and My Day operational surfaces

View File

@@ -0,0 +1,218 @@
# Task BU-R.1 Implementation Report - 2026-07-07
## Scope
- audit the current ALLA OS implementation against the frozen BU-R.0 and BU-R.0.1 business blueprint
- classify capabilities as `Existing`, `Partial`, `Missing`, `Legacy`, or `Refactor Candidate`
- document preservation, dependency, priority, and readiness guidance for later implementation phases
- keep the phase documentation-only with no schema, API, UI, service, permission, or business-logic changes
## Review Summary
Reviewed before auditing:
- [AGENTS.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/AGENTS.md)
- [plans/task-bu-r.1.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/plans/task-bu-r.1.md)
- [docs/business/relationship-sales-workspace-blueprint-v1.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/business/relationship-sales-workspace-blueprint-v1.md)
- [docs/implementation/task-bu-r.0-business-blueprint-freeze-2026-07-07.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/implementation/task-bu-r.0-business-blueprint-freeze-2026-07-07.md)
- [docs/implementation/task-bu-r.0.1-workspace-activity-business-blueprint-2026-07-07.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/implementation/task-bu-r.0.1-workspace-activity-business-blueprint-2026-07-07.md)
- [docs/standards/project-foundations.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/project-foundations.md)
- [docs/standards/architecture-rules.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/architecture-rules.md)
- [docs/standards/task-review-checklist.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/standards/task-review-checklist.md)
- [docs/security/crm-authorization-boundaries.md](/C:/Users/mtpphtaps/Documents/gitea/alla-allaos-fullstack/docs/security/crm-authorization-boundaries.md)
- relevant CRM/foundation source under `src/features/crm/**`, `src/features/foundation/**`, `src/app/dashboard/crm/**`, `src/app/api/**`, `src/config/nav-config.ts`, and `src/db/schema.ts`
## Executive Summary
1. Customer, Contact, Opportunity, Quotation, Approval, Dashboard, security, and PDF/document foundations are already mature and should be preserved.
2. Lead capability exists as a real separated workspace and schema, but its follow-up implementation remains lighter and more audit-log-backed than the blueprint target.
3. Follow-up capability is real across lead, opportunity, quotation, and dashboard analytics, but a shared production Activity platform does not exist yet.
4. Timeline, Calendar Workspace, My Day, Manager Workspace, and role-based business workspaces are still mostly target-state architecture, not production capability.
5. Notification foundation is reusable and production-ready, but current live business-event coverage is approval-centric rather than activity-centric.
## 1. Business Capability Matrix
| Domain | Capability | Status | Notes |
| --- | --- | --- | --- |
| Relationship | Customer master, profile, related opportunity/quotation linkage | Existing | Customer detail already acts as a relationship context surface with related commercial records. |
| Relationship | Customer ownership | Existing | Persisted owner assignment plus owner history exists and is governed by ADR-0015. |
| Relationship | Contact sharing and visibility | Existing | Persisted `crm_contact_shares` plus share-aware access enforcement exists. |
| Relationship | Customer account type / prospect classification | Partial | Customer type and status options exist, but relationship-health semantics are not governed in product behavior yet. |
| Relationship | Customer relationship health | Missing | No governed health model, scoring logic, or dedicated UI module yet. |
| Relationship | Customer timeline | Partial | Audit Log and related-record links exist, but no generated cross-entity customer timeline exists. |
| Activity | Lead follow-up | Existing | Lead follow-ups exist, but are stored via audit payloads instead of a dedicated follow-up table. |
| Activity | Opportunity follow-up | Existing | Persisted child resource with CRUD, UI tab, dashboard aggregation, and report reuse exists. |
| Activity | Quotation follow-up | Existing | Persisted child resource with CRUD, UI tab, dashboard aggregation, and report reuse exists. |
| Activity | Shared Activity entity/platform | Partial | Contract-first activity types and permissions exist under `src/features/crm/activity/types.ts`, but there is no production storage/service/UI yet. |
| Activity | Meeting / visit / phone / reminder / internal task | Missing | Only follow-up-oriented capability is implemented today. |
| Activity | Shared activity lifecycle and ownership rules | Partial | Blueprint-ready contract exists; production behavior still fragmented by feature. |
| Lead | Separate lead workspace | Existing | Dedicated pages, service layer, schema, assignment, follow-up, and linked opportunities are live. |
| Lead | Marketing handoff into opportunity | Partial | Linked opportunity visibility exists, but explicit governed conversion workflow is still limited. |
| Lead | Lead outcome derivation from downstream sales | Missing | Lead outcome behavior remains lighter than the blueprint target and ADR-0018 direction. |
| Opportunity | Opportunity ownership and assignment | Existing | Sales assignment, reassignment, branch/product scope, and linked lead provenance are implemented. |
| Opportunity | Forecast fields and probability | Existing | `expectedCloseDate`, `projectCloseDate`, `deliveryDate`, `chancePercent`, and `isHotProject` are live. |
| Opportunity | Expected Award Date / Expected Delivery Date semantics | Partial | Underlying dates exist, but exact blueprint naming/behavior still needs semantic reconciliation. |
| Opportunity | Outcome governance won/lost/reopen/PO | Existing | ADR-0016 behavior is implemented with mark-won, mark-lost, reopen, and PO attachment flows. |
| Commercial | Quotation CRUD, revision, approval, pricing | Existing | Mature quotation feature with revision chain, approval, preview, PDF, and customer package support exists. |
| Commercial | Customer package | Existing | Implemented as approved-PDF plus document-library assembly with permission checks. |
| Commercial | PO integration | Partial | PO capture is implemented on opportunity outcome, but customer-workspace and timeline integration are not yet complete. |
| Approval | Workflow runtime | Existing | Shared approval runtime, steps, actor resolution, notification publishing, and dashboard analytics exist. |
| Approval | Approval automation reminders/escalation | Existing | Reminder and escalation policy foundations are present. |
| Workspace | Customer workspace | Partial | Current customer detail is a strong base, but blueprint sections like Activities, Timeline, Health, Upcoming Work, and Notes are incomplete. |
| Workspace | Sales workspace | Partial | Lead, opportunity, quotation pages exist, but they are entity pages more than one unified role workspace. |
| Workspace | Manager workspace | Missing | No first-class manager control-tower page exists yet. |
| Workspace | Executive workspace | Missing | No dedicated executive workspace exists yet. |
| Workspace | My Day | Missing | No personalized action-home surface exists yet. |
| Workspace | Calendar workspace | Missing | No dedicated calendar route, projection layer, or calendar UI exists yet. |
| Timeline | Generated business timeline | Missing | Audit Log exists, but there is no platform-generated cross-entity timeline model. |
| Dashboard | CRM dashboard KPI foundation | Existing | Summary, funnel, follow-up, approval, revenue, ranking, and hot projects are implemented. |
| Dashboard | Manager / executive-specific dashboard layers | Partial | Current dashboard supports broad KPI visibility, but not fully distinct role workspaces. |
| Notification | Inbox foundation and read/archive flows | Existing | Generic app notifications and inbox UI are production-ready. |
| Notification | Approval notifications | Existing | Approval runtime publishes notification events and inbox surfaces them. |
| Notification | Activity / follow-up / assignment notifications | Missing | Business-event coverage for operational activity is not implemented yet. |
| Event Model | Audit events | Existing | Core audit foundation is widespread and mature. |
| Event Model | Approval events | Existing | Approval event publishing is live. |
| Event Model | Activity-driven business events | Partial | Opportunity and quotation mutations exist, but shared fan-out governance is not yet implemented as one event model. |
## 2. Capability Coverage Report
Coverage values below are qualitative readiness estimates based on audited business scope, not literal line-of-code metrics.
| Domain | Coverage | Summary |
| --- | --- | --- |
| Customer / Relationship | 70% | Strong ownership, sharing, profile, and related-record foundation; missing relationship health and generated timeline. |
| Activity | 35% | Follow-up is real, but shared activity platform, meeting/task/reminder families, and unified lifecycle are not implemented. |
| Lead | 70% | Dedicated domain and workspace exist, but downstream derived outcome and richer handoff workflow remain incomplete. |
| Opportunity | 85% | Assignment, forecast fields, follow-up, hot project, and outcome governance are mature. |
| Quotation | 90% | CRUD, revision, approval, document, package, and pricing foundations are strong. |
| Approval | 90% | Runtime, settings, automation, and dashboard visibility are well-established. |
| Dashboard | 80% | KPI dashboard is live and substantial, but role-specialized workspace behavior is still incomplete. |
| Calendar | 10% | Date fields and reminder policies exist, but no true calendar workspace capability exists. |
| Timeline | 20% | Audit Log exists, but blueprint-grade generated business timeline does not. |
| Notification | 50% | Good reusable foundation, but limited current business-event breadth. |
| Workspace Model | 40% | Entity routes exist, but My Day, Manager, Executive, and Calendar workspaces are still future capability. |
## 3. Gap Analysis: Current System vs Business Blueprint
### No Change
- Customer ownership and contact sharing foundation
- Opportunity outcome governance
- Quotation approval, document, PDF, artifact, and customer package foundations
- CRM dashboard KPI foundation
- CRM authorization and pricing-visibility enforcement
### Enhancement
- Customer detail evolving into Customer Workspace
- Opportunity/quotation date semantics aligning to expected-award and expected-delivery definitions
- Dashboard role layering for manager and executive needs
- Notification foundation expanded from approval-centric events into broader CRM business events
- Lead handoff and downstream outcome synchronization
### Refactor
- Fragmented follow-up behavior into a shared Activity platform over time
- Historical `enquiry` terminology remnants in docs and older lineage
- `workspaces` navigation semantics, which currently mean organization/team administration rather than business-role workspaces
### New Capability
- Generated Timeline
- Calendar Workspace
- My Day
- Manager Workspace
- Executive Workspace
- Activity platform with shared families beyond follow-up
## 4. Architecture Preservation Report
### Keep Unchanged
- `src/features/crm/customers/**`
- `src/features/crm/opportunities/**`
- `src/features/crm/quotations/**`
- `src/features/foundation/approval/**`
- `src/features/foundation/approval-automation/**`
- `src/features/foundation/notifications/**`
- `src/features/foundation/pdf-generator/**`
- `src/features/foundation/document-artifact/**`
- `src/features/crm/dashboard/**`
- `src/lib/auth/crm-access.ts` and CRM security enforcement
### Extend Only
- customer detail and related tabs into Customer Workspace sections
- lead/opportunity/quotation follow-up flows into future Activity adapters
- dashboard into manager and executive role surfaces
- notification event publishing into broader business-event coverage
- nav and workspace routing into clearer role-oriented destinations
### Controlled Refactor Required
- shared activity storage/service/UI
- timeline projection layer
- calendar projection and filtering layer
- terminology cleanup across historical docs and edge code paths
### Backward Compatibility Concerns
- lead follow-up currently depends on audit-log payloads rather than a dedicated persisted follow-up table
- approval and notification fan-out already exist for approvals, so later activity events must avoid double-publishing behavior
- dashboard/service/reporting logic already depends on current follow-up storage, so activity migration must preserve analytics continuity
- current `workspaces` routes are already used for organization/team administration and should not be silently repurposed
## 5. Business Capability Dependency Map
```text
Customer / Contact
|- Lead
| `- Opportunity
| |- Follow-up / Future Activity Platform
| |- Quotation
| | |- Approval
| | |- PDF / Artifact / Customer Package
| | `- Commercial Notifications
| |- Dashboard / Reports
| `- Won / Lost / PO
|
`- Future Customer Workspace
|- Timeline
|- Calendar Projection
|- My Day
`- Manager / Executive Workspace
```
## 6. Capability Priority Matrix
| Epic / Capability | Priority | Why |
| --- | --- | --- |
| Activity Platform | Critical | It is the main missing shared business model and blocks Calendar, Timeline, My Day, and richer notifications. |
| Customer Workspace | Critical | Customer is the relationship anchor and already has a strong partial base worth extending. |
| Timeline | High | Required for blueprint-aligned relationship history and event visibility. |
| Calendar Workspace | High | Strong business need, but depends on activity/event projection clarity. |
| My Day | High | Key daily operating surface and natural consumer of activity, reminders, and approvals. |
| Manager Workspace | High | Needed for operational control, workload balancing, and hot-project governance. |
| Notification Expansion | Medium | Foundation exists; main work is business-event coverage and orchestration. |
| Executive Workspace | Medium | Valuable, but depends on manager/dashboard/timeline foundations first. |
| Terminology / legacy cleanup | Medium | Important for governance clarity, but not as blocking as Activity or Workspace delivery. |
## 7. Implementation Readiness Report
| Area | Readiness | Notes |
| --- | --- | --- |
| Customer Workspace | Requires UI enhancement | Data foundation is strong; sections like health, upcoming work, and relationship summary need expansion. |
| Activity Platform | Requires schema + service + UI enhancement | Only contract-first types exist today. |
| Lead lifecycle enhancement | Requires service + UI enhancement | Existing lead feature is usable, but derived outcome/handoff depth is incomplete. |
| Opportunity forecast semantics | Requires service + UI enhancement | Core fields exist already. |
| Quotation commercial execution | Ready immediately | Mature enough to preserve and extend. |
| Approval runtime | Ready immediately | Mature enough to preserve and extend. |
| Dashboard role layering | Requires UI + service enhancement | Foundation exists and is reusable. |
| Timeline | Requires schema/service/UI future phase | No true generated timeline capability yet. |
| Calendar Workspace | Requires schema/service/UI future phase | No production projection layer or UI route exists yet. |
| My Day | Requires service/UI future phase | Depends on activity, reminder, approval, and hot-project orchestration. |
| Notification expansion | Requires service enhancement | Foundation exists; business-event coverage does not. |
## 8. Candidate Epics After BU-R.1
- Epic: Customer Workspace
- Epic: Activity Platform
- Epic: Timeline Projection
- Epic: Calendar Workspace
- Epic: My Day
- Epic: Manager Workspace
- Epic: Executive Workspace
- Epic: Notification Event Expansion
- Epic: Lead Handoff and Outcome Alignment
- Epic: Terminology and Governance Reconciliation
## Verification
- Documentation-only change.
- No schema, API, UI, service, permission, or business-logic files were modified for runtime behavior.
- No build or test command was required for this audit pass.
## Outcome
BU-R.1 confirms that the repo already has a strong production backbone for relationship, opportunity, quotation, approval, document, dashboard, and security work. The biggest blueprint gaps are no longer hidden inside core CRUD; they are concentrated in the cross-cutting operating model: shared Activity, Timeline, Calendar, My Day, Manager Workspace, Executive Workspace, and business-event-driven notifications.