Client-side enforcement is the whole trust model
Assumption (implicit): that the workflow can only be driven through the React UI, so
The audit trail is not court-grade
The audit trail is the product's core value — a disciplinary process stands or falls on
The case-status vocabulary has three coexisting generations
There is no single source of truth for what a case's status can be. Three naming
Phase transitions are not atomic
useWorkflow.executeTransition performs a phase change as a sequence of independent
Document generation forges the compliance checklist
src/lib/checklist-auto-approve.ts maps three phases to a "canonical deliverable":
Role is global-max, and the app is really binary
Two tacit facts about permissions, both dangerous.
The active company is in-memory only
useCompanyContext (src/hooks/useCompanyContext.tsx) holds activeCompanyId in a plain
Legal dates are stamped from click time
Several legally significant dates — the ones that anchor statutory deadlines — are set
Legal state lives in untyped JSONB
Every investigative action (diligência) stores all of its structured content,
The DB is built for configurable workflows; the app hardcodes one
The schema includes a workflow_rules table, per-company:
case_phase_deliverables is referenced but never created
casephasedeliverables is one of the most-used tables in the app — it holds the formal
There are no tests
The repository is wired for testing — Vitest, Testing Library, jsdom, a setup.ts with a
The marketing video promises properties the code lacks
The remotion/ folder is a five-scene product explainer. Scene4Security.tsx makes three
Self-registration provisions no tenant, membership, or role
Register.tsx calls only supabase.auth.signUp({ email, password, data: { full_name } }).
Untyped string vocabularies couple frontend and backend
The app is threaded with magic string vocabularies that must match exactly between the
Several in-app links point at routes that don't exist
App.tsx registers a specific route set. Several components navigate to paths that are