Honest status — what works vs what's claimed
A candid big-picture read on maturity, so nobody scopes the rebuild off the demo. This is the executive summary of the Tacit Assumptions and Security sections.
What genuinely works (the demo is real)
- The 8-phase workflow runs end to end: you can open a case, move it through the phases, tick checklists, produce documents, run diligências, and export a dossier.
- The domain modelling is good — the phases, the branch logic, the deadline catalogue, the document templates, the role cast. Real Portuguese-labour-law thinking went in.
- The external portal works: token access, visibility windows, submissions, access log.
- The email queue is genuinely sophisticated (priority, retries, DLQ, TTL, idempotency).
What is claimed but not true
The marketing video (Scene4Security) sells three properties the code doesn't deliver:
| Claimed | Reality |
|---|---|
| "Encriptação ponta-a-ponta" (E2E encryption) | Keypair table exists, unused; files stored plaintext in a non-isolated bucket |
| "Controlo de acessos por papel" (RBAC) | RLS enforces membership, not roles; app is effectively binary; self-provision escalation possible |
| "Audit trail completo" (complete audit) | Client-authored, best-effort, conditional, truncated at 200 |
See Intent vs reality.
What is missing or broken beneath the surface
The demo works because nothing adversarial is happening. The guarantees a compliance product must have are absent:
- The workflow is advisory. All guards run in the browser; the DB lets any member set any status directly. → client-side integrity
- Tenants aren't isolated. World-readable companies; a single bucket any user can read; cross-tenant evidence queries. → RLS gaps, storage
- The audit log isn't trustworthy as evidence. → audit
- The legal clocks are naive — uncited figures, no PT holidays, click-time dates. → deadline math
- Zero test coverage of any legal rule. → no tests
- Hard security holes:
tempPassword="password", an unauthenticated seed endpoint that mints a super admin, HTML injection in the dossier, committed keys. → credentials, dossier XSS - Incomplete provenance: a central table (
case_phase_deliverables) is never created by the migrations; signup provisions no tenant. → phantom table, signup
The one-line verdict
An excellent domain prototype and a poor production system. The rebuild's job is to keep the domain knowledge (it's the hard-won part) and replace the entire enforcement substrate — move the workflow, roles, audit, and isolation server-side, and pin every legal rule with a cited test.