Skip to main content

Open questions

Things the code can't answer — decisions or confirmations needed before/while rebuilding. Good candidates for the first GitHub issues.

  • Confirm each source: "legal" deadline against the Código do Trabalho, with article citations: 30-day caducidade after IP, 30-day charges-after-IP, 10-working-day employee response, 30-day decision, 5-working-day CT/Sindicato wait. Which are calendar vs working days? → phase deadlines
  • Is the 60-day prescrição from knowledge of the infraction modelled anywhere? (cases.knowledge_date exists but no rule uses it.)
  • Exactly which employees trigger the mandatory CT/Sindicato consultation, and is the "dismissal_intent && employee_rep_or_union_related" condition the right test? → bodies opinion
  • Does the witness cap (10 total / 3 per fact) apply as implemented, and to whom? → witness limits
  • Is the five-value sanction set complete vs the CT's sanction ladder? → outcomes

Product / architecture​

  • Per-tenant workflow configuration: was workflow_rules an intended feature, or is the single legal FSM authoritative? Drop the table or wire it. → workflow_rules ignored
  • Portal URL scheme: token (/portal/:token) vs slug (/consulta/:slug) vs a separate portal.myworkplace.legal host? Resolved (#76): /portal/:token — an opaque, revocable token per notified party, outside /c/:companyId and outside the authenticated shell. The arguido is not an account holder; a company slug is guessable and leaks tenant identity; and SYS-REQ-201/202 need each consultation attributable and window-confined, which a per-party token expresses and a slug cannot. The path namespace is host-agnostic, so moving the portal to its own host later needs no route changes. Retires the PoC's phantom /consulta/:slug → broken links
  • Dossier format: is a ZIP acceptable, or is a signed/sealed PDF required for it to be legally "immutable"? → dossier generation
  • E2E encryption: is the marketing claim a real requirement? user_encryption_keys exists but is unused. → intent vs reality
  • One-company-per-user at signup (enforced by setup-company) vs multi-company users (the data model allows it, the UI can't switch). Which is the product?
  • What is the true schema of case_phase_deliverables (from the live Supabase project)? → phantom table

Data migration​

  • Is there production data in the live PoC project (abpzzrrlaxfdcqndmguk) that must be migrated, or is the rebuild greenfield? This decides how much the enum/role/status reconciliation work matters.