Skip to main content

PRD-011: Case Workflow — Dossier Export (shared, cross-phase)

Author: MLT backend team | Date: 2026-08-19 | Status: Draft | Version: v0.1.0

Revision History​

VersionDateAuthorDescription of Change
v0.1.02026-08-19MLT backend teamInitial draft — the shared cross-phase export, backfilled from the rebuild roadmap (interim PRD). Format spike framed on the integrity-vs-confidentiality distinction.

1. Context & Business Rationale​

The Dossier is the exportable legal record, compiled from every phase — cover (capa), phase timeline, checklist, evidence index (with SHA-256 hashes), and the audit trail. It is a shared epic, not phase-owned, because it spans all phases and is produced (typically) at the end of the process to be handed over / held as the court-defensible record.

Part of the Case Workflow theme (theme: case-workflow; no phase label — it is cross-phase). The PoC shipped a ZIP whose footer merely asserted "snapshot imutável" — a claim nothing enforced, with silent incompleteness (dropped evidence, audit capped at 1000 events) and unescaped fields (XSS).

Sourcing: the firm brief (_poc/firm-qa.md). PoC autopsy: dossier generation, dossier XSS.

2. Problem Statement​

There is no server-side, sanitised, complete dossier assembly, and no real integrity mechanism — the PoC's "immutable" ZIP is trivially editable and can silently omit material.

3. Goals, Non-Goals, and Success Metrics​

3.1 Goals​

  • Assemble the dossier server-side from all phases (timeline, checklist, evidence-with-hashes, audit), sanitised, failing loudly on missing evidence.
  • Decide the export format + integrity mechanism (signed/sealed PDF vs ZIP) — a spike.

3.2 Non-Goals​

  • The audit ledger + evidence hashes themselves (Platform Infrastructure #44 — this consumes them).
  • If a PDF renderer/signer is chosen, its implementation is a follow-up task the spike opens.

3.3 Success Metrics​

Metric TypeMetric DefinitionBaselineTarget
PrimaryComplete, sanitised dossier assembled server-sidePoC: ZIP, lossy, XSS100% complete + escaped
Guard RailMissing evidence silently droppedPoC: yesFails loudly
Guard Rail"Immutable" claim without a mechanismPoC: footer text onlyTamper-evident by signature

4. User Personas & Actors​

4.1 Case Manager (Primary)​

  • Role: export the dossier as the case's legal record.

5. User Stories​

  • As a case manager, I want the dossier compiled server-side from every phase (timeline, checklist, evidence with hashes, audit) — escaped and failing loudly on any missing evidence — so the record is complete and safe. → #98
  • As the team, we want a recorded decision on the export format and its integrity mechanism, so "immutable" means something enforceable. → #99 (spike)

6. System Requirements​

6.1 Assembly​

  • SYS-REQ-101: The dossier shall compile timeline, checklist, evidence (with hashes) and audit into one artifact, server-side.
  • SYS-REQ-102: All interpolated fields shall be escaped; a missing evidence file shall fail the export, not be silently dropped.

6.2 Format & integrity (spike outcome)​

  • SYS-REQ-201: A decision on format + integrity mechanism (signature/seal) shall be recorded, with the integrity and confidentiality axes kept distinct.
  • SYS-REQ-202: If PDF, a follow-up task for the renderer + signing (PAdES) shall be opened.

7. Workflow​

POST /dossier { includeAuditLog, itemIds[] } → 202 { exportId, status: generating }
        │  (server-side assembly: capa · timeline · checklist · evidence index (SHA-256) · audit)
        │  missing evidence → FAIL LOUDLY (no silent skip); all fields escaped
        ▼
GET  /dossier/{exportId} → 200 { status, downloadUrl? }

8. Open Questions — the format spike (#99)​

Frame the decision on two separate axes — don't conflate them:

ConcernMechanismNeeded?
Integrity — was it altered? (the legal requirement)digital signature / hash sealYes — required
Confidentiality — who can open it?password / encryptionOptional
  • Primary: signed/sealed PDF (PAdES) — content hashed + digitally signed at export; any later byte-change breaks the signature → tamper-evident, court-defensible. This is what "immutable" must mean: not un-editable (impossible for a copyable file) but any change is detectable. Reuse the same signing key/approach as the audit ledger's external anchoring (#44).
  • Optional add-on: encryption/password — layer it on top of the signed PDF if the firm wants the file itself locked. It is confidentiality, not immutability.
  • Reject: plain or password-protected ZIP as the integrity story — a password gates access, it does not make contents tamper-evident (anyone with the password can edit and re-zip undetectably).

9. Edge Cases & Exception Handling​

  • Missing/failed evidence download → export fails with a clear error (no silent skip).
  • Large dossier → async export (202 + poll), already reflected in the endpoint shape.

10. Given-When-Then Acceptance Criteria​

Assemble the final dossier server-side (#98)

  • The dossier compiles timeline, checklist, evidence (with hashes) and audit into one artifact.
  • All interpolated fields are escaped; a missing evidence file fails the export, not silently drops it.

Decide dossier format — spike (#99)

  • A recorded decision on format + integrity mechanism (signature/seal), integrity-vs-confidentiality axes kept distinct.
  • If PDF, a follow-up task for the renderer + signing (PAdES) is opened.

11. Technical Constraints & Dependencies​

  • Blocked by: the audit trail — append-only hash-chained ledger (#44) — which supplies the audit entries and evidence hashes.
  • Cross-phase: consumes deliverables, checklist, evidence, and audit from every phase.