PoC Autopsy

The My Workplace Legal proof of concept was vibecoded by the client's team on Lovable and handed to us as a zip. This section documents it before we rebuild it properly as MyLegalTeam (.NET + React + FastAPI monorepo).

These are atomic notes: one concept per page, cross-linked. The point is not to re-describe the obvious — the workflow is an explicit, well-shaped state machine and needs no explanation. The point is to surface the tacit assumptions: the load-bearing decisions that live only in code behaviour, never in a comment or a test, and that a rebuild would silently break.

What the PoC is

A multi-tenant SaaS for Portuguese workplace disciplinary procedures (processos disciplinares, Código do Trabalho). An HR/legal team runs a case through eight legally-anchored phases — from Abertura to Relatório Final e Decisão — producing a court-defensible dossier at the end. The accused employee (arguido) gets a read/respond view through an external token portal.

• Stack: Vite + React 18 + TypeScript + shadcn/ui + Tailwind; Supabase (Postgres + Auth + Storage + Edge Functions in Deno); TanStack Query; Remotion (a marketing video).
• Provenance: forked from a generic whistleblower template, then pivoted. The ancestry still leaks — see The whistleblower pivot.
• Live Supabase project ships in .env (abpzzrrlaxfdcqndmguk), anon key committed.

Read this first

The single most important fact colours everything else:

The entire workflow engine, audit trail, and permission model run in the browser against the anon Supabase key. Row-Level Security does not enforce the workflow or the role model. Every legal guard is advisory and bypassable with a direct API call.

See Client-side enforcement is the whole trust model.

Map of this section

• Big Picture — the forest: what it is, the case lifecycle, personas, the system at a glance, honest status, glossary. Read this first for orientation.
• Tacit Assumptions — the headline register of dangerous implicit decisions.
• Domain & Legal Rules — the Código do Trabalho rules baked into code.
• Phase Steps & Inputs — per phase, every step and every field the operator is asked to fill in, and where each answer lands.
• Architecture Maps — one small map per subsystem.
• Security Findings — the exploitable holes.
• Data Model — tables, enums, the pivot.
• Rebuild Guidance — preserve / fix / open questions.

New here? Start with What it is → The case lifecycle → Honest status.

Provenance & confidence

Everything here was derived by reading the PoC source (_poc/extracted/), not by running it. Where a claim is inferred rather than observed, the note says so. Line references are approximate — treat identifiers (table, column, function names) as the stable anchors.