Skip to main content

Document generation forges the compliance checklist

src/lib/checklist-auto-approve.ts maps three phases to a "canonical deliverable":

const DELIVERABLE_PHASE_TO_CHECKLIST_PHASE = {
  INTAKE: "INTAKE",
  NOTA_CULPA: "CHARGES_ISSUED",
  RELATORIO_DECISAO: "FINAL_REPORT",
};

When that deliverable is validated, autoApproveChecklistForPhase flips every pending checklist item of the phase to status: 'approved', is_completed: true in one UPDATE.

So validating the Nota de Culpa document silently marks all CHARGES_ISSUED items approved — including items nobody actually verified, e.g. "Envio ao trabalhador confirmado" and "Comprovativo de receção obtido". For a compliance product, the checklist is supposed to be the evidence that each step really happened; here it is auto-satisfied as a side-effect of generating a document.

Compounding it, there are three different writers to checklist item state with different semantics:

  • useWorkflow.toggleChecklistItem — sets is_completed only (not status)
  • useChecklistOperations.updateStatus — sets status (+ is_completed when approved)
  • autoApproveChecklistForPhase — bulk-approves

…while the transition gate in useWorkflow.canTransition checks status === 'approved'. So ticking a checkbox (is_completed) does not unblock a transition, but generating a document does. The checkbox UI is partly decorative.

Note also a fourth checklist status, ready_for_review, is permitted by the DB trigger validate_checklist_item_status() (draft / ready_for_review / approved) but the approve/draft UI model barely surfaces it.

What breaks: the checklist cannot be trusted as an audit of real-world completion.

Rebuild implication​

Separate "document produced" from "obligation verified". If certain items are genuinely implied by a validated document, record that provenance explicitly rather than marking them as independently checked.