# Phase 0 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-09-phase-0-foundation.md
Started: 2026-07-09

## Tasks

- [x] Task 1: Scaffold Next.js + Supabase clients (commit f83686f, review clean)
- [x] Task 2: Role types + middleware (commit 6939a21, review clean)
- [x] Task 3: Database migrations (commit 05daf70, review clean — 2 advisories: concurrent ref_no race, evidence soft-delete needs SECURITY DEFINER fn)
- [x] Task 4: Apply migrations to Supabase cloud (user ran supabase login + link + db push)
- [x] Task 5: Auth flow (commit 5598594, review clean — LOW: open redirect in callback/route.ts:8 fix before prod)
- [x] Task 6: Protected dashboard pages (commit c3ba543, review clean)
- [x] Task 7: QR code generation (commit 152a660, review clean)

---

# Phase 2 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-2-investigation-capa.md
Started: 2026-07-11
Base commit (Phase 2 start): 1fe646d82d23c3d0f493cc4ce8844f5c19c8b699

## Tasks

- [x] Task 1: DB Migration — triage fields, RCA structured data, write_audit_log RPC (commits dbbb663..a718a2d, review clean — MINOR: DROP CASCADE without explicit signature, no ON DELETE on triaged_by FK)
- [x] Task 2: DOSH obligation pure function + tests (commit 8b00c72, review clean)
- [x] Task 3: Triage panel — component, API route, page (commit e55c528, review pending)
- [x] Task 4: Investigation workspace — component, API route, page (commit 63cb28f, review pending)
- [x] Task 5: CAPA board + form + detail (commit 1780586, review pending)
- [x] Task 6: Verification flow (commit 804b1fb, review pending)
- [x] Task 7: CAPA overdue escalation cron (commit 75fa260, review pending)
- [x] Task 8: JKKP 6/7 PDF generation (commit 54332d0, review pending)

---

# Phase 3 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md
Started: 2026-07-11
Base commit: 0e53d5c

## Tasks

- [x] Task 1: Claude client + Voyage AI embed helper (commit ebaa98d, review clean — MINOR: module cache isolation in embed test; client.ts uses ?? '' instead of throw on missing key)
- [x] Task 2: pgvector migration + match_incidents RPC (commit ab6299f, review clean)
- [x] Task 3: Report quality check (commits 3bec95a..a5933d2, review clean — MINOR: 400/500 fix branches untested; stale qualityCheck state on description edit)
- [x] Task 4: Triage AI suggestion (commit f10fa07, review clean — MINOR: 500 path untested; return toolBlock.input instead of narrowed input; submit not disabled during aiLoading)
- [x] Task 5: Similar incident retrieval (commit 547cc6e, review clean — MINOR: cast drops extra columns; error/empty indistinguishable in panel; <a> instead of <Link>)
- [x] Task 6: RCA/CAPA draft assistant (commit 10e7196, review clean — MINOR: as never cast on p_new_value; implementer added runtime validation beyond spec — positive deviation)
- [x] Task 7: Dashboard enhancement (commit 3473cf8, review clean — MINOR: by_site sort added beyond spec; verified_at/completed_at casts match brief verbatim)
- [x] Task 8: Final verification (build clean, 61/61 tests pass)
- [x] Task 8 final fixes: RLS guard + AI try/catch (commit c07bdb7, build clean, 61/61 pass)

---

# Phase 3 (v2) Progress Ledger — Role Dashboards + CSV Export

Plan: docs/superpowers/plans/2026-07-11-phase-3-ai-dashboard.md
Started: 2026-07-11
Base commit: 16e8f9d

## Tasks

- [x] Task 1: Management dashboard (commit 3dac469, review clean — MINOR: status col selected but unused; unbounded allIncidents fetch is pre-prod perf risk)
- [x] Task 2: Supervisor dashboard (commits ceb5c79..69df452, review clean after fix — MINOR: serial pre-fetches before Promise.all; overdue/CAPA counts subject to 1000-row Supabase cap at volume)
- [x] Task 3: CAPA owner dashboard (commits a2f1be7..070e2d1, review clean after fix — MINOR: PRIORITY_COLORS defined inside render; en-MY ICU fallback risk on Vercel; incident link non-functional for capa_owner role)
- [x] Task 4: Reporter dashboard (commits 55b6dac..e631d04, review clean after fix — MINOR: profile/query errors silently swallowed; reviewer's second 🔴 on empty-string date is false positive — "" is falsy, existing && guard already blocks it)
- [x] Task 5: CSV export endpoint (commit dfca872, review clean — tests 67/67 pass)
- [x] Task 6: RCA draft test (commit 76d9363, review clean — 68/68 pass)
- [x] Final review fixes: rename on-time rate, hoist getApiKey, remove broken capa-owner link (commit 871ef7c, re-review clean — 88/88 pass)
- [x] Whole-branch review: clean — no critical defects; RLS on CSV export verified correct by design
- [x] Task 6: RCA draft test + final verification (commit 76d9363, 68/68 tests pass, build clean)

---

# Phase 4 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-4-scale-polish.md
Started: 2026-07-11
Base commit: 55b6dac

## Tasks

- [x] Task 1: WhatsApp notification helper + migration (commit b6845f5, review clean — MINOR out-of-scope: export route allowedRoles[role] prototype-safe pattern)
- [x] Task 2: WhatsApp integration — incident alert + CAPA escalation (commit a47f3aa + edb0bde, review clean — MINOR: overdue_3d WhatsApp path untested; serial Meta calls in IIFE; mock call-index fragility in capa test; duplicate vi.clearAllMocks)
- [x] Task 3: CAPA effectiveness recheck (commit b9def9c, review clean — MINOR: getNextRecheckDate uses local setDate not UTC → fix setDate→setUTCDate before prod; CRON_SECRET undefined demotes to "Bearer undefined"; DB update after send has no error check; nextDate??null no-op)
- [x] Task 4: i18n infrastructure + EN/MS/ZH translations (commit 87264a5, review clean — MINOR: report page h1 still hardcoded English (plan gap); offline db stub throws at runtime (temporary, Task 5 replaces); language-switcher cookie value not URL-decoded; SW path /ims hardcoded in layout)
- [x] Task 5: PWA offline capture (commits c048878..448ea48, review clean after fix — MINOR: SW clients.claim() outside waitUntil; fixed basePath in fetch URL; fixed syncNow stable callback with useRef)

---

# Phase 5 & 6 SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-11-phase-5-6-usability-compliance-analytics.md
Started: 2026-07-11 · Completed: 2026-07-12
Branch: phase-5-6

## Tasks

- [x] Housekeeping: removed stray "whatsapp 2" duplicates (identical to canonical)
- [x] In-app notification bell + badge (migration 016, SECURITY DEFINER RPC, /api/notifications, bell in protected layout, wired into incident/CAPA/escalation flows)
- [x] Incident closure lock + addenda (migration 017: incident_addenda + DB triggers; POST /close endpoint added — did not exist; addenda UI)
- [x] Incident list pagination (server-side .range(), shared Pagination component, HSE + supervisor inboxes)
- [x] Witness statement + alcohol test UI (investigation form + route, existing schema columns)
- [x] Type-specific intake forms (migration 018: type_details JSONB; validateTypeDetails whitelist; env/asset/security/fire field groups; EN/MS/ZH; offline queue support)
- [x] JKKP 8 annual register export (lib/reports/jkkp8.ts + /api/reports/jkkp8 CSV; dashboard button + January deadline banner)
- [x] Admin user + site/zone management (invite via service-role client, role/site/active management, site+zone CRUD with QR link)
- [x] Evidence thumbnails (Supabase render transform + onError fallback, lazy loading)
- [x] Phase 6: 12-month trend chart + top root causes (lib/dashboard/trends.ts pure helpers + tests)
- [x] Phase 6: AI rising-risk zones (/api/dashboard/ai/risk-flags, claude-opus-4-8 forced tool_use, panel on HSE + management dashboards)
- [x] Drive-by: fixed 9 pre-existing missing /ims basePath prefixes

Verification: 112 tests passing (23 files), tsc clean, next build clean.

---

# Bugfix SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-17-bugfixes-invite-capa-drugtest.md
Started: 2026-07-17
Base commit: e682162

## Tasks

- [x] Task 1: Fix invite redirect URL — commit a3ce59f, review clean
- [x] Task 2: CAPA Assigned To — commit e687510, review clean
- [x] Task 3: Split alcohol/urine test — commits e30d583..ac2f072, review clean (2 minor: as never cast in supervisor page; cosmetic single-test grid)

## Final Review (2026-07-17)
Verdict: Approved — ready to merge
Minor findings (non-blocking):
- alcohol_test_result missing CHECK constraint (urine_test_result has it) — asymmetric, follow-up migration
- PATCH audit_log only on complete=true, not on every field save — pre-existing gap
- supervisor page `as never` cast — already logged
- cosmetic single-test grid — already logged

# Remove Invite-by-Email SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-18-remove-invite-by-email.md
Started: 2026-07-18
Base commit: ac2f072

## Tasks

- [x] Task 1: Strip invite mode from UI + API — commit 33d4dd4, review clean (minor: audit log skipped on DELETE when target row null; unreachable ?? fallback in DELETE)
- [x] Task 2: Delete invite-callback page — no commit needed (files were untracked), review clean

## Final Review (2026-07-18)
Verdict: Approved after fix
- Important fixed: orphaned auth user on profile update failure — commit d5803da
- Minor (non-blocking): confirmDeleteId cleared before error check in deleteUser; no client-side guard disabling Delete for own account row

# Forgot Password SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-21-forgot-password.md
Started: 2026-07-21
Base commit: 3a5daaa

## Tasks

- [x] Task 1: Add "Forgot password?" link to login form (commit 4d7ab5d, review clean)
- [x] Task 2: Create forgot-password page (commit 211117e, review clean — reviewer finding 1 false positive: /reset-password page created by Task 3; finding 3 false positive: disabled={loading} already on button; finding 2 minor: appUrl fallback non-blocking, NEXT_PUBLIC_APP_URL set in .env.production)
- [x] Task 3: Create reset-password page + login success banner (commit fa88d62, review clean)
- [x] Task 4: Deploy to VPS (commit fa88d62 + 4fbab33, deployed)
- [x] Final review fixes: middleware isPublicRoute, Link basePath, session guard (commit 4fbab33, re-review approved)

# CAPA Owner Notes SDD Progress Ledger

Plan: docs/superpowers/plans/2026-07-23-capa-owner-notes.md
Started: 2026-07-23
Base commit: 71cf90e

## Tasks

- [x] Task 1: DB migration — owner_notes column (commit 52171ac, review clean — Critical finding resolved: column confirmed live via admin client SELECT)
- [x] Task 2: API expose owner_notes (commit 96eaeb7, review clean)
- [x] Task 3: CapaOwnerNotesForm component (commit 5f34dbb, review clean)
- [x] Task 4: Wire pages + deploy (commit 938eb7e, review clean)
- [x] Task 4: Wire pages + deploy (commit 938eb7e, review clean)
- [x] Final review fixes: field-level auth split, status gate, RLS migration, audit old_value, pending_verification form guard (commit 509ed90, re-review approved)

## Status: COMPLETE (deployed)
One manual step outstanding: apply supabase/migrations/20260723000002_tighten_capa_update_rls.sql via Supabase dashboard SQL editor.