The enforcement model

Templates, cases, steps

A workflow template is a named sequence of steps for a kind of work — receiving, installation, testing, commissioning, maintenance, removal, or custom. Each step has a type: photo_required, measurement_in_range (with min, max and unit), checklist_pass, seal_verified, signature, or document_upload. Opening a case against an asset copies the template's steps onto that case, unsatisfied.

Cases and their steps come into being only through lt_open_case and lt_open_inspection. A direct insert of a pre-satisfied step is refused by trigger; so is deleting a step, so the trick of removing the blocking step and then closing does not work.

The gates

Satisfying a step is a BEFORE UPDATE trigger that checks the evidence against the step's type: a photograph step needs at least one stored photograph, a measurement must fall inside the configured range, a signature needs a signature certificate, a document step needs a document reference. Steps satisfy in order. Every satisfied step names the person who did it.

Closing a case is refused while any required step is unsatisfied; the refusal names how many are left. Some case kinds also require independent acceptance by someone who did not perform the work. Once closed, the case and its steps are frozen — updates are refused, and the freeze survives the row moving to a new owner at handover because a stewardship-only change (org_id and nothing else) is the one edit the freeze lets through.

Nobody outranks the gate

The triggers do not check who you are. A database superuser cannot close an incomplete case; the stress suite proves it.

Corrections are added

A wrong entry is not edited. A correction is a new, attributed, logged entry on an open case; closed evidence is never rewritten.

Deficiencies close with proof

A deficiency cannot move to closed without at least one fix photograph and a named verifier; NCRs cannot close without a documented corrective action.