Compliance
What the in-app compliance roadmap covers (Anexo 21/22/23)
Section titled “What the in-app compliance roadmap covers (Anexo 21/22/23)”Per .../lib/compliance/ROADMAP.md, the dashboard’s compliance feature is organized into two streams:
Stream A — Bitácora & Alarms (Anexo 21): a durable event log (bitácora) covering WorkOS auth/user events, manual entries, read-back APIs, and an audit UI — all roles must be able to read; only Admin/Supervisor/Operator can write manually; Auditor Fiscal is read-only. Currently blocked on a PostgreSQL migration (003) to persist the log — the working implementation writes to an ephemeral local JSON sink that’s wiped on container restart.
Stream B — Compliance Dashboard (Anexo 22/23): an obligations/evidence tracking workflow — compliance_obligation, compliance_evidence, compliance_activity, compliance_workflow_state tables (migration 004, depends on 003), with fixed step sequences per Anexo 22 (vendor accreditation/certification) and Anexo 23 (lab sample dictamen), RBAC-gated status transitions, and an Airflow-driven deadline monitor (PENDING → AT_RISK → OVERDUE).
See the source file for full per-task detail, external prerequisites (DB migration ownership, WorkOS role setup, SharePoint grants), and the “Definition of Done” checklist.
Underlying data
Section titled “Underlying data”Compliance logic reads from the same PostgreSQL database as the balance page — see Postgres Setup for the connection model shared across dashboard features.