# Packet Station policy

Status: planned, phase 2. This is a stub. It lists what the approved plan says this document will contain. See [PLAN.md](PLAN.md), "Policy port and concurrency rules".

## Purpose

Who may do what to a packet, and when. A Python port of the old `guard.js`, run only on the server. Pure functions, no I/O.

## Roles

Every role comes from an AD group: Admin; Clerical, Warehouse and Q.C. with a member and a Supervisor level; Project Management (view only); and 14 shop departments with Worker, Lead and Supervisor. A person's roles are the union of their groups.

## Custody

Only whoever holds the packet may change it. Draft: Clerical. Warehouse: Warehouse. Ready and review: the department lead or above. Assigned and in progress: the lead or above, or the assigned worker. Q.C.: Q.C. Complete: Clerical. Filed: nobody.

## Actions and transitions

An Action enum with one rule per action: who, from and to status, department change, change-order hold, preconditions, signature meaning, and whether a reason is required.

## Preconditions

Named predicates, checked on the server and never bypassed, including by Admin.

## Order of checks

Removed, wrong status, change-order hold, admin bypass of custody with an IT reason, filed lock, who and custody, then preconditions.

## Signatures

Which actions need a PIN or domain password signature, and what the signature records.

## Concurrency

Compare-and-set on workflow steps (409 "someone else already took this step"), row versions on child rows, server-assigned numbers, append-only tables.

## Tightenings against the old build

The old policy is looser than the old UI in places. Each tightening is listed here so Seth can veto it. Known so far: Clerical lead actions move to Clerical Supervisor; packets routed to Shipping get the Clerical close and file path; SET_DATABOOK_AT is restricted to Clerical and Q.C. by default.