feat(F-142): completed feature

work/artifacts/F-142/implementer.md

@@ -0,0 +1,41 @@
+# F-142 — Implementer evidence
+
+## Entrega
+
+Se completó la fase obligatoria de discovery antes de crear componentes o endpoints:
+
+- `docs/reporting/REPORTING_ARCHITECTURE.md`
+- `docs/reporting/REPORTING_TASKS.md`
+
+También se abrieron los tickets P0 iniciales en el backlog mediante `scripts/new_ticket.py`:
+
+- F-143 — contracts, filters and RBAC
+- F-144 — historical store and financial snapshots
+- F-145 — payment lines and POS cash-safe capture
+- F-146 — ReportingService, summary and sales API
+- F-147 — Admin reporting shell and global filters
+- F-148 — sales dashboard and channel views
+- F-149 — product/category/brand reports
+- F-150 — CSV export
+
+## Hallazgos principales
+
+- La fuente única actual es `orders_orders` + `orders_items`, pero las ventas todavía no tienen `store_id` directo.
+- TPV ya distingue `source`, `terminal_id` y `cash_session_id`, aunque el flujo POS completo todavía está en tickets POS posteriores.
+- Pagos actuales son eventos de proveedor y no contienen método de pago ni líneas para pagos mixtos.
+- No existe un modelo de devoluciones detallado ni movimientos de caja inmutables.
+- `orders_items` conserva precio/descuento/impuesto, pero no `vat_rate` ni `cost_at_sale`; por tanto IVA por tipo y margen se marcan como no disponibles.
+- El total de pedido no separa portes, por lo que la API futura debe distinguir total cobrado de ventas de mercancía.
+- Categoría/marca actuales no son snapshots históricos.
+
+## Scope deliberadamente excluido
+
+No se implementaron endpoints, tablas reporting paralelas, dashboards, datos mock, cálculos financieros frontend ni caché prematura. La implementación comienza en F-143/F-144/F-145 y respeta el orden de dependencias documentado.
+
+## Verificación
+
+```text
+./scripts/verify.sh       ✅
+backlog válido (264)      ✅
+una sola feature activa (F-142) ✅
+```

work/artifacts/F-142/leader-close.json

@@ -0,0 +1,20 @@
+{
+  "feature_id": "F-142",
+  "agent": "leader",
+  "verdict": "APPROVED",
+  "summary": "F-142 cerrado: arquitectura de Reporting integrada con los modelos actuales, análisis de datos disponibles/faltantes, contrato API conceptual, estrategia de consultas/caché/RBAC y roadmap P0-P3 entregados antes de implementar dashboards.",
+  "checks": [
+    "reviewer.json APPROVED",
+    "security.json APPROVED",
+    "qa.json APPROVED",
+    "docs/reporting/REPORTING_ARCHITECTURE.md exists",
+    "docs/reporting/REPORTING_TASKS.md exists",
+    "P0 backlog tickets F-143..F-150 created with scripts/new_ticket.py",
+    "F-142 only in_progress during work",
+    "verify.sh exit 0",
+    "git diff --check exit 0"
+  ],
+  "commit_message": "docs(reporting): add architecture and phased task plan",
+  "next_step": "Start F-143: Reporting contracts, filters and RBAC",
+  "closed_at": "2026-08-21T20:08:00Z"
+}

work/artifacts/F-142/qa.json

@@ -0,0 +1,20 @@
+{
+  "feature_id": "F-142",
+  "agent": "qa",
+  "stage": "qa_gate",
+  "verdict": "APPROVED",
+  "reviewed_at": "2026-08-21T20:07:30Z",
+  "summary": "La fase de preparación de Reporting está completa y verificable. Los documentos cubren los 12 apartados requeridos, el plan P0-P3 está creado y el backlog contiene los tickets P0 sin activar una segunda feature.",
+  "acceptance_traceability": [
+    {"criterion":"Architecture file generated","ok":true,"evidence":"docs/reporting/REPORTING_ARCHITECTURE.md exists and documents models, relations, metrics, missing data, queries, indexes, API, components, cache, permissions and performance risks"},
+    {"criterion":"Task file generated","ok":true,"evidence":"docs/reporting/REPORTING_TASKS.md exists with dependency graph, P0/P1/P2/P3 and Definition of Done"},
+    {"criterion":"P0 coverage","ok":true,"evidence":"P0 includes dashboard, filters, sales, channel/store/terminal, products, payments, CSV and RBAC via RPT-001..RPT-010"},
+    {"criterion":"P1/P2/P3 coverage","ok":true,"evidence":"Cash, discounts, refunds, categories, customers, inventory, comparisons/drill-down, margins, heatmap, stock advanced, PDF, forecasting, alerts, scheduled reports and BI are classified"},
+    {"criterion":"No unjustified metrics","ok":true,"evidence":"Architecture marks margin, payment method, detailed refunds, VAT by rate and cash movement as unavailable until source data exists"},
+    {"criterion":"Backlog tickets created through script","ok":true,"evidence":"F-143..F-150 created by scripts/new_ticket.py; all remain pending; F-142 is the only in_progress feature"},
+    {"criterion":"Harness verification","ok":true,"evidence":"./scripts/verify.sh → backlog válido (264 features), runtime-status válido, exit 0"}
+  ],
+  "checks": [],
+  "issues": [],
+  "notes":"No application code was intentionally changed for Reporting. The next implementation ticket is F-143, followed by data prerequisites F-144/F-145 before financial dashboards."
+}

work/artifacts/F-142/reviewer.json

@@ -0,0 +1,19 @@
+{
+  "feature_id": "F-142",
+  "agent": "reviewer",
+  "stage": "review_gate",
+  "verdict": "APPROVED",
+  "reviewed_at": "2026-08-21T20:06:30Z",
+  "summary": "La arquitectura de Reporting está documentada antes de implementar UI/API y está basada en las tablas y módulos reales del repositorio. Identifica explícitamente qué métricas existen y qué datos faltan.",
+  "checks": [
+    {"item":"Existing models and relations inventoried","ok":true,"evidence":"REPORTING_ARCHITECTURE.md sections 2-3 cover orders/items, payments, inventory, POS, catalog, prices, promotions, taxes, customers and cash"},
+    {"item":"Available vs unavailable metrics separated","ok":true,"evidence":"Section 4 explicitly excludes payment method, detailed refunds, VAT rate, historical margin, shipping split and cash movements until data exists"},
+    {"item":"No parallel source of truth proposed","ok":true,"evidence":"Architecture uses orders_orders/orders_items and existing transactional modules; aggregation deferred until measured"},
+    {"item":"API/filter/query design present","ok":true,"evidence":"Common filter contract, response envelope, CTE strategy, grouping and pagination documented"},
+    {"item":"Performance and cache risks addressed","ok":true,"evidence":"EXPLAIN/ANALYZE-first policy, measured indexes, 30-60s cache proposal, N+1 prohibition and export limits"},
+    {"item":"Frontend/RBAC evolution documented","ok":true,"evidence":"Reusable Admin components, URL filters, backend permissions and financial-data scope documented"},
+    {"item":"P0-P3 task plan created","ok":true,"evidence":"REPORTING_TASKS.md contains dependency graph, P0, P1, P2 and P3 tasks; F-143..F-150 opened for P0"}
+  ],
+  "issues": [],
+  "notes":"This feature intentionally stops at architecture/tasks. Dashboard implementation must start with F-143 and must not bypass the missing-data prerequisites in F-144/F-145."
+}

work/artifacts/F-142/security.json

@@ -0,0 +1,19 @@
+{
+  "feature_id": "F-142",
+  "agent": "security",
+  "stage": "security_gate",
+  "verdict": "APPROVED",
+  "reviewed_at": "2026-08-21T20:07:00Z",
+  "summary": "El diseño incorpora los controles necesarios para reporting: autorización backend, aislamiento de tienda, protección de PII/finanzas, SQL parametrizado y exportaciones limitadas. No se ha añadido código ni almacenamiento de datos.",
+  "checks": [
+    {"item":"PII scope identified","ok":true,"evidence":"Customer report requires permission and architecture limits emails/addresses to authorized reports"},
+    {"item":"Financial data scope identified","ok":true,"evidence":"REPORTING_FINANCIAL protects cost/margin, tax detail and cash differences"},
+    {"item":"Cross-store isolation planned","ok":true,"evidence":"Store scope is required in SQL and authorization; negative tests included in task Definition of Done"},
+    {"item":"SQL injection risk addressed","ok":true,"evidence":"Contract requires parameterized values, bounded filters and rejects invalid IDs; groupBy/order are allowlisted concepts"},
+    {"item":"Payment data safety addressed","ok":true,"evidence":"Payment-line task explicitly forbids PAN/CVV and stores only provider references"},
+    {"item":"Export abuse addressed","ok":true,"evidence":"REPORTING_EXPORT, server-side limits/streaming and audit metadata are required"},
+    {"item":"No security behavior changed in F-142","ok":true,"evidence":"Only docs and pending backlog tickets were added"}
+  ],
+  "issues": [],
+  "notes":"Implementation must treat the architecture as a security contract: frontend visibility is not authorization; each report/export/filter must be checked in backend."
+}