# Indirect Goods Upgrade — Phase 11 Completion

## Permission model

The following dedicated permissions are registered, seeded and available as Laravel gates:

- `warehouse.indirect-issue.inventory`
- `warehouse.indirect-issue.direct-delivery`
- `warehouse.indirect-issue.foc`
- `warehouse.indirect-issue.reverse`
- `warehouse.indirect-returns.view`
- `warehouse.indirect-returns.create`
- `warehouse.indirect-returns.inspect`
- `warehouse.indirect-returns.complete`
- `warehouse.indirect-returns.reverse`
- `warehouse.indirect-foc.view`
- `warehouse.indirect-foc.adjust`
- `warehouse.indirect-foc.dispose`
- `warehouse.indirect-reconciliation.run`

Role assignments follow least privilege:

| Role | Phase 11 permissions |
|---|---:|
| Warehouse manager | 13 |
| Warehouse supervisor | 9 |
| Warehouse clerk | 5 |
| Project manager | 3 |
| Warehouse viewer | 2 |

Reverse, disposal and reconciliation permissions are intentionally manager-only. There are currently no public reversal or disposal routes; adding one later requires the reserved permission before the route can be exposed.

## Enforced boundaries

- Warehouse indirect issue requires `warehouse.indirect-issue.inventory`.
- Supplier direct delivery requires `warehouse.indirect-issue.direct-delivery`.
- FOC issue requires `warehouse.indirect-issue.foc`.
- The combined Material Issue endpoint checks the permission for every indirect source that contains a positive allocation. Direct-only submissions are unaffected.
- Return view/create/inspect/complete actions each use their dedicated permission.
- Indirect FOC view and manual adjustment use separate permissions.
- Supplier direct-delivery documents require the supplier-delivery permission.
- Consumption stock and invoice lookup APIs require consumption view permission.
- Warehouse and FOC availability APIs require their matching source permission, preventing unauthorized stock inference.

## Audit controls

| Operation | Audit evidence |
|---|---|
| Warehouse/FOC issue | Fulfillment `fulfilled_by`/`fulfilled_at`, allocations, and stock movements with before/moved/after quantities |
| Supplier direct delivery | Delivery/acceptance document, fulfillment source reference, user and timestamps |
| FOC manual adjustment | Required reason, quantity/status before and after, requester/approver and approval timestamp |
| Return submission | Creator, idempotency key, retained document path, submitted lines and conditions |
| Return inspection | Inspector and inspection timestamp |
| Return completion | Completer and completion timestamp, FOC destination, adjustment and movement records |
| Consumption | Consumer, consumption date, allocation link and project-stock movement |

Completed indirect return and fulfillment documents have no hard-delete route. Uploaded return evidence is retained through the document record. Manual FOC adjustment requires a reason, and its before/after values are immutable ledger entries.

## Verification

- All 13 permissions exist in the database.
- Role assignment counts match the table above.
- Permission boundary suite passes for all current indirect mutation routes and stock APIs.
- Domain invariant tests remain green.
- Combined result: 10 tests, 40 assertions.
- PHP syntax, Blade compilation and diff validation pass.