[jcotillo]

Why

TURNWRK-728 makes the compliance tracker its own product line on the shared core: a host can sign up for just the Florida tracker without the rest of Dispatch. Entitlement to a suite surface lives on Org.enabledApps, which today only knows hostfixCmms, restock and service, so there is no way to say "this org has the tracker and nothing else".

What changed

• OrgAppKey gains 'compliance' and OrgEnabledApps.compliance?: boolean, documented as the standalone tracker entry. Scheduling automation stays a plan entitlement (Operator); this key never grants it.
• orgAppEnabled(org, 'compliance') is opt-in: true only when the key is true, never grandfathered onto orgs with no enabledApps, false when suspended.
• normalizeEnabledApps writes compliance: true only when on. Absent reads as off, so every existing org doc and every consumer test fixture (clean, restock, dispatch, cortex) stays byte-identical after the bot sync.
• Net source lines: +13 / -1 in src/types/org.ts; tests +29.

What deliberately did NOT change

• firestore.rules: enabledApps is already a privileged org field as a whole map, so the new key is covered.
• DEFAULT_TRIAL_ENABLED_APPS: the tracker is a choice in onboarding, not a default.

Proof

New tests fail on the old org.ts (stashed) and pass with the change:

old org.ts:  × normalize keeps it when on and omits it when off   Tests 1 failed | 13 passed (14)
new org.ts:  Tests 14 passed (14)

Verification

• npx tsc --noEmit: exit 0
• npx vitest run: 68/68 files, 703/703 passed

Consumer: TurnWrk/dispatch PR for TURNWRK-728 vendors this commit (a090753). Merge this one first; the bot sync then restamps dispatch on the squash-merged main SHA.

Refs: TURNWRK-728

🤖 Generated with Claude Code

[practical-bot]

Review

I reviewed origin/main...a0907536b1b9e50a58d727c860ee01b14f255968 (#36), scoped to the shared-core portion of TURNWRK-728. The change is appropriately limited to the shared Org entitlement type and its normalization/lookup behavior; onboarding, Dispatch routing, scheduling, and Playwright coverage belong to the linked consumer PR and are not duplicated here.

What is right:

• OrgAppKey and OrgEnabledApps add the opt-in compliance key without changing the existing trial defaults.
• orgAppEnabled keeps compliance off for absent enabledApps, requires the key to be exactly true, and still turns every app off for suspended orgs.
• normalizeEnabledApps preserves existing canonical output for the other apps and emits compliance only when enabled, matching the compatibility goal stated in the PR.
• The focused regression tests cover enabled, absent, suspended, and normalization cases. The CI typecheck + unit job ran npm run typecheck, npm run test:run, npm run build, and vendored checks successfully on this head. The secret scan and Firestore rules behavior jobs also passed.

Claim ledger

• PR claim: “New tests fail on the old org.ts (stashed) and pass with the change: old org.ts: × normalize keeps it when on and omits it when off Tests 1 failed | 13 passed (14); new org.ts: Tests 14 passed (14).” UNVERIFIED for the old-tree result: the referenced stash/old-tree artifact is not available in this review workspace, so I did not infer the historical failure. The current command passed: npm run test:run -- tests/orgAppEnabled.test.ts → 14 passed (14).
• PR claim: “npx tsc --noEmit: exit 0.” PASS, independently run: npx tsc --noEmit → exit 0 (no output). It is also covered by CI run 37548675469, job typecheck + unit.
• PR claim: “npx vitest run: 68/68 files, 703/703 passed.” VERIFIED-BY-CI, not re-run wholesale by design. CI run 37548675469, job typecheck + unit, ran npm run test:run successfully. The changed-surface command independently passed: npm run test:run -- tests/orgAppEnabled.test.ts → 1 passed, 14 passed (14).
• PR claim: “firestore.rules: enabledApps is already a privileged org field as a whole map, so the new key is covered.” VERIFIED-BY-CI for the unchanged rules behavior: CI run 37548675469, job firestore rules behavior tests, ran npm run test:rules successfully.
• PR claim: “Net source lines: +13 / -1 in src/types/org.ts; tests +29.” PASS against the PR diff: source is +13/-1, tests are +29; total tracked diff is +42/-1.

No blocking findings.

REVIEW VERDICT: approve
FINDING: The PR body’s historical old-tree mutation result could not be re-executed because the referenced stash/artifact is unavailable; the current regression test and CI evidence pass -> DROPPED (historical evidence limitation, not a defect)

[jcotillo]

merge:queued applied at Julissa's request (Claude Code seat, 2026-10-06): TURNWRK-728, Talos-approved, CI green.