# Validation Report: URS-005

**Title:** Prevent Uncertified Reps from Creating Orders
**Date:** 2026-09-29T02:31:01.775Z
**Duration:** 90.1s
**Overall Status:** ✅ PASS

## User Requirement

> The system shall prevent uncertified reps from creating orders until approved. (Repeating with URS-055)

*Source: `User_Requirement_Specifications_Vantis_DeviceFlow.xlsx` — the run below proves the system meets this requirement.*

## Environment

- **Inbox URL:** http://localhost:39399
- **Database:** localhost:41629/cc_repinbox_dev

## Setup

Status: ✅ PASS

## Test Steps

Each step below corresponds to one Playwright test that ran sequentially. Screenshots and video recordings provide visual evidence of the UI behaviour.

### 1. Step 1a: Uncertified rep blocked — ✅ PASS

**What this step proves:**

Proves the system correctly prevents a representative who has not completed the manufacturer's required certification from creating orders. Rana Reyes is in pending certification, so the bill-only order creation form displays a "Certification required" notice with a link to complete the certification, and the gated manufacturer is absent from the manufacturer picker. The same block appears on both the /billing/new and /orders/requests/new routes, confirming the enforcement is applied consistently across order entry points.

**Audit events generated by this step:**

*(Evidence matched by declared name — step timing not available or no events fell in window)*

| Time | Type | Action | User | Org | Performed |
|------|------|--------|------|-----|-----------|
| 2026-09-29 02:31:06Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — |
| 2026-09-29 02:31:23Z | user_log | user:login | blair.bennett@corvetasurgical.com | Corveta Surgical Group | — |
| 2026-09-29 02:31:36Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — |
| 2026-09-29 02:31:58Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — |

**Screenshots:**

![step 01 ryan logged in](screenshots/step-01-ryan-logged-in.png)

![step 01 order blocked](screenshots/step-01-order-blocked.png)

**Video recording:**

[▶ Watch step recording](videos/step-01-uncertified-blocked.webm)

---

### 2. Step 1b: Trunk order requests allowed while pending — ✅ PASS

**Screenshots:**

![step 01 order request trunk allowed](screenshots/step-01-order-request-trunk-allowed.png)

---

### 3. Step 2: Certified rep control — ✅ PASS

**What this step proves:**

Control condition confirming that the blocking behavior is targeted at uncertified reps only. Blair Bennett, whose representation relationship is active, can access the order creation form without any certification notice. The form auto-advances to Step 2 with Vantis pre-selected. This eliminates the possibility that the block in Step 1 is a general UI defect.

**Audit events generated by this step:**

*(Evidence matched by declared name — step timing not available or no events fell in window)*

| Time | Type | Action | User | Org | Performed |
|------|------|--------|------|-----|-----------|
| 2026-09-29 02:31:06Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — |
| 2026-09-29 02:31:23Z | user_log | user:login | blair.bennett@corvetasurgical.com | Corveta Surgical Group | — |
| 2026-09-29 02:31:36Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — |
| 2026-09-29 02:31:58Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — |

**Screenshots:**

![step 02 bob logged in](screenshots/step-02-bob-logged-in.png)

![step 02 order form accessible](screenshots/step-02-order-form-accessible.png)

**Video recording:**

[▶ Watch step recording](videos/step-02-certified-control.webm)

---

### 4. Step 3: Rep completes certification — ✅ PASS

**What this step proves:**

Rana opens the manufacturer's required certification and completes it in the UI: opens and acknowledges the training document (timestamped server-side), passes the knowledge check (graded server-side), and signs. Completion activates the representation relationship (status='active', reason_code='certification_completed') — this is what lifts the order gate.

**Audit events generated by this step:**

*(Evidence scoped to step execution window: 2026-09-29T02:31:44.403Z → 2026-09-29T02:31:55.853Z)*

| Time | Type | Action | User | Org | Performed |
|------|------|--------|------|-----|-----------|
| 2026-09-29 02:31:51Z | decision | forms.grade_submission | rana.reyes@corvetasurgical.com | Vantis | yes |
| 2026-09-29 02:31:55Z | decision | certifications.complete_certification.issue_certificate | rana.reyes@corvetasurgical.com | Vantis | yes |
| 2026-09-29 02:31:55Z | certification | signing_code_consumed | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:31:55Z | certification | completed | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:31:55Z | organization_representation | status_change | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:31:55Z | decision | certifications.complete_certification.mark_relationship_certified | rana.reyes@corvetasurgical.com | Vantis | yes |
| 2026-09-29 02:31:55Z | user_log | rep_relationship_certified | rana.reyes@corvetasurgical.com | Vantis | — |

**Screenshots:**

![step 03 identity verified](screenshots/step-03-identity-verified.png)

![step 03 doc acknowledged](screenshots/step-03-doc-acknowledged.png)

![step 03 quiz answers](screenshots/step-03-quiz-answers.png)

![step 03 signature](screenshots/step-03-signature.png)

![step 03 completed](screenshots/step-03-completed.png)

**Video recording:**

[▶ Watch step recording](videos/step-03-rep-certification.webm)

---

### 5. Step 4: Certified order creation — ✅ PASS

**What this step proves:**

Validates that the now-certified representative can create and submit a bill-only order without restriction. Rana logs in after completing the certification, accesses /billing/new without any certification notice, selects an account, adds a product with lot number, and successfully submits the order. The system redirects to /billing, confirming the gate is lifted immediately on certification completion.

**Audit events generated by this step:**

*(Evidence scoped to step execution window: 2026-09-29T02:32:00.426Z → 2026-09-29T02:32:30.289Z)*

| Time | Type | Action | User | Org | Performed |
|------|------|--------|------|-----|-----------|
| 2026-09-29 02:32:12Z | decision | bill_only_order.duplicate_submission_block | rana.reyes@corvetasurgical.com | Corveta Surgical Group | no |
| 2026-09-29 02:32:26Z | decision | bill_only_order.direct_po_import_on_create | rana.reyes@corvetasurgical.com | Vantis | no |
| 2026-09-29 02:32:26Z | decision | representatives.gate_rep_action | rana.reyes@corvetasurgical.com | Vantis | no |
| 2026-09-29 02:32:26Z | decision | representatives.gate_rep_action | rana.reyes@corvetasurgical.com | Vantis | no |
| 2026-09-29 02:32:26Z | decision | bill_only_order.inventory_items_decrement | rana.reyes@corvetasurgical.com | Vantis | yes |
| 2026-09-29 02:32:26Z | decision | bill_only_order.duplicate_submission_block | rana.reyes@corvetasurgical.com | Corveta Surgical Group | no |
| 2026-09-29 02:32:26Z | scheduled_task | scheduled_task.scheduled | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:32:26Z | billing_order | status_change | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:32:26Z | decision | basicErp.deriveSalesOrder | rana.reyes@corvetasurgical.com | Vantis | no |
| 2026-09-29 02:32:26Z | scheduled_task | scheduled_task.scheduled | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:32:26Z | scheduled_task | scheduled_task.scheduled | rana.reyes@corvetasurgical.com | Vantis | — |
| 2026-09-29 02:32:26Z | decision | bill_only.link_purchase_order | rana.reyes@corvetasurgical.com | Corveta Surgical Group | no |
| 2026-09-29 02:32:28Z | decision | bill_only.notifications.cc_incident_recipients | — | Vantis | no |
| 2026-09-29 02:32:29Z | transactional_email | new_bill_only | — | Corveta Surgical Group | — |

**Emails triggered by this step:**

*(Evidence matched by declared name — step timing not available or no events fell in window)*

**Email 1: New Bill-Only Order - 9/28/2026 - Vantis BO-1**

Template: `New_Bill-Only_Order_-_9_28_2026_-_Vantis_BO-1`

![New Bill-Only Order - 9/28/2026 - Vantis BO-1](screenshots/emails/2026-09-29T02-32-29-054Z-New_Bill-Only_Order_-_9_28_2026_-_Vantis_BO-1.png)

**Screenshots:**

![step 04 ryan logged in certified](screenshots/step-04-ryan-logged-in-certified.png)

![step 04 form accessible](screenshots/step-04-form-accessible.png)

![step 04 account selected](screenshots/step-04-account-selected.png)

![step 04 devices selected](screenshots/step-04-devices-selected.png)

![step 04 documents](screenshots/step-04-documents.png)

![step 04 review](screenshots/step-04-review.png)

![step 04 order submitted](screenshots/step-04-order-submitted.png)

**Video recording:**

[▶ Watch step recording](videos/step-04-certified-order.webm)

---

## Database Validations

The following SQL queries ran against the application database after the Playwright scenarios completed. Each query asserts a specific condition that proves the feature under test persisted its data correctly.

### Rana relationship now active — ✅ PASS

**Assertion:** Rana's representation relationship should be active after certification completion

```sql
SELECT id, status, active, responded_at, responded_by_user_id
      FROM organization_representation_relationships
      WHERE id = $1
```

| id | status | active | responded_at | responded_by_user_id |
| --- | --- | --- | --- | --- |
| 95d6e7f8-a9b0-1234-9012-345678901234 | active | true | NULL | NULL |

### Blair relationship still active (control) — ✅ PASS

**Assertion:** Blair's active flag should remain true and unaffected by Rana's approval flow

```sql
SELECT id, status, active
      FROM organization_representation_relationships
      WHERE id = $1
```

| id | status | active |
| --- | --- | --- |
| 84c5d6e7-f8a9-0123-8901-234567890123 | proposed_pending_onboarding | true |

### Certification completion status change recorded — ✅ PASS

**Assertion:** A status change to 'active' with reason_code 'certification_completed' should be recorded in the history table

```sql
SELECT id, to_status, from_status, reason_code, changed_by_user_id, created_at
      FROM organization_representation_request_status_changes
      WHERE relationship_id = $1
        AND created_at > NOW() - INTERVAL '30 minutes'
      ORDER BY created_at DESC
      LIMIT 5
```

| id | to_status | from_status | reason_code | changed_by_user_id | created_at |
| --- | --- | --- | --- | --- | --- |
| 01a0eb01-2461-72de-a98d-202156dbbd38 | active | pending_certification | certification_completed | 28c9d0e1-f2a3-4567-2345-678901234567 | 2026-09-29T02:31:55.713Z |

### Rana's certification record created on completion — ✅ PASS

**Assertion:** Exactly one certification record should exist for Rana, on the current version, with a completion timestamp and a signature reference

```sql
SELECT rep_user_id, certification_id, certification_version_id,
        completed_at, signature_ref
      FROM certification_records
      WHERE rep_user_id = $1 AND certification_id = $2
```

| rep_user_id | certification_id | certification_version_id | completed_at | signature_ref |
| --- | --- | --- | --- | --- |
| 28c9d0e1-f2a3-4567-2345-678901234567 | ce000100-0000-4000-8000-000000000001 | ce000200-0000-4000-8000-000000000002 | 2026-09-29T02:31:55.723Z | 01a0eb01-244b-70e8-9963-4952b5bf708e |

### Billing order created by Rana after certification — ✅ PASS

**Assertion:** At least one billing order should have been created by Rana after being certified

```sql
SELECT bo.id, bo.order_number, bo.status, bo.created_at, bo.created_by_user_id
      FROM billing_orders bo
      WHERE bo.created_by_user_id = $1
        AND bo.created_at > NOW() - INTERVAL '30 minutes'
      ORDER BY bo.created_at DESC
      LIMIT 5
```

| id | order_number | status | created_at | created_by_user_id |
| --- | --- | --- | --- | --- |
| 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | BO-1 | submitted | 2026-09-29T02:32:26.491Z | 28c9d0e1-f2a3-4567-2345-678901234567 |

### Audit trail for certification completion — ✅ PASS

**Assertion:** Audit/decision events should exist referencing Rana or his relationship after the certification completion

```sql
SELECT ae.id, ae.event_type, ae.action, ae.created_at, ae.user_id, ae.object_id,
        substring(ae.payload::text, 1, 500) as payload_preview
      FROM audit_events ae
      WHERE ae.created_at > NOW() - INTERVAL '30 minutes'
        AND (ae.object_id = $1 OR ae.object_id = $2)
      ORDER BY ae.created_at DESC
      LIMIT 10
```

| id | event_type | action | created_at | user_id | object_id | payload_preview |
| --- | --- | --- | --- | --- | --- | --- |
| 01a0eb01-2463-7069-9cbf-6cf121250d28 | organization_representation | status_change | 2026-09-29T02:31:55.713Z | 28c9d0e1-f2a3-4567-2345-678901234567 | 95d6e7f8-a9b0-1234-9012-345678901234 | {"reason": "Certification completed", "toStatus": "active", "fromStatus": "pending_certification", "reasonCode": "certification_completed", "requestingOrganizationId": "b2c3d4e5-f6a7-8901-bcde-f12345678901"} |
| 01a0eb01-2469-7de8-b2ae-b2979caaec1a | decision | certifications.complete_certification.mark_relationship_certified | 2026-09-29T02:31:55.713Z | 28c9d0e1-f2a3-4567-2345-678901234567 | 95d6e7f8-a9b0-1234-9012-345678901234 | {"reason": "relationship_pending_certification", "performed": true, "entityType": "organization_representation_relationship"} |

## Audit & Email Assertion Ledger

Per-declaration outcome of every `expectedAuditActions` and `expectedEmailTemplates` entry written into the orchestrator. Missing evidence here is a real test failure, not a soft warning.

### Audit Action Assertions

Each row asserts that a declared `expectedAuditActions` entry produced a matching row in `audit_events`. A ❌ flips overall status to FAIL — the declaration is real proof, not just an annotation.

| Step | Expected Audit Action | Found |
|------|-----------------------|-------|
| Step 1: Uncertified rep blocked | `user_log:user:login` | ✅ |
| Step 2: Certified rep control | `user_log:user:login` | ✅ |
| Step 3: Rep completes certification | `certification:completed` | ✅ |
| Step 4: Certified order creation | `decision:bill_only_order.direct_po_import_on_create` | ✅ |

### Email Template Assertions

Each row asserts that a declared `expectedEmailTemplates` entry was matched (case-insensitive substring) by a captured email subject or template. A ❌ flips overall status to FAIL.

| Step | Expected Template | Found |
|------|-------------------|-------|
| Step 4: Certified order creation | `New Bill-Only Order` | ✅ |

## Audit Log Events

Every row written to `audit_events` while this test was running (scoped to the demo organizations). Provides compliance evidence that user actions are traced end-to-end (URS-003).

**Capture window start:** 2026-09-29T02:31:00.048Z

<details><summary>Query used to capture events</summary>

```sql
SELECT
    ae.created_at,
    ae.event_type,
    ae.action,
    ae.user_id,
    u.email AS user_email,
    ae.organization_id,
    o.name AS organization_name,
    ae.object_id,
    ae.secondary_object_id,
    ae.payload,
    ae.route,
    ae.trace_id
  FROM audit_events ae
  LEFT JOIN users u ON u.id = ae.user_id
  LEFT JOIN organizations o ON o.id = ae.organization_id
  WHERE ae.created_at >= $1
    AND ae.organization_id = ANY($2::uuid[])
  ORDER BY ae.created_at ASC
```
</details>

31 event(s) captured:

| Time | Type | Action | User | Org | Object ID | Performed | Reason |
|------|------|--------|------|-----|-----------|-----------|--------|
| 2026-09-29 02:31:06Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — | — |  |
| 2026-09-29 02:31:23Z | user_log | user:login | blair.bennett@corvetasurgical.com | Corveta Surgical Group | — | — |  |
| 2026-09-29 02:31:36Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — | — |  |
| 2026-09-29 02:31:40Z | certification | signing_code_issued | rana.reyes@corvetasurgical.com | Vantis | ce000100-0000-4000-8000-000000000001 | — |  |
| 2026-09-29 02:31:40Z | decision | certifications.signing_challenge.send_sms | rana.reyes@corvetasurgical.com | Vantis | 01a0eb00-ea64-7719-8e9b-e116ce70acd9 | no | no_phone_channel |
| 2026-09-29 02:31:41Z | transactional_email | certification_signing_code | — | Vantis | 01a0eb00-ea64-7719-8e9b-e116ce70acd9 | — |  |
| 2026-09-29 02:31:44Z | certification | signing_code_verified | rana.reyes@corvetasurgical.com | Vantis | ce000100-0000-4000-8000-000000000001 | — |  |
| 2026-09-29 02:31:51Z | decision | forms.grade_submission | rana.reyes@corvetasurgical.com | Vantis | ce000300-0000-4000-8000-000000000002 | yes | all_answers_correct |
| 2026-09-29 02:31:55Z | decision | certifications.complete_certification.issue_certificate | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-244b-70e8-9963-49514e13bfe6 | yes | quiz_backed_completion |
| 2026-09-29 02:31:55Z | certification | signing_code_consumed | rana.reyes@corvetasurgical.com | Vantis | ce000100-0000-4000-8000-000000000001 | — |  |
| 2026-09-29 02:31:55Z | certification | completed | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-244b-70e8-9963-49514e13bfe6 | — |  |
| 2026-09-29 02:31:55Z | organization_representation | status_change | rana.reyes@corvetasurgical.com | Vantis | 95d6e7f8-a9b0-1234-9012-345678901234 | — | Certification completed |
| 2026-09-29 02:31:55Z | decision | certifications.complete_certification.mark_relationship_certified | rana.reyes@corvetasurgical.com | Vantis | 95d6e7f8-a9b0-1234-9012-345678901234 | yes | relationship_pending_certification |
| 2026-09-29 02:31:55Z | user_log | rep_relationship_certified | rana.reyes@corvetasurgical.com | Vantis | — | — | Certification completed |
| 2026-09-29 02:31:56Z | certification_certificate | issued | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-246d-71af-a685-d5da18aa74d2 | — |  |
| 2026-09-29 02:31:56Z | certification_completion_record | issued | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-2471-742e-9c95-f78d31cb017a | — |  |
| 2026-09-29 02:31:58Z | user_log | user:login | rana.reyes@corvetasurgical.com | Corveta Surgical Group | — | — |  |
| 2026-09-29 02:32:12Z | decision | bill_only_order.duplicate_submission_block | rana.reyes@corvetasurgical.com | Corveta Surgical Group | fea7b8c9-d0e1-2345-0123-456789012345 | no | no_same_day_candidates |
| 2026-09-29 02:32:26Z | decision | bill_only_order.direct_po_import_on_create | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | no | No uploaded PO documents |
| 2026-09-29 02:32:26Z | decision | representatives.gate_rep_action | rana.reyes@corvetasurgical.com | Vantis | a1b2c3d4-e5f6-7890-abcd-ef1234567890 | no | no_blocking_relationship |
| 2026-09-29 02:32:26Z | decision | representatives.gate_rep_action | rana.reyes@corvetasurgical.com | Vantis | a1b2c3d4-e5f6-7890-abcd-ef1234567890 | no | no_blocking_relationship |
| 2026-09-29 02:32:26Z | decision | bill_only_order.inventory_items_decrement | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | yes | inventory_items_decremented |
| 2026-09-29 02:32:26Z | decision | bill_only_order.duplicate_submission_block | rana.reyes@corvetasurgical.com | Corveta Surgical Group | fea7b8c9-d0e1-2345-0123-456789012345 | no | no_same_day_candidates |
| 2026-09-29 02:32:26Z | scheduled_task | scheduled_task.scheduled | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9ced-7f15-9d8b-dbde3f953072 | — |  |
| 2026-09-29 02:32:26Z | billing_order | status_change | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | — |  |
| 2026-09-29 02:32:26Z | decision | basicErp.deriveSalesOrder | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | no | flag_disabled |
| 2026-09-29 02:32:26Z | scheduled_task | scheduled_task.scheduled | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9ce5-735d-9aba-1bcae783afa6 | — |  |
| 2026-09-29 02:32:26Z | scheduled_task | scheduled_task.scheduled | rana.reyes@corvetasurgical.com | Vantis | 01a0eb01-9cea-7cda-a04e-d84a932b0ac7 | — |  |
| 2026-09-29 02:32:26Z | decision | bill_only.link_purchase_order | rana.reyes@corvetasurgical.com | Corveta Surgical Group | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | no | no_purchase_order_selected |
| 2026-09-29 02:32:28Z | decision | bill_only.notifications.cc_incident_recipients | — | Vantis | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | no | order has no no-charge item with an incident reason |
| 2026-09-29 02:32:29Z | transactional_email | new_bill_only | — | Corveta Surgical Group | 01a0eb01-9cc1-7f8c-a57c-d51d8d4d62f9 | — |  |

## Email Evidence

2 notification email(s) were captured during this test run. Each email is rendered as a screenshot for compliance review.

### 1. Your signing code for LiraLock Implant System Certification

**Template:** `Your_signing_code_for_LiraLock_Implant_System_Certification`

![Your signing code for LiraLock Implant System Certification](screenshots/emails/2026-09-29T02-31-41-375Z-Your_signing_code_for_LiraLock_Implant_System_Certification.png)

### 2. New Bill-Only Order - 9/28/2026 - Vantis BO-1

**Template:** `New_Bill-Only_Order_-_9_28_2026_-_Vantis_BO-1`

![New Bill-Only Order - 9/28/2026 - Vantis BO-1](screenshots/emails/2026-09-29T02-32-29-054Z-New_Bill-Only_Order_-_9_28_2026_-_Vantis_BO-1.png)