RIEactie 2.0 — Project Map

📋 Governance (AI + Developer Rules)

CLAUDE.md GOV Claude Code working principles: plan-mode, subagent strategy, doc sync mandate (14 docs must stay in sync including project-map), prototype workflow, refactoring patterns (junction-helper, state-aware UI), user-trust mode, pragmatic scope management. Read by AI every session.
AGENTS.md GOV Architecture conventions, naming rules, CSS architecture (5-level interactive hierarchy, design tokens), version pointers to all canonical docs. Now a pointer-document: security/access/scoring rules reference FD and SECURITY.md.
DESIGN.md GOV Design tokens: CSS variables (brand, semantic, neutral, risk score), typography, spacing, elevation. Canonical source for all visual values — UI Design and prototype reference this.
README.md GOV Project overview, stack, doc index with versions, key concepts, quality metrics. First thing a new developer reads.
tasks/lessons.md GOV Process lessons from documentation mistakes. Pattern → rule format. Includes pre-commit grep checklist and numerical claims discipline.

📘 Canonical Specifications

docs/Functional_Design.md v5.30 Business requirements (~6,800 lines). ISO 29148-conformant SRS, 242 inline [REQ-###] anchors active + 1 superseded (REQ-094 Superseded by REQ-175). Recent: Wave 3 page-level UI shells (apr 2026): §3.6 Login Security Flows (REQ-202/203), §2.5 sidebar IA + dev-links (REQ-204/205), §5.6.13 Dashboard clickable KPI filters (REQ-213), §5.13a Profielpagina 4-tabs (REQ-217..220), §5.37 Teams CRUD (REQ-210), §5.38 Sessies-pagina's split per-user/admin (REQ-211/211b), §4.1 cross-refs naar split-screen REQ-201. Plus v5.28 Cleanup batch (§5.6b UserFindingFilter narrative + §5.30.3 Yuki architectural overview + §5.36 Cookie Consent expansion — closes audits #019/#016/#021), Bulk-close findings (§5.6.9, REQ-241), Trigger-conditie & default-velden per vraag (§5.15.7, REQ-175 v4), Actielijst-redesign (§5.6a, REQ-061 UX), Constructie 2.0 (§5.15, REQ-175), Platform Admin role, Progressiematrix (§5.6.12), Filter-vragen (§5.15.3a), Unified Detail Drawer (§5.32), Shared Measures (§5.33), Periodieke Maatregelen (§5.34).
docs/UI_Design.md v1.24 UI/UX patterns (~3,180 lines). UX Review Sweep (20 issues, 6 commits 32cf627..2fff194): WCAG AA contrast, Lucide SVG icon-set (15 inline <symbol>), status-strook simplified, sidebar IA Werken/Inzicht/Instellingen, drawer 9→3 super-tabs (Inhoud/Risico/Acties), filter-cascade reden user-friendly, undo-toast + showConfirm/showChoice modals, mode-segmented-control, density-segment in toolbar, top-pagination info, ESC+⌘K keyboard nav, inline form-validation, empty-state pattern, login split-screen, scroll-spy. Plus Actielijst-redesign §4.29, pakket-breed sticky-chrome, compacte stepper (§7), Stap 1 sibling-pattern (§4.28). Full page specs: Progressiematrix (§4.24), Constructie 2.0 (§4.25, REQ-175), BRF (§4.26), RI&E Dashboard (§4.27). Unified Drawer §4.23 + Shared Measures UI §4.23.1 + Periodieke Maatregelen UI §4.23.2. Reusable primitives in DESIGN.md §10.
docs/Implementation_Guide.md v6.19 Technical implementation (~4,200 lines). Phase 4 ops/UX backlog: §3.19 IntegrityCheckJob (REQ-243 daily 02:00 cross-tenant FK-orphan sweep), §3.17.9 DLQ manual-retry workflow, §3.17.10 YukiReconciliationJob (REQ-244 ghost-invoice recovery 02:30), §3.20 BulkCloseService (REQ-241 chunked 500-finding txn), §6.7 Idempotency-Key Pattern (REQ-242 Stripe-style), §6.8 OrphanedDraftException. Plus v6.18 §3.18 VaststellenService (REQ-178) + v6.17 §3.17 Yuki Accounting Integration (REQ-177): YukiClient + YukiInvoiceMapper + YukiSyncJob + YukiStatusPollJob, OAuth 2.0 per-Account, encrypted API-key, retry+DLQ. Plus v6.16 Cross-System Review fixes (Optimistic-lock §5.2.1, ActionSuggestionLink fix §3.15.2, 25MB upload, §6.6 17 generic UI helpers).
docs/DBML.txt v5.27 Database schema source of truth. 80 tables, 156 FKs, 57 CHECK constraints. v5.27 Schema-gap closure (REQ-219/220/202/263/241): +Table NotificationPreference + TrustedDevices, +Users.UiPreferences/CookieConsent + Findings.CloseReason columns, SecurityLog event-enum +14 events — closed §8 sync-gap for 5 shipped prototype features. v5.26 Project table dropped (audit #016 wontfix → fixed): Table Project + ProjectDocument removed; Findings.IdProject + Tasks.IdProject FKs dropped. Net 80→78 tables (-2), 161→158 FKs (-3), 58→57 CHECKs (-1 chk_project_dates). Plus v5.25 Constructie cache-key + publish-batch tracing (Phase 4 #2/#3): Account.ConstructieVersion (BIGINT NOT NULL DEFAULT 1, monotonic counter bumped door publishDrafts() — Vue 3 cache-key), DraftChangeSet.PublishBatchId (VARCHAR(26) ULID, ops-debug correlation). Plus v5.24 Yuki Accounting Integration kolommen (REQ-177): Account.YukiApiKey/YukiCustomerCode (encrypted), BillingPeriod.YukiInvoiceId/SyncedAt/LastError/Status + chk_billingperiod_yuki_status, PriceTier.YukiProductCode. Alle nullable — sprint-1 schema-only. GEEN Mollie-kolommen (Yuki level-2 sub-processor). Plus v5.23 Cross-System Review fixes (AnswerType simplificatie, ChecklistAnswer kolommen, Person.Email per-Account, UpdatedAt DATETIME(3)). Paste into dbdiagram.io for visual ERD.

🔒 Security & Compliance

docs/SECURITY.md v1.3 Security policy (24 sections). Threat model, OWASP Top 10, ISO 27001 compliance matrix, forbidden/required coding patterns, incident response. SecurityLog event-enum + security.scope_violation_detected (REQ-243 IntegrityCheckJob daily 02:00 cross-tenant FK-orphan sweep). Canonical source for security rules (AGENTS.md points here).
docs/Risk_Register.md v1.1 32 project risks with scoring (W×I), mitigations and REQ-### linkage. Linked to SECURITY.md and RTM.md. Annual review cadence.
docs/RTM.md v1.21 Requirements Traceability Matrix. 242 active + 1 superseded. 17 implemented prototype-only (REQ-170..REQ-176, REQ-178, REQ-210/211/211b/217-220/241/243 — laatste 9 toegevoegd in mei 2026 prototype landing batch). Wave 3 page-level UI shells (REQ-201..220 + REQ-211b, 21 REQs) per controller's 7 design decisions (split-screen login REQ-201, remember-me REQ-202, account-locked REQ-203, sidebar IA REQ-204/205, RI&E home progress-strook REQ-206, BRF 3-level REQ-207, Scoring picker REQ-208, Gebruikers drawer REQ-209, Teams CRUD REQ-210, Sessions split REQ-211/211b, Structuur drill-down REQ-212, Dashboard KPIs REQ-213, Rapportages REQ-214, Tijdlijn page REQ-215, Scoring read-only REQ-216, Profile-page REQ-217..220) + REQ-183 hybrid Account-template + per-Client override (Q7) + NEW SECTION Profile & User Settings (4). Plus v1.19 Wave 1 entity-CRUD (REQ-179..193), Wave 2 cross-cutting UI patterns (REQ-221..240), Wave 4 non-functional (REQ-256..263), Phase 4 product-candidate landing (REQ-241..244).
docs/BLUEPRINT_AUDIT.md v1.0 Punch-list of canonical-spec discrepancies surfaced by the validation harness or by manual audit cycles. Each finding maps to a fix in FD/IG/DBML/UI. 12 fixed (#001-#004, #012, #013, #014, #015, #016, #019, #020, #021), 5 wontfix (#011, #017, #024, #027, #028), 6 open (#005-#010), 3 deferred (#023, #025, #026). Cleanup batch (apr 2026) closed #016 (Project table drop), #019 (UserFindingFilter narrative), #021 (RTM legend prototype-only), formalized #011 wontfix (Finding casing convention), added #028 wontfix (workflow sub-step REQ obsolete).
docs/schema-fixes/ REF Overlay SQL files appended to auto-generated schema-raw.sql when DBML notation can't express a feature. Currently empty (Task 1 findings were all fixable directly in DBML.txt). Future audit cycles populate.

🎯 User Journeys & Testing

docs/user-journeys.md BDD 154 Gherkin BDD scenarios across 46 Features and 103 Rules. Covers all 7 user roles + 12 cross-cutting domains (auth, notifications, error handling, soft-delete, etc.) plus REQ-170..175 (Volledigheidsmatrix, Filter-vragen, Unified Drawer, Shared Measures, Periodieke Maatregelen, Constructie 2.0). @REQ-### tags for traceability. Direct testbaar met Cucumber/Pest.

🎨 Demo & Visual References

prototype/src/ SRC Source-of-truth voor het prototype — 146 small files (39 CSS, 25 HTML pages, 75 JS modules, 7 shell wrappers, alle <1.1k lines). Concatenated to docs/prototype.html via scripts/build-prototype.sh. Maakt section-targeted Read/Edit mogelijk zonder de 270k-token monoliet te laden. Zie CLAUDE.md §Prototype Access Protocol.
docs/prototype.html BUILD Build-artifact (~20,791 lines). Canonical visual reference voor alle schermen. Bevat alle 14+ pagina's incl. Progressiematrix, Constructie 2.0, BRF, Filter-vragen, Unified Detail Drawer, Shared Measures, Periodieke Maatregelen, Stap 4 vaststelling + promotion (Path A), Stap 3 dynamic Review met per-Subject feedback-thread + Reviewer-list panel + validation-gate, Toetsing status-timeline + compliance-toetsing, Rapportages real exports, Profielpagina 4-tabs (REQ-217..220), Integriteitscontrole admin status surface (REQ-243), Mijn sessies per-user split (REQ-211), Teams CRUD met state-aware delete + Activiteit-tab (REQ-210), Bulk-close popover met dedup-preview (REQ-241). Deployed op demo.rieactie.nl via docs/sync.sh (rebuilds before FTP).
docs/moodboard.html REF Kleurenreferentie met alle CSS variabelen uit prototype/src/styles/00-root-and-base.css :root block (44 tokens incl. --primary-deep for login WCAG AA + gradients + info/step states). Visuele palette-preview.

📐 Diagrams (Mermaid)

docs/diagrams/flowbeschrijving.md REF RI&E workflow flowchart. 4-staps proces: Inventarisatie → PvA → Review → Toetsing.
docs/diagrams/sitemap.md REF Sitemap / navigation tree. Alle pagina's en hun hiërarchie per module.
docs/diagrams/tenant-hierarchie.md REF 5-niveau tenant hiërarchie: Account → Branch → Client → Region → Location.
docs/diagrams/journey-*.md REF 3 Mermaid user journey diagrams (visual). Vervangen door BDD-scenarios in user-journeys.md.

📝 Design Plans (historical decisions)

docs/plans/2026-04-06-attachment-storage-design.md PLAN Attachment opslag: database BLOB met aparte DocumentContent tabel (niet disk). Approved.
docs/plans/2026-04-03-billing-design.md PLAN Abonnementen & billing: benoemde prijslijsten, staffels, pro-rata upgrades, lifecycle. Meest uitgebreide plan (47KB).
docs/plans/2026-04-02-gantt-*-design.md PLAN Gantt-tijdlijn + drag-interactie design: move/resize constraints, snap-to-grid, optimistic updates.
docs/plans/2026-04-02-pva-grid-redesign.md PLAN Plan van Aanpak grid: bevindingen-tabel met uitklapbare maatregelen sub-rijen.
docs/plans/2026-04-01-brf-detail-panel-design.md PLAN BRF detail panel: 3-tab drawer (Algemeen, Oorzaken, Gevolgen).
docs/plans/2026-03-30-batch-actions-design.md PLAN Batch acties: bulk-mode toggle, checkbox selectie, toolbar-transform.
docs/plans/2026-03-28-server-side-pagination*.md PLAN Server-side paginering: API contract, klassieke navigatie, 50 rijen default.

📚 External References

docs/references/*.pdf REF Arbokennisnet RI&E-dossier, RI&E stappenplan flyer, Ministerie SZW brief (2022). Bronnen voor compliance en scoring.
docs/references/screenshots/ REF 6 concurrentie-screenshots (IMA Online interface). Inspiratie voor UI-design.

⚙️ Operations

docs/Runbook.md v1.0 Operational reference (~342 lines, 11 sections + See also). Prerequisites, local development setup (cold-clone to running), prototype run + edit, demo deploy via docs/sync.sh, DB ops (Laravel-stack DOC), DBML→MySQL schema generation, OpenAPI tooling, common operational tasks (DLQ replay, integrity-check, publish-drafts CLI), rollback procedure (incl. vaststelling-irreversibility), troubleshooting (6 common issues). Cross-links liberally to CLAUDE.md/AGENTS.md/FD/IG/SECURITY rather than duplicating content.
docs/Onboarding.md v1.0 Day-1 reference for new developer (~209 lines, 8 sections + See also). Structured 2.5h reading order (10 docs with time estimates), 90-min setup checklist (8 numbered steps), first task spec (scaffold Laravel backend, 2-3h, explicit Definition of Done with FK/CHECK count verification), Q&A channels (placeholders for office hours + Slack), 15-term glossary cheat-sheet, 8 Don'ts anchored in CLAUDE.md/AGENTS.md/DESIGN.md, hour-by-hour Day-1 schedule with end-of-day checklist. Companion to Runbook.md.