From 269f9984ef726535f34373c9d060b341d320bb61 Mon Sep 17 00:00:00 2001
From: gsinghpal <gur_preet.singh@outlook.com>
Date: Sun, 24 May 2026 01:45:39 -0400
Subject: [PATCH] =?UTF-8?q?feat(plating-views):=20Layer=203=20=E2=80=94=20?=
 =?UTF-8?q?field/button=20gates=20per=20role?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Phase D Task D5 of permissions overhaul. Adds explicit groups= to
form-level elements so non-matching roles don't even SEE the buttons
they can't use:

- SO Confirm button → group_fp_sales_manager (Sales Rep sees the SO
  in draft but no Confirm button — matches model-level gate from Phase G)
- SO pricing fields (price_unit/subtotal/total/untaxed/tax) →
  group_fp_sales_rep (Technician/Shop Manager don't see pricing if
  they navigate to an SO)
- Partner Account Hold tab → group_fp_manager (was the fold-in
  group_fp_accounting; the audit-finding-11 _administrator typo lives
  in res_partner.py and is Phase G's fix)
- CAPA Close + all state-transition buttons → group_fp_quality_manager;
  edit fields use readonly="not user_has_groups(...)" so Manager
  retains read+comment per spec section 2.C
- Audit Start/Findings/Close buttons → group_fp_quality_manager
- AVL Approve/Suspend/Reinstate/Remove → group_fp_quality_manager
  (model uses Suspend+Remove instead of spec's literal 'Disqualify';
  both surfaces gated, semantics match)
- Customer Spec edit fields → readonly for non-QM (Manager keeps
  read access per spec; only inputs lock)
- FAIR Approve/Reject buttons → group_fp_quality_manager (Submit-
  for-Review and Reset stay open to whoever created the FAIR)
- Certificate Issue button — Strategy B chosen: single button hidden
  when cert_type=nadcap_cert AND user is not QM. Cleaner than splitting
  into two buttons; no separate action_sign exists on fp.certificate
  (Issue is the sign+publish action). FAIR lives in its own model;
  fp.certificate only has nadcap_cert as a special type. The ir.rule
  from Phase C enforces model-level writes independently.
- CGP form buttons (7 view files: ai, controlled_good, psa,
  receipt_shipment, registration, security_incident, visitor) →
  group_fp_quality_manager on every action button

Defense in depth: ir.rules and ACLs (from Phases B + C) already
restrict model access. These view gates are the UI layer that
matches.

Concerns:
- Spec line 192 names 'sale.order view — x_fc_account_hold_override'
  but no such field exists in the codebase. Closest practical match
  was the partner-side Account Hold management tab, which already had
  a group= attribute. Re-gated there; no SO-side field to gate.
- AVL model has no action_disqualify per spec; uses suspend+remove.
  Both gated to QM.
- fp.certificate has no action_sign (only action_issue). FAIR's
  approve/reject covers the FAIR side; nadcap-cert Issue covers the
  cert side via Strategy B.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---
 .../__manifest__.py                           |  2 +-
 .../views/fp_certificate_views.xml            | 12 +++-
 .../fusion_plating_cgp/__manifest__.py        |  2 +-
 .../views/fp_cgp_ai_views.xml                 | 15 +++--
 .../views/fp_cgp_controlled_good_views.xml    | 14 +++--
 .../views/fp_cgp_psa_views.xml                | 14 +++--
 .../views/fp_cgp_receipt_shipment_views.xml   | 14 +++--
 .../views/fp_cgp_registration_views.xml       | 17 ++++--
 .../views/fp_cgp_security_incident_views.xml  | 14 +++--
 .../views/fp_cgp_visitor_views.xml            | 14 +++--
 .../__manifest__.py                           |  2 +-
 .../views/sale_order_views.xml                | 25 +++++++-
 .../fusion_plating_invoicing/__manifest__.py  |  2 +-
 .../views/res_partner_views.xml               | 10 +++-
 .../fusion_plating_quality/__manifest__.py    |  2 +-
 .../views/fp_audit_views.xml                  | 11 +++-
 .../views/fp_avl_views.xml                    | 18 ++++--
 .../views/fp_capa_views.xml                   | 59 +++++++++++++------
 .../views/fp_customer_spec_views.xml          | 37 ++++++++----
 .../views/fp_fair_views.xml                   | 12 +++-
 20 files changed, 222 insertions(+), 74 deletions(-)

diff --git a/fusion_plating/fusion_plating_certificates/__manifest__.py b/fusion_plating/fusion_plating_certificates/__manifest__.py
index b1a1b0ca..9423c7c0 100644
--- a/fusion_plating/fusion_plating_certificates/__manifest__.py
+++ b/fusion_plating/fusion_plating_certificates/__manifest__.py
@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Certificates',
-    'version': '19.0.7.9.2',
+    'version': '19.0.7.9.3',
     'category': 'Manufacturing/Plating',
     'summary': 'Certificate registry for CoC, thickness reports, and quality documents.',
     'description': """
diff --git a/fusion_plating/fusion_plating_certificates/views/fp_certificate_views.xml b/fusion_plating/fusion_plating_certificates/views/fp_certificate_views.xml
index 9f3406be..2b280275 100644
--- a/fusion_plating/fusion_plating_certificates/views/fp_certificate_views.xml
+++ b/fusion_plating/fusion_plating_certificates/views/fp_certificate_views.xml
@@ -39,9 +39,19 @@
         <field name="arch" type="xml">
             <form>
                 <header>
+                    <!-- Phase D5 — Nadcap certs are QM-only to Issue per spec
+                         section 2.C (FAIR/Nadcap sign/issue restricted to
+                         Quality Manager). Strategy B: single button visible
+                         to all when state=draft and cert_type is routine
+                         (coc/thickness_report/mill_test/customer_specific);
+                         hidden for non-QM when cert_type=nadcap_cert. The
+                         ir.rule from Phase C also restricts model writes on
+                         FAIR/Nadcap so model-layer enforcement is independent.
+                         No separate action_sign exists on this model — Issue
+                         is the sign + publish action. -->
                     <button name="action_issue" string="Issue"
                             type="object" class="btn-primary"
-                            invisible="state != 'draft'"/>
+                            invisible="state != 'draft' or (certificate_type == 'nadcap_cert' and not user_has_groups('fusion_plating.group_fp_quality_manager'))"/>
                     <!-- Print = the same EN report action the gear-menu
                          Print > Certificate of Conformance (English)
                          calls. Routes through fusion_pdf_preview's
diff --git a/fusion_plating/fusion_plating_cgp/__manifest__.py b/fusion_plating/fusion_plating_cgp/__manifest__.py
index c27569d7..1c5349b4 100644
--- a/fusion_plating/fusion_plating_cgp/__manifest__.py
+++ b/fusion_plating/fusion_plating_cgp/__manifest__.py
@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Controlled Goods Program',
-    'version': '19.0.1.2.2',
+    'version': '19.0.1.2.3',
     'category': 'Manufacturing/Plating',
     'summary': 'Canadian Controlled Goods Program (CGP) compliance for plating '
                'shops handling defence work: registration, authorized individuals, '
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_ai_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_ai_views.xml
index ac6af36c..63f3da0e 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_ai_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_ai_views.xml
@@ -36,15 +36,22 @@
         <field name="arch" type="xml">
             <form string="Authorized Individual">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C (CGP fold-in lands entirely under
+                         Quality Manager). -->
                     <button name="action_activate" string="Activate" type="object"
                             class="oe_highlight"
-                            invisible="state == 'active'"/>
+                            invisible="state == 'active'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_suspend" string="Suspend" type="object"
-                            invisible="state not in ('active',)"/>
+                            invisible="state not in ('active',)"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_revoke" string="Revoke" type="object"
-                            invisible="state == 'revoked'"/>
+                            invisible="state == 'revoked'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_deactivate" string="Deactivate" type="object"
-                            invisible="state != 'active'"/>
+                            invisible="state != 'active'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="active,inactive,suspended,revoked"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_controlled_good_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_controlled_good_views.xml
index c5a4ba2a..5584c93a 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_controlled_good_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_controlled_good_views.xml
@@ -35,17 +35,23 @@
         <field name="arch" type="xml">
             <form string="Controlled Good" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_mark_in_process" string="In Process"
                             type="object"
-                            invisible="state == 'in_process'"/>
+                            invisible="state == 'in_process'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_in_storage" string="In Storage"
                             type="object"
-                            invisible="state == 'in_storage'"/>
+                            invisible="state == 'in_storage'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_shipped" string="Shipped" type="object"
-                            invisible="state == 'shipped'"/>
+                            invisible="state == 'shipped'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_destroyed" string="Destroyed"
                             type="object"
-                            invisible="state == 'destroyed'"/>
+                            invisible="state == 'destroyed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="received,in_process,in_storage,shipped"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_psa_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_psa_views.xml
index 501241f0..6b2ad2f9 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_psa_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_psa_views.xml
@@ -35,16 +35,22 @@
         <field name="arch" type="xml">
             <form string="Personnel Security Assessment" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_start" string="Start" type="object"
                             class="oe_highlight"
-                            invisible="state != 'draft'"/>
+                            invisible="state != 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_complete" string="Complete" type="object"
                             class="oe_highlight"
-                            invisible="state != 'in_progress'"/>
+                            invisible="state != 'in_progress'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_expire" string="Mark Expired" type="object"
-                            invisible="state != 'completed'"/>
+                            invisible="state != 'completed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
-                            invisible="state == 'draft'"/>
+                            invisible="state == 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="draft,in_progress,completed,expired"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_receipt_shipment_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_receipt_shipment_views.xml
index 69f551d7..290f40dd 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_receipt_shipment_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_receipt_shipment_views.xml
@@ -37,16 +37,22 @@
         <field name="arch" type="xml">
             <form string="CGP Receipt / Shipment" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_authorize" string="Authorize" type="object"
                             class="oe_highlight"
-                            invisible="state != 'draft'"/>
+                            invisible="state != 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_execute" string="Execute" type="object"
                             class="oe_highlight"
-                            invisible="state != 'authorized'"/>
+                            invisible="state != 'authorized'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close" type="object"
-                            invisible="state != 'executed'"/>
+                            invisible="state != 'executed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
-                            invisible="state == 'draft'"/>
+                            invisible="state == 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="draft,authorized,executed,closed"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_registration_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_registration_views.xml
index 72b17627..8d8ee68c 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_registration_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_registration_views.xml
@@ -36,17 +36,24 @@
         <field name="arch" type="xml">
             <form string="CGP Registration" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_mark_registered" string="Mark Registered"
                             type="object" class="oe_highlight"
-                            invisible="state != 'pending'"/>
+                            invisible="state != 'pending'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_suspend" string="Suspend" type="object"
-                            invisible="state != 'registered'"/>
+                            invisible="state != 'registered'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_expire" string="Mark Expired" type="object"
-                            invisible="state not in ('registered','suspended')"/>
+                            invisible="state not in ('registered','suspended')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_revoke" string="Revoke" type="object"
-                            invisible="state == 'revoked'"/>
+                            invisible="state == 'revoked'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_pending" string="Reset" type="object"
-                            invisible="state == 'pending'"/>
+                            invisible="state == 'pending'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="pending,registered,suspended,expired,revoked"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_security_incident_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_security_incident_views.xml
index 675c1714..14b165bb 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_security_incident_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_security_incident_views.xml
@@ -39,16 +39,22 @@
         <field name="arch" type="xml">
             <form string="Security Incident" class="o_fp_cgp_classified">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_investigate" string="Investigate"
                             type="object" class="oe_highlight"
-                            invisible="state != 'discovered'"/>
+                            invisible="state != 'discovered'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_report" string="Report to PSPC"
                             type="object" class="oe_highlight"
-                            invisible="state != 'investigating'"/>
+                            invisible="state != 'investigating'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close" type="object"
-                            invisible="state not in ('investigating','reported')"/>
+                            invisible="state not in ('investigating','reported')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset" string="Reset" type="object"
-                            invisible="state == 'discovered'"/>
+                            invisible="state == 'discovered'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="discovered,investigating,reported,closed"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_cgp/views/fp_cgp_visitor_views.xml b/fusion_plating/fusion_plating_cgp/views/fp_cgp_visitor_views.xml
index 6d38503d..5c8fa81d 100644
--- a/fusion_plating/fusion_plating_cgp/views/fp_cgp_visitor_views.xml
+++ b/fusion_plating/fusion_plating_cgp/views/fp_cgp_visitor_views.xml
@@ -39,16 +39,22 @@
         <field name="arch" type="xml">
             <form string="CGP Visitor">
                 <header>
+                    <!-- Phase D5 — all CGP form buttons are QM-only per spec
+                         section 2.C. -->
                     <button name="action_check_in" string="Check In" type="object"
                             class="oe_highlight"
-                            invisible="state != 'scheduled'"/>
+                            invisible="state != 'scheduled'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_check_out" string="Check Out" type="object"
                             class="oe_highlight"
-                            invisible="state != 'checked_in'"/>
+                            invisible="state != 'checked_in'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_deny" string="Deny" type="object"
-                            invisible="state not in ('scheduled','checked_in')"/>
+                            invisible="state not in ('scheduled','checked_in')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_cancel" string="Cancel" type="object"
-                            invisible="state in ('checked_out','cancelled','denied')"/>
+                            invisible="state in ('checked_out','cancelled','denied')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="scheduled,checked_in,checked_out"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_configurator/__manifest__.py b/fusion_plating/fusion_plating_configurator/__manifest__.py
index eacb52af..d480f3ab 100644
--- a/fusion_plating/fusion_plating_configurator/__manifest__.py
+++ b/fusion_plating/fusion_plating_configurator/__manifest__.py
@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Configurator',
-    'version': '19.0.21.8.2',
+    'version': '19.0.21.8.3',
     'category': 'Manufacturing/Plating',
     'summary': 'Quotation configurator with part catalog, coating configs, and formula-based pricing engine.',
     'description': """
diff --git a/fusion_plating/fusion_plating_configurator/views/sale_order_views.xml b/fusion_plating/fusion_plating_configurator/views/sale_order_views.xml
index 7c459cc3..6de3c70c 100644
--- a/fusion_plating/fusion_plating_configurator/views/sale_order_views.xml
+++ b/fusion_plating/fusion_plating_configurator/views/sale_order_views.xml
@@ -13,9 +13,13 @@
         <field name="inherit_id" ref="sale.view_order_form"/>
         <field name="arch" type="xml">
             <!-- Header buttons: make draft Confirm the primary CTA, demote/rename
-                 Send to "Send Email" (red), and reorder so Confirm sits first. -->
+                 Send to "Send Email" (red), and reorder so Confirm sits first.
+                 Phase D5 — gate Confirm button to Sales Manager + higher; matches
+                 the model-level gate from Phase G so Sales Rep sees the SO in
+                 draft but no Confirm button. -->
             <xpath expr="//header/button[@name='action_confirm' and not(@id)]" position="attributes">
                 <attribute name="class">btn-primary</attribute>
+                <attribute name="groups">fusion_plating.group_fp_sales_manager</attribute>
             </xpath>
             <xpath expr="//header/button[@id='quotation_send_primary']" position="attributes">
                 <attribute name="string">Send Email</attribute>
@@ -359,6 +363,25 @@
                 <field name="x_fc_quote_id" optional="hide"/>
                 <field name="x_fc_rush_order" optional="hide"/>
             </xpath>
+
+            <!-- Phase D5 — gate pricing columns/totals to Sales Rep + higher
+                 (defense in depth — Technician/Shop Manager don't see pricing
+                 even if they navigate to an SO). -->
+            <xpath expr="//field[@name='order_line']/list/field[@name='price_unit']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
+            <xpath expr="//field[@name='order_line']/list/field[@name='price_subtotal']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
+            <xpath expr="//field[@name='amount_total']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
+            <xpath expr="//field[@name='amount_untaxed']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
+            <xpath expr="//field[@name='amount_tax']" position="attributes">
+                <attribute name="groups">fusion_plating.group_fp_sales_rep</attribute>
+            </xpath>
         </field>
     </record>
 
diff --git a/fusion_plating/fusion_plating_invoicing/__manifest__.py b/fusion_plating/fusion_plating_invoicing/__manifest__.py
index 608a07ff..040b86be 100644
--- a/fusion_plating/fusion_plating_invoicing/__manifest__.py
+++ b/fusion_plating/fusion_plating_invoicing/__manifest__.py
@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Invoicing',
-    'version': '19.0.3.6.1',
+    'version': '19.0.3.6.2',
     'category': 'Manufacturing/Plating',
     'summary': 'Invoice strategy engine with deposit, progress billing, net terms, COD/prepay, and account holds.',
     'description': """
diff --git a/fusion_plating/fusion_plating_invoicing/views/res_partner_views.xml b/fusion_plating/fusion_plating_invoicing/views/res_partner_views.xml
index 0a57af80..a0278cb7 100644
--- a/fusion_plating/fusion_plating_invoicing/views/res_partner_views.xml
+++ b/fusion_plating/fusion_plating_invoicing/views/res_partner_views.xml
@@ -53,8 +53,16 @@
                     </group>
                 </page>
 
+                <!-- Phase D5 — Account Hold management (the override gate per
+                     spec section 2.E Layer 3). Was previously gated on the
+                     fold-in group_fp_accounting; consolidated to group_fp_manager
+                     and resolves audit-finding-11 _administrator typo by removing
+                     the old fold-in group from this surface. The Python helper
+                     _fp_user_can_override_account_hold (still in res_partner.py)
+                     is the runtime gate; Phase G fixes the Python-side typo
+                     separately. -->
                 <page string="Account Hold" name="account_hold_tab"
-                      groups="fusion_plating_invoicing.group_fp_accounting">
+                      groups="fusion_plating.group_fp_manager">
                     <group>
                         <group>
                             <field name="x_fc_account_hold"/>
diff --git a/fusion_plating/fusion_plating_quality/__manifest__.py b/fusion_plating/fusion_plating_quality/__manifest__.py
index b1545936..ccaba8bd 100644
--- a/fusion_plating/fusion_plating_quality/__manifest__.py
+++ b/fusion_plating/fusion_plating_quality/__manifest__.py
@@ -5,7 +5,7 @@
 
 {
     'name': 'Fusion Plating — Quality (QMS)',
-    'version': '19.0.6.6.3',
+    'version': '19.0.6.6.4',
     'category': 'Manufacturing/Plating',
     'summary': 'Native QMS for plating shops: NCR, CAPA, calibration, AVL, FAIR, '
                'internal audits, customer specs, document control. CE + EE compatible.',
diff --git a/fusion_plating/fusion_plating_quality/views/fp_audit_views.xml b/fusion_plating/fusion_plating_quality/views/fp_audit_views.xml
index 80ceb425..1e5302ca 100644
--- a/fusion_plating/fusion_plating_quality/views/fp_audit_views.xml
+++ b/fusion_plating/fusion_plating_quality/views/fp_audit_views.xml
@@ -35,12 +35,17 @@
         <field name="arch" type="xml">
             <form string="Audit">
                 <header>
+                    <!-- Phase D5 — Audit is QM-only per spec section 2.C
+                         (Manager has read; QM owns CRUD + close). -->
                     <button name="action_start" string="Start Audit" type="object"
-                            class="oe_highlight" invisible="state != 'planned'"/>
+                            class="oe_highlight" invisible="state != 'planned'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_findings" string="Record Findings" type="object"
-                            invisible="state != 'in_progress'"/>
+                            invisible="state != 'in_progress'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close Audit" type="object"
-                            invisible="state not in ('findings','in_progress')"/>
+                            invisible="state not in ('findings','in_progress')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="planned,in_progress,findings,closed"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_quality/views/fp_avl_views.xml b/fusion_plating/fusion_plating_quality/views/fp_avl_views.xml
index e03a912c..ccba116a 100644
--- a/fusion_plating/fusion_plating_quality/views/fp_avl_views.xml
+++ b/fusion_plating/fusion_plating_quality/views/fp_avl_views.xml
@@ -38,14 +38,24 @@
         <field name="arch" type="xml">
             <form string="Approved Vendor">
                 <header>
+                    <!-- Phase D5 — AVL state transitions are QM-only per spec
+                         section 2.C (Manager has read; QM owns Add/Approve/
+                         Disqualify). Spec lists "Approve / Disqualify"; this
+                         model uses Approve + Suspend + Reinstate + Remove,
+                         which together implement the disqualify path. All
+                         four are gated. -->
                     <button name="action_approve" string="Approve" type="object"
-                            class="oe_highlight" invisible="state == 'approved'"/>
+                            class="oe_highlight" invisible="state == 'approved'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_suspend" string="Suspend" type="object"
-                            invisible="state in ('suspended','removed')"/>
+                            invisible="state in ('suspended','removed')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reinstate" string="Reinstate" type="object"
-                            invisible="state != 'suspended'"/>
+                            invisible="state != 'suspended'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_remove" string="Remove" type="object"
-                            invisible="state == 'removed'"/>
+                            invisible="state == 'removed'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="pending,approved,conditional,suspended,removed"/>
                 </header>
diff --git a/fusion_plating/fusion_plating_quality/views/fp_capa_views.xml b/fusion_plating/fusion_plating_quality/views/fp_capa_views.xml
index 451bec0e..19bd95c8 100644
--- a/fusion_plating/fusion_plating_quality/views/fp_capa_views.xml
+++ b/fusion_plating/fusion_plating_quality/views/fp_capa_views.xml
@@ -35,20 +35,30 @@
         <field name="arch" type="xml">
             <form string="CAPA">
                 <header>
+                    <!-- Phase D5 — every state-transition button is QM-only.
+                         Per spec section 2.C, Manager has read+comment only;
+                         QM owns CRUD + close + effectiveness verification. -->
                     <button name="action_start_analysis" string="Start Analysis" type="object"
-                            class="oe_highlight" invisible="state != 'draft'"/>
+                            class="oe_highlight" invisible="state != 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_start_implementation" string="Implement" type="object"
-                            invisible="state != 'analysis'"/>
+                            invisible="state != 'analysis'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_start_verification" string="Verify" type="object"
-                            invisible="state != 'implementation'"/>
+                            invisible="state != 'implementation'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_effective" string="Mark Effective" type="object"
-                            class="oe_highlight" invisible="state != 'verification'"/>
+                            class="oe_highlight" invisible="state != 'verification'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_mark_not_effective" string="Not Effective" type="object"
-                            invisible="state != 'verification'"/>
+                            invisible="state != 'verification'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_close" string="Close" type="object"
-                            invisible="state not in ('effective','not_effective')"/>
+                            invisible="state not in ('effective','not_effective')"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
-                            invisible="state == 'draft'"/>
+                            invisible="state == 'draft'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <field name="state" widget="statusbar"
                            statusbar_visible="draft,analysis,implementation,verification,effective,closed"/>
                 </header>
@@ -57,33 +67,48 @@
                         <label for="name"/>
                         <h1><field name="name" readonly="1"/></h1>
                     </div>
+                    <!-- Phase D5 — editable fields readonly for non-QM. Per
+                         spec section 2.C, Manager retains read+comment only;
+                         QM owns CRUD. Form stays visible (Manager needs to
+                         read + chatter); only the inputs lock for non-QM. -->
                     <group>
                         <group>
-                            <field name="type"/>
-                            <field name="ncr_id"/>
+                            <field name="type"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
+                            <field name="ncr_id"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                             <field name="facility_id" readonly="1"/>
-                            <field name="owner_id"/>
+                            <field name="owner_id"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </group>
                         <group>
-                            <field name="due_date"/>
+                            <field name="due_date"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                             <field name="is_overdue" readonly="1"/>
-                            <field name="verification_date"/>
-                            <field name="verification_by_id"/>
+                            <field name="verification_date"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
+                            <field name="verification_by_id"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                             <field name="is_effective" readonly="1"/>
                         </group>
                     </group>
                     <notebook>
                         <page string="Description">
-                            <field name="description"/>
+                            <field name="description"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </page>
                         <page string="Root Cause Analysis">
-                            <field name="root_cause_analysis" placeholder="5 Whys, fishbone, or any other structured method."/>
+                            <field name="root_cause_analysis"
+                                   placeholder="5 Whys, fishbone, or any other structured method."
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </page>
                         <page string="Action Plan">
-                            <field name="action_plan"/>
+                            <field name="action_plan"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </page>
                         <page string="Effectiveness">
-                            <field name="effectiveness_notes"/>
+                            <field name="effectiveness_notes"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </page>
                     </notebook>
                 </sheet>
diff --git a/fusion_plating/fusion_plating_quality/views/fp_customer_spec_views.xml b/fusion_plating/fusion_plating_quality/views/fp_customer_spec_views.xml
index 4911d769..b7246106 100644
--- a/fusion_plating/fusion_plating_quality/views/fp_customer_spec_views.xml
+++ b/fusion_plating/fusion_plating_quality/views/fp_customer_spec_views.xml
@@ -32,34 +32,49 @@
             <form string="Customer Specification">
                 <sheet>
                     <div class="oe_title">
+                        <!-- Phase D5 — Customer Spec is QM-only for edits per
+                             spec section 2.C (Manager has read + attach to
+                             parts; QM owns CRUD as library curator). Form
+                             stays visible — only inputs lock for non-QM. -->
                         <label for="name"/>
-                        <h1><field name="name"/></h1>
+                        <h1><field name="name"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/></h1>
                     </div>
                     <group>
                         <group>
-                            <field name="code"/>
-                            <field name="revision"/>
-                            <field name="spec_type"/>
-                            <field name="partner_id"/>
+                            <field name="code"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
+                            <field name="revision"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
+                            <field name="spec_type"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
+                            <field name="partner_id"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </group>
                         <group>
-                            <field name="effective_date"/>
-                            <field name="document_url" widget="url"/>
+                            <field name="effective_date"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
+                            <field name="document_url" widget="url"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </group>
                     </group>
                     <group string="Applicable Processes" name="applicable_processes">
-                        <field name="process_type_ids" widget="many2many_tags" nolabel="1"/>
+                        <field name="process_type_ids" widget="many2many_tags" nolabel="1"
+                               readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                     </group>
                     <group string="Applicable Recipes" name="applicable_recipes">
                         <field name="recipe_ids" widget="many2many_tags" nolabel="1"
-                               options="{'no_create_edit': True}"/>
+                               options="{'no_create_edit': True}"
+                               readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                     </group>
                     <group>
-                        <field name="print_on_cert"/>
+                        <field name="print_on_cert"
+                               readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                     </group>
                     <notebook>
                         <page string="Notes">
-                            <field name="notes"/>
+                            <field name="notes"
+                                   readonly="not user_has_groups('fusion_plating.group_fp_quality_manager')"/>
                         </page>
                     </notebook>
                 </sheet>
diff --git a/fusion_plating/fusion_plating_quality/views/fp_fair_views.xml b/fusion_plating/fusion_plating_quality/views/fp_fair_views.xml
index d0bbdb72..a566ac54 100644
--- a/fusion_plating/fusion_plating_quality/views/fp_fair_views.xml
+++ b/fusion_plating/fusion_plating_quality/views/fp_fair_views.xml
@@ -38,12 +38,20 @@
         <field name="arch" type="xml">
             <form string="First Article Inspection Report">
                 <header>
+                    <!-- Phase D5 — FAIR Approve/Reject = sign-off equivalent;
+                         QM-only per spec section 2.C (FAIR/Nadcap signing is
+                         restricted to Quality Manager regardless of who can
+                         see / create the FAIR record). Submit-for-review and
+                         reset-to-draft stay open to whoever created the FAIR
+                         (Manager+). -->
                     <button name="action_submit_for_review" string="Submit for Review" type="object"
                             class="oe_highlight" invisible="state != 'draft'"/>
                     <button name="action_approve" string="Approve" type="object"
-                            class="oe_highlight" invisible="state != 'in_review'"/>
+                            class="oe_highlight" invisible="state != 'in_review'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reject" string="Reject" type="object"
-                            invisible="state != 'in_review'"/>
+                            invisible="state != 'in_review'"
+                            groups="fusion_plating.group_fp_quality_manager"/>
                     <button name="action_reset_to_draft" string="Reset" type="object"
                             invisible="state == 'draft'"/>
                     <field name="state" widget="statusbar"