# ClaimPrism Pro 0.10.0 — Team & Roles

## Goal

Add a professional multi-user review model for ClaimPrism Pro while preserving the existing review workflow, assignments and audit history.

## Roles and capabilities

- WordPress administrators retain full ClaimPrism access.
- ClaimPrism Reviewer: can view the Pro review queue, update review status, add internal notes and work on findings assigned to them.
- ClaimPrism Manager: can do everything a Reviewer can do, assign/reassign reviewers, run bulk review actions, manage Evidence, scheduled scans and reports.
- Capabilities are ClaimPrism-specific rather than broad WordPress/WooCommerce administration grants.

Implemented capabilities:
- `claimprism_review_findings`
- `claimprism_assign_reviewers`
- `claimprism_manage_evidence`
- `claimprism_manage_scans`
- `claimprism_view_reports`
- `claimprism_manage_team`

## Reviewer source

Reviewer dropdowns list only WordPress users who are authorized to review ClaimPrism findings. Assignments continue to persist by WordPress user ID; UI labels use `display_name`, with login as a fallback.

`All reviewers` remains a filter-only option. `Unassigned` remains a valid assignment state and is never stored as a synthetic user.

## Current access behavior

- Reviewer queues are automatically restricted to findings assigned to the current Reviewer.
- Reviewers may change review status and internal notes on their own assigned findings.
- Reviewers cannot reassign findings and cannot update findings assigned to another operator.
- Managers and administrators can assign/reassign findings and use Bulk Review Actions.
- Evidence Repository, Scheduled Scans and Periodic Reports are hidden from Reviewer-only users.
- A scoped compatibility bridge allows Reviewer/Manager users to enter the existing 0.9 dashboard shell without granting site-wide `manage_options` or `manage_woocommerce` privileges. Mutating ClaimPrism actions remain mapped to their dedicated 0.10 capability.

## Compatibility

- Existing assignments to administrators remain valid.
- Existing review history remains append-only and untouched.
- Existing administrators continue to pass capability checks.
- Free builds must not include premium Team & Roles runtime files.

## Audit requirements

Every review event continues to store the actor ID. Assignment changes identify the assigned reviewer by WordPress user ID and render the current display name when history is viewed.

## Validation

Automated coverage includes:
- premium-only/Freemius gating;
- role and capability definitions;
- capability-based reviewer enumeration;
- Reviewer self-assignment boundary;
- Manager assignment permission;
- manager-only panel suppression;
- scoped legacy dashboard compatibility bridge;
- Free-package stripping regression.

Manual Local validation will use at least two additional WordPress users: one Reviewer and one Manager.

## Release constraint

This 0.10.0 branch is stacked on the validated 0.9.0 candidate. Do not merge, deploy to Freemius, publish a release, or modify the WordPress.org 0.6.0 review package without explicit approval.
