[marchtian]

Requested by 田騏 · project thread

Fixes found while running the v0.6 supplier-portal exit browser test locally (overview #75, exit conditions in 07 §6.2).

What the exit test found

1. Portal-submitted admission applications were stuck. The application is created by the system flow and owned by the portal user, so the category manager got 403 when accepting or returning it, and nobody internal was told it existed.
   • New edit sharing rule 处理准入申请 on srm_supplier_application for category manager and buyer lead.
   • srm_application_submit notifies whoever raised the portal invitation.
   • New field return_reason (required by validation return_reason_required when the status becomes returned), visible to the portal so the supplier knows what to supplement.
   • srm_application_resubmit falls back to the person who returned the application (not the portal user who created it) when no reviewer is set.
2. Portal users saw the internal navigation groups and internal-only actions (empty lists and buttons that only failed on the server). New capability srm_internal_access granted by srm_internal_base and srm_auditor; internal nav groups and internal actions (confirm legacy review, contract submit/activate, open portal, verify bank account, score submit, void, resolve appeal, reassign scorer) require it. "Submit appeal" stays ungated because internal staff relay appeals and the flow checks the roster itself.
3. Supplier was never told a claim was raised on a SCAR. srm_scar_supplier_notice gets a claim event with new template srm_scar_claim_proposed (number only, no amount).
4. pnpm setup:local failed under OS_AUTH_MEMBERSHIP_POLICY=invite-only (required for the portal). The script now adds each account to the org and makes srmadmin an org admin; local-demo.md documents the portal walkthrough.

Docs

02 (return_reason), 03 §3 step 4 / §8 step 6 / notify table, 04 §3.2, 05 §1 and §5, 07 §6.2 V6 (local exit test passed; hosted recheck still open), implementation/local-demo.md.

Verification

pnpm validate, lint, typecheck, i18n:check, test (357 passed, 1 skipped), build all pass locally. New tests: portal application handled by the inviting manager and returned only with a reason; claim notice to the supplier; internal capability only on internal positions and every nav group gated to internal or portal users. Isolation tests untouched.

---

Generated by Claude Code