02 · Structure
Architecture
Thin workflow modules that all write through one shared engine, so tracking and audit behavior is uniform and never re-implemented per module.
High-level shape
UI / Buyer Portal ──▶ API layer (auth · role-based access · REST/GraphQL)
│
┌────────────────────────┼────────────────────────┐
▼ ▼ ▼
Workflow modules ─writes─▶ Status & Ownership Cross-cutting svcs
(Lead … Post-Sales) Engine (tasks · escalation ·
Modules 1–6 (state machine · owner notifications · audit)
hand-off · SLA)
│
▼
Persistence (SQL): deals · statuses · owners ·
tasks · activity_log · documents
│
external integrations ───┴─── email · enrichment/SAP (deferred)
│
┌────────────────────────┼────────────────────────┐
▼ ▼ ▼
Workflow modules ─writes─▶ Status & Ownership Cross-cutting svcs
(Lead … Post-Sales) Engine (tasks · escalation ·
Modules 1–6 (state machine · owner notifications · audit)
hand-off · SLA)
│
▼
Persistence (SQL): deals · statuses · owners ·
tasks · activity_log · documents
│
external integrations ───┴─── email · enrichment/SAP (deferred)
Modules (bounded by workflow stage)
1
Lead Management
2
Opportunity & Pre-Sales
3
Quotation
4
Sampling
5
Vendor Approval & Contract
6
Post-Sales & Portal
Key rule: every module writes through the Status & Ownership Engine — tracking is
structural, not something each screen re-implements. See 04 · Status & Ownership.
Cross-cutting services
| Service | Purpose |
|---|---|
| Status & Ownership Engine | Validates transitions, reassigns owners, records history |
| Task service | Deadlines / SLA per activity; feeds escalation |
| Escalation service | Watcher that runs the alert chain on SLA breach |
| Activity log | Append-only audit of every meaningful action |
| Notification service | Email / in-app |
| Document service | Stores & serves invoices, certificates, BL (also to portal) |
Integrations
| System | Purpose | Direction |
|---|---|---|
| AI enrichment (deferred) | Local worker + free registries (GLEIF/OpenCorporates/VIES); manual interim | inbound |
| SAP | Inventory / stock | bidirectional |
| Comms, drip campaign | outbound / inbound |
Tech stack — decided: .NET + SQL Server
Backend
ASP.NET Core Web API (.NET 8 LTS), modular by workflow stage.
Data
SQL Server via EF Core; status_history & activity_log first-class; global query filters for scoping.
Auth & RBAC
ASP.NET Core Identity + policy-based permissions. See Roles & Access.
Background work
Hosted background service / scheduler for SLA timers & escalation.
Front-end
ASP.NET Core MVC (Razor) + HTMX for dynamic partial-page updates (HTML fragments) — server-rendered, no Node.js. See Services & APIs.
Defense in depth
Optional SQL Server Row-Level Security beneath the app-level filters.