Design review · before you write migrations

Production Assessment

The prototype against real Ugandan conditions, the law that binds it, and what it takes to enforce any of this while paper is still in the building.

Verdict first

You were right to close the public door. But the deeper problem is not who can read the pipeline — it is that the pipeline is still paper, and no Django application can enforce anything about an object a constable is carrying in a bag. The system's real power is to make the paper's silence expensive.

Sound The dual A/B taxonomy, the append-only event log, the ten-record chain, the separate conduct database, and a complaint entry point at every stage. These match the process document and will survive contact with a real registry.

Corrected this round Pipeline detail now sits behind eight named accounts with role-scoped querysets. The public gets a status line. The registry officer has real custody powers — move and flag — and every action lands in an audit trail.

Still wrong The ODPP has no disciplinary power over a police investigating officer. Half the Type A complaints in the prototype are routed to an office that cannot act on them. This is the one design fault to fix before migrations.

The jurisdiction fault — fix this first

Type A against an ODPP officer A State Attorney, a registry clerk, an Inspectorate officer. Inspections & Quality Assurance owns this, the isolated disciplinary registry is the right home, and the ODPP can actually discipline the person. Everything the prototype does here is correct.

Type A against a police officer An IO who solicited money at Jinja Road is a Uganda Police Force employee. The ODPP cannot investigate, suspend or sanction him. That complaint must be referred to the Police Professional Standards Unit — and where it discloses corruption, to the IGG or the Anti-Corruption Division.

What the schema needs A subject_institution field on the conduct file — ODPP / UPF / JUDICIARY / OTHER — and a Referral model carrying destination body, letter reference, date sent and date of reply. A referral with no reply after 30 days is itself an escalation. Otherwise the ODPP becomes a place complaints go to die politely.

Seven Ugandan scenarios the design has to survive

What actually happens {{ s.reality }}

What the build must do {{ s.fix }}

The law this system sits inside

Not legal advice — a checklist to take to the ODPP legal team before go-live. Each row changes something concrete in the code.

Instrument

Why it bites

Consequence in the build

Enforcing RBAC in Django — where each rule actually lives

A permission checked in a template is decoration. Every rule below is enforced at the layer named, and each needs a test that tries to break it as a wrong-roled user.

The registry officer — the role that makes the system work

Everyone else in this system reads. The registry officer is the only role whose actions change where a physical object is, which makes it both the most valuable account and the most dangerous one.

The single highest-value intervention

Print a QR code on the file jacket the moment the CRB number is issued, and make every registry counter scan it in and out. Nothing else in this project buys as much.

A scan takes two seconds, needs no typing, works on a cheap Android handset, and turns each blind courier leg into a timestamped pair. A dispatch scan with no matching arrival scan after 72 hours becomes an automatic Type B flag with nobody having to complain. That one rule closes the chain-of-custody breakpoint, the zero-ingest-telemetry gap and the index disconnect at the same time.

Deployment reality

Re-checking the process — five decisions still open

{{ g.title }} {{ g.body }} Decision needed from you — {{ g.ask }}

Pilot rather than rollout

Eighteen regions at once will fail on training alone. Run Jinja Road → Central Registry → RSA Nakawa → Nakawa Chief Magistrate Court for ninety days: it is the one corridor where headquarters already has real-time sight and the courier leg is short enough to measure honestly.

Metric 1Blind days per fileTotal days between a dispatch scan and its matching arrival scan. If this does not fall in ninety days, the scanning discipline has not landed and nothing else matters.

Metric 2Share of decisions communicatedPercentage of sanctioned, DFI'd and closed files with an outward communication recorded within seven days. This is the number the public actually feels.

Metric 3Complaints the system raises itselfAuto-flagged latency breaches as a share of all Type B records. A healthy system finds its own delays before a complainant walks to Naguru to report them.

Built by