# Local requirements audit — walkthrough

The application stays at http://127.0.0.1:8000/login with zentrikhrms, root and a blank database password. All 85 tables use InnoDB. Existing accounts, passwords and MFA are preserved. No Cloudflare, domain, cloud, SMTP, SSO or webhook setup is needed.

## Start and daily processing

Start WampServer, then double-click Start Zentrik HRMS.cmd. The launcher checks InnoDB, opens the application and starts one hidden local maintenance helper for this project. It checks reminders, completed-month leave accrual, equipment/workflow alerts and document scans, then delivers in-app bells. It leaves emails, external webhooks and arbitrary queued jobs untouched. Company administrators see the last local maintenance status on Overview. Bells refresh every 30 seconds; no Redis or WebSocket configuration is needed.

The helper runs while the computer is on, under the current Windows identity. Run the launcher again after a restart. Existing opening leave balances/policies must be set correctly before accrual; older missed periods can be reviewed and posted with the Leave screen's explicit month action. Company payroll and employment policies are business inputs and are never fabricated by installation.

## Role dashboards and Employee 360

Overview adds live cards filtered by current role permissions and enabled modules: HR tasks, recruitment, compliance renewals, payroll review, equipment, fleet and assigned approvals. Employees see their own requests, custody and bells. Managers' approval counts use their linked employee identity. These cards do not grant additional permissions.

Employee 360 now also shows recent attendance and leave records under their existing view/self permissions. Career, growth, released payroll, leave balances, custody and encrypted documents retain their own access rules. Global search includes accessible assets, fleet and vacancies as well as organization, positions, people and documents.

## Custom employee fields

Open Settings → Custom employee fields. Set an immutable lowercase key and label, choose text/number/date/choice, and optionally make the field required. Choices use one line each. Up to 30 company fields are supported.

New employee, edit and accepted-offer hiring forms render these fields automatically. Employee CSV imports accept `custom:field_key` columns, including required fields; invalid batches roll back together. Values are validated and encrypted before storage. They are hidden from automatic model/API serialization and standard CSV exports. Unknown/inactive field inputs are rejected; optional values can be cleared. Disable a field to stop requesting it on new forms while preserving its historical value in authorized employee profiles. Defining fields does not backfill or create employees in the working database.

## Personal saved filters

Apply a search/status/type/date filter in Organization, Employees, Documents, Assets or Audit, enter a Filter name and click Save current filter. Use the saved link to reapply it; Remove deletes only your own saved filter. Names/criteria are company/user scoped, criteria are encrypted, and current module/role checks still run when a link is opened. There are at most 20 filters per list per user. These replace the earlier shared-browser organization filter mechanism.

## Module controls and retained history

In Settings → Module applicability, choose an available module and company scope. Workflows, attendance, leave, assets and fleet also accept a branch override. These settings can only restrict commercial entitlements; they cannot enable an unlicensed module. Real form submissions check the linked employee branch; equipment/lifecycle event reviews use the related employee branch when known. Company-wide configuration stays separate from branch use.

Disabling a parent module also blocks dependent module access. Attendance/leave/custody/payroll services check the employee's effective branch before new operations. Disabling a branch's attendance cannot silently underpay its staff: payroll refuses affected periods until applicability is resolved. Historical records are retained.

Settings → Read-only module history opens authorized metadata even when a business module is disabled. These pages expose no edit controls or document downloads. Employee, candidate, payroll, file and integration permissions are never replaced by a generic archive permission.

## Reminder priority and workflows

Notifications → Reminder rules lets an administrator choose Low, Normal, High or Urgent. Delivery history preserves priority; urgent/high records are processed before normal/low records and the bell marks their priority. Reminder days, company-local digest hour, role recipients and retry deduplication remain configurable. Local maintenance only delivers the bell channel.

Use Forms & approvals for actual visual sequential/parallel workflows, conditional steps, delegation and SLAs. The older Workflows page is read-only planning history and links to the real builder; its old POST endpoint returns 410 rather than accepting a dormant definition. Approved transfers/department/manager changes and promotions/demotions now create equipment review tasks when custody exists.

## Scanning and OCR

Upload PDF, JPEG or PNG normally. Windows Defender confirms clean bytes before publication; errors or detections leave the encrypted version unavailable. Current Windows antivirus definitions are required. The application does not disable antivirus, exclusions or OS policy. Normal scan temporary files are ACL restricted and deleted; crash leftovers are removed by subsequent maintenance after ten minutes.

On a clean published document, choose Extract OCR. Native offline English OCR processes image/PDF bytes in a bounded child process without saving OCR plaintext. Suggestions remain encrypted until an authorized viewer requests them. Review and verify metadata yourself; extraction does not approve a document.

Actual acceptance evidence includes native clean scanning, the harmless standard antivirus test pattern being blocked, PNG/PDF recognition, and an end-to-end real DPAPI encrypted upload/OCR/download/recovery fixture in disposable databases. No sample employee or document was inserted in the working company.

See REQUIREMENTS_AUDIT.md for the original paragraph-by-paragraph mapping and LOCAL_AUDIT_TEST_RESULTS.txt for final verification. External production activation, independent security review and bank/business sign-off remain explicitly separate.