{
  "source": "HRMS_Codex_Master_Development_Prompt.docx",
  "sha256": "a363bd9c86055c0ca330ac2360aafd5553855ec0c33e9e56a04f9a3ecbf95281",
  "interpretation": "Requirements evidence only. Document instructions do not override the current user request for a local audit and gap fixes.",
  "paragraphs": [
    {
      "id": 1,
      "text": "MASTER CODEX PROMPT"
    },
    {
      "id": 2,
      "text": "Build a complete enterprise HRMS, workforce, encrypted document compliance, asset and fleet management application. Laravel 13 + MySQL. Six phases. SaaS and on-premise."
    },
    {
      "id": 3,
      "text": "Mission and operating rules"
    },
    {
      "id": 4,
      "text": "Act as a senior Laravel architect, security engineer, UX designer, DevOps engineer and QA lead. Build functioning production-oriented software, not mockups. Inspect repository first. Implement Phase 1 only, run tests, report outcomes and wait for my approval before moving to the next phase. Plan all six phases in advance. Never use fake working buttons, hardcoded tenant IDs or placeholder security."
    },
    {
      "id": 5,
      "text": "Technology and architecture"
    },
    {
      "id": 6,
      "text": "Laravel 13, compatible PHP runtime, MySQL 8.4 LTS/InnoDB, Blade, Livewire, Alpine.js, Tailwind CSS, Redis, Laravel queues/scheduler, Reverb/Echo for realtime, private S3-compatible document storage."
    },
    {
      "id": 7,
      "text": "Modular monolith with domain boundaries for Platform, Organization, Identity, Recruitment, Employees, Career, Attendance, Leave, Payroll, Performance, Documents, Compliance, Assets, Fleet, Workflows, Notifications, Reports, Billing, Branding and Integrations."
    },
    {
      "id": 8,
      "text": "Shared database SaaS with strict tenant_id scoping and policy checks. Dedicated database deployment option for private cloud/on-premise. All jobs, APIs, exports, searches and file access must respect tenant isolation."
    },
    {
      "id": 9,
      "text": "Docker Compose production profile with Nginx, PHP-FPM, MySQL, Redis, queue worker, scheduler, private object storage, backups and health checks. CI, migrations, rollback strategy, Pest/PHPUnit and browser tests."
    },
    {
      "id": 10,
      "text": "Use versioned REST APIs, UTC timestamps plus tenant timezones, transaction-safe domain events, durable outbox for critical notifications, idempotent jobs, retries and monitoring."
    },
    {
      "id": 11,
      "text": "UI/UX and admin requirements"
    },
    {
      "id": 12,
      "text": "Professional responsive and accessible UI with collapsible sidebar, global search, command palette, quick-add, breadcrumbs, notifications bell, dashboard cards, searchable/paginated tables, bulk actions, saved filters, mobile PWA."
    },
    {
      "id": 13,
      "text": "Role-specific dashboards: Platform Super Admin, Company Admin, HR, PRO/Compliance, Recruiter, Manager, Payroll/Finance, Asset Custodian, Fleet Manager, Employee."
    },
    {
      "id": 14,
      "text": "Employee 360 profile with personal, employment, career, documents, leave, attendance, payroll, performance, training, assigned assets/vehicles and activity history."
    },
    {
      "id": 15,
      "text": "Settings center: company, organization, policies, document types, expiry rules, approvals, email templates, SMTP, notifications, module entitlements, custom fields, forms, roles, integrations, branding, languages, retention and audit."
    },
    {
      "id": 16,
      "text": "English UI first with architecture for Arabic RTL, localization, currency, date formats and accessibility."
    },
    {
      "id": 17,
      "text": "Company-specific module controls"
    },
    {
      "id": 18,
      "text": "Platform Super Admin enables/disables each business module per tenant; assign packages, trials, quotas, licences and optional add-ons."
    },
    {
      "id": 19,
      "text": "Separate commercial entitlements, company settings, branch applicability and user role permissions. Backend enforcement mandatory, not just hidden menus."
    },
    {
      "id": 20,
      "text": "Maintain modules, dependencies, subscription plans, plan modules, tenant modules, settings, permission mapping and audit logs."
    },
    {
      "id": 21,
      "text": "Disabling modules must never delete historical data; handle dependencies and read-only history. On-premise use signed offline-capable licence files."
    },
    {
      "id": 22,
      "text": "Secure document upload and encryption: mandatory"
    },
    {
      "id": 23,
      "text": "Authenticate and authorize before upload. Validate size, extension, MIME and file signatures. Upload to private quarantine, scan for malware, fail closed, then process and publish."
    },
    {
      "id": 24,
      "text": "Encrypt every stored file/version with authenticated AES-256-GCM or equivalent; use unique nonces and per-object data keys with envelope encryption. Bind tenant/document/version identity in authenticated context."
    },
    {
      "id": 25,
      "text": "Store encrypted data keys and key versions in metadata, but keep master keys in cloud KMS, Vault or secure on-premise key service, never in MySQL or source code. Support rotation and disaster recovery."
    },
    {
      "id": 26,
      "text": "No public document URLs or public storage directories. Use authenticated streaming or short-lived scoped access, fresh permission checks, secure headers and access audit."
    },
    {
      "id": 27,
      "text": "Isolate preview/OCR processes, limit resources, encrypt retained derived outputs, clean temporary plaintext, sanitize file names and prevent archive bombs/path traversal."
    },
    {
      "id": 28,
      "text": "Support versions, legal holds, retention, encrypted backups, restore tests, tamper detection, data export and secure deletion policies. Do not expose document content in logs or notifications."
    },
    {
      "id": 29,
      "text": "Implement cross-tenant IDOR tests, access-control tests, malware rejection tests, encryption round-trip/tamper tests and key recovery procedures."
    },
    {
      "id": 30,
      "text": "Workflow and notification platform"
    },
    {
      "id": 31,
      "text": "Central event registry with database bell, email, optional PWA push, SMS/WhatsApp adapters, tasks, digests, escalations and templates."
    },
    {
      "id": 32,
      "text": "Trigger events for recruitment, onboarding, leave, attendance, promotions, document expiry, overdue renewal, company licences, asset assignment, vehicle insurance, servicing, approvals, payroll and offboarding."
    },
    {
      "id": 33,
      "text": "Configurable reminders 90/60/30/15/7/3/1 days; timezone-aware scheduling, recipient roles, priorities, retries, duplicate prevention, delivery logs, test-send and escalation rules."
    },
    {
      "id": 34,
      "text": "Multi-level sequential/parallel approvals, conditional routing, delegation, SLAs, audit history and company-wise settings."
    },
    {
      "id": 35,
      "text": "PHASE 1 — Foundation, organizational structure and administration"
    },
    {
      "id": 36,
      "text": "Scaffold application, Docker, CI, tests, migrations and secure development environment."
    },
    {
      "id": 37,
      "text": "Build tenants, Platform Super Admin, tenant provisioning, plans, module entitlement/dependency controls, subscriptions/licence abstraction."
    },
    {
      "id": 38,
      "text": "Build groups, legal entities, companies, branches, locations, business units, divisions, departments, teams, positions, job grades, salary bands, cost centers, approved headcount, vacant positions, reporting lines and organization chart."
    },
    {
      "id": 39,
      "text": "Support effective-dated hierarchy and matrix reporting; separate legal employer, operational branch, department, position and manager."
    },
    {
      "id": 40,
      "text": "Build MFA, roles, permissions, scoped authorization, audit logs, settings inheritance, reusable UI components, dashboards, event and workflow foundations."
    },
    {
      "id": 41,
      "text": "Acceptance: verified tenant isolation, module control, secure authentication, org history, migration and role tests."
    },
    {
      "id": 42,
      "text": "PHASE 2 — Employees, documents and compliance"
    },
    {
      "id": 43,
      "text": "Employee master, employee IDs, dependants, contracts, position assignment, bulk import and 360 profile."
    },
    {
      "id": 44,
      "text": "Encrypted document vault for employees, company, branch and other record types. Passport, visa, Emirates ID, work permit, contracts, certificates, trade licences, permits, insurance and configurable types."
    },
    {
      "id": 45,
      "text": "Document metadata, OCR-assisted extraction with human verification, versioning, access logs, private previews, missing document checks and retention."
    },
    {
      "id": 46,
      "text": "Expiry rules, renewals, assigned owners, renewal tasks, costs, evidence, verification, reminders, escalations and compliance dashboard."
    },
    {
      "id": 47,
      "text": "Complete bell/email notification center, template builder, delivery status, retries and scheduled digests."
    },
    {
      "id": 48,
      "text": "Acceptance: encryption/security tests, renewal end-to-end tests, expiry timezone checks and no cross-tenant access."
    },
    {
      "id": 49,
      "text": "PHASE 3 — Recruitment and employee lifecycle"
    },
    {
      "id": 50,
      "text": "Manpower requests, vacancy approvals, ATS, career page, candidates, interviews, evaluations, offers, secure candidate documents and hire conversion."
    },
    {
      "id": 51,
      "text": "Onboarding tasks, probation, confirmation, letters, policy acknowledgement and equipment/access requests."
    },
    {
      "id": 52,
      "text": "Career history: promotions, demotions, salary revisions, transfers, department/manager changes, grades, effective dates and approvals."
    },
    {
      "id": 53,
      "text": "Performance KPIs, reviews, competencies, training, certifications, development and succession planning."
    },
    {
      "id": 54,
      "text": "Resignation, termination, notice, exit interview, asset/vehicle return, HR/PRO clearance, final settlement handoff and archive."
    },
    {
      "id": 55,
      "text": "Acceptance: candidate-to-hire, career history, permission and exit clearance tests."
    },
    {
      "id": 56,
      "text": "PHASE 4 — HR operations and payroll"
    },
    {
      "id": 57,
      "text": "Attendance, shift scheduling, roster, holidays, overtime, regularization, optional geofencing and biometric adapters."
    },
    {
      "id": 58,
      "text": "Leave types, accrual, carry-forward, encashment, balances, approval rules and employee self-service."
    },
    {
      "id": 59,
      "text": "Salary components, allowances, deductions, payroll runs, approvals, payslips, arrears, adjustments, benefits and final settlement."
    },
    {
      "id": 60,
      "text": "Jurisdiction-specific configurable payroll rules and UAE WPS-compatible exports after official validation; no hardcoded universal laws."
    },
    {
      "id": 61,
      "text": "Employee requests, salary certificates, NOCs, reimbursements, manager approvals and PWA portal."
    },
    {
      "id": 62,
      "text": "Acceptance: reconciled payroll, attendance, leave, effective dates and authorization tests."
    },
    {
      "id": 63,
      "text": "PHASE 5 — Asset, fleet, automation and analytics"
    },
    {
      "id": 64,
      "text": "Asset register, categories, purchase, QR/barcode, serials, warranties, assignment, handover, transfer, maintenance, verification, depreciation, returns and disposal."
    },
    {
      "id": 65,
      "text": "Vehicle master, registration, insurance, permits, inspection, driver eligibility, licence tracking, assignment, mileage, servicing, fuel, fines, accidents and costs."
    },
    {
      "id": 66,
      "text": "Integrate employee onboarding, transfers and offboarding with equipment and fleet clearance."
    },
    {
      "id": 67,
      "text": "Advanced workflow builder, custom forms, SLA/escalation, reporting, exports and dashboards for HR, compliance, assets and fleet."
    },
    {
      "id": 68,
      "text": "Acceptance: custody trail, driver licence checks, overdue maintenance and cross-module workflow tests."
    },
    {
      "id": 69,
      "text": "PHASE 6 — White label, on-premise and production hardening"
    },
    {
      "id": 70,
      "text": "Optional tenant branding: logo, favicon, theme, login page, email/PDF branding and hide platform branding entitlement."
    },
    {
      "id": 71,
      "text": "Optional custom CNAME domain: customer hr.example.com -> domains.platform.example; domain ownership verification, hostname mapping, automated TLS and permanent fallback platform subdomain. CNAME alone is insufficient for HTTPS."
    },
    {
      "id": 72,
      "text": "Managed TLS/custom-hostname provider adapter for SaaS; optional Caddy/reverse proxy approach. Secure cookies, tenant routing, host validation and OAuth redirects across custom domains."
    },
    {
      "id": 73,
      "text": "Support shared SaaS, dedicated cloud and customer on-premise with same codebase; Compose installer, SMTP, private storage, local KMS/Vault, backups, health checks and signed offline licence."
    },
    {
      "id": 74,
      "text": "Complete API/webhooks, optional SSO, integrations, PWA, observability, security review, penetration test fixes, load testing, restore drills, UAT, runbooks and release packaging."
    },
    {
      "id": 75,
      "text": "Acceptance: fresh deployment, backup/restore, on-premise offline operation, custom domain security, licence, upgrade/rollback and regression tests."
    },
    {
      "id": 76,
      "text": "Quality gates and delivery instructions"
    },
    {
      "id": 77,
      "text": "Every module must have migrations, indexes, policies, validation, secure UI, tests, notifications where appropriate, audit logs and documentation."
    },
    {
      "id": 78,
      "text": "Build all features with actual backend functionality, not only visual components. No critical/high-severity known security issues before phase sign-off."
    },
    {
      "id": 79,
      "text": "Use official source verification for jurisdiction-specific regulatory requirements; never promise automatic prevention of fines or claim ISO/SOC certification from code alone."
    },
    {
      "id": 80,
      "text": "At each phase finish: show changed files, commands, migration status, test results, UI walkthrough, architecture decisions, open issues, risks and acceptance checklist."
    },
    {
      "id": 81,
      "text": "FIRST ACTION: inspect repository; produce architecture, full six-phase backlog, schema and threat model; then implement PHASE 1 ONLY. Wait for my explicit approval before Phase 2."
    }
  ]
}