# Phase 2 implementation plan

User approved continuation after Phase 1. Preserve the working tenant, accounts and all InnoDB tables. Phase 3 remains outside this approval.

1. Add tenant-scoped employees, dependants, contracts, effective position assignments, configurable document types, documents/versions/access records, renewals, reminder rules and notification delivery metadata.
2. Add employee directory, 360 profile, CSV import/export and scoped account links. Assignment capacity is validated transactionally and actual assignments supersede planning occupancy.
3. Encrypt uploads in logical private quarantine with unique per-version AES-256-GCM keys/nonces and tenant/document/version authenticated context. Wrap data keys with Vault Transit or Windows CurrentUser DPAPI; never use APP_KEY as a document master key. Scan using ClamAV INSTREAM; fail closed. Authenticated downloads verify GCM before sending any bytes. Keep OCR output encrypted and require human metadata verification.
4. Add document type requirements, expiry dashboard, renewal ownership/tasks/cost/evidence/verification, legal holds, retention and purge safeguards.
5. Add timezone-local reminders, duplicate prevention, role recipients, escalation, delivery logs/retry, template editing/test-send and daily digests. Email is at-least-once; external SMTP cannot guarantee exactly-once delivery.
6. Verify isolation, authorization, malware/unavailable scanner rejection, encryption roundtrip/tampering/context binding, renewal lifecycle, expiry date/timezone boundaries and migration rollback. Inspect browser flows and document actual infrastructure limits.

Security integrations: ClamAV daemon is mandatory for publication. Vault requires a derived Transit key, TLS and a least-privilege token. Windows DPAPI uses the Windows process account's OS-protected master keys; restores require that identity's recoverable profile/credentials. Server-side OCR is an isolated optional service with bounded inputs, timeouts and temporary plaintext cleanup. Documents are never put on the public disk or exposed by a storage URL.