Brings in the token set from the Claude Design export: warm neutrals,
semantic status colours, and the twelve-hue categorical poste palette,
in light and dark. Declared through Tailwind's @theme so utilities
compile to var(--color-*) and follow the theme without per-component
branching.
The poste palette derives every hue from one formula with an
alternating lightness step, so neighbouring hues never land at the same
lightness. ShiftChip always prints the poste code alongside the fill:
colour carries meaning in the grid, and a grid has to stay readable in
print, in greyscale, and to someone who confuses red and green.
Week counters live in src/domain/counters rather than in the component,
because the same numbers will feed the hours report and the payroll
export later. Durations are whole minutes: decimal hours drift by a
minute in ways that are invisible on screen and wrong on a payslip.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
DesignSync cannot authorize from this environment, so the brief is
versioned here for the user to paste into claude.ai/design.
Records two constraints the design must respect or its output cannot
ship: no external resources, since the CSP names no third-party origin
and a test fails if that changes — which rules out Google Fonts — and
a categorical palette that survives colour-blindness, since shift
colour carries meaning in the planning grid rather than decorating it.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
Scaffolds the project: Next.js 16 App Router with strict TypeScript,
Prisma 7 on PostgreSQL 16, Tailwind 4, Vitest, Playwright, CI, and a
standalone Docker image that applies migrations on boot.
Makes the no-tracker rule of PLAN.md 3.7 enforceable rather than
stated. A per-request nonce-based CSP names no external origin, a unit
test fails if any network directive gains one, and a second test fails
if a tracking package appears in package.json. The end-to-end test
drives the standalone server the Docker image runs, not `next dev`,
so a proxy matcher that stopped matching could not pass unnoticed.
Environment is validated at import, so a missing DATABASE_URL fails at
boot with a readable message instead of surfacing later as a driver
error mid-export. ENCRYPTION_KEY is checked to be 32 bytes.
Three deviations from the plan, recorded in PLAN.md and README:
Next 16 rather than 15, `proxy.ts` rather than the now-deprecated
`middleware.ts`, and database-backed sessions rather than Auth.js v5,
which is still beta and whose JWTs would make the session revocation
required by compliance item 23 awkward.
Verified locally against PostgreSQL 16: migrations apply, extensions
created, typecheck, lint, 9 unit tests and the end-to-end header test
all pass.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
The employer confirmed three things: some managers are on forfait
jours, the working week is 35h, and there is no company-level
agreement. The third one invalidates an earlier claim in the plan.
Sunday: the spec attributed the 100% rate to a company agreement.
With no such agreement, and the branch setting no Sunday rate, the
basis is article L3132-27 on mayor-authorised Sundays. That article
requires pay at least doubled AND compensatory rest of equal
duration, and caps the year at twelve such Sundays. The plan only
carried the pay side, so working a Sunday would have silently
skipped a distinct entitlement. Adds SUNDAY_MAYOR_QUOTA and writes
the rest to the ledger. Which Sunday regime the stores operate
under still needs confirming, since the compensation differs.
Forfait jours: brought into scope. IDCC 1517 is the enabling
agreement, so no company agreement is needed. Contracts carry
workTimeArrangement, the 218-day cap, and the individual written
agreement without which activation is refused. Such contracts leave
the hourly rules but stay under the rest rules, and gain their own
workload-review obligations. Adds ForfaitDayEntry, WorkloadReview
and a three-year retention line.
Records that no rule in scope now rests on a company norm: no
derogation to 12h days, no 46h average, no in-house annualisation.
Refreshes the matrix to the version carrying the explicit minors
stop signal.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
Adds matrice-conformite-rh-france-2026.md to the repo and rewrites
section 12 around it. Also fixes the link in Audit Combo/INDEX.md,
which pointed one level above the repo root.
The matrix changes the design in four places:
- Time has three states, not two. Planned, actual and paid must be
distinguishable, and payment may never be made conditional on a
manager's validation, nor may an authorisation workflow delete
hours actually worked.
- The rule engine must be effective-dated, not merely versioned: a
prior payroll has to replay identically after a rule change.
- Retention is per object with a documented start point and
justification, explicitly not "5 years everywhere". Adds
RetentionPolicy and the duration table.
- Control features need a server-side gate that stays closed until
the employee notice and the CSE opinion are recorded. FeatureFlag
carries those fields.
Adds paid-leave accrual, the 15-month carry-over, and the
obligation to inform an employee of their rights within a month of
returning from sick leave.
Scopes out payslips, DSN and geolocation, and flags on-call duty and
forfait jours as open questions. Notes that the matrix covers adult
employees only, so the MINOR_* rules remain unsourced and are now a
stop signal.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
The root dropdowns/ tree was deduplicated in 52ac285, so the header
note telling the reader to remove it no longer describes the repo.
Only Audit Combo/dropdowns/ remains, which is what the plan already
references throughout.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
Replaces the blanket stop signal in section 6.3 with the actual
parameter set, each value tagged with its origin: ordre public,
collective agreement, or company-level agreement.
Covers daily/weekly maxima (10h, 48h, 44h averaged over 12 weeks),
rest periods, the 10-consecutive-day limit, part-time minima
(24h, with the 21h and 6h derogations), complementary-hour rates
(+10%/+25%), overtime brackets (+25% to the 43rd hour, +50%
beyond), the 180-hour contingent and its rest counterpart,
modulation caps, night-work window, and the public-holiday rules
the "JF 50%" label refers to.
Key correction: the "Dimanche 100%" in the account configuration is
NOT a convention rule. IDCC 1517 sets no Sunday rate and defers to
company agreement, so SUNDAY_WORK reads an account-level override
rather than the agreement parameters, and Account gains
agreementOverrides for it.
The values come from secondary public sources, not the consolidated
Legifrance text, so a narrower validation requirement remains:
cross-check on Legifrance, obtain the company agreement, confirm
with the Silae payroll manager.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
The targeted edits in the previous commit left the document
self-contradictory in places. This reconciles it.
- The stale-export rule contradicted the append-only invariant on
PayrollExport. Staleness is now derived from
PayPeriod.unlockedAt rather than written as a flag, and the
period gains unlockedAt/unlockedBy to support it.
- Invariant count was still seven after an eighth was added.
- Lot references were a mix of the old Lot 0-4 numbering and the
current WP-xx packages; all now use WP-xx.
- Articles/conversations were said to be deferred to "lot 5" while
HR analytics were wrongly listed as deferred too.
- Section 1 now carries all five audit findings, including the
non-terminal pay-period lock and the closed enumerations.
Adds the matching tests: the unlock/re-export cycle, cross-view
consistency, mutation refusal while locked, and CSP enforcement.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
The dropdown audit enumerates values the earlier spec had guessed.
Replaces the guesses with the observed lists and adds what they imply.
- Roles: five, not the six invented ones (owner, admin, director,
manager, employee).
- Contract types: nine observed values, including the two dirigeant
types that were missing; professionnalisation was never observed and
is dropped.
- Planning has five views, not three: month and presence/absence were
missing. All five read one model.
- Pay periods can be unlocked, and deleted while locked. Locking is
therefore not terminal: re-locking recomputes snapshots, so exports
from a since-unlocked period must be flagged stale or a file sent to
Silae silently stops matching the data.
- Absence types carry a social-security flag; incomplete-profile
filtering needs separate RUP and DPAE required-field sets.
- Document templates resolve variables per location.
Adds a telemetry invariant: the audit intercepted 2102 third-party
tracking requests and no business calls. An HR app must not leak
employee-context navigation to ad networks, so trackers are banned and
a restrictive CSP ships in WP-00 to make that testable.
Notes that the root dropdowns/ directory duplicates the copy under
Audit Combo/ byte for byte.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
Rewrites PLAN.md as a normative spec an orchestrator can build from
end to end, rather than a proposal.
Scope locked per owner decision: multi-location, Silae as the
downstream payroll system, no time clock. Timeclock entities are
dropped; actual hours are now manager-entered on the shift, with
planned hours authoritative when absent.
Adds the full Prisma schema, the permission catalogue, 17 compliance
rule codes, the leave ledger contract, the Silae CSV format
(UTF-8, semicolon, HS-/AB-/EV- prefixes), the route inventory, and
12 work packages with testable acceptance criteria.
Collective-agreement values and Silae rubric codes are declared stop
signals: the spec forbids inventing them and requires human input
before production.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
Rewrites the plan against the audit bundle rather than public docs.
Three findings changed the design:
- The audited account runs IDCC 1517 (commerces de detail non
alimentaires), not HCR. The rules engine seeds from that agreement.
- Authorization is capability-based with separate scopes, and roles are
customer-configurable, so Role/Permission/Scope are split from day one.
- Leave counters are a ledger of operations, not a stored balance.
Scope, stack and deployment are stated as assumptions pending
confirmation. Payroll stays export-only; DSN, eIDAS signature and DPAE
transmission are delegated.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Cr9dkEHwbDgkWPnyGj1Rjv
Claude