From e2559d1f59105dc2525a9247197d5addee138c76 Mon Sep 17 00:00:00 2001 From: weeihan Date: Sun, 12 Jul 2026 10:46:44 +0800 Subject: [PATCH] docs: real README, current phase status in CLAUDE.md, complete env example - README was untouched create-next-app boilerplate - CLAUDE.md still claimed "Phase 0 not started"; all phases 0-6 complete - .env.local.example was missing SUPABASE_SERVICE_ROLE_KEY, Resend, and Meta WhatsApp variables added in later phases Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ --- .env.local.example | 12 +++++++++ CLAUDE.md | 2 +- README.md | 62 ++++++++++++++++++++++++++++------------------ 3 files changed, 51 insertions(+), 25 deletions(-) diff --git a/.env.local.example b/.env.local.example index 41e0e92..30c43bb 100644 --- a/.env.local.example +++ b/.env.local.example @@ -2,6 +2,18 @@ NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here NEXT_PUBLIC_APP_URL=http://localhost:3000 +NEXT_PUBLIC_SITE_URL=http://localhost:3000 CRON_SECRET= + +# Server-side only — never expose to the client +SUPABASE_SERVICE_ROLE_KEY= +RESEND_API_KEY=re_... +RESEND_FROM_EMAIL=alerts@yourdomain.com + +# AI keys — optional here; preferred location is the app_settings table (/hse/settings) ANTHROPIC_API_KEY=sk-ant-... VOYAGE_API_KEY=pa-... + +# Meta WhatsApp Cloud API — optional here; preferred location is app_settings +META_WHATSAPP_PHONE_NUMBER_ID= +META_WHATSAPP_ACCESS_TOKEN= diff --git a/CLAUDE.md b/CLAUDE.md index b8b4b71..15d3b64 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -15,7 +15,7 @@ Replaces WhatsApp/Excel safety reporting. Client: Ms. Agnes, Mr. Terence, Mr. Ya - **QR:** qrcode npm package ## Current Phase -**Phase 0 — Foundation (not started)** +**All phases (0–6) complete as of 2026-07-12.** Remaining work is ops: production env vars (`SUPABASE_SERVICE_ROLE_KEY`, Meta WhatsApp, Resend, `CRON_SECRET`), VPS cron registration (`docs/vps-cron.md`), optional Supabase Pro for image thumbnails. See `[[phases]]` memory for full phase breakdown and deliverables. ## Dev Conventions diff --git a/README.md b/README.md index e215bc4..7287118 100644 --- a/README.md +++ b/README.md @@ -1,36 +1,50 @@ -This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app). +# IMS — HSE Incident Management System -## Getting Started +AI-powered HSE incident management for Setia Corporation's 3PL warehouse operations. Replaces WhatsApp/Excel safety reporting with a structured report → triage → investigation → CAPA → verification → closure workflow, compliant with Malaysian DOSH law (OSHA 1994, NADOPOD 2004). -First, run the development server: +## Features + +- **QR-based incident capture** — zone-specific QR codes, mobile-first form, works offline (PWA + IndexedDB sync), EN / Bahasa Malaysia / 中文 +- **Type-specific intake** — injury, near miss, hazard, asset/MHE, environmental, security, fire +- **Triage & DOSH check** — severity 1–5, automatic NADOPOD 2004 obligation detection (immediate notify / JKKP 6 / JKKP 7 / JKKP 8) +- **Investigation** — 5-Why and fishbone RCA, witness statements, alcohol/urine test log +- **CAPA module** — kanban board, owner assignment, evidence-gated completion, auto-escalation ladder, 30/60/90-day effectiveness rechecks +- **Closure lock** — closed incidents are immutable at the DB level; addenda only +- **Compliance exports** — JKKP 6/7 PDF auto-fill, JKKP 8 annual register CSV, January deadline reminder +- **Notifications** — email (Resend), WhatsApp (Meta Cloud API), in-app bell +- **AI (Claude, server-side only)** — report quality check, severity suggestion, similar-incident retrieval (pgvector), RCA drafting, rising-risk zone flags +- **Dashboards** — leading vs lagging indicators, 12-month trend, zone heatmap, top root causes, CAPA on-time rate, DOSH filing status + +## Stack + +Next.js 15 (App Router, basePath `/ims`) · Supabase (Postgres + RLS + pgvector) · Claude API · Voyage AI embeddings · Resend · Meta WhatsApp Cloud API · pdf-lib · Vitest + +## Development ```bash -npm run dev -# or -yarn dev -# or -pnpm dev -# or -bun dev +npm install +npm run dev # http://localhost:3000/ims +npm test # vitest +npm run build # production build (standalone output) +npm run generate-qr # zone QR PNGs into public/qr ``` -Open [http://localhost:3000](http://localhost:3000) with your browser to see the result. +Environment: copy `.env.local.example` (Supabase URL/keys, `SUPABASE_SERVICE_ROLE_KEY` for admin invites, `RESEND_API_KEY`, Meta WhatsApp creds, `CRON_SECRET`). Claude/Voyage keys live in the `app_settings` table (admin UI at `/hse/settings`) with env fallback. -You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file. +Migrations: `supabase/migrations/` — apply with `supabase db push`. -This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel. +Cron (VPS): daily CAPA escalation + effectiveness recheck — see `docs/vps-cron.md`. -## Learn More +## Docs -To learn more about Next.js, take a look at the following resources: +- `docs/01_PRD_HSE_Incident_Management_System.md` — product requirements +- `docs/02_Technical_Specification_for_Claude_Code.md` — technical spec +- `docs/03_Development_Roadmap_and_Claude_Code_Brief.md` — phase roadmap +- `docs/superpowers/plans/` — per-phase implementation plans +- `.superpowers/sdd/progress.md` — build ledger -- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API. -- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial. +## Compliance notes -You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome! - -## Deploy on Vercel - -The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js. - -Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details. +- Evidence files retained ≥5 years, never hard-deleted (JKKP 8 register requirement) +- Every mutation audit-logged (`audit_log` table); AI suggestions logged with human decision +- RLS enforced at the database level for every table