docs: real README, current phase status in CLAUDE.md, complete env example

- README was untouched create-next-app boilerplate
- CLAUDE.md still claimed "Phase 0 not started"; all phases 0-6 complete
- .env.local.example was missing SUPABASE_SERVICE_ROLE_KEY, Resend, and
  Meta WhatsApp variables added in later phases

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CPf5Rc8QPx6V8KLEEgfKEQ

.env.local.example

@@ -2,6 +2,18 @@
 NEXT_PUBLIC_SUPABASE_URL=https://your-project-ref.supabase.co
 NEXT_PUBLIC_SUPABASE_ANON_KEY=your-anon-key-here
 NEXT_PUBLIC_APP_URL=http://localhost:3000
+NEXT_PUBLIC_SITE_URL=http://localhost:3000
 CRON_SECRET=<generate with: openssl rand -hex 32>
+
+# Server-side only — never expose to the client
+SUPABASE_SERVICE_ROLE_KEY=<required for admin user invites (/admin)>
+RESEND_API_KEY=re_...
+RESEND_FROM_EMAIL=alerts@yourdomain.com
+
+# AI keys — optional here; preferred location is the app_settings table (/hse/settings)
 ANTHROPIC_API_KEY=sk-ant-...
 VOYAGE_API_KEY=pa-...
+
+# Meta WhatsApp Cloud API — optional here; preferred location is app_settings
+META_WHATSAPP_PHONE_NUMBER_ID=
+META_WHATSAPP_ACCESS_TOKEN=

CLAUDE.md

@@ -15,7 +15,7 @@ Replaces WhatsApp/Excel safety reporting. Client: Ms. Agnes, Mr. Terence, Mr. Ya
 - **QR:** qrcode npm package
 
 ## Current Phase
-**Phase 0 — Foundation (not started)**
+**All phases (0–6) complete as of 2026-07-12.** Remaining work is ops: production env vars (`SUPABASE_SERVICE_ROLE_KEY`, Meta WhatsApp, Resend, `CRON_SECRET`), VPS cron registration (`docs/vps-cron.md`), optional Supabase Pro for image thumbnails.
 See `[[phases]]` memory for full phase breakdown and deliverables.
 
 ## Dev Conventions

README.md

@@ -1,36 +1,50 @@
-This is a [Next.js](https://nextjs.org) project bootstrapped with [`create-next-app`](https://nextjs.org/docs/app/api-reference/cli/create-next-app).
+# IMS — HSE Incident Management System
 
-## Getting Started
+AI-powered HSE incident management for Setia Corporation's 3PL warehouse operations. Replaces WhatsApp/Excel safety reporting with a structured report → triage → investigation → CAPA → verification → closure workflow, compliant with Malaysian DOSH law (OSHA 1994, NADOPOD 2004).
 
-First, run the development server:
+## Features
+
+- **QR-based incident capture** — zone-specific QR codes, mobile-first form, works offline (PWA + IndexedDB sync), EN / Bahasa Malaysia / 中文
+- **Type-specific intake** — injury, near miss, hazard, asset/MHE, environmental, security, fire
+- **Triage & DOSH check** — severity 1–5, automatic NADOPOD 2004 obligation detection (immediate notify / JKKP 6 / JKKP 7 / JKKP 8)
+- **Investigation** — 5-Why and fishbone RCA, witness statements, alcohol/urine test log
+- **CAPA module** — kanban board, owner assignment, evidence-gated completion, auto-escalation ladder, 30/60/90-day effectiveness rechecks
+- **Closure lock** — closed incidents are immutable at the DB level; addenda only
+- **Compliance exports** — JKKP 6/7 PDF auto-fill, JKKP 8 annual register CSV, January deadline reminder
+- **Notifications** — email (Resend), WhatsApp (Meta Cloud API), in-app bell
+- **AI (Claude, server-side only)** — report quality check, severity suggestion, similar-incident retrieval (pgvector), RCA drafting, rising-risk zone flags
+- **Dashboards** — leading vs lagging indicators, 12-month trend, zone heatmap, top root causes, CAPA on-time rate, DOSH filing status
+
+## Stack
+
+Next.js 15 (App Router, basePath `/ims`) · Supabase (Postgres + RLS + pgvector) · Claude API · Voyage AI embeddings · Resend · Meta WhatsApp Cloud API · pdf-lib · Vitest
+
+## Development
 
 ```bash
-npm run dev
-# or
-yarn dev
-# or
-pnpm dev
-# or
-bun dev
+npm install
+npm run dev        # http://localhost:3000/ims
+npm test           # vitest
+npm run build      # production build (standalone output)
+npm run generate-qr  # zone QR PNGs into public/qr
 ```
 
-Open [http://localhost:3000](http://localhost:3000) with your browser to see the result.
+Environment: copy `.env.local.example` (Supabase URL/keys, `SUPABASE_SERVICE_ROLE_KEY` for admin invites, `RESEND_API_KEY`, Meta WhatsApp creds, `CRON_SECRET`). Claude/Voyage keys live in the `app_settings` table (admin UI at `/hse/settings`) with env fallback.
 
-You can start editing the page by modifying `app/page.tsx`. The page auto-updates as you edit the file.
+Migrations: `supabase/migrations/` — apply with `supabase db push`.
 
-This project uses [`next/font`](https://nextjs.org/docs/app/building-your-application/optimizing/fonts) to automatically optimize and load [Geist](https://vercel.com/font), a new font family for Vercel.
+Cron (VPS): daily CAPA escalation + effectiveness recheck — see `docs/vps-cron.md`.
 
-## Learn More
+## Docs
 
-To learn more about Next.js, take a look at the following resources:
+- `docs/01_PRD_HSE_Incident_Management_System.md` — product requirements
+- `docs/02_Technical_Specification_for_Claude_Code.md` — technical spec
+- `docs/03_Development_Roadmap_and_Claude_Code_Brief.md` — phase roadmap
+- `docs/superpowers/plans/` — per-phase implementation plans
+- `.superpowers/sdd/progress.md` — build ledger
 
-- [Next.js Documentation](https://nextjs.org/docs) - learn about Next.js features and API.
-- [Learn Next.js](https://nextjs.org/learn) - an interactive Next.js tutorial.
+## Compliance notes
 
-You can check out [the Next.js GitHub repository](https://github.com/vercel/next.js) - your feedback and contributions are welcome!
-
-## Deploy on Vercel
-
-The easiest way to deploy your Next.js app is to use the [Vercel Platform](https://vercel.com/new?utm_medium=default-template&filter=next.js&utm_source=create-next-app&utm_campaign=create-next-app-readme) from the creators of Next.js.
-
-Check out our [Next.js deployment documentation](https://nextjs.org/docs/app/building-your-application/deploying) for more details.
+- Evidence files retained ≥5 years, never hard-deleted (JKKP 8 register requirement)
+- Every mutation audit-logged (`audit_log` table); AI suggestions logged with human decision
+- RLS enforced at the database level for every table