Release Notes

• Spec 010: SOW Terms & Branded Time-Used Report (PR #21, closing issue #20) shipped a new Work Logs pillar:
  • Project records now carry SOW contract terms (signed date, conditions/notes, monthly hour allowance per billing rate category), edited on a new SOW Terms page.
  • A branded, per-customer per-month "Work Report" PDF export shows worked hours by task and day, with an included-vs-used-vs-delta comparison when a SOW allowance is set. No team member names or rates appear in the report.
  • A Critical bug was caught and fixed before shipping: the project save path was silently dropping identity fields (customer, name, key) whenever they weren't part of the edit.
  • The export is gated behind a live-data freshness check, so a stale or cached view can never be exported as if it were current.
• Work Report polish landed directly on main after the spec merged, refining the export based on a first look at real output:
  • Renamed to "Work Report" with an "Included Workload" column and a categorized Grand Total Summary.
  • Task notes now render as italicized sub-rows under their task, with numeric table headers right-aligned and semantic colors applied per row.
  • Table header styling and colors, and the customer/period placement in the top-right of the PDF header, were fixed after a styling regression.
• Work Logs grid now auto-refreshes after editing, creating, or deleting a work log entry, instead of requiring a manual reload to see the change.
• App-wide feedback toasts, URL filter persistence, and automatic cache invalidation were added, along with a build auto-counter; dashboard layout, the "who's out today" widget, and SOW management screens were also polished.
• Same-origin validation added to an internal fetch helper: `fetchWithLocalFallback` now refuses any URL that isn't a same-origin http/https request with no embedded credentials, closing a potential SSRF/open-redirect surface if the function is ever called with a non-literal URL.
• A Phase 12 compliance audit for Spec 010 scored 8.5/10, with all three findings corrected same-week (a deleted task-completion line restored, a documented doc-only-exception boundary note, and a leftover branch removed); lessons were merged into the shared learnings synthesis.
• Work Report date ordering: entries in both the on-screen Work Report and the exported PDF now display sorted in ascending chronological order by date, with subtle visual dividers separating items.
• Task entry migration and safety snapshots: moving a task across projects or milestones now automatically migrates all historical work log entries to the new parent, with descriptive toast notifications and a pre-migration safety backup created before any changes are written.
• Work Logs filter counts and persistence: customer and project dropdowns now synchronize live active entry counts in real time, filter selections persist across page changes and refreshes, and customer lists are alphabetized in Projects & Tasks.
• Codebase hardening and health modularization: completed a comprehensive 6-batch cleanup resolving 19 audit findings:
  • Eliminated sidebar Out of Office flash-of-unstyled-content and added live auto-refresh listeners to home widgets for pending approvals and out-of-office status.
  • Enforced atomic concurrency checks for the 12-hour daily work log limit, isolated snapshot saves, and hardened input validation.
  • Added atomic foreign key checks preventing deletion of projects or tasks with linked records.
  • Decomposed the server health router into modular domain handlers for diagnostics, integrity checks, migration, and task renumbering.
  • Resolved flaky month navigation test races in Playwright and replaced roadmap coverage-theater assertions with contract tests.
• Automated version stamping: build versions now automatically combine the completed specification count with a timestamped build identifier (e.g. `0.10.YYMMDDHHMM`), ensuring unique, traceable deployments.

This week's window (2026-08-24 to 2026-08-30) closes on 2026-08-30, so this file was generated before the week finished; re-run the skill later in the week to pick up any remaining activity through Sunday.

• Out of Office month-boundary fix: the calendar could not handle a date range crossing a month boundary. Picking a start date, then navigating to the next month to pick the end date, silently cleared the in-progress selection. The picker now keeps the first click in memory across month navigation, so cross-month ranges work.
• Work Logs duplicate-entry fix: the entry modal had a "one entry per task per day" rule that silently merged a second entry into the first instead of creating a separate row, making it impossible to log two distinct activities on the same task and day without losing the first entry's description. The rule was removed at every layer (entry form, offline/local fallback store, server-side API), so each entry now saves independently.
• Spec 008: Leave History, Reporting & Admin Correction (PR #17, closing issue #15) was the bulk of this week's work:
  • Two new read views, a Leave History table and a Current & Upcoming Leaves panel, so managers and approvers can see the full trail and pipeline of leave requests instead of only the current month.
  • Requesters can edit their own still-pending leave request instead of cancelling and resubmitting.
  • Admins have a correction tool to edit or cancel any leave entry directly, with a full record of what the correction changed.
  • A Yearly Leave Overview export (PDF/Excel), and System Health integrity checks that catch orphaned or leaked leave data.
  • Known gap: Export PDF/Excel currently hangs with no output, both on the new Yearly Leave Overview and the pre-existing Monthly Collective Sheet export. Not a regression from this week's work; tracked separately as issue #16.
• Smaller fixes and features landed directly on main, outside that pull request:
  • A "View As" tool lets an admin preview the dashboard as any other user, for support and testing; its access was progressively locked down over the week to the intended single owner, its picker now renders correctly over the page, and its role labels are pulled live from Users & Permissions instead of a hardcoded list.
  • Out of Office now allows self-managed entries, and a flash-of-unstyled-content issue on the sidebar's View As control was removed.
  • JSON export and backups are now restricted to admins, and permission checks for editing worklogs and OOF entries use the actual logged-in user rather than a cached or assumed one.
  • Dependency updates (Astro, @astrojs/react, Vitest, and related dev tooling) went in after a clean test pass.
  • The local end-to-end test harness was fixed: it had been silently failing almost every test because the local preview server had no route to the API backend, which was masking a real bug where opening the "Log Work" modal crashed the page outright. Both are now fixed and the full end-to-end suite passes.

• Timesheets went live, the biggest feature of the week. Staff can log daily attendance and request the four Romanian leave types (paid vacation, unpaid leave, medical leave, special leave); managers can approve or reject those requests. Paid-vacation balances are calculated automatically, and a branded, signed collective attendance sheet can be exported as PDF or Excel for payroll. The home page now shows who's out today and which leave requests are waiting on a manager.
• Groundwork before that feature: the API layer learned to verify who is actually making a request (checking the identity token Cloudflare Access attaches to every login, instead of trusting the browser), and the "Timekeeping" work-logging area was renamed to "Work Logs" everywhere so it would not collide with the new Timesheets terminology.
• Security pass: CI workflows had their third-party actions pinned to exact versions instead of floating tags, the backup API's search parameters were sanitised against injection, and a set of authorization gaps in the Work Logs API (permission checks that could be bypassed) were closed.
• Admin and operations tightened: Attendance gained holiday tracking, custom leave entitlements, and clearer access controls; System Health added integrity alerts and backup safety checks; user and role management was reorganised; Work Logs gained clearer customer grouping and sorting.
• Automated weekly release notes introduced: this week added the process used to produce this page.
• Out of Office tracking shipped: a monthly calendar showing which exempt and tracked staff are away, with two-click date-range marking, optional labels, and conflict checks against approved leave. Approvers can also enter a formal leave request directly on a team member's behalf, applied immediately when there's no attendance conflict. Who's Out Today, integrity checks, and backups were all extended to cover the new records.

• First week of the dashboard: the repository and application foundation were created, including the static dashboard shell, shared data tier, deployment structure, and initial access and permission controls.
• Work Logs shipped (originally "time-tracking"), the first operational area: customer, project, milestone, and task management, time entry, a stopwatch timer, weekly worklog views, billing-rate rules, filtered reports, and Excel or JSON exports. The initial data migration also replaced mock records with working project data.
• Backups and history shipped: staff can create and export snapshots, compare historical data, restore a selected snapshot, and rely on an automatic safety snapshot before a restore changes live data.
• Projects & Tasks reorganised into a customer, project, milestone, and task hierarchy, with customer and partner filters for navigating larger work lists; follow-up changes improved project keys, cascading selectors, milestone behaviour, and sub-key saving.
• Refinement passes landed after the main features shipped, covering permission checks, page-loading flashes, persisted seed data, screen density, search behaviour, and project-key validation. No feature was reverted during the week.