Changelog

All notable changes to the VENI-AI platform are documented here, organized by release. Each entry maps to closed issues across the platform repositories.

---

v0.4.0 — 2026-04-19

HRM — Full Feature Release

Employee Lifecycle & Profile

• Lifecycle state machine — guarded transitions: Candidate → Active → Probation → Terminated (hrm#23)
• Sensitive data encryption — SSN, IBAN, bank account encrypted with AES-256-GCM at rest; masked for non-HR roles (hrm#38)
• Permanent Employee UUID — immutable legal identifier generated on promotion from Candidate (hrm#40)
• Legal Document Vault — contract/ID uploads with seal guard (sealed docs cannot be deleted) (hrm#40)
• CV management & versioning — multiple CV versions with upload date and active flag (hrm#18)
• AI CV parsing — upload PDF/DOCX → extract fields → human confirms → create candidate (hrm#33)
• Candidate management — create pre-hire candidates without a Shell account; auto-link on first login by email (hrm#32)
• Natural language employee search (hrm#13)
• Advanced search & filters (hrm#12)
• Quick View profile popup — summary without leaving the directory (hrm#19)
• Export employee profiles to PDF (hrm#14)
• Automated Skill Matrix updates (hrm#15)
• Salary & title audit ledger — time-travel record, view profile as of any date (hrm#24)
• RBAC for employee profiles — field-level visibility per role (hrm#17)
• Audit trail for all profile modifications (hrm#16)
• Comprehensive employee information storage — full set of employment fields (hrm#11)

Shell Integration

• Shell User Provisioner — outbound sync to Shell on employee create/terminate (hrm#29)
• Shell Role & Attribute Mapper — syncs HRM job title / department to Shell user attributes (hrm#30)
• Global Header Provider — exposes user avatar & info endpoint for Shell top-bar (hrm#28)
• EMPLOYEE_ACTIVATED event + Shell Provisioner hook (hrm#37)
• Access Kill-Switch — instant HRM access revocation via admin tool on termination (hrm#31)
• HRM Module Federation verified inside Shell (hrm#63)
• Authentication & token exchange verified (hrm#56)

Onboarding

• Magic Link portal — candidate self-submits bank/tax/ID documents via secure time-limited link (hrm#35)
• HR side-by-side review — submitted data presented alongside offer details for verification (hrm#36)
• Probation first-login guide — new hires in Probation status see an orientation guide on first login (hrm#44)

Leave Management

• Leave Policy Engine — HR configures auto-accrual schedules, carry-forward limits, and eligibility rules per leave type (hrm#26)
• Probation block — employees in Probation status cannot submit leave requests (hrm#44)
• Document Vault — contract storage with role-based access control (hrm#27)

New Features

• Attendance — self-service check-in/out, late detection, overtime calculation, monthly timesheet, org summary (hrm#64)
• Payroll Management — salary/bank mapping, tax resolution, pay run processing, Four-Eyes salary approval, payslips (hrm#39, hrm#65)
• Analytics & Reporting — headcount trends, leave utilization, attendance rates, department breakdown (hrm#68)
• In-app Notification Center — real-time alerts for leave decisions, status transitions, pending reviews (hrm#67)
• Enhanced Dashboard — role-aware KPI widgets, headcount, pending actions (hrm#66)
• Drag-and-drop Org Chart — HR can reassign reporting lines and departments directly on the chart canvas (hrm#25)

Quality

• Unit tests: EncryptionService, LifecycleService, AttendanceService, PayrollService, LegalVaultService, ProfileService (hrm#50–55)
• Verify: RBAC, Attendance, Payroll, Legal Vault, Employee Profile, Lifecycle (hrm#57–62)

---

v0.3.0 — 2026-04-15

Shell — Org Settings & Home API Integration

• Org settings: Save Settings wired to PUT /organizations/:id (veni-ai#70)
• Org settings: InviteMemberDialog connected to POST /users/invite with real role mapping (Owner / Admin / Member) (veni-ai#71)
• Org settings: Pending invitations list in Members tab — view and revoke outstanding invites (veni-ai#72)
• Org settings: Role filter Select in Members tab wired to real data (veni-ai#69)
• Org settings: MemberColumns fixed accessorKey mismatch and role detection (replaced email heuristic with real roles) (veni-ai#67, veni-ai#68)
• Org settings: Delete member — proper error handling, loading state on trash button, confirmation dialog (replaced window.confirm) (veni-ai#94)
• Home page — wired real API for Recent Activity, Stats, and Service cards (veni-ai#85)
• Org settings: User management fully integrated with real API (veni-ai#84)
• Provider Identifiers list connected to real API (veni-ai#60)
• Subscription plan subscribers fetched from live data (veni-ai#56)

HRM — Initial Delivery

• CI/CD pipeline — GitHub Actions (develop → dev cluster) (hrm#9)
• UI layout — sidebar & header matching Shell design system (hrm#8)
• Shell auth integration — migrated to Shell JWKS (RS256) token exchange pattern (hrm#7)
• K8s deployment setup — dev cluster (hrm#6)

---

v0.2.0 — 2026-04-08

Shell — SCS Architecture Phases & Auth Hardening

SCS Infrastructure

• Phase 1 — EDA: Event-Driven Data Replication via Redis Streams (veni-ai#40)
• Phase 1 — mTLS: Internal mTLS enforced for all gRPC service-to-service calls (veni-ai#41)
• Phase 2 — BFF Pattern: Transitioned to HttpOnly cookie-based token storage; access tokens no longer exposed to browser JavaScript (veni-ai#42)
• Phase 2 — Design Tokens: Scaffolded @veni-ai/design-tokens package (veni-ai#43)
• Phase 3 — OpenTelemetry: Distributed tracing implemented across Shell API and satellite services (veni-ai#45)
• Phase 4 — Performance: Module Federation 2.0 and prefetching optimizations (veni-ai#46)

Auth Fixes

• Org members no longer shown /welcome after login — correctly land on /dashboard (veni-ai#74)
• Google OAuth: fixed UTF-8 mojibake in non-ASCII names during JWT decode (veni-ai#73)
• Duplicate org bug: fixed concurrent OAuth callbacks creating duplicate organizations (veni-ai#52)

Shell UI

• App Sidebar expanded/collapsed state persisted across sessions (veni-ai#59)
• Satellite Hub Dashboard connected to real API (veni-ai#58)
• Audit & Billing page connected to real revenue data (veni-ai#57)

Documentation

• Authentication documentation updated to match BFF/cookie implementation (veni-ai#37)
• Onboarding scenarios documented — Individual & Business flows (veni-ai#34)
• Fixed illustration of Vertical Autonomy / SCS slices in introduction page (veni-ai#38)

---

v0.1.0 — 2026-03-21

Shell — Platform Foundation

• Admin UI — platform user, role, and permission management (veni-ai#31)
• RBAC gRPC endpoint — cross-service permission queries from satellite modules (veni-ai#30)
• RBAC design — roles, permissions, and user management architecture (veni-ai#28)
• veni-service template — local user model and provisioning (veni-ai#29)
• Monorepo patterns — proven SCS patterns adopted from reference implementation (veni-ai#25)
• Venizia favicon replaced default Vite favicon (veni-ai#35)
• Initial infrastructure fixes: Traefik Docker API version, Makefile service paths, Bun link: protocol, install order (veni-ai#26, veni-ai#27, veni-ai#23, veni-ai#24)