# HR Management System
## Build & Test
- Install: `pip install -r requirements.txt`
- Migrate: `python manage.py migrate`
- Run: `python manage.py runserver`
- Test: `pytest apps/ -x`
## Full-Stack Conventions
Backend:
- Django class-based views, dedicated methods each
- Django ORM exclusively — zero raw SQL
- `select_related`/`prefetch_related` on every queryset
- requirements.txt: package names only, no versions
- Kebab-case file names: `employee-detail-view.py`
Frontend:
- Tailwind CSS latest version via CDN
- Semantic HTML: `<main>`, `<section>`, `<nav>`, `<footer>`
- Favicon: 96x96 PNG per Google guidelines
- No React — server-rendered Django templates only
- `for=`/`id=` on every label/input pair
- `aria-labelledby` on sections → heading `id`
## Security (STRICT)
- PII encrypted at rest (django-encrypted-model-fields)
- RBAC: Admin > HR Manager > Employee
- Payroll: HR Manager+ only, row-level permission
- SSO via SAML — no password-based auth
- Audit log on every `save()` and `delete()`
- Data exports require approval workflow
- Session timeout: 30 min inactivity
## Architecture
- `apps/employees/` — Profiles, org chart, search
- `apps/leave/` — PTO requests, balance calc
- `apps/payroll/` — Salary processing, payslip PDF
- `apps/onboarding/` — Checklists & docs
## Agent Behaviour Rules
READ THIS BEFORE WRITING ANY CODE:
- Do NOT change existing class/method/function names
- Do NOT rename files without explicit approval
- Do NOT guess business logic — ask first
- Do NOT create summary docs or READMEs
- Always specify exact file path in responses
- Performance first: every query counts
- When in doubt about anything — ASK