Project Control — project-monitoring

Continue prompt

{
  "project": "project-monitoring",
  "mission": "Advance and maintain the PT Famika construction monitoring SaaS by executing roadmap features (Phase H subcon/AP/CCO, Excel import button, Option B group overrides, BoQ lock approval flow, and BoQ snapshots) on GitHub repo binyo32/project-monitoring and Supabase project hawojxoxgwofsoejakrb, while strictly upholding shared HRD database isolation, price snapshot immutability, and browser-first data modification rules.",
  "read_first": [
    "/data/vault/wiki/projects/project-monitoring.md (primary operating manual: architecture invariants, live features, UAT findings, 2026-08-11 state update)",
    "/data/vault/projects/project-monitoring-overview.md (project overview: stack, user roles, features, hosting architecture, phase history)",
    "/data/vault/projects/project-monitoring-database.md (database schema reference: 13 pm_* tables, columns, indexes, FK map, ER diagram)",
    "/data/vault/projects/project-monitoring-rls-policies.md (RLS security matrix per role and helper functions)",
    "/data/vault/projects/project-monitoring-rpc-functions.md (PL/pgSQL security definer RPC functions and dependency graph)",
    "/data/vault/projects/project-monitoring-future-prompts.md (ready-to-paste roadmap prompts and editorial dark glassmorphism design system rules)",
    "/data/vault/wiki/projects/project-monitoring-ftth.md (production data context for FTTH Pinggir Rel, capital injections vs owner payments)",
    "/data/vault/projects/project-monitoring-credentials.md (prod credentials reference and role password conventions)",
    "/data/vault/projects/project-monitoring-edge-functions.md (edge functions, shared HRD tables, and Postgres extensions)",
    "output/census-latest.json (confirms invisible off-VM status and repo location binyo32/project-monitoring)"
  ],
  "verification_anchor": {
    "command": "cat /data/vault/wiki/projects/project-monitoring.md && echo '---' && head -n 30 /data/vault/projects/project-monitoring-overview.md",
    "expect": "Markdown documents with frontmatter (title: \"project-monitoring\" / \"Project Monitoring — Famika\", status: active) detailing the PT Famika construction SaaS, React 19 + Supabase stack, shared HRD database invariants, and the 2026-08-11 v0.9.0 state update."
  },
  "project_context": {
    "what_it_is": "Project Monitoring is a multi-tier construction-monitoring SaaS web application for PT Famika. It tracks Klien (clients) → Projects (SPK contracts) → Purchase Orders (initial and addendums) → RAB Categories and Line Items (Master Budget) → PO-level Allocations (pm_po_rab_items) → Bill of Quantities (pm_boq_items) with a dual-approval workflow (Admin submits progress → PM approves → GM approves → finalized update). It features S-curve progress tracking, an Executive Command Center (Portfolio Health Index 40/40/20 IKP scoring), an Architectural Grid with combobox BoQ resolution, Indonesian-locale Excel pasting, and role-based Spotlight onboarding tours with a triple-defense sandbox.",
    "domain_notes": "The production database on Supabase (ref: hawojxoxgwofsoejakrb) is shared with a legacy HRD attendance system (~968 auth users, 36K records without RLS). Therefore, all PM tables are strictly prefixed with pm_* and have RLS enabled; every schema migration is a direct production deploy. Real production operations track the 'FTTH Pinggir Rel' project (47 RAB items, 2 POs, 60.58% HPP margin, 2,565 segment reports). In construction financial accounting, pm_capital_injections represents working capital injected into the project rather than client revenue, and pm_owner_payments feeds invoice payment status. Historical pricing (unit_price_at_submit and unit_price_hpp) is always snapshotted and never re-read from catalogues."
  },
  "tech_stack": {
    "frontend": "React 19, Vite, TypeScript, Tailwind CSS, Lucide React, Framer Motion (custom Spotlight portal), pdfmake (lazy-loaded PDF generation), SheetJS (Excel workbook parsing)",
    "backend_baas": "Supabase (PostgreSQL 15+, Supabase Auth, Edge Functions in Deno/TypeScript, Row Level Security)",
    "database_schema": "13+ pm_* tables (pm_user_roles, pm_parent_projects, pm_projects, pm_purchase_orders, pm_rab_categories, pm_rab_items, pm_po_rab_items, pm_boq_items, pm_item_progress_logs, pm_project_milestones, pm_project_assignments, pm_notifications, pm_activity_logs, pm_hpp_items, pm_daily_reports, pm_daily_achievement_items, pm_capital_injections, pm_owner_payments), materialized views (pm_portfolio_pulse_daily, pm_portfolio_health_summary, pm_project_cashflow_schedule), and SECURITY DEFINER RPCs",
    "edge_functions": "pm-send-email (SMTP notifications on progress submit/approve/reject), pm-smtp-check",
    "ui_theme": "Editorial dark glassmorphism (tonal shifts bg-white/[0.02] → bg-white/[0.05], no 1px borders, Manrope typography, sky-500 primary, sticky table headers, tokenized CSS)",
    "hosting": "Hostinger static web hosting (Apache with .htaccess rewrite rules for SPA routing) at https://aliceblue-kangaroo-466328.hostingersite.com",
    "documentation": "MkDocs Material (bilingual EN/ID) in docs/ with Cytoscape.js interactive workflow graph and localStorage auth gate"
  },
  "current_state": {
    "summary": "FGD roadmap 39/39 completed, application version 0.9.0 (status: active/developing, updated 2026-08-11). Phase A-G delivered (Daily Achievement Reports v34.2.0, Architectural Grid v21, Executive Command Center v22, Spotlight Onboarding v23, HPP BoM margin tracking v18, RLS hardening, pdfmake PDFs, simplified approval mode). Production DB hawojxoxgwofsoejakrb is live and shared with HRD. Real project FTTH Pinggir Rel active. No codebase or git clone exists on VM101 disk (repo is binyo32/project-monitoring on GitHub).",
    "source_of_this_status": "Vault operating manual /data/vault/wiki/projects/project-monitoring.md (updated 2026-08-11), cross-referenced with /data/vault/projects/project-monitoring-overview.md, /data/vault/wiki/projects/project-monitoring-ftth.md, and output/census-latest.json invisible_projects."
  },
  "repo_locations": {
    "github_remote": "https://github.com/binyo32/project-monitoring (main branch force-pushed 2026-05-24 following credential scrub)",
    "local_clone_vm101": "none (off-VM / invisible project on VM101; tracked via Obsidian vault pages)",
    "developer_workstation_path": "C:\\Users\\dimas\\Documents\\git\\project-monitoring (local Windows clone for development and Claude Code sessions)",
    "live_frontend_url": "https://aliceblue-kangaroo-466328.hostingersite.com",
    "supabase_dashboard": "https://hawojxoxgwofsoejakrb.supabase.co (project ref: hawojxoxgwofsoejakrb)"
  },
  "key_files": {
    "/data/vault/wiki/projects/project-monitoring.md": "Primary on-VM operating manual detailing live features, architecture invariants, UAT cycle results, schema corrections, and the 2026-08-11 v0.9.0 state update",
    "/data/vault/projects/project-monitoring-overview.md": "Architecture overview document covering tech stack, user roles, feature map, and phase history",
    "/data/vault/projects/project-monitoring-database.md": "Database schema reference for all 13 pm_* tables, constraints, indexes, ER diagram, and FK relationships",
    "/data/vault/projects/project-monitoring-rls-policies.md": "Complete RLS policy map and access matrix per user role (super_admin, gm, pm, admin)",
    "/data/vault/projects/project-monitoring-rpc-functions.md": "PL/pgSQL security definer RPC function source code (pm_submit_update, pm_approve_update, pm_reject_update) and dependency graph",
    "/data/vault/projects/project-monitoring-future-prompts.md": "Ready-to-paste implementation prompts for roadmap features and editorial dark glassmorphism design system specifications",
    "/data/vault/wiki/projects/project-monitoring-ftth.md": "Production data notes for FTTH Pinggir Rel (capital injections, owner payments, segment progress, material ledger)",
    "/data/vault/projects/project-monitoring-credentials.md": "Production user credentials and password convention (karyawan123 default, banteng for SA owner) for UAT testing",
    "/data/vault/projects/project-monitoring-edge-functions.md": "Documentation of PM edge functions (pm-send-email), shared HRD database tables, and Postgres extensions",
    ".htaccess": "Apache rewrite configuration on Hostinger enabling SPA client-side routing fallback",
    "docs/": "MkDocs Material documentation site (workflow-graph.md, APP-WALKTHROUGH-DETAILED.md, uat/) with auth-gate.js"
  },
  "next_steps": [
    "Open the project repository on the development workstation (C:\\Users\\dimas\\Documents\\git\\project-monitoring or clone binyo32/project-monitoring from GitHub) and verify local workspace state against origin/main.",
    "Review and execute roadmap prompts from /data/vault/projects/project-monitoring-future-prompts.md, prioritizing Prompt #3 (Excel .xlsx upload button with SheetJS), Prompt #2 (Option B per-row group override), Prompt #5 (Approval-page integration for BoQ lock), and Prompt #6 (BoQ snapshot versioning).",
    "Implement Phase H modules (Subcontractor management, Accounts Payable tracking, and Change Order / CCO workflow) while adhering strictly to editorial dark glassmorphism design tokens.",
    "Populate material master catalogue records in production Supabase (hawojxoxgwofsoejakrb) via the browser DOM / UI to unblock FTTH Pinggir Rel material ledger operations.",
    "Resolve the pending cost-masking policy decision regarding HPP visibility across lower-tier user roles (admin and field_admin).",
    "Complete the backdated S-Curve simulation on UAT-2026-05-23-PO-PROJECT-01 across the 8-week schedule (Weeks 2-8 SQL inserts + matview refresh).",
    "Deploy the compiled MkDocs documentation wiki (docs/ -> site/) with auth-gate.js to Hostinger /uat/ once FTP/cPanel access is restored."
  ],
  "constraints": [
    "Shared database isolation: The Supabase project (hawojxoxgwofsoejakrb) is shared with the legacy HRD system (~968 auth users without RLS); all PM tables MUST use the pm_* prefix, have RLS enabled, and every migration is a live production deployment. Never execute un-scoped queries like SELECT * FROM auth.users without role guards.",
    "Browser-first production data rule: All production data entry and data repairs must be performed via browser DOM / UI; direct SQL modifications on production tables require explicit per-case user approval (standing rule filed after 6+ re-typings).",
    "Price snapshot immutability: Construction accounting demands point-in-time pricing; unit_price_at_submit in pm_item_progress_logs and unit_price_hpp in pm_boq_items must always be snapshotted at save time and never re-calculated or re-read from master catalogues.",
    "Polling over Realtime: In-app notifications and UI updates must use polling on pm_notifications rather than Supabase Realtime subscriptions (Realtime channels were removed due to duplicate subscribe crashes in React StrictMode).",
    "Dual-approval workflow: Progress updates require two distinct approvals (pm_approved=true then gm_approved=true); current_qty updates and S-curve snapshots are applied only when status becomes 'finalized'. Respect the partial unique index idx_pm_progress_pending_unique.",
    "Editorial dark glassmorphism: Strictly follow design system tokens (no 1px borders, tonal background shifts bg-white/[0.02] → bg-white/[0.05], Manrope typography, sky-500 primary, tokenized colors). Never hardcode raw dark color values.",
    "PostgREST pagination: PostgREST caps result sets at 1000 rows; always paginate queries for high-volume entities such as segment progress reports and material ledgers.",
    "Capital vs revenue distinction: In financial reporting and dashboard metrics, pm_capital_injections represents working capital, NOT client revenue; keep operating entity vs payer entity strictly separate.",
    "Credential security: Never commit passwords (karyawan123, banteng) or SMTP secrets to git repositories (history was previously scrubbed after app/query_po.cjs leaked secrets). Store credentials only in gitignored .env.uat or Supabase Edge Function environment variables.",
    "Off-VM boundary: Do not fabricate on-VM codebases or Docker containers on VM101; this project lives on GitHub (binyo32/project-monitoring), Supabase, and Hostinger, and is tracked on VM101 via Obsidian vault notes."
  ],
  "known_staleness_warning": "The primary vault operating manual (/data/vault/wiki/projects/project-monitoring.md) was last updated on 2026-08-11 (14 days ago). Because development occurs on GitHub (binyo32/project-monitoring) and production runs on Hostinger and Supabase, on-VM vault documentation cannot capture offline commits, recent field logs for FTTH Pinggir Rel, or recent Supabase schema adjustments made directly off-VM.",
  "handoff_metadata": {
    "created": "2026-08-25",
    "created_by": "project-control automated continue-prompt generator",
    "all_facts_sourced_from": "census-latest.json + /data/vault/wiki/projects/project-monitoring.md + /data/vault/projects/project-monitoring-overview.md + /data/vault/projects/project-monitoring-database.md + /data/vault/projects/project-monitoring-rls-policies.md + /data/vault/projects/project-monitoring-rpc-functions.md + /data/vault/projects/project-monitoring-edge-functions.md + /data/vault/projects/project-monitoring-future-prompts.md + /data/vault/wiki/projects/project-monitoring-ftth.md + /data/vault/projects/project-monitoring-credentials.md"
  }
}
project-monitoring

Continue prompt

Detail

Observed Signals

1. What's Left

2. Continue / Drop Suggestion

3. Dynamic Milestone Estimate
