01Systems & Platforms
HR, attendance and statutory payroll for ~300 people
The client is an Indonesian apparel manufacturer of roughly 300 staff — Bali timezone, IDR, Bahasa Indonesia primary with an English fallback. HR operations lived across a master-data workbook, chat threads, paper forms and a payroll spreadsheet whose macros nobody wanted to touch.
Two forces made the spreadsheet stack untenable. Indonesian statutory payroll — PPh 21, BPJS contributions, overtime multipliers, the 78-hour monthly overtime threshold, THR — was computed by hand every month with no record of which rule produced which payslip. And Indonesia's personal data law (UU 27/2022) raised the bar for demonstrable access control over employee data, which a shared workbook fundamentally cannot provide.
The brief was not 'build an HR app'. It was: make each month's payroll reproducible, defensible, and impossible to quietly alter after the fact.
A Next.js 16 App Router monolith where every mutation is a server action rather than a REST endpoint — 105 page routes and exactly one HTTP route. Authorization resolves before any module runs; pure rule engines sit beneath the modules and never touch I/O.
Attendance is stored append-only. Punches, corrections and voids are events; nothing is ever edited in place. A correction is a void-and-replace pair with its own audit record, so a dispute six months later can be reconstructed exactly as it happened.
A pure day engine turns that ledger into priced minute buckets: events plus schedule plus leave plus rules in, buckets out. No I/O, no clock, no database — which is what makes it testable and what makes a payroll run reproducible.
Geofencing validates punches against branch coordinates using browser geolocation, with a Leaflet-based branch editor for the operations team.
Base and overtime pay, BPJS contributions, a PPh 21 TER-style band table, THR and leave cash-out each live in their own separately versioned engine. A payslip records which rule version produced it.
Every money value moves through decimal.js fixed-point arithmetic. Floating point has no place in a system that has to agree with a bank file to the rupiah.
A finalized run is immutable. It passes an eight-stage approval workflow, then produces payslips as HTML and React-PDF — and a checksummed Mandiri MCM2 bank transfer file, generated by byte-carefully patching the bank's macro-preserving XLSM template so the re-keying step between payroll and the bank disappears.
A 158-code permission catalog is resolved per request as access-level bundle plus per-user grants minus restrictions, then narrowed by scope — all, team, or self — with field-level masking on top.
Restricted fields — national ID, tax ID, bank accounts, social-security numbers — are encrypted at the application layer with AES-256-GCM and versioned ciphertext, so a database dump is not a personal-data breach.
The legacy 291-column workbook was not thrown away; it was kept as the reconciliation reference. CLI tooling imports historical payroll, diffs environments, and cross-checks computed results against the workbook baseline.
A spreadsheet-style master-data workspace with staged edits, Excel-style fill and paste, atomic validation and org-chart cycle detection gives HR the ergonomics they already knew, with a full export → edit → import round trip that previews, applies transactionally, and rolls back.
It is not enough to compute the right number. You have to be able to show, months later, which rule version produced it, from which attendance events, and prove nobody edited it afterwards. That requirement drove three decisions at once: the append-only ledger, the versioned engines, and immutability on finalized runs.
The bank's bulk-transfer format is a macro-bearing XLSM template. Regenerating it from scratch breaks the macros; the file has to be patched byte-carefully so the workbook stays valid and checksummed. Getting this right removed a hand-keying step that sat between a finalized payroll run and actual money moving.
Tax and contribution rates are documented in the repo as UNVERIFIED pending confirmation with Accounting, with a standing production-gaps register tracking what remains. Encoding uncertainty as a tracked, visible gap rather than a confident constant is the honest engineering choice, and it is how the rule versions earn their keep.
105 page routes and one HTTP route. Every mutation goes through a server action that authorizes, scopes, validates and audits before it touches a module. There is no second, weaker path into the data — which is the entire point when the data is 300 people's salaries and national IDs.
No AI runs in the product, and that is deliberate — nothing probabilistic belongs between an attendance event and a payslip. AI was the delivery method, not a feature: large releases ran a documented multi-agent workflow of parallel read-only audit agents, a verifying integrator, parallel build lanes, then a fresh set of adversarial reviewers whose blockers had to be cleared before the release was recorded.
Attendance punches become priced minute buckets automatically; overtime derives from actual attendance with no request step; the 78-hour threshold reallocation, BPJS, PPh 21 and THR are computed by versioned engines; and the bank transfer file is generated directly from the finalized run instead of being re-typed into the bank's converter workbook. Operationally, CLI scripts automate legacy import, cross-environment reconciliation, production integrity checks and clean-state verification — and a boot-time hook flags a production database contaminated with demo records.
32 numbered releases, each with a git tag matching the container image tag and the in-app version constant, recorded in the changelog, in a deployment history document, and in a version table surfaced inside the app. Each release entry states the management request it answers, what was deliberately NOT changed — 'the calculation-owning files and prisma/ are byte-identical to the previous version, verified by diff' — and the gates it passed. A written, permanent non-destructive deployment invariant governs what may never be done to production.
Objective size signals taken from the repository. No impact metrics are claimed that the source does not prove.
Internal, login-gated system holding real employee data. No production screens are published.