WorkSphere AI

MASTER PROJECT DEVELOPMENT PROMPT WorkSphere AI — AI-Powered Employee Task Management, Project Monitoring, and Workforce Collaboration Platform 1. YOUR ROLE AND OBJECTIVE Act as a senior full-stack software architect, UI/UX designer, frontend developer, backend developer, database architect, AI engineer, cybersecurity engineer, QA engineer, and DevOps engineer. Your responsibility is to design, develop, test, and deliver a complete, advanced, production-oriented full-stack web application named WorkSphere AI. Do not create merely a static website, UI prototype, or collection of disconnected dashboard pages. Develop a functional, integrated application with a working frontend, backend, database, authentication, authorization, task management, reporting, notifications, analytics, AI features, and multilingual support. All buttons, forms, dashboards, navigation elements, filters, tables, charts, and interactive components must perform their intended functions. Use professional software engineering practices, a clean architecture, reusable components, responsive layouts, secure API endpoints, database validation, error handling, and comprehensive testing. If an AI coding environment has access to a terminal, file system, browser, and development server, use those capabilities to implement and verify the project. Do not stop after generating a plan or writing sample code. Complete the project incrementally, run the application, test critical workflows, identify errors, fix them, and continue until the required functionality works. Do not claim that a feature is complete unless it has been implemented and tested. 2. PROJECT IDENTITY Product Name: WorkSphere AI Product Category: Enterprise Employee Management, Project Management, Productivity Tracking, and Workforce Collaboration Platform. Tagline: "Assign Smarter. Work Better. Achieve Together." Core Objective: Develop a centralized company management platform where administrators manage organizational access, managers assign and monitor projects, employees update daily work progress and submit reports, and an intelligent automation system monitors deadlines, sends reminders, and provides actionable project insights. The application must be suitable for small companies, medium-sized businesses, and larger organizations, with an architecture that can be extended into a multi-tenant Software-as-a-Service product. The platform should reduce manual follow-ups, improve project visibility, simplify employee reporting, support better workload planning, and help organizations identify potential delays. 3. CORE PROBLEM STATEMENT Companies often use separate spreadsheets, emails, messaging applications, and manual reporting processes to manage employee work. This creates problems such as: Managers cannot easily track all employee assignments. Employees forget or delay daily work reports. Project deadlines are missed because reminders are not systematic. Managers must manually contact employees for progress updates. Employees may have too many overlapping projects. Managers lack a centralized view of project progress. Work reports and feedback are scattered across different systems. Companies struggle to identify delayed projects early. Employees have difficulty identifying their most urgent tasks. Language barriers can make business software less accessible. Manual reporting consumes time that could be spent on productive work. Project decisions are difficult to audit when changes are not recorded. WorkSphere AI must address these problems through centralized task management, structured reporting, automated notifications, project analytics, workload planning, and AI-assisted interactions. 4. REQUIRED USER ROLES Implement three primary roles: Administrator Manager Employee Use secure server-side role-based access control. A user must never gain administrator or manager privileges simply by selecting a role on a public registration form. Roles must be assigned or approved through an authorized organizational process. Every protected backend operation must verify the user's identity, organization membership, role, and access to the requested resource. 4.1 ADMINISTRATOR MODULE The administrator manages the organization and its configuration. Required capabilities: Create and configure the organization workspace. Manage organization details and settings. Invite employees and managers. Approve or provision accounts. Activate and deactivate user accounts. Assign authorized roles. Create and manage departments. Create and manage teams. Assign managers to departments and teams. Define reporting policies. Configure working hours. Configure weekends and holidays. Configure default report submission deadlines. Configure reminder schedules. Configure notification preferences. Configure project priority options. Manage organization-wide permissions. View organization-level project statistics. View employee and manager directories. View authorized audit logs. Manage approved document categories. Manage application settings. Review system activity. Configure data retention policies. Manage organization subscription settings if billing is implemented. The administrator should have organization-level visibility according to explicit permissions and company policy. Do not automatically expose sensitive employee documents or private information merely because someone is an administrator. 4.2 MANAGER MODULE Managers are responsible for project creation, assignment, monitoring, review, and coordination. Required capabilities: View assigned teams and employees. View team dashboards. Create projects. Edit project information. Archive or cancel projects. Assign projects to employees or teams. Create tasks within projects. Assign tasks to one or more employees. Set priorities and deadlines. Define project milestones. Define task dependencies. Define expected deliverables. Define reporting frequency. Define reporting deadlines. Monitor daily employee progress. View submitted work reports. Approve reports. Request report corrections. Add feedback and comments. Monitor incomplete reports. Monitor overdue tasks. Monitor upcoming deadlines. Monitor blocked tasks. Review project risk alerts. View employee workload. Identify conflicting deadlines. View project timelines. View project completion percentages. Export authorized reports. Generate weekly, monthly, quarterly, and annual summaries. Receive notifications about important project events. Use the AI assistant to query authorized project information. Managers must only access employees, projects, and reports within their authorized organizational scope. 4.3 EMPLOYEE MODULE Employees must have a personalized dashboard that displays their responsibilities. Required capabilities: View assigned tasks. View assigned projects. View task descriptions. View assigning manager. View priorities. View start dates and due dates. View required deliverables. View project milestones. View task dependencies. Update task status. Update progress percentage. Submit daily work reports. Save report drafts. Edit reports when permitted. Upload deliverables. Report blockers. Record time spent when enabled by company policy. View previous reports. View manager feedback. Respond to requests for corrections. View report approval status. View upcoming deadlines. View personal calendar. View notifications. Search personal tasks and projects. Ask the AI assistant questions about authorized work. Use voice input to draft reports. Change interface language. Configure notification preferences. Update permitted profile details. Employees must not be able to edit another employee's reports, approve their own reports when approval is required, or access unauthorized project information. 5. AUTHENTICATION AND USER ONBOARDING Implement a complete authentication flow. Required features: Sign-up or invitation acceptance. Sign-in. Sign-out. Email verification. Password recovery when supported by the chosen authentication provider. Session management. Secure protected routes. Role-based redirects after authentication. Unauthorized-access handling. Account activation and deactivation. Organization membership verification. Authentication error messages. Loading states. Login activity records. Appropriate session-expiration handling. Recommended authentication provider: Clerk. Use Clerk's supported integration for the selected frontend and backend architecture. After authentication, maintain a corresponding application user record in the database. Do not treat the authentication provider's public profile as the complete company employee record. Required application user fields: User ID. Full name. Email address. Phone number, if collected. Organization ID. Department ID, where applicable. Assigned role. Preferred language. Account status. Profile image, if supported. Created timestamp. Updated timestamp. Use the authentication provider's stable user identifier to associate authentication identities with application records. A phone number should not be mandatory unless the organization explicitly requires it. Do not store plaintext passwords or authentication secrets in the application database. Do not store passwords, session tokens, or complete authentication credentials in login history. Record security events such as successful and failed login attempts, timestamps, and suitable device or session metadata where supported and justified. Never allow an ordinary employee to elevate their own permissions by editing browser requests, URL parameters, or client-side role values. 6. ORGANIZATION, DEPARTMENT, AND TEAM MANAGEMENT Support company structures such as: Organization → Departments → Teams → Managers → Employees → Projects → Tasks Required features: Create departments. Rename departments. Assign department managers. Create teams. Add or remove team members. Transfer employees between departments when authorized. Maintain reporting relationships. View employee profiles. Filter employees by department, team, manager, and status. Preserve historical assignments where necessary. Restrict access to organization-specific information. An employee may belong to multiple projects and, if supported by the organization model, more than one team. The system must maintain clear rules for who can assign work and who can view each project. 7. ADVANCED PROJECT MANAGEMENT Develop a complete project management module. Each project must support: Project title. Unique project identifier. Description. Organization ID. Project owner. Responsible manager. Assigned employees. Start date. Target deadline. Priority. Project status. Progress percentage. Expected deliverables. Milestones. Task list. Task dependencies. Attachments. Comments. Project activity history. Created timestamp. Updated timestamp. Completion timestamp. Cancellation reason, when applicable. Project statuses: Planned. Not Started. In Progress. At Risk. Blocked. Completed. On Hold. Cancelled. Support project views such as: List view. Kanban board. Calendar view. Timeline view. Project detail view. Milestone view. Provide filtering by status, priority, manager, employee, department, and deadline. Provide sorting by deadline, creation date, priority, and progress. Support project completion only when the required completion criteria are satisfied or an authorized manager explicitly overrides them with an appropriate audit record. 8. ANNUAL PROJECT AND WORKLOAD PLANNING This is a core feature and must be implemented carefully. Managers must be able to plan an employee's workload over an entire year. Example: An employee receives six projects, each with a planned duration of approximately two months. The manager defines the dates, expected deliverables, dependencies, and priorities for each project. The system displays all six projects on a yearly calendar or timeline. Required functionality: Annual project planning. Project start and end dates. Quarterly and monthly views. Project milestones. Task dependencies. Planned workload estimates. Employee availability. Deadline conflict detection. Overlapping project warnings. Workload summaries. Project rescheduling. Historical deadline changes. Notification schedule previews. Annual completion summaries. If multiple projects require substantial work during the same period, warn the manager before they finalize the assignments. Where estimates are available, compare planned effort with employee availability. Do not assume that every project has an equal workload simply because the projects have equal durations. Support weekends, holidays, and approved leave when calculating working-day deadlines. Allow managers to reschedule projects without losing the original deadline history. Record who changed a deadline and why. Do not automatically extend deadlines without authorization. 9. TASK MANAGEMENT SYSTEM Tasks are the operational foundation of the platform. Each task must support: Task title. Task description. Task identifier. Parent project. Assigned employee or employees. Assigning manager. Priority. Start date. Due date. Estimated effort. Actual time spent, if enabled. Current status. Progress percentage. Dependencies. Required deliverables. Attachments. Comments. Reporting frequency. Reporting deadline. Created timestamp. Updated timestamp. Completion timestamp. Task history. Task statuses: Not Started. In Progress. Blocked. Submitted for Review. Changes Requested. Completed. Cancelled. Required functionality: Create tasks. Assign tasks. Edit tasks. Reassign tasks. Change priorities. Update progress. Add comments. Upload permitted attachments. Track dependencies. Filter tasks. Search tasks. Sort tasks. View task history. Mark tasks as blocked. Resolve blockers. Submit tasks for review. Request changes. Complete tasks after appropriate validation. Prevent circular task dependencies. Validate that task dates and project dates are logically consistent. When an employee updates progress, recalculate the relevant project progress using a documented method. For projects with multiple tasks, do not simply average percentages if tasks have different estimated effort or importance. Use a documented weighted calculation where appropriate. Preserve the original task history so that managers can see meaningful changes over time. 10. DAILY EMPLOYEE WORK REPORTING Implement a complete daily reporting system. Employees must be able to submit structured work reports for tasks assigned to them. Required report fields: Report ID. Employee ID. Organization ID. Project ID. Task ID. Reporting date. Work completed. Progress percentage. Current task status. Time spent, if enabled. Blockers. Next steps. Additional comments. Supporting attachments. Submission timestamp. Review status. Reviewer ID, when applicable. Created timestamp. Updated timestamp. Employees should be able to save incomplete reports as drafts. The system must distinguish between: A missing report. A submitted report. A report awaiting review. A report requiring corrections. An approved report. A missing report must not automatically be interpreted as proof that no work was completed. Report review workflow Implement: Draft → Submitted → Under Review → Approved If corrections are requested: Submitted → Under Review → Changes Requested → Resubmitted → Approved Required manager actions: Open a report. Review the content. Review supporting files. Add feedback. Approve the report. Request changes. View report history. Store review decisions and feedback as separate records when appropriate. Prevent unauthorized employees from approving their own reports when the company's approval policy requires independent review. Allow employees to edit reports according to configurable rules. Preserve previous versions when a submitted report is revised. Support a daily report history page with date filters, project filters, and task filters. 11. AUTOMATED REMINDER SYSTEM Implement a reliable automated reminder system. The application must monitor report submission requirements, task deadlines, project deadlines, review requests, and overdue work. Daily reporting reminders Example schedule: Before the reporting deadline: send an optional reminder. Shortly before the deadline: send a reminder if the report is still missing. After the deadline: mark the required report as overdue. On the next working day: send a follow-up if the report remains outstanding. Make these schedules configurable. Do not send daily reminders for tasks that do not require daily reports. Account for: Organization time zone. Employee time zone if supported. Working days. Weekends. Company holidays. Approved leave. Reporting frequency. Reporting deadlines. Previously submitted reports. Reminder preferences. Project deadline reminders Support configurable reminders such as: Fourteen days before a deadline. Seven days before a deadline. Three days before a deadline. One day before a deadline. On the deadline. After the deadline if the work remains incomplete. Avoid duplicate notifications. Do not send reminders after a task has been cancelled or completed unless the notification is an intentional completion confirmation. Notification channels Implement: In-app notifications. Email notifications. Browser notifications where supported and permitted. Web push notifications as an optional enhancement. SMS as an optional future integration. Email reminders should contain the relevant project or task, the deadline, the reason for the reminder, and a secure link to the appropriate page. Use a transactional email provider such as Resend or Amazon SES. Do not expose private report information in notification previews unnecessarily. Notification preferences Allow users to configure permitted notification categories and delivery preferences. Company-required operational reminders should follow organizational policy, while optional notifications should respect user preferences. Reliability requirements Use a scheduled job system and background worker. For a scalable implementation, use Redis and BullMQ or a suitable equivalent. Implement: Scheduled jobs. Retry policies. Failure tracking. Delivery status. Duplicate prevention. Idempotent processing. Notification history. Dead-letter or failed-job handling. Monitoring and structured logging. Do not rely on a browser tab remaining open for scheduled reminders to run. 12. INTELLIGENT PROJECT RISK DETECTION Implement a project-risk monitoring module. The system should analyze relevant information, including: Time remaining. Planned completion. Current progress. Remaining tasks. Estimated effort. Task dependencies. Reported blockers. Historical progress updates. Employee availability. Deadline changes. Start with transparent, configurable business rules. Example: A project is 35% complete, has several blocked tasks, and has only three days remaining. The system flags the project as potentially at risk. Display: Risk level. Reason for the warning. Relevant tasks. Deadline. Current progress. Suggested next actions. Risk levels: Low. Moderate. High. Critical. The initial implementation must use understandable rules rather than pretending to have a trained predictive model. Later, introduce an AI-assisted risk assessment if sufficient reliable data is available. AI predictions must be presented as estimates, not guaranteed outcomes. Provide explanations and allow authorized managers to review and dismiss alerts. Do not automatically penalize employees based on a risk score. 13. AI-POWERED WORK ASSISTANT Implement an AI assistant named WorkSphere AI Assistant. The assistant should be available through a floating widget on authorized application pages. Support both text input and voice input. The assistant must use the authenticated user's permissions when retrieving information. It must never bypass backend authorization or access information simply because a user asks for it. Employee assistant capabilities Support requests such as: Show my tasks for today. Which of my tasks has the nearest deadline? Show my pending reports. Summarize my current projects. Open my daily report form. Read my upcoming deadlines. Explain my manager's feedback. Summarize my approved work reports. Show tasks blocked by dependencies. Explain the steps required to complete a task. Manager assistant capabilities Support requests such as: Show projects approaching their deadlines. Show required reports that have not been submitted. Show reports awaiting approval. Summarize the website redesign project. Show blocked tasks in my team. Identify projects that may be delayed. Summarize this week's team progress. Show employees with overlapping project deadlines. Generate a draft weekly project summary. Explain why a project has been flagged as at risk. Administrator assistant capabilities Support authorized organization-level queries such as: Show active departments. Summarize organization-wide project status. Show pending account invitations. Summarize project completion trends. Show notification delivery statistics. Do not expose sensitive employee information unless the requesting user has explicit permission. AI action safety Read-only actions may be performed after authorization. Actions that modify important records must require confirmation. Examples: Creating a task. Assigning an employee. Changing a deadline. Approving a report. Closing a project. Sending a message to multiple employees. The assistant should explain the proposed action and ask the user to confirm before executing it. Use structured backend tools or narrowly scoped APIs instead of allowing the model to run arbitrary database queries. Treat user-submitted report content and uploaded documents as untrusted data. Do not allow instructions contained inside those documents to override system permissions or AI safety rules. If the assistant cannot find reliable information, it must say so rather than inventing an answer. 14. VOICE ASSISTANT AND SPEECH INTERACTION Implement a voice interface integrated with the AI assistant. Required features: Microphone button. Clear recording state. Permission handling. Speech-to-text. Editable transcript. Text-to-speech responses. Language selection. Voice interaction error handling. Text fallback. Accessible controls. User confirmation before important actions. Voice commands for employees Examples: "Show my tasks for today." "What is my nearest deadline?" "Which reports are pending?" "Open my daily report." "Summarize my current project." "Draft my daily report." Voice commands for managers Examples: "Show overdue projects." "Which reports need my approval?" "Summarize my team's progress this week." "Which tasks are blocked?" "Show projects with deadlines this month." Voice-based report drafting An employee might say: "I completed the navigation menu and fixed two bugs. The API integration is blocked because the endpoint is not ready." The system should convert this into an editable report draft containing: Work completed. Progress update, if provided or reliably derived. Blockers. Next steps, if provided. Never invent progress percentages or completed work that the employee did not state. The employee must review the generated report before submission. Speech technology Use browser speech recognition and speech synthesis where supported. If multilingual speech recognition is insufficient, integrate a suitable speech service. Evaluate support for English, Telugu, and Hindi before choosing the service. Do not promise identical speech-recognition quality for every language or browser. If a microphone is unavailable, provide a complete text-based alternative. 15. MULTILINGUAL INTERFACE Support three interface languages: English. Telugu. Hindi. Add a clearly visible language selector to the application header and settings page. Persist the user's selected language in the database and load it after authentication. Use a proper internationalization library rather than manually replacing interface strings. Translate: Navigation menus. Dashboard headings. Buttons. Form labels. Validation messages. Status labels. Notification templates. Empty states. Error messages. Settings pages. Onboarding instructions. AI assistant interface text. Use Unicode-compatible fonts and ensure Telugu and Hindi text renders correctly. Provide a sensible fallback when a translation is missing. Do not translate project names, employee names, identifiers, or original user-generated reports automatically. Provide optional translation for reports and AI responses where supported. When a report is translated, preserve the original version and clearly label the translated version. The language selector must change the interface without requiring the user to sign out. Use consistent terminology across the application. 16. DASHBOARDS AND ANALYTICS Create a professional dashboard for each role. Employee dashboard Display: Welcome message. Current date. Tasks due today. Overdue tasks. Upcoming deadlines. Active projects. Current task statuses. Reports awaiting review. Reports requiring corrections. Recent manager feedback. Recent notifications. Weekly progress summary. Personal calendar. Quick-action buttons. AI assistant. Manager dashboard Display: Total employees in the manager's scope. Active projects. Tasks completed this week. Tasks in progress. Overdue tasks. Projects approaching deadlines. Projects at risk. Blocked tasks. Missing required reports. Reports awaiting approval. Employee workload overview. Team completion trends. Recent project activity. Notification history. Quick-action buttons. AI assistant. All dashboard metrics must be computed from actual authorized database records. Do not use hardcoded numbers in the functional dashboard. Administrator dashboard Display: Organization overview. Active employees. Active managers. Department statistics. Active projects. Completed projects. Overdue projects. Organization-level reporting statistics. Pending invitations. Notification delivery statistics. Recent administrative activity. Authorized audit-log summaries. System configuration shortcuts. Analytics Provide appropriate charts and summaries for: Task completion trends. Project completion trends. Report submission rates. Overdue task trends. Review turnaround times. Workload distribution. Blocker resolution times. Project deadline performance. Include date filters, department filters, project filters, and authorized employee filters. Provide useful empty states when there is insufficient data. Do not display fabricated analytics. 17. REPORT EXPORTS AND BUSINESS SUMMARIES Implement export functionality for authorized users. Support: Daily activity summaries. Weekly project reports. Monthly project reports. Quarterly summaries. Annual project completion reports. Employee task summaries. Manager review summaries. Overdue task reports. Project milestone reports. Support CSV export. Support PDF export as an additional feature. Use the correct organization, date range, and permission scope for each export. Validate filters before generating reports. Do not allow users to export information belonging to unauthorized departments or organizations. AI-generated summaries must be clearly distinguished from original records. Provide links to the source records where appropriate. 18. COLLABORATION AND COMMUNICATION Implement task and project collaboration features. Required features: Task comments. Project discussions. Mentions where supported. Comment timestamps. Author identification. Attachment support. Report feedback. Activity history. Notification on relevant mentions. Notification on manager feedback. Notification on task reassignment. Notification on project changes. Do not expose private personal contact information unnecessarily. Provide a clear history of important project events. For attachments, use private object storage rather than making all uploaded files publicly accessible. Validate file type, size, permissions, and download authorization. 19. CALENDAR AND SCHEDULING Implement a calendar module. Provide: Daily view. Weekly view. Monthly view. Annual view. Display: Task deadlines. Project milestones. Project start and end dates. Reporting deadlines. Scheduled meetings if supported. Approved leave where authorized. Allow users to open the associated project or task from a calendar entry. Use the correct organization time zone when calculating deadlines and scheduling notifications. Handle daylight-saving changes for supported time zones. Support filtering by project, status, and event category. Do not expose confidential events to unauthorized users. 20. OPTIONAL LEAVE MANAGEMENT Implement a basic leave module if it fits the development schedule. Features: Submit leave requests. Select leave dates. Add a reason where required by company policy. View leave history. Approve or reject requests according to permission rules. Notify the employee of the decision. Exclude approved leave from relevant reporting reminders. Account for leave in workload planning. Only collect information necessary for the company's leave policy. Leave approval should be handled separately from task-report approval. 21. SEARCH AND FILTERING Implement a global search experience for authorized records. Search across: Projects. Tasks. Employees. Departments. Daily reports. Comments, where authorized. Support: Keyword search. Status filters. Priority filters. Date ranges. Department filters. Project filters. Employee filters. Sorting. Pagination. Apply permission checks before returning search results. Avoid exposing unauthorized record titles or metadata through search suggestions. 22. AUDIT LOGS AND ACTIVITY HISTORY Implement audit logs for important changes. Track events such as: Project created. Project updated. Task assigned. Task reassigned. Deadline changed. Task status changed. Report submitted. Report revised. Report approved. Report returned for corrections. Role changed. Account activated or deactivated. Permission changed. Project cancelled. Project completed. Each relevant event should contain: Event identifier. Actor ID. Organization ID. Event type. Resource type. Resource ID. Timestamp. Relevant change metadata. Do not store passwords, access tokens, or unnecessary sensitive information in audit logs. Protect audit records from unauthorized modification. Maintain an appropriate retention policy. 23. COMPLETE DATABASE DESIGN Use PostgreSQL with Prisma ORM. Design a normalized, relational database with foreign keys, appropriate indexes, constraints, and migrations. At minimum, evaluate the need for these tables: Organizations. Users. Departments. Teams. TeamMembers. Invitations. Projects. ProjectMembers. ProjectMilestones. Tasks. TaskAssignments. TaskDependencies. TaskStatusHistory. DailyReports. ReportAttachments. ReportRevisions. ReportReviews. Comments. Notifications. NotificationJobs. NotificationDeliveries. UserPreferences. LeaveRequests. AuditLogs. LoginEvents. AIInteractions, if required by the privacy design. OrganizationSettings. ReportingPolicies. Holidays. ApprovedWorkingSchedules, if needed. You may adjust the schema to avoid unnecessary duplication, but document the final design. Required database practices: Use stable primary keys. Add foreign keys. Use unique constraints where necessary. Add indexes for frequently queried columns. Use transactions for related updates. Enforce data integrity. Handle concurrent updates. Preserve historical records where appropriate. Use migrations rather than manually modifying production schemas. Use appropriate deletion and archival strategies. Prevent cross-organization data access. Use pagination for large result sets. Use appropriate decimal or integer representations for percentages and effort values. Validate date ranges. Prevent duplicate task assignments where duplicates are not permitted. Use a documented method for project progress calculations. Use database transactions for important multi-record operations, such as report approval and related audit-log creation. 24. BACKEND ARCHITECTURE Use Node.js, Express, TypeScript, PostgreSQL, and Prisma. Create a modular backend architecture. Suggested modules: Authentication. Organizations. Users. Departments. Teams. Projects. Tasks. Task assignments. Daily reports. Report reviews. Notifications. Calendar. Analytics. Search. AI assistant. Voice assistant integration. Localization. File management. Leave management. Audit logs. Health checks. Separate: Routes. Controllers. Business services. Data-access logic. Validation schemas. Authorization middleware. Error handling. Background jobs. Shared utilities. Use a consistent API response format. Validate incoming request bodies, query parameters, and path parameters. Return appropriate HTTP status codes. Do not expose stack traces, secrets, database errors, or internal implementation details to clients. Implement: Authentication middleware. Organization-scope middleware. Role-based authorization. Resource-level permission checks. Input validation. Rate limiting. Secure CORS configuration. Structured logging. Centralized error handling. Request correlation IDs where useful. Never trust role IDs, organization IDs, or employee IDs supplied by the frontend without checking the authenticated user's authorization. 25. FRONTEND ARCHITECTURE Use React and TypeScript. Use a maintainable component structure. Suggested structure: Application shell. Public pages. Authentication pages. Employee pages. Manager pages. Administrator pages. Shared components. Form components. Dashboard components. Project components. Task components. Report components. Notification components. Calendar components. Analytics components. AI assistant components. Localization utilities. API client. Authentication integration. Route guards. Error boundaries. Shared types. Form validation. Recommended frontend tools: React. TypeScript. Vite. React Router. Tailwind CSS. shadcn/ui. TanStack Query. React Hook Form. Zod. Recharts. A suitable internationalization library. A suitable date-handling library. Use the latest mutually compatible stable versions when starting the project. Do not install incompatible or unnecessary packages. Implement loading indicators, error states, empty states, retry actions, and form validation. Ensure the frontend does not display success messages until the backend operation has succeeded. Use optimistic updates only when they can be safely reconciled with server responses. 26. USER INTERFACE AND DESIGN SYSTEM Create a premium, modern enterprise SaaS interface. The website must look professional and polished rather than like a basic student CRUD project. Design principles: Clean layouts. Strong visual hierarchy. Consistent spacing. Clear typography. Reusable components. Responsive dashboards. Accessible contrast. Consistent button styles. Clear form validation. Subtle animations. Useful empty states. Readable tables. Professional charts. Consistent icons. Keyboard accessibility. Use a consistent design system. Suggested visual direction: Dark navy or charcoal for navigation. Light neutral backgrounds for dashboards. Blue or teal for primary actions. Green for successful completion. Amber for warnings. Red for overdue and critical conditions. Clear neutral colors for inactive states. Use colors consistently and never rely on color alone to communicate status. Required UI components Sidebar. Top navigation bar. Organization switcher if multiple organizations are supported. Search bar. Language selector. Notification center. User profile menu. Summary cards. Data tables. Filters. Pagination. Project cards. Task cards. Kanban board. Progress indicators. Calendar. Timeline. Charts. Modal dialogs. Confirmation dialogs. Forms. File upload controls. Toast notifications. AI assistant widget. Voice input controls. Empty states. Loading skeletons. Error messages. Support desktop, tablet, and mobile layouts. On mobile, provide a usable navigation pattern and prevent wide tables from breaking the layout. Respect reduced-motion preferences. Provide accessible labels for buttons and form controls. 27. SECURITY AND PRIVACY REQUIREMENTS Security is mandatory. Implement: Secure authentication. Server-side role-based access control. Resource-level authorization. Organization-level data isolation. Input validation. Output encoding. Protection against SQL injection through safe ORM usage and careful raw-query handling. Rate limiting. Secure file uploads. Private attachment storage. HTTPS in production. Secure secret management. Appropriate CORS configuration. Safe session handling. Error sanitization. Audit logging. Database backups. Data retention policies. Account deactivation. Authorization tests. Never place API secrets in frontend code. Never commit .env files containing real secrets to GitHub. Provide .env.example with placeholder values. Do not store plaintext passwords. Do not log sensitive tokens. Do not allow employees to read another organization's data by changing a URL, ID, or request payload. Test authorization failures explicitly. Treat uploaded files, comments, reports, and AI inputs as untrusted content. Do not use hidden frontend elements as the only form of access control. 28. AI PRIVACY AND RESPONSIBLE ANALYTICS Use AI to support employees and managers rather than replacing responsible human judgment. Requirements: Do not expose confidential records through AI responses. Apply permissions before retrieving AI context. Minimize sensitive information sent to external AI services. Avoid retaining full prompts unnecessarily. Define retention rules for AI interaction logs. Never treat AI-generated summaries as original source records. Identify AI-generated content where appropriate. Allow users to review AI-generated reports. Require confirmation for important modifications. Provide explanations for risk alerts. Avoid automated punitive employee scoring. Do not equate keyboard activity or login duration with productivity. Make predictions clearly distinguishable from verified facts. The AI assistant must only call approved, narrowly scoped application tools. Do not give the language model unrestricted database access. 29. ERROR HANDLING AND RELIABILITY Implement robust error handling across the application. Handle: Authentication failures. Unauthorized access. Missing records. Invalid form data. Database connection failures. Duplicate submissions. Network failures. Email delivery failures. AI service outages. Speech recognition failures. File upload failures. Invalid date ranges. Concurrent edits. Background job failures. Expired sessions. Provide useful user-facing messages. Log technical details securely on the server. Do not expose internal stack traces to end users. Implement retry options where appropriate. Use idempotency or equivalent safeguards for operations that may be repeated. The application should remain usable when optional services, such as the AI provider, are temporarily unavailable. Core task management and reporting must not depend on the AI assistant being online. 30. TESTING REQUIREMENTS Write automated tests for critical business logic. Include: Authentication tests Valid sign-in. Invalid authentication. Protected route access. Deactivated account handling. Session and organization membership checks. Authorization tests Employee cannot access manager-only endpoints. Manager cannot access unauthorized projects. User cannot access another organization's records. Employee cannot approve their own report where prohibited. User cannot modify another employee's report without permission. Project tests Create project. Update project. Assign project members. Validate dates. Complete or cancel projects. Enforce organization scope. Task tests Create task. Assign task. Update progress. Change status. Reject circular dependencies. Validate task dates. Prevent unauthorized modification. Reporting tests Create draft. Submit report. Review report. Request corrections. Resubmit report. Approve report. Preserve report history. Notification tests Generate due-date reminders. Avoid duplicate reminders. Skip completed or cancelled tasks. Respect reporting frequency. Respect working-day rules. Retry failed email delivery. Record delivery outcomes. AI tests Retrieve only authorized records. Refuse unauthorized data requests. Generate draft reports without inventing facts. Require confirmation for important changes. Handle AI provider failures. Localization tests Switch between English, Telugu, and Hindi. Preserve selected language after login. Render Unicode text correctly. Display fallback translations when necessary. Frontend tests Forms. Navigation. Role-based views. Error states. Loading states. Dashboard filters. Report submission. Responsive layouts. Also conduct end-to-end testing of the principal workflows. Use realistic sample data for development and testing, not real employee information. 31. REQUIRED END-TO-END WORKFLOWS The following workflows must function from beginning to end. Workflow A: Company onboarding Organization is created. Administrator account is provisioned securely. Administrator signs in. Administrator creates departments. Administrator invites a manager. Manager accepts the invitation. Manager receives the correct permissions. Workflow B: Project assignment Manager creates a project. Manager sets start and end dates. Manager creates tasks. Manager assigns tasks to employees. Employees see their assignments. Assignment notifications are created. Project and task information is stored in the database. Workflow C: Daily reporting Employee opens an assigned task. Employee updates task progress. Employee enters work completed. Employee identifies blockers. Employee saves a draft. Employee submits the report. The manager receives a notification. The manager reviews the report. The manager approves it or requests changes. The employee sees the result. The system records the review history. Workflow D: Deadline reminders A project or task has a deadline. A scheduled background process checks its status. The system identifies an approaching deadline. The system creates an appropriate notification. An email is sent when configured. Delivery status is recorded. Duplicate reminders are prevented. Completed or cancelled tasks stop receiving ordinary overdue reminders. Workflow E: AI assistant User opens the assistant. User enters a text or voice request. The request is interpreted. The backend authenticates the user. The backend checks resource permissions. Authorized information is retrieved. The AI generates a response. The interface displays the result. Important changes require confirmation. The system records only the necessary interaction metadata. Workflow F: Multilingual interface User signs in. The saved language is loaded. User switches to Telugu. Interface labels update. User navigates between pages. Telugu remains selected. User switches to Hindi. Hindi labels render correctly. User signs out and signs in again. The preferred language is restored. Workflow G: Annual planning Manager opens annual planning. Manager selects an employee or team. Manager creates multiple projects. Manager defines milestones and deadlines. The system identifies overlapping assignments. The manager reviews workload warnings. The manager confirms the plan. The yearly timeline displays all assignments. Deadline reminders are scheduled. Rescheduling records are preserved. 32. DEPLOYMENT AND CONFIGURATION Prepare the application for deployment. Recommended architecture: Frontend: Vercel or an equivalent static/frontend hosting platform. Backend: a suitable Node.js hosting service. Database: managed PostgreSQL. Background jobs: dedicated worker process. Queue: Redis when using BullMQ. File storage: private object storage. Authentication: Clerk. Email: a transactional email provider. AI: a securely configured language-model API. Use environment variables for configuration. Prepare: .env.example. Database migration scripts. Database seed scripts. Development instructions. Production configuration. Health-check endpoint. Error logging. Deployment instructions. Backup and recovery guidance. Do not assume that environment variables from the development environment are automatically available in production. Configure frontend and backend URLs separately. Configure authentication allowed origins and redirect URLs correctly. Use production HTTPS URLs. Verify that authentication scripts load successfully and that the backend can validate the selected authentication provider's sessions. Do not expose secret API keys in frontend environment variables. Document all third-party service setup requirements. The application must have a clear development mode that works with placeholder credentials for services that cannot be configured automatically, without pretending that external integrations are functional. 33. GITHUB AND PROJECT STRUCTURE Organize the repository cleanly. A monorepo structure is acceptable: work-sphere-ai/ apps/ web/ api/ worker/ packages/ shared/ validation/ config/ prisma/ schema.prisma migrations/ seed.ts docs/ architecture.md database-design.md api-documentation.md setup-guide.md security.md tests/ .env.example .gitignore README.md package.json Adjust this structure to suit the chosen implementation, but keep frontend, backend, background jobs, shared types, and documentation organized. Use TypeScript consistently where practical. Include: Clear README. Installation instructions. Required software versions. Environment setup instructions. Database migration instructions. Database seeding instructions. Development commands. Testing commands. Build commands. Deployment instructions. Feature list. Architecture explanation. Screenshots after the UI is implemented. Do not commit secrets, real employee data, production databases, or private uploaded documents. Use Git commits with meaningful messages. 34. DEMONSTRATION DATA Create a development-only seed script. Seed data should include: One sample organization. Several departments. One administrator. Two managers. Several employees. Multiple projects. Tasks with different priorities. Tasks with different statuses. Example daily reports. Example manager feedback. Upcoming deadlines. Overdue tasks. Example notifications. Project milestones. Example blockers. Use fictional names and example data. Never hardcode dashboard statistics. The seed data must be stored in the database and all metrics must be calculated from actual records. Do not create a production backdoor or hardcoded universal password. Document the safe process for provisioning the initial administrator account. 35. PERFORMANCE AND SCALABILITY Design the application so it can grow beyond a small demonstration. Requirements: Database indexes. Pagination. Efficient database queries. Avoid unnecessary repeated queries. Avoid loading all records into the browser. Background processing for notifications. Appropriate caching. Rate limiting. Efficient dashboard aggregation. Lazy loading for large modules where useful. Safe concurrent updates. Efficient file delivery. Appropriate logging. Monitoring hooks. Do not introduce complex infrastructure without a clear need. Start with a maintainable architecture and scale components when justified. 36. ACCESSIBILITY AND RESPONSIVENESS The application must work on: Desktop computers. Laptops. Tablets. Mobile browsers. Requirements: Responsive layouts. Keyboard navigation. Accessible form labels. Visible focus indicators. Appropriate contrast. Screen-reader-friendly controls. Accessible dialog behavior. Error messages associated with form fields. Reduced-motion support. Usable touch targets. Correct rendering of English, Telugu, and Hindi text. Ensure the voice assistant has a text alternative. Ensure users can operate the main application without voice input. 37. REQUIRED DEVELOPMENT ORDER Build the application in the following order. Do not skip foundational steps. Phase 1: Architecture and setup Inspect the development environment. Establish the repository structure. Configure the frontend. Configure the backend. Configure TypeScript. Configure PostgreSQL. Configure Prisma. Define the database schema. Create initial migrations. Configure environment variables. Prepare seed data. Document the setup. Phase 2: Authentication and authorization Integrate authentication. Create application user records. Implement organization membership. Implement administrator, manager, and employee permissions. Protect frontend routes. Protect backend endpoints. Test cross-organization isolation. Phase 3: Organization management Build administrator dashboard. Implement departments. Implement teams. Implement employee invitations. Implement employee directory. Implement account management. Phase 4: Project management Implement project creation. Implement project editing. Implement project assignments. Implement milestones. Implement task dependencies. Implement project detail pages. Implement project list and Kanban views. Phase 5: Task management Implement task creation. Implement task assignment. Implement progress updates. Implement task status history. Implement comments. Implement attachment support. Implement task filtering and search. Phase 6: Daily reports Implement report drafts. Implement report submission. Implement report history. Implement manager review. Implement approval and correction workflows. Implement revision history. Implement report notifications. Phase 7: Reminders and scheduling Implement scheduled jobs. Implement report reminders. Implement deadline reminders. Implement overdue processing. Implement email delivery. Implement retries and duplicate prevention. Test time-zone and working-day behavior. Phase 8: Dashboards and analytics Implement employee dashboard. Implement manager dashboard. Implement administrator dashboard. Implement charts. Implement date filters. Implement workload summaries. Implement project risk alerts. Implement CSV and PDF exports. Phase 9: Multilingual support Implement English translations. Implement Telugu translations. Implement Hindi translations. Implement language selection. Persist language preferences. Translate notification templates. Test language switching. Phase 10: AI assistant Integrate the AI provider. Implement authorized data retrieval. Implement employee queries. Implement manager queries. Implement report drafting. Implement project summaries. Implement safe action confirmation. Implement graceful failure handling. Phase 11: Voice interface Implement microphone controls. Implement speech recognition. Implement speech synthesis. Support the selected languages where possible. Implement editable transcripts. Implement voice-based report drafts. Test unsupported-browser behavior. Phase 12: Advanced modules Annual planning. Workload conflict detection. Calendar improvements. Leave management. Advanced search. Audit-log viewer. Additional collaboration features. Phase 13: Testing and security Run automated tests. Run authorization tests. Test core end-to-end workflows. Test responsive layouts. Test language rendering. Test email delivery. Test background jobs. Test failure scenarios. Fix identified defects. Phase 14: Deployment Build frontend. Build backend. Run production migrations safely. Configure production environment variables. Deploy the application. Verify authentication. Verify database connectivity. Verify notifications. Verify critical workflows. Complete documentation. 38. IMPORTANT IMPLEMENTATION RULES Follow these rules throughout development. Do not build only a frontend prototype. Do not leave essential buttons nonfunctional. Do not use fake dashboard statistics in the finished application. Do not create disconnected pages with no backend integration. Do not bypass authentication to make development easier. Do not trust frontend role checks. Do not allow unauthorized cross-organization access. Do not hardcode production credentials. Do not commit secrets. Do not fabricate AI results. Do not let AI modify important records without required confirmation. Do not invent work reports or progress percentages. Do not send duplicate notifications. Do not ignore time zones or working days. Do not delete important report history when revisions occur. Do not automatically penalize employees using unverified productivity metrics. Do not make core task management depend on external AI availability. Do not claim successful deployment without verification. Do not leave known critical errors unresolved. Do not overwrite existing working project files without first inspecting them. Do not replace an existing package configuration without checking compatibility. Do not invent environment variables or claim external services are connected when they are not. Do not create migrations that silently destroy existing data. Do not stop after implementing only the login page or dashboard. Do not implement all features superficially at the expense of the core workflow. When working in an existing repository, inspect its structure, identify the current framework and dependencies, preserve useful existing code, and make changes incrementally. When a service requires credentials or user authorization, explain exactly what must be configured and continue with other work that can be completed safely. If a feature is not feasible in the current environment, document the limitation and provide a clearly identified implementation path. 39. FINAL ACCEPTANCE CRITERIA The project is considered ready for its initial release only when all required core criteria pass. Authentication Users can authenticate. Application profiles are created or synchronized correctly. Role permissions are enforced by the backend. Unauthorized access is rejected. Project management Managers can create projects. Managers can create and assign tasks. Employees can view authorized assignments. Project deadlines and milestones are persisted. Project status updates work. Daily reporting Employees can save drafts. Employees can submit reports. Managers can review reports. Managers can approve reports or request changes. Report history is preserved. Notifications Required reminders are generated. Configured emails are sent. Delivery outcomes are recorded. Duplicate reminders are prevented. Completed tasks do not receive inappropriate overdue reminders. Dashboards Each role receives the correct dashboard. Statistics are derived from database records. Filters work. Empty and error states work. Security Cross-organization data access is blocked. Employees cannot perform manager-only actions. File access is authorized. Secrets are not exposed. Important actions are audited. Multilingual interface English works. Telugu works. Hindi works. Language selection persists. Interface text renders correctly. AI and voice AI requests use authorized data. Report drafts are editable. Important actions require confirmation. AI failures do not break core functionality. Voice features work where supported. Text alternatives remain available. Quality The application builds successfully. Critical tests pass. No known critical authorization defects remain. Setup instructions work. Database migrations are documented. The README explains the project. Deployment requirements are documented. 40. REQUIRED FINAL DELIVERABLES At completion, provide: Complete source code. Functional frontend. Functional backend. PostgreSQL database schema. Prisma migrations. Database seed script. Authentication integration. Role-based authorization. Project and task management. Daily work reporting. Manager approval workflows. Automated reminder system. Email notification integration. Employee, manager, and administrator dashboards. Analytics and report exports. English, Telugu, and Hindi interface. AI assistant integration. Voice assistant integration where supported. Annual project planning. Deadline and workload risk detection. Audit logging. Automated tests. Environment variable template. GitHub-ready repository. Detailed README. Installation instructions. Local development instructions. Database setup instructions. Third-party service setup instructions. Deployment instructions. Known limitations. List of features implemented and tested. List of remaining optional features, if any. Do not falsely label unfinished functionality as complete. Clearly separate fully implemented features, partially implemented features, and future enhancements. 41. BEGIN IMPLEMENTATION NOW Start by inspecting the available development environment and determining whether this is a new project or an existing repository. If it is a new project: Establish the architecture. Create the repository structure. Configure the development environment. Set up PostgreSQL and Prisma. Design the database. Implement authentication and authorization. Build the core project, task, and reporting workflows. Continue through the remaining development phases. If it is an existing project: Inspect the current files. Identify the working features. Identify existing errors. Preserve working functionality. Create an implementation checklist. Complete missing functionality incrementally. Test the application after each significant change. Work independently wherever the environment permits. Do not ask me to approve every minor implementation decision. Use sensible engineering defaults and document important assumptions. Ask me only when an essential decision cannot be resolved safely without my input, such as a required external account authorization or an irreversible operation. If the project is too large to complete in a single execution, divide it into clear milestones, persist progress in the repository, and continue from the last verified milestone instead of restarting or replacing working code. Prioritize a fully functional, secure core application before optional enhancements. The ultimate objective is to deliver a professional, maintainable, responsive, intelligent, multilingual employee and project management platform named WorkSphere AI.