hr_lite 0.60.0 → 0.62.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 051c3d4efb869bb1c40f819e884e245c5d45462c2664a62464c84ec2686b750e
-  data.tar.gz: 263dbc61a8861a69b06b0b6597542e496feac6fd3bb6eb78cadd04a947681f41
+  metadata.gz: 7f779cdbd416cb664617888bbb71b2c6866742b52e3ad5525ac2c5819a9b9908
+  data.tar.gz: 346563b5b820eabc5aec4d83076cb1a3dd37f6309c159ad15c7a3f70698032a3
 SHA512:
-  metadata.gz: c4b151e5a71926157f4976df9ad3fd55f3b60468c6f0d10f7877d2fc9c2363e1ebe7d5d9a86961660848744a840e9b96f597cc1207d86168f20dd7410096ba60
-  data.tar.gz: c457f267dc96c0b89278bf870f431174204cb258879cb68e90b152ef37d224354068732b2b118678e6b1329cf24351c5a26dca8672e120549d83c3b906e622a1
+  metadata.gz: 682e1b50a140c01d357a77666d721629e713dc8c1f97465ea8943c92b8d0cee5a5e47933c98f9451d5e80019bdc548879a27f1c72002279a19ab051500873ce6
+  data.tar.gz: 57fa8aa33593a9f4ac0d88abf82dcc47dd32f666872924038ffb1de4754cb981312fec76e23fcd9706bc31b2aa75a3dc40a42bd25b8d4c947d26705b2f356f2c

data/CHANGELOG.md

@@ -7,6 +7,25 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.62.0] - 2026-10-22
+
+Hiring replies per round, an AI draft button and the sender's signature. Two migrations: a new `hr_lite_hiring_replies` table, and `allow_sunday` on campaigns.
+
+- **Reply links per round.** `@round1_link`, `@round2_link` and `@round3_link` each open the candidate's own `/apply/:token` page for that round, with no login, one reply per link. Every round asks for one of the next ten interview days and one 2-hour slot (10–12, 12–2, 2–4, 4–6, 6–8; at most 4 candidates per slot per day), plus an optional alternate phone. Round 1 also asks for interest, joining time and four yes/no questions. Round 2 asks for a CV and photo ID. Round 3 collects the joining details: marksheets, an Aadhaar number and card, and a PAN number and card. A candidate without a PAN can tick "I don't have a PAN yet", and HR sees "PAN pending". Salary slips for the last 3 months are optional; a fresher ticks "I have no salary slips". A consent box is required. Documents must be PDF, JPG or PNG, checked from the file's bytes, at most 5 MB each. They are encrypted before they reach storage, so a leaked blob is unreadable, and HR downloads them only through an audit-logged route that decrypts them. Aadhaar and PAN numbers are encrypted. HR sees them masked (XXXX XXXX 1234, XXXXX1234X), and "Show full" is an audit-logged POST that shows the number once. Sunday is off unless the campaign ticks "Allow Sunday interviews". A reply moves round 1 candidates to interested or not interested, goes on the timeline, notifies the HR sender, and prefills "Schedule round N". The campaign page shows linked count tiles: invited, replied, interested, and booked for rounds 1, 2 and 3.
+- **Write with AI** on the template form, when the host adds `config.hiring.draft_email(text:, placeholders:)`. It rewrites what HR typed into a template name (if empty), subject and message that use only known @fields, and saves nothing. Output with an unknown field is refused. It is limited to 20 drafts an hour per person and is audit-logged. It posts the same form with `ai=1`, because `formaction` would break per-form CSRF tokens.
+- **Signature preview.** The template preview shows `config.hiring.signature` (sanitized) when the host provides it.
+- **Select all ticks the rows.** "All N in this filter" now ticks and unticks every row, through `select_all.js`.
+
+## [0.61.0] - 2026-10-21
+
+Hiring panel. Six migrations: five new tables and one that grants `hiring.manage` to HR, Leadership and Super Admin and seeds the first outreach email.
+
+- **Campaigns.** One per opening. Position, programme, stipend, CTC, location and schedule live on the campaign and fill the email's @placeholders.
+- **Sheet import with a preview.** Headers are matched through an alias list after case-folding and dropping punctuation, so each university's spelling works. Unknown columns are kept as extra data and usable as @placeholders. Two columns claiming one field wait for HR to pick one. Every skipped row says why, a repeat upload updates instead of duplicating, and nothing is saved before confirm. Phone and date of birth are encrypted. `config.read_sheet` reads the file (default: .csv only).
+- **Bulk email from one mailbox.** A confirm page names everyone left out (already sent, or a placeholder empty or unknown). One spaced job per recipient goes through `config.hiring.send_email`, and a unique index plus a claimed row stop double sends. An answer that never came is marked for a person to check, never resent. Sends are limited to ten an hour per person.
+- **Pipeline and timeline.** The stages are imported, invited, interested, not interested, interview (round N), selected, rejected and on hold. Moves the pipeline does not allow are refused, a rejection needs a listed reason, and every change goes on the candidate's timeline with who made it.
+- **Interview invites.** Rounds go on the hiring mailbox's Google Calendar through `config.hiring`, with reschedule and cancel. Each round is its own row.
+
 ## [0.60.0] - 2026-10-21
 
 Background failures reach a person. No migrations.

data/README.md

@@ -376,6 +376,24 @@ permission reaches (`leave.view`, `payroll.view`, `expense.approve`,
 Leadership picks Employee of the Month, Quarter and Year at `/admin/awards`,
 and Home shows the current winners to everyone.
 
+## Hiring
+
+Admin › Hiring (`hiring.manage`): campaigns, candidate sheet import, bulk email, interview rounds and decisions. The engine never talks to Google itself. Set `config.hiring` to an object with:
+
+```ruby
+sender                      # => { email:, name:, ready:, connect_url: }
+send_email(to:, subject:, body:)               # => { message_id:, thread_id: } (plain text)
+create_event(summary:, description:, attendee:, starts_at:, ends_at:) # => { event_id:, meet_link: }
+update_event(event_id:, starts_at:, ends_at:)
+cancel_event(event_id:)
+draft_email(text:, placeholders:)              # optional => { subject:, body: } for "Write with AI"
+signature                                      # optional => the sender's HTML signature, for the preview
+```
+
+`@round1_link`, `@round2_link` and `@round3_link` point each candidate at their own `/apply/:token` page for that round, on `public_url_base`. The page needs no login. Round 1 asks for interest, joining time and four yes/no questions. Every round asks for a day, one 2-hour slot and an optional alternate phone. Rounds 2 and 3 ask for documents. Sunday is offered only when the campaign allows it.
+
+Raise `HrLite::HiringDeliveryFailed` when nothing was sent and `HrLite::HiringDeliveryUnknown` when the provider may have acted (timeouts, 5xx). Never put the recipient in the error text: it is stored. `config.read_sheet = ->(path, filename) { rows }` reads uploads (default: .csv).
+
 ## Recurring jobs
 
 Schedule these on the host's job scheduler (cron, GoodJob, Sidekiq-cron,

data/app/assets/javascripts/hr_lite/select_all.js

@@ -0,0 +1,21 @@
+// "Select all" for a list of checkboxes in one form.
+// Markup contract: <input type="checkbox" data-hrl-select-all="candidate_ids[]">.
+// Ticking it ticks every box of that name in the same form; unticking any row
+// unticks it again. The server still reads the box itself, so it works without JS.
+(function () {
+  "use strict";
+
+  document.addEventListener("change", function (event) {
+    var box = event.target;
+    var form = box.form;
+    if (!form) return;
+    var all = form.querySelector("[data-hrl-select-all]");
+    if (!all) return;
+    var rows = form.querySelectorAll('input[name="' + all.getAttribute("data-hrl-select-all") + '"]');
+    if (box === all) {
+      rows.forEach(function (row) { row.checked = all.checked; });
+    } else if (box.name === all.getAttribute("data-hrl-select-all") && !box.checked) {
+      all.checked = false;
+    }
+  });
+})();

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -653,3 +653,29 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-search__close { display: flex; justify-content: flex-end; margin: 0 0 var(--hrl-s-2); }
 .hrl-search::backdrop { background: rgb(15 23 42 / .4); }
 .hrl-search__list { list-style: none; margin: var(--hrl-s-1) 0 0; padding: 0; display: grid; gap: var(--hrl-s-2); }
+/* Hiring email preview: plain text, so its line breaks are the email's. */
+.hrl-hiring-preview { white-space: pre-line; overflow-wrap: anywhere; padding: var(--hrl-s-4); border: 1px solid var(--hrl-line); border-radius: var(--hrl-radius-sm); background: var(--hrl-bg); }
+/* Hiring candidate: actions first on a phone, a right-hand column on desktop. */
+@media (min-width: 1024px) {
+  .hrl-grid--side { grid-template-columns: 2fr 1fr; align-items: start; }
+  .hrl-grid--side > .hrl-grid__aside { grid-column: 2; grid-row: 1 / span 9; }
+}
+.hrl-card--next { background: var(--hrl-info-bg); border-color: transparent; }
+.hrl-hiring-decide > .button_to { flex: 1 1 8rem; }
+.hrl-hiring-decide > .button_to .hrl-btn { width: 100%; }
+.hrl-hiring-person { display: flex; align-items: center; gap: var(--hrl-s-3); width: 100%; }
+.hrl-hiring-avatar { flex: none; width: 52px; height: 52px; border-radius: var(--hrl-radius-pill); background: var(--hrl-info-bg); color: var(--hrl-accent); display: grid; place-items: center; font: 700 var(--hrl-t-lead) var(--hrl-font-head); }
+/* Pipeline stepper: a number until reached, a tick once passed. */
+.hrl-steps { list-style: none; margin: 0; padding: 0; display: grid; grid-template-columns: repeat(5, minmax(0, 1fr)); gap: var(--hrl-s-1); text-align: center; }
+.hrl-steps li { display: grid; justify-items: center; gap: var(--hrl-s-1); font-size: var(--hrl-t-micro); color: var(--hrl-ink-2); }
+.hrl-steps__dot { width: 28px; height: 28px; border-radius: var(--hrl-radius-pill); display: grid; place-items: center; font-weight: 700; border: 1px solid var(--hrl-line); background: var(--hrl-card); color: var(--hrl-muted); }
+.hrl-steps .is-done .hrl-steps__dot { background: var(--hrl-ok); border-color: var(--hrl-ok); color: var(--hrl-accent-ink); }
+.hrl-steps .is-now .hrl-steps__dot { background: var(--hrl-accent); border-color: var(--hrl-accent); color: var(--hrl-accent-ink); }
+.hrl-steps .is-now { font-weight: 700; color: var(--hrl-accent); }
+.hrl-mail__head { display: grid; gap: var(--hrl-s-2); padding-bottom: var(--hrl-s-3); margin-bottom: var(--hrl-s-3); border-bottom: 1px solid var(--hrl-line); overflow-wrap: anywhere; }
+/* The candidate reply page: no staff shell, one readable column. */
+.hrl-public { max-width: 40rem; margin: 0 auto; padding: var(--hrl-s-6) var(--hrl-gutter) calc(var(--hrl-s-10) + env(safe-area-inset-bottom)); }
+.hrl-hiring-signature { margin-top: var(--hrl-s-3); padding-top: var(--hrl-s-3); border-top: 1px dashed var(--hrl-line); font-size: var(--hrl-t-small); overflow-wrap: anywhere; }
+.hrl-public__logo { display: block; height: 40px; width: auto; margin-bottom: var(--hrl-s-4); }
+.hrl-kpi--link { display: block; min-height: var(--hrl-target); color: inherit; text-decoration: none; }
+.hrl-kpi--link:hover { border-color: var(--hrl-accent); }

data/app/controllers/hr_lite/admin/hiring_campaigns_controller.rb

@@ -0,0 +1,96 @@
+module HrLite
+  module Admin
+    # Hiring drives: the list, one campaign's pipeline, and its sheet import.
+    class HiringCampaignsController < ApplicationController
+      FIELDS = %i[title position programme stipend ctc location schedule status allow_sunday].freeze
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action :set_campaign, except: %i[index new create]
+
+      def index
+        @campaigns = paginate(HiringCampaign.newest_first)
+        @counts = HiringCandidate.where(campaign_id: @campaigns.map(&:id)).group(:campaign_id, :stage).count
+      end
+
+      def show
+        @stage = params[:stage].presence_in(HiringCandidate::STAGES)
+        @campus = params[:campus].presence
+        @replied = params[:replied].presence
+        @round = params[:round].to_i.presence_in([ 1, 2, 3 ])
+        @stage_counts = @campaign.candidates.group(:stage).count
+        replies = HiringReply.responded.where(candidate_id: @campaign.candidates.select(:id))
+        # Each tile's count is exactly what its link lists.
+        @kpis = { "Awaiting reply" => [ @stage_counts["invited"].to_i, { stage: "invited" } ],
+                  "Replied" => [ replies.distinct.count(:candidate_id), { replied: 1 } ],
+                  "Interested" => [ @stage_counts["interested"].to_i, { stage: "interested" } ] }
+        (1..3).each { |r| @kpis["Booked round #{r}"] = [ replies.where(round: r).where.not(preferred_slot: nil).count, { round: r } ] }
+        @campuses = @campaign.candidates.where.not(campus: [ nil, "" ]).distinct.order(:campus).pluck(:campus)
+        @candidates = paginate(@campaign.pipeline(stage: @stage, campus: @campus, replied: @replied, round: @round))
+        @templates = HiringTemplate.alphabetical
+        @attention = HiringMessage.joins(:candidate).where(hr_lite_hiring_candidates: { campaign_id: @campaign.id })
+                                  .where(status: %w[failed unknown sending]).includes(:candidate, :template).limit(50)
+      end
+
+      # A new campaign starts from the last one's offer: HR edits what changed.
+      def new
+        @campaign = HiringCampaign.new(HiringCampaign.newest_first.first&.slice(*FIELDS.excluding(:title, :status)))
+      end
+
+      def create
+        @campaign = HiringCampaign.new(campaign_params)
+        return render(:new, status: :unprocessable_entity) unless @campaign.save
+
+        redirect_to hr_lite.admin_hiring_campaign_path(@campaign), notice: "Campaign created. Upload the candidate sheet next."
+      end
+
+      def edit; end
+
+      def update
+        return render(:edit, status: :unprocessable_entity) unless @campaign.update(campaign_params)
+
+        redirect_to hr_lite.admin_hiring_campaign_path(@campaign), notice: "Saved."
+      end
+
+      # GET: the upload form. POST with a file: the preview. POST with the
+      # sealed rows and confirm: the import. Nothing is saved before confirm.
+      def import
+        return if request.get?
+
+        rows = params[:sheet].present? ? read_sheet(params[:sheet]) : sealer.decrypt_and_verify(params[:rows].to_s)
+        @import = HiringImport.new(@campaign, rows, picks: params.fetch(:picks, {}).permit!.to_h)
+        if params[:confirm].present? && @import.import!
+          counts = @import.counts
+          return redirect_to hr_lite.admin_hiring_campaign_path(@campaign),
+                             notice: "#{counts['create']} added, #{counts['update']} updated, #{counts['skip']} skipped."
+        end
+        @sealed = sealer.encrypt_and_sign(rows, expires_in: 1.hour)
+        render :preview
+      rescue ArgumentError => e
+        redirect_to hr_lite.import_admin_hiring_campaign_path(@campaign), alert: e.message
+      rescue ActiveSupport::MessageEncryptor::InvalidMessage
+        redirect_to hr_lite.import_admin_hiring_campaign_path(@campaign), alert: "That preview expired. Upload the sheet again."
+      rescue ActiveRecord::RecordNotUnique
+        redirect_to hr_lite.import_admin_hiring_campaign_path(@campaign), alert: "Another import ran at the same time. Upload the sheet again."
+      end
+
+      private
+
+      def set_campaign = @campaign = HiringCampaign.find(params[:id])
+      def campaign_params = params.require(:hiring_campaign).permit(*FIELDS)
+
+      def read_sheet(file)
+        rows = HrLite.config.read_sheet.call(file.tempfile.path, file.original_filename)
+        Array(rows).map { |row| Array(row).map { |cell| HiringImport.text(cell) } }
+      rescue ArgumentError
+        raise
+      rescue StandardError
+        raise ArgumentError, "That file could not be read. Save it as .xlsx or .csv with the headers in the first row."
+      end
+
+      # The previewed rows ride in the form, encrypted, so nothing touches disk.
+      def sealer
+        ActiveSupport::MessageEncryptor.new(Rails.application.key_generator.generate_key("hr_lite.hiring_import", 32))
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_candidates_controller.rb

@@ -0,0 +1,50 @@
+module HrLite
+  module Admin
+    # One candidate: what we know, every email and interview, the timeline,
+    # and the decisions HR makes by hand.
+    class HiringCandidatesController < ApplicationController
+      # Invited and interview come from sending and scheduling, never a button.
+      MANUAL = %w[interested not_interested selected rejected on_hold].freeze
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action { @candidate = HiringCandidate.includes(:campaign).find(params[:id]) }
+
+      def show
+        @messages = @candidate.messages.includes(:template).order(:created_at)
+        @interviews = @candidate.interviews.order(:round, :created_at)
+        @timeline = @candidate.timeline.limit(100)
+        @replies = @candidate.replies.responded.order(:round).with_attached_documents
+        next_round = [ @candidate.round, *@interviews.select { |i| %w[scheduled unknown].include?(i.status) }.map(&:round) ].max + 1
+        @next_reply = @replies.find { |r| r.round == next_round && r.preferred_slot }
+      end
+
+      # A document from the candidate's reply, streamed only to hiring.manage and audit-logged.
+      def document
+        attachment = ActiveStorage::Attachment.find_by!(id: params[:attachment_id], record_type: "HrLite::HiringReply",
+                                                        record_id: @candidate.replies.select(:id))
+        AuditLog.record!(action: "hiring.document_viewed", subject: @candidate, changes: { "attachment" => attachment.id })
+        bytes = attachment.record.read_document(attachment)
+        send_data bytes, filename: attachment.filename.to_s.split("--", 2).last, disposition: "attachment",
+                         type: Marcel::MimeType.for(StringIO.new(bytes), name: attachment.filename.to_s)
+      end
+
+      # The full Aadhaar or PAN, shown once on this render, audit-logged; never stored in the session.
+      def reveal
+        reply = @candidate.replies.find(params[:reply_id])
+        field = params[:field].presence_in(%w[aadhaar pan]) or raise ActiveRecord::RecordNotFound
+        AuditLog.record!(action: "hiring.kyc_revealed", subject: @candidate, changes: { "field" => field, "round" => reply.round })
+        @revealed = { reply.id => { field => (field == "aadhaar" ? reply.aadhaar_number : reply.pan_number) } }
+        show
+        render :show
+      end
+
+      def stage
+        to = params[:to].presence_in(MANUAL) or raise ArgumentError, "That is not a decision HR makes here."
+        @candidate.move_to!(to, reason: params[:reason], note: params[:note])
+        redirect_to hr_lite.admin_hiring_candidate_path(@candidate), notice: "Moved to #{@candidate.stage_label}."
+      rescue ArgumentError => e
+        redirect_to hr_lite.admin_hiring_candidate_path(@candidate), alert: e.message
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_interviews_controller.rb

@@ -0,0 +1,77 @@
+module HrLite
+  module Admin
+    # Interview rounds on the hiring mailbox's Google Calendar. The row is
+    # written before Google is called, so an answer that never arrives still
+    # leaves a record ("unknown") for HR to check.
+    class HiringInterviewsController < ApplicationController
+      LENGTHS = [ 30, 45, 60 ].freeze
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action { @candidate = HiringCandidate.includes(:campaign).find(params[:hiring_candidate_id]) }
+      before_action(except: :create) { @interview = @candidate.interviews.find(params[:id]) }
+      before_action :require_calendar!
+
+      def create
+        return back(alert: "#{@candidate.stage_label} cannot be interviewed.") unless HiringCandidate::MOVES.fetch(@candidate.stage).include?("interview")
+        return back(alert: "Pick a date and time in the future.") unless (starts, ends = slot)
+
+        round = @candidate.interviews.where(status: %w[scheduled unknown]).maximum(:round).to_i + 1
+        @interview = @candidate.interviews.create!(round: round, starts_at: starts, ends_at: ends)
+        ids = adapter.create_event(summary: "Interview: #{@candidate.campaign.position} (round #{round})",
+                                   description: "#{@candidate.campaign.title}. Join with the Google Meet link in this invite.",
+                                   attendee: @candidate.email, starts_at: starts, ends_at: ends)
+        @interview.update!(status: "scheduled", event_id: ids[:event_id], meet_link: ids[:meet_link])
+        @candidate.move_to!("interview", round: round)
+        @candidate.log!("interview_scheduled", round: round, starts_at: starts.iso8601)
+        back(notice: "Invite sent for round #{round}.")
+      rescue HrLite::HiringDeliveryUnknown, HrLite::HiringDeliveryFailed => e
+        google_trouble(e, "interview_scheduled")
+      end
+
+      def update
+        return back(alert: "Pick a date and time in the future.") unless (starts, ends = slot)
+        adapter.update_event(event_id: @interview.event_id, starts_at: starts, ends_at: ends)
+        @interview.update!(starts_at: starts, ends_at: ends)
+        @candidate.log!("interview_rescheduled", round: @interview.round, starts_at: starts.iso8601)
+        back(notice: "Round #{@interview.round} moved. Google told the candidate.")
+      rescue HrLite::HiringDeliveryUnknown, HrLite::HiringDeliveryFailed => e
+        google_trouble(e, "interview_rescheduled")
+      end
+
+      def destroy
+        adapter.cancel_event(event_id: @interview.event_id) if @interview.event_id
+        @interview.update!(status: "cancelled")
+        @candidate.log!("interview_cancelled", round: @interview.round)
+        back(notice: "Round #{@interview.round} cancelled. Google told the candidate.")
+      rescue HrLite::HiringDeliveryUnknown, HrLite::HiringDeliveryFailed => e
+        google_trouble(e, "interview_cancelled")
+      end
+
+      private
+
+      def adapter = HrLite.config.hiring
+      def back(**flash) = redirect_to(hr_lite.admin_hiring_candidate_path(@candidate), **flash)
+
+      def require_calendar!
+        back(alert: "Connect the hiring mailbox before scheduling.") unless adapter&.sender&.dig(:ready)
+      end
+
+      def slot
+        starts = Time.zone.parse("#{params[:date]} #{params[:time]}")
+        return unless starts&.future?
+
+        minutes = LENGTHS.include?(params[:minutes].to_i) ? params[:minutes].to_i : LENGTHS.first
+        [ starts, starts + minutes.minutes ]
+      rescue ArgumentError
+        nil
+      end
+
+      def google_trouble(error, action)
+        unknown = error.is_a?(HrLite::HiringDeliveryUnknown)
+        @interview.update!(status: unknown ? "unknown" : "failed", error: error.message.to_s.truncate(200)) if action == "interview_scheduled"
+        @candidate.log!("#{action}_#{unknown ? 'unknown' : 'failed'}", round: @interview.round)
+        back(alert: unknown ? "Google did not confirm. Check the hiring calendar before trying again." : "Google refused: #{error.message}")
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_sends_controller.rb

@@ -0,0 +1,62 @@
+module HrLite
+  module Admin
+    # Bulk email: a confirm page that says exactly who gets it and who is
+    # left out (and why), then one queued job per recipient, spaced out.
+    class HiringSendsController < ApplicationController
+      SPACING = 3.seconds
+
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      rate_limit to: 10, within: 1.hour, only: :create, name: "hiring_send", by: -> { hr_current_user.id },
+                 with: -> { redirect_to hr_lite.admin_hiring_campaigns_path, alert: "Ten sends in an hour is the limit. Try again later." }
+
+      def new
+        load_recipients
+      end
+
+      def create
+        load_recipients
+        unless @sender&.dig(:ready)
+          return redirect_to hr_lite.admin_hiring_campaign_path(@campaign), alert: "Connect the hiring mailbox before sending."
+        end
+
+        batch = SecureRandom.uuid
+        queued = @recipients.filter_map do |candidate|
+          HiringMessage.create!(candidate: candidate, template: @template, batch: batch, sent_by: hr_current_user)
+        rescue ActiveRecord::RecordNotUnique
+          nil # already queued by another click
+        end
+        queued.each_with_index { |message, i| HiringSendJob.set(wait: SPACING * i).perform_later(message.id) }
+        AuditLog.record!(action: "hiring.batch", subject: @campaign,
+                         changes: { "template" => @template.name, "recipients" => queued.size, "batch" => batch })
+        redirect_to hr_lite.admin_hiring_campaign_path(@campaign), notice: "#{queued.size} emails queued from #{@sender[:email]}."
+      end
+
+      # Only a definite failure is sent again; "unknown" may already be in Gmail.
+      def retry
+        message = HiringMessage.find(params[:id])
+        if message.status == "failed"
+          message.update!(status: "queued", error: nil, sent_by: hr_current_user)
+          HiringSendJob.perform_later(message.id)
+        end
+        redirect_to hr_lite.admin_hiring_campaign_path(message.candidate.campaign_id), notice: "Queued again."
+      end
+
+      private
+
+      # Recomputed on every request from the ids: the confirm page is never trusted.
+      def load_recipients
+        @campaign = HiringCampaign.find(params[:hiring_campaign_id])
+        @template = HiringTemplate.find(params[:template_id])
+        @sender = HrLite.config.hiring&.sender
+        scope = params[:all].present? ? @campaign.pipeline(stage: params[:stage], campus: params[:campus], replied: params[:replied], round: params[:round].to_i.presence_in([ 1, 2, 3 ])) : @campaign.pipeline.where(id: Array(params[:candidate_ids]))
+        already = HiringMessage.where(template: @template, candidate_id: scope.select(:id)).pluck(:candidate_id).to_set
+        @recipients, @left_out = [], []
+        scope.includes(:campaign, :interviews).each do |candidate|
+          missing = HiringMerge.new(candidate, sender_name: @sender&.dig(:name)).render(@template).missing
+          reason = already.include?(candidate.id) ? "already sent this template" : (missing.join(", ") if missing.any?)
+          reason ? @left_out << [ candidate, reason ] : @recipients << candidate
+        end
+      end
+    end
+  end
+end

data/app/controllers/hr_lite/admin/hiring_templates_controller.rb

@@ -0,0 +1,71 @@
+module HrLite
+  module Admin
+    # Hiring emails HR writes once and sends to many, with a preview filled
+    # for a real candidate.
+    class HiringTemplatesController < ApplicationController
+      before_action { hr_require_permission!("hiring.manage", scope: :all) }
+      before_action(only: %i[edit update]) { @template = HiringTemplate.find(params[:id]) }
+      # "Write with AI" posts the same form with ai=1 (formaction would break per-form CSRF tokens).
+      rate_limit to: 20, within: 1.hour, only: %i[create update], if: -> { params[:ai].present? }, name: "hiring_ai_draft", by: -> { hr_current_user.id },
+                 with: -> { redirect_to hr_lite.admin_hiring_templates_path, alert: "Twenty AI drafts an hour is the limit. Try again later." }
+
+      def index = @templates = HiringTemplate.alphabetical
+      def new = @template = HiringTemplate.new
+
+      def create
+        @template = HiringTemplate.new(template_params)
+        return draft if params[:ai].present?
+        return render(:new, status: :unprocessable_entity) unless @template.save
+
+        redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
+      end
+
+      def edit = load_preview
+
+      def update
+        return draft if params[:ai].present?
+        return load_preview && render(:edit, status: :unprocessable_entity) unless @template.update(template_params)
+
+        redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
+      end
+
+      private
+
+      # "Write with AI": rewrites what HR typed into a clean email that uses
+      # only known @fields. Nothing is saved; HR reviews it, then saves.
+      def draft
+        @template.assign_attributes(template_params)
+        apply_ai_draft
+        @template.persisted? ? load_preview && render(:edit) : render(:new)
+      end
+
+      def apply_ai_draft
+        out = HrLite.config.hiring.draft_email(text: "Subject: #{@template.subject}\n\n#{@template.body}", placeholders: HiringMerge::RESERVED)
+        unknown = HiringMerge.tokens("#{out[:subject]} #{out[:body]}") - HiringMerge::RESERVED
+        raise HrLite::HiringDeliveryFailed, "it used unknown fields (#{unknown.map { |t| "@#{t}" }.join(', ')})" if unknown.any?
+
+        @template.assign_attributes(subject: out[:subject], body: out[:body])
+        @template.name = out[:name] if @template.name.blank? && out[:name].present?
+        AuditLog.record!(action: "hiring.ai_draft", subject: @template)
+        flash.now[:notice] = "AI draft ready. Check it, then save."
+      rescue HrLite::HiringDeliveryFailed, HrLite::HiringDeliveryUnknown => e
+        flash.now[:alert] = "AI could not draft this: #{e.message}"
+      end
+
+      def load_preview
+        @sample = HiringCandidate.includes(:campaign, :interviews).order(updated_at: :desc).limit(200).to_a
+        @preview_for = @sample.find { |c| c.id == params[:candidate_id].to_i } || @sample.first
+        return true unless @preview_for
+
+        sender_name = HrLite.config.hiring&.sender&.dig(:name)
+        @preview = HiringMerge.new(@preview_for, sender_name:).render(@template)
+        # Readiness across the previewed candidate's campaign: who a send would reach.
+        @campaign_size = @preview_for.campaign.candidates.count
+        @ready = @preview_for.campaign.candidates.includes(:campaign, :interviews).count { |c| HiringMerge.new(c, sender_name:).render(@template).missing.empty? }
+        true
+      end
+
+      def template_params = params.require(:hiring_template).permit(:name, :subject, :body)
+    end
+  end
+end

data/app/controllers/hr_lite/hiring_replies_controller.rb

@@ -0,0 +1,32 @@
+module HrLite
+  # The candidate's own page for one interview round, from @round1_link …
+  # @round3_link: their day and slot, round 1's interest questions, and from
+  # round 2 their documents. One reply per link.
+  class HiringRepliesController < ApplicationController
+    # WHY no login: candidates have no account. The unguessable 24-character
+    # token in their link is the key, and it opens only that one reply.
+    skip_before_action :hr_authenticate!
+    skip_before_action HrLite.config.authenticate_method, raise: false
+    layout "hr_lite/public"
+    rate_limit to: 10, within: 1.hour, only: :create, name: "hiring_reply",
+               with: -> { redirect_to hr_lite.hiring_reply_path(params[:token]), alert: "Too many tries. Please try again in an hour." }
+
+    before_action do
+      @reply = HiringReply.includes(candidate: :campaign).find_by!(token: params[:token].to_s)
+      @candidate = @reply.candidate
+    end
+
+    def show; end
+
+    def create
+      @reply.submit!(interested: params[:interested].to_s, date: params[:date], slot: params[:slot], joining: params[:joining],
+                     yes_no: params.permit(*HiringReply::YES_NO.keys).to_h, alternate_phone: params[:alternate_phone].to_s.strip,
+                     files: params.fetch(:documents, {}).permit(*HiringReply::DOCUMENTS.fetch(@reply.round, {}).keys).to_h,
+                     kyc: params.permit(:aadhaar_number, :pan_number, :pan_pending, :no_salary_slips, :consent).to_h.symbolize_keys)
+      redirect_to hr_lite.hiring_reply_path(@reply.token)
+    rescue ArgumentError => e
+      flash.now[:alert] = e.message
+      render :show, status: :unprocessable_entity
+    end
+  end
+end

data/app/helpers/hr_lite/application_helper.rb

@@ -88,6 +88,10 @@ module HrLite
         { label: "Help desk", path: :admin_hr_requests_path, match: [ "/admin/hr_requests" ], if: -> { hr_can?("hr_request.manage", scope: :all) } },
         { label: "Manage policies", path: :admin_policies_path, match: [ "/admin/policies" ], if: -> { hr_can?("policy.manage", scope: :all) } }
       ] },
+      { label: "Hiring", tabs: [
+        { label: "Campaigns", path: :admin_hiring_campaigns_path, match: [ "/admin/hiring_campaigns", "/admin/hiring_candidates" ], if: -> { hr_can?("hiring.manage", scope: :all) } },
+        { label: "Email templates", path: :admin_hiring_templates_path, match: [ "/admin/hiring_templates" ], if: -> { hr_can?("hiring.manage", scope: :all) } }
+      ] },
       { label: "Admin", divider: true, tabs: [
         { label: "Settings", path: :admin_leave_types_path, match: [ "/admin/leave_types", "/admin/office_locations", "/admin/holidays", "/admin/expense_categories" ], if: LEAD },
         { label: "HR settings", path: :edit_admin_setting_path, match: [ "/admin/setting" ], if: LEAD },
@@ -194,6 +198,7 @@ module HrLite
       "People" => '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.9M16 3.1a4 4 0 0 1 0 7.8"/>',
       "Me" => '<circle cx="12" cy="8" r="4"/><path d="M4 21a8 8 0 0 1 16 0"/>',
       "Help" => '<circle cx="12" cy="12" r="9"/><path d="M9.1 9a3 3 0 0 1 5.8 1c0 2-3 3-3 3M12 17h.01"/>',
+      "Hiring" => '<rect x="2" y="7" width="20" height="14" rx="2"/><path d="M16 21V5a2 2 0 0 0-2-2h-4a2 2 0 0 0-2 2v16"/>',
       "Admin" => '<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/>',
       "More" => '<circle cx="5" cy="12" r="1.5"/><circle cx="12" cy="12" r="1.5"/><circle cx="19" cy="12" r="1.5"/>',
       "Search" => '<circle cx="11" cy="11" r="7"/><path d="m20 20-3.5-3.5"/>'
@@ -253,6 +258,39 @@ module HrLite
       hr_lite.public_send(helper, approval.subject_id)
     end
 
+    HIRING_BADGES = { "imported" => "muted", "invited" => "info", "interested" => "ok", "not_interested" => "bad",
+                      "interview" => "warn", "selected" => "ok", "rejected" => "bad", "on_hold" => "muted" }.freeze
+
+    def hrl_hiring_badge(candidate)
+      modifier = HIRING_BADGES.fetch(candidate.stage)
+      tag.span(candidate.stage_label, class: [ "hrl-badge", ("hrl-badge--#{modifier}" unless modifier == "info") ])
+    end
+
+    # The five steps of the candidate stepper: [label, :done|:now|:todo].
+    HIRING_STEPS = %w[Imported Invited Interested Interview Decision].freeze
+    HIRING_STEP_OF = { "imported" => 0, "invited" => 1, "interested" => 2, "not_interested" => 2, "interview" => 3,
+                       "selected" => 4, "rejected" => 4, "on_hold" => 4 }.freeze
+
+    def hrl_hiring_steps(candidate)
+      at = HIRING_STEP_OF.fetch(candidate.stage)
+      HIRING_STEPS.each_with_index.map do |label, i|
+        label = candidate.stage_label if i == at && %w[not_interested interview selected rejected on_hold].include?(candidate.stage)
+        [ label, i < at ? :done : (i == at ? :now : :todo) ]
+      end
+    end
+
+    # One line per hiring timeline row, from the whitelisted changes it stored.
+    def hrl_hiring_event(log)
+      c = log.audited_changes.to_h
+      at = c["starts_at"] && Time.zone.parse(c["starts_at"]).strftime("%-d %b %Y, %-l:%M %p")
+      case log.action.delete_prefix("hiring.")
+      when "stage" then [ "Moved to #{c['to'].to_s.humanize}", c["reason"] ].compact.join(": ")
+      when /\Aemail_(\w+)\z/ then "Email #{Regexp.last_match(1)}: #{c['template']}"
+      when /\Ainterview_(\w+)\z/ then [ "Round #{c['round']} #{Regexp.last_match(1).tr('_', ' ')}", at ].compact.join(" for ")
+      else log.action.delete_prefix("hiring.").humanize
+      end
+    end
+
     def hrl_pagination
       render "hr_lite/shared/pagination"
     end

data/app/jobs/hr_lite/hiring_send_job.rb

@@ -0,0 +1,42 @@
+module HrLite
+  # Sends one queued hiring email through the host's mail adapter. The first
+  # step claims the row, so a redelivered or parallel job finds it taken and
+  # stops: a send is attempted at most once. A crash after the claim leaves
+  # "sending", which the screens show as "check Gmail", never as "send again".
+  # Adapter errors must not quote the recipient: their text is stored.
+  class HiringSendJob < ApplicationJob
+    queue_as :default
+
+    def perform(message_id)
+      return unless HiringMessage.where(id: message_id, status: "queued").update_all(status: "sending", updated_at: Time.current) == 1
+
+      message = HiringMessage.find(message_id)
+      HrLite::Current.set(actor: message.sent_by) { deliver(message) }
+    end
+
+    private
+
+    def deliver(message)
+      candidate = message.candidate
+      adapter = HrLite.config.hiring
+      sender = adapter&.sender
+      return finish(message, "failed", error: "No sender mailbox is connected") unless sender&.dig(:ready)
+
+      mail = HiringMerge.new(candidate, sender_name: sender[:name]).render(message.template)
+      return finish(message, "failed", error: "Missing #{mail.missing.join(', ')}") if mail.missing.any?
+
+      ids = adapter.send_email(to: candidate.email, subject: mail.subject, body: mail.body)
+      finish(message, "sent", sent_at: Time.current, gmail_message_id: ids[:message_id], gmail_thread_id: ids[:thread_id])
+      candidate.move_to!("invited") if candidate.stage == "imported"
+    rescue HrLite::HiringDeliveryUnknown => e
+      finish(message, "unknown", error: e.message.to_s.truncate(200))
+    rescue HrLite::HiringDeliveryFailed => e
+      finish(message, "failed", error: e.message.to_s.truncate(200))
+    end
+
+    def finish(message, status, **attributes)
+      message.update!(status: status, **attributes)
+      message.candidate.log!("email_#{status}", template: message.template.name)
+    end
+  end
+end

data/app/models/hr_lite/hiring_campaign.rb

@@ -0,0 +1,23 @@
+module HrLite
+  # One hiring drive for one opening. Its fields fill the @placeholders in
+  # every email, so the offer lives here, never in template copy.
+  class HiringCampaign < ApplicationRecord
+    has_many :candidates, class_name: "HrLite::HiringCandidate", foreign_key: :campaign_id,
+                          inverse_of: :campaign, dependent: :restrict_with_error
+
+    validates :title, :position, presence: true
+    validates :status, inclusion: { in: %w[open closed] }
+
+    scope :newest_first, -> { order(created_at: :desc) }
+
+    # The pipeline list and "select all" on it are the same filter.
+    def pipeline(stage: nil, campus: nil, replied: nil, round: nil)
+      scope = candidates
+      scope = scope.where(id: HiringReply.responded.select(:candidate_id)) if replied.present?
+      scope = scope.where(id: HiringReply.responded.where(round: round).where.not(preferred_slot: nil).select(:candidate_id)) if round.present?
+      scope = scope.where(stage: stage) if stage.presence_in(HiringCandidate::STAGES)
+      scope = scope.where(campus: campus) if campus.present?
+      scope.order(:name, :id)
+    end
+  end
+end