hr_lite 0.61.0 → 0.64.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d57f2981c5062477e62d5cf7518fb074dfedccd73de6338d3263ce57143dd824
-  data.tar.gz: eb27ceb943445189d60db425d2fd7250d89fbb6e118f48b456d0a33eb22dfc4b
+  metadata.gz: 86b218a8a46bb4b5c3527df1fb637aee4b7617e8ef8abfd4e018274bc08e05af
+  data.tar.gz: 3e645c3511f89479289ac9169317183232d54c7443846208062d9b764bf692f0
 SHA512:
-  metadata.gz: 128a548490e3eb5c3028c197eb352e14419d200bbff36c79c7237bb4f355b666dd525ad7a0e54a7d1c8f6814d3b8165e3311215ab8f17dd81ac20460ae47b926
-  data.tar.gz: 84179555ec4cf9ea6623071e0f72da671ff3f17f69f9d4771fbe6a833e6ba77ca6edcab85bbeebbf835d6aee2d2a23ee1f61d1cba42f7f26186e6d61d246ca14
+  metadata.gz: 8ac6f7b8261f2dbaa74acb697effd3deb137d6f3d84647df9260c602ea457d7cb7067b631bdcbef4c09d56555f5688884bcac7607b48ae52002b0946291e4597
+  data.tar.gz: dfd0bb1099a90b72051f91569303e321d1d3a4cd216baf3cd9ba11f4dae720e5738be651fb584863b2fbe080702f0b8b517c70f49c9223f3ae6563cf72c0b6e6

data/CHANGELOG.md

@@ -7,6 +7,36 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.64.0] - 2026-10-22
+
+Decision emails. One migration: `purpose` on hiring templates.
+
+- **Selected, Rejected and On hold each send a saved email.** The first time a button is used with no email set, HR is taken to write it, with Write with AI on hand. Then they return to the candidate and click again. After that, every click moves the stage and sends that email through the HR person's own Gmail, once per candidate. Decisions are refused while the mailbox is not connected.
+- **Decision emails can be edited, never deleted.** There is one per decision, and the purpose never changes. The templates page lists them first, flagging any that are not set.
+
+## [0.63.1] - 2026-10-22
+
+A reply link can only be answered by the candidate it belongs to. No migrations.
+
+- **Previews never show a real reply link.** The template preview and the send-confirm check render "[Name's round N link]" instead, so HR can no longer open a previewed candidate's link and answer as them. A real link is made only when an email is actually sent.
+- **The reply page names its owner and checks their email.** It says "This form is for <full name>" and asks for the email the link was sent to. A different email is refused and nothing is saved.
+
+## [0.63.0] - 2026-10-22
+
+Every penalty row now says why it exists. No migrations.
+
+- **Penalty cause, behind an "i".** Tap a row in "Penalties in <month>" (or its "i") to see the day and punch that caused it and what it adds to the day it sits on, e.g. "You checked in at 19:39 on Mon 19 Oct, after 11:00, so +1h goes on your next 2 working days. So Thu 22 Oct needs 60 min more before checkout." A carried penalty (late after 11:00, or left early) used to show only the day it landed on, so it read as a penalty for a day the person was on time.
+- **How to avoid or clear them.** The Penalty hours card adds: check in by your slot and stay until the required checkout; if a punch was wrong, fix that day and ask HR to remove the penalties it caused.
+
+## [0.62.0] - 2026-10-22
+
+Hiring replies per round, an AI draft button and the sender's signature. Two migrations: a new `hr_lite_hiring_replies` table, and `allow_sunday` on campaigns.
+
+- **Reply links per round.** `@round1_link`, `@round2_link` and `@round3_link` each open the candidate's own `/apply/:token` page for that round, with no login, one reply per link. Every round asks for one of the next ten interview days and one 2-hour slot (10–12, 12–2, 2–4, 4–6, 6–8; at most 4 candidates per slot per day), plus an optional alternate phone. Round 1 also asks for interest, joining time and four yes/no questions. Round 2 asks for a CV and photo ID. Round 3 collects the joining details: marksheets, an Aadhaar number and card, and a PAN number and card. A candidate without a PAN can tick "I don't have a PAN yet", and HR sees "PAN pending". Salary slips for the last 3 months are optional; a fresher ticks "I have no salary slips". A consent box is required. Documents must be PDF, JPG or PNG, checked from the file's bytes, at most 5 MB each. They are encrypted before they reach storage, so a leaked blob is unreadable, and HR downloads them only through an audit-logged route that decrypts them. Aadhaar and PAN numbers are encrypted. HR sees them masked (XXXX XXXX 1234, XXXXX1234X), and "Show full" is an audit-logged POST that shows the number once. Sunday is off unless the campaign ticks "Allow Sunday interviews". A reply moves round 1 candidates to interested or not interested, goes on the timeline, notifies the HR sender, and prefills "Schedule round N". The campaign page shows linked count tiles: invited, replied, interested, and booked for rounds 1, 2 and 3.
+- **Write with AI** on the template form, when the host adds `config.hiring.draft_email(text:, placeholders:)`. It rewrites what HR typed into a template name (if empty), subject and message that use only known @fields, and saves nothing. Output with an unknown field is refused. It is limited to 20 drafts an hour per person and is audit-logged. It posts the same form with `ai=1`, because `formaction` would break per-form CSRF tokens.
+- **Signature preview.** The template preview shows `config.hiring.signature` (sanitized) when the host provides it.
+- **Select all ticks the rows.** "All N in this filter" now ticks and unticks every row, through `select_all.js`.
+
 ## [0.61.0] - 2026-10-21
 
 Hiring panel. Six migrations: five new tables and one that grants `hiring.manage` to HR, Leadership and Super Admin and seeds the first outreach email.

data/README.md

@@ -386,8 +386,12 @@ send_email(to:, subject:, body:)               # => { message_id:, thread_id: }
 create_event(summary:, description:, attendee:, starts_at:, ends_at:) # => { event_id:, meet_link: }
 update_event(event_id:, starts_at:, ends_at:)
 cancel_event(event_id:)
+draft_email(text:, placeholders:)              # optional => { subject:, body: } for "Write with AI"
+signature                                      # optional => the sender's HTML signature, for the preview
 ```
 
+`@round1_link`, `@round2_link` and `@round3_link` point each candidate at their own `/apply/:token` page for that round, on `public_url_base`. The page needs no login. Round 1 asks for interest, joining time and four yes/no questions. Every round asks for a day, one 2-hour slot and an optional alternate phone. Rounds 2 and 3 ask for documents. Sunday is offered only when the campaign allows it.
+
 Raise `HrLite::HiringDeliveryFailed` when nothing was sent and `HrLite::HiringDeliveryUnknown` when the provider may have acted (timeouts, 5xx). Never put the recipient in the error text: it is stored. `config.read_sheet = ->(path, filename) { rows }` reads uploads (default: .csv).
 
 ## Recurring jobs

data/app/assets/javascripts/hr_lite/select_all.js

@@ -0,0 +1,21 @@
+// "Select all" for a list of checkboxes in one form.
+// Markup contract: <input type="checkbox" data-hrl-select-all="candidate_ids[]">.
+// Ticking it ticks every box of that name in the same form; unticking any row
+// unticks it again. The server still reads the box itself, so it works without JS.
+(function () {
+  "use strict";
+
+  document.addEventListener("change", function (event) {
+    var box = event.target;
+    var form = box.form;
+    if (!form) return;
+    var all = form.querySelector("[data-hrl-select-all]");
+    if (!all) return;
+    var rows = form.querySelectorAll('input[name="' + all.getAttribute("data-hrl-select-all") + '"]');
+    if (box === all) {
+      rows.forEach(function (row) { row.checked = all.checked; });
+    } else if (box.name === all.getAttribute("data-hrl-select-all") && !box.checked) {
+      all.checked = false;
+    }
+  });
+})();

data/app/assets/stylesheets/hr_lite/hr_lite.css

@@ -294,6 +294,10 @@ details > form > button[type=submit], details > form > .hrl-btn { margin-top: .2
 .hrl-btn[disabled] { opacity: .55; cursor: default; }
 summary.hrl-btn { list-style: none; }
 summary.hrl-btn::-webkit-details-marker { display: none; } /* Safari before 18.4 draws it whatever the display */
+/* A line with an "i": tap anywhere on it for why; the reason drops below. */
+.hrl-why > summary { display: flex; align-items: center; justify-content: space-between; gap: .5rem; min-height: 44px; list-style: none; cursor: pointer; }
+.hrl-why > summary::-webkit-details-marker { display: none; }
+.hrl-why > summary > .hrl-icon { color: var(--hrl-accent); }
 
 /* Badges & chips */
 .hrl-badge {
@@ -673,3 +677,9 @@ a.hrl-tree__name { display: inline-flex; align-items: center; min-height: var(--
 .hrl-steps .is-now .hrl-steps__dot { background: var(--hrl-accent); border-color: var(--hrl-accent); color: var(--hrl-accent-ink); }
 .hrl-steps .is-now { font-weight: 700; color: var(--hrl-accent); }
 .hrl-mail__head { display: grid; gap: var(--hrl-s-2); padding-bottom: var(--hrl-s-3); margin-bottom: var(--hrl-s-3); border-bottom: 1px solid var(--hrl-line); overflow-wrap: anywhere; }
+/* The candidate reply page: no staff shell, one readable column. */
+.hrl-public { max-width: 40rem; margin: 0 auto; padding: var(--hrl-s-6) var(--hrl-gutter) calc(var(--hrl-s-10) + env(safe-area-inset-bottom)); }
+.hrl-hiring-signature { margin-top: var(--hrl-s-3); padding-top: var(--hrl-s-3); border-top: 1px dashed var(--hrl-line); font-size: var(--hrl-t-small); overflow-wrap: anywhere; }
+.hrl-public__logo { display: block; height: 40px; width: auto; margin-bottom: var(--hrl-s-4); }
+.hrl-kpi--link { display: block; min-height: var(--hrl-target); color: inherit; text-decoration: none; }
+.hrl-kpi--link:hover { border-color: var(--hrl-accent); }

data/app/controllers/hr_lite/admin/hiring_campaigns_controller.rb

@@ -2,7 +2,7 @@ module HrLite
   module Admin
     # Hiring drives: the list, one campaign's pipeline, and its sheet import.
     class HiringCampaignsController < ApplicationController
-      FIELDS = %i[title position programme stipend ctc location schedule status].freeze
+      FIELDS = %i[title position programme stipend ctc location schedule status allow_sunday].freeze
 
       before_action { hr_require_permission!("hiring.manage", scope: :all) }
       before_action :set_campaign, except: %i[index new create]
@@ -15,9 +15,17 @@ module HrLite
       def show
         @stage = params[:stage].presence_in(HiringCandidate::STAGES)
         @campus = params[:campus].presence
+        @replied = params[:replied].presence
+        @round = params[:round].to_i.presence_in([ 1, 2, 3 ])
         @stage_counts = @campaign.candidates.group(:stage).count
+        replies = HiringReply.responded.where(candidate_id: @campaign.candidates.select(:id))
+        # Each tile's count is exactly what its link lists.
+        @kpis = { "Awaiting reply" => [ @stage_counts["invited"].to_i, { stage: "invited" } ],
+                  "Replied" => [ replies.distinct.count(:candidate_id), { replied: 1 } ],
+                  "Interested" => [ @stage_counts["interested"].to_i, { stage: "interested" } ] }
+        (1..3).each { |r| @kpis["Booked round #{r}"] = [ replies.where(round: r).where.not(preferred_slot: nil).count, { round: r } ] }
         @campuses = @campaign.candidates.where.not(campus: [ nil, "" ]).distinct.order(:campus).pluck(:campus)
-        @candidates = paginate(@campaign.pipeline(stage: @stage, campus: @campus))
+        @candidates = paginate(@campaign.pipeline(stage: @stage, campus: @campus, replied: @replied, round: @round))
         @templates = HiringTemplate.alphabetical
         @attention = HiringMessage.joins(:candidate).where(hr_lite_hiring_candidates: { campaign_id: @campaign.id })
                                   .where(status: %w[failed unknown sending]).includes(:candidate, :template).limit(50)

data/app/controllers/hr_lite/admin/hiring_candidates_controller.rb

@@ -13,12 +13,50 @@ module HrLite
         @messages = @candidate.messages.includes(:template).order(:created_at)
         @interviews = @candidate.interviews.order(:round, :created_at)
         @timeline = @candidate.timeline.limit(100)
+        @replies = @candidate.replies.responded.order(:round).with_attached_documents
+        next_round = [ @candidate.round, *@interviews.select { |i| %w[scheduled unknown].include?(i.status) }.map(&:round) ].max + 1
+        @next_reply = @replies.find { |r| r.round == next_round && r.preferred_slot }
       end
 
+      # A document from the candidate's reply, streamed only to hiring.manage and audit-logged.
+      def document
+        attachment = ActiveStorage::Attachment.find_by!(id: params[:attachment_id], record_type: "HrLite::HiringReply",
+                                                        record_id: @candidate.replies.select(:id))
+        AuditLog.record!(action: "hiring.document_viewed", subject: @candidate, changes: { "attachment" => attachment.id })
+        bytes = attachment.record.read_document(attachment)
+        send_data bytes, filename: attachment.filename.to_s.split("--", 2).last, disposition: "attachment",
+                         type: Marcel::MimeType.for(StringIO.new(bytes), name: attachment.filename.to_s)
+      end
+
+      # The full Aadhaar or PAN, shown once on this render, audit-logged; never stored in the session.
+      def reveal
+        reply = @candidate.replies.find(params[:reply_id])
+        field = params[:field].presence_in(%w[aadhaar pan]) or raise ActiveRecord::RecordNotFound
+        AuditLog.record!(action: "hiring.kyc_revealed", subject: @candidate, changes: { "field" => field, "round" => reply.round })
+        @revealed = { reply.id => { field => (field == "aadhaar" ? reply.aadhaar_number : reply.pan_number) } }
+        show
+        render :show
+      end
+
+      # Selected / Rejected / On hold also send that decision's saved email. With
+      # none saved yet, HR writes it first; the decision waits until it exists.
       def stage
         to = params[:to].presence_in(MANUAL) or raise ArgumentError, "That is not a decision HR makes here."
+        raise ArgumentError, "#{@candidate.stage_label} cannot move to #{to.humanize}." unless HiringCandidate::MOVES.fetch(@candidate.stage).include?(to)
+
+        template = HiringTemplate.for_decision(to)
+        if HiringTemplate::PURPOSES.key?(to) && !template
+          return redirect_to hr_lite.new_admin_hiring_template_path(purpose: to, candidate_id: @candidate.id),
+                             alert: "Write the #{HiringTemplate::PURPOSES[to]} email first. Every #{HiringTemplate::PURPOSES[to]} click sends it."
+        end
+        raise ArgumentError, "Connect your Google account for hiring before sending decision emails." if template && !HrLite.config.hiring&.sender&.dig(:ready)
+
         @candidate.move_to!(to, reason: params[:reason], note: params[:note])
-        redirect_to hr_lite.admin_hiring_candidate_path(@candidate), notice: "Moved to #{@candidate.stage_label}."
+        if template && (message = HiringMessage.create_or_find_by!(candidate: @candidate, template: template) { |m| m.batch = SecureRandom.uuid; m.sent_by = hr_current_user }).previously_new_record?
+          HiringSendJob.perform_later(message.id)
+        end
+        redirect_to hr_lite.admin_hiring_candidate_path(@candidate),
+                    notice: "Moved to #{@candidate.stage_label}.#{" The #{template.name} email is on its way." if template}"
       rescue ArgumentError => e
         redirect_to hr_lite.admin_hiring_candidate_path(@candidate), alert: e.message
       end

data/app/controllers/hr_lite/admin/hiring_sends_controller.rb

@@ -48,11 +48,11 @@ module HrLite
         @campaign = HiringCampaign.find(params[:hiring_campaign_id])
         @template = HiringTemplate.find(params[:template_id])
         @sender = HrLite.config.hiring&.sender
-        scope = params[:all].present? ? @campaign.pipeline(stage: params[:stage], campus: params[:campus]) : @campaign.pipeline.where(id: Array(params[:candidate_ids]))
+        scope = params[:all].present? ? @campaign.pipeline(stage: params[:stage], campus: params[:campus], replied: params[:replied], round: params[:round].to_i.presence_in([ 1, 2, 3 ])) : @campaign.pipeline.where(id: Array(params[:candidate_ids]))
         already = HiringMessage.where(template: @template, candidate_id: scope.select(:id)).pluck(:candidate_id).to_set
         @recipients, @left_out = [], []
         scope.includes(:campaign, :interviews).each do |candidate|
-          missing = HiringMerge.new(candidate, sender_name: @sender&.dig(:name)).render(@template).missing
+          missing = HiringMerge.new(candidate, sender_name: @sender&.dig(:name), preview: true).render(@template).missing
           reason = already.include?(candidate.id) ? "already sent this template" : (missing.join(", ") if missing.any?)
           reason ? @left_out << [ candidate, reason ] : @recipients << candidate
         end

data/app/controllers/hr_lite/admin/hiring_templates_controller.rb

@@ -5,20 +5,28 @@ module HrLite
     class HiringTemplatesController < ApplicationController
       before_action { hr_require_permission!("hiring.manage", scope: :all) }
       before_action(only: %i[edit update]) { @template = HiringTemplate.find(params[:id]) }
+      # "Write with AI" posts the same form with ai=1 (formaction would break per-form CSRF tokens).
+      rate_limit to: 20, within: 1.hour, only: %i[create update], if: -> { params[:ai].present? }, name: "hiring_ai_draft", by: -> { hr_current_user.id },
+                 with: -> { redirect_to hr_lite.admin_hiring_templates_path, alert: "Twenty AI drafts an hour is the limit. Try again later." }
 
       def index = @templates = HiringTemplate.alphabetical
-      def new = @template = HiringTemplate.new
+      def new = @template = HiringTemplate.new(purpose: params[:purpose].presence_in(HiringTemplate::PURPOSES.keys))
 
       def create
-        @template = HiringTemplate.new(template_params)
+        @template = HiringTemplate.new(template_params.merge(purpose: params.dig(:hiring_template, :purpose).presence))
+        return draft if params[:ai].present?
         return render(:new, status: :unprocessable_entity) unless @template.save
 
+        candidate = HiringCandidate.find_by(id: params[:candidate_id]) if @template.purpose
+        return redirect_to(hr_lite.admin_hiring_candidate_path(candidate), notice: "Saved. Click #{HiringTemplate::PURPOSES[@template.purpose]} again to send it.") if candidate
+
         redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
       end
 
       def edit = load_preview
 
       def update
+        return draft if params[:ai].present?
         return load_preview && render(:edit, status: :unprocessable_entity) unless @template.update(template_params)
 
         redirect_to hr_lite.edit_admin_hiring_template_path(@template), notice: "Saved."
@@ -26,16 +34,37 @@ module HrLite
 
       private
 
+      # "Write with AI": rewrites what HR typed into a clean email that uses
+      # only known @fields. Nothing is saved; HR reviews it, then saves.
+      def draft
+        @template.assign_attributes(template_params)
+        apply_ai_draft
+        @template.persisted? ? load_preview && render(:edit) : render(:new)
+      end
+
+      def apply_ai_draft
+        out = HrLite.config.hiring.draft_email(text: "Subject: #{@template.subject}\n\n#{@template.body}", placeholders: HiringMerge::RESERVED)
+        unknown = HiringMerge.tokens("#{out[:subject]} #{out[:body]}") - HiringMerge::RESERVED
+        raise HrLite::HiringDeliveryFailed, "it used unknown fields (#{unknown.map { |t| "@#{t}" }.join(', ')})" if unknown.any?
+
+        @template.assign_attributes(subject: out[:subject], body: out[:body])
+        @template.name = out[:name] if @template.name.blank? && out[:name].present?
+        AuditLog.record!(action: "hiring.ai_draft", subject: @template)
+        flash.now[:notice] = "AI draft ready. Check it, then save."
+      rescue HrLite::HiringDeliveryFailed, HrLite::HiringDeliveryUnknown => e
+        flash.now[:alert] = "AI could not draft this: #{e.message}"
+      end
+
       def load_preview
         @sample = HiringCandidate.includes(:campaign, :interviews).order(updated_at: :desc).limit(200).to_a
         @preview_for = @sample.find { |c| c.id == params[:candidate_id].to_i } || @sample.first
         return true unless @preview_for
 
         sender_name = HrLite.config.hiring&.sender&.dig(:name)
-        @preview = HiringMerge.new(@preview_for, sender_name:).render(@template)
+        @preview = HiringMerge.new(@preview_for, sender_name:, preview: true).render(@template)
         # Readiness across the previewed candidate's campaign: who a send would reach.
         @campaign_size = @preview_for.campaign.candidates.count
-        @ready = @preview_for.campaign.candidates.includes(:campaign, :interviews).count { |c| HiringMerge.new(c, sender_name:).render(@template).missing.empty? }
+        @ready = @preview_for.campaign.candidates.includes(:campaign, :interviews).count { |c| HiringMerge.new(c, sender_name:, preview: true).render(@template).missing.empty? }
         true
       end
 

data/app/controllers/hr_lite/hiring_replies_controller.rb

@@ -0,0 +1,32 @@
+module HrLite
+  # The candidate's own page for one interview round, from @round1_link …
+  # @round3_link: their day and slot, round 1's interest questions, and from
+  # round 2 their documents. One reply per link.
+  class HiringRepliesController < ApplicationController
+    # WHY no login: candidates have no account. The unguessable 24-character
+    # token in their link is the key, and it opens only that one reply.
+    skip_before_action :hr_authenticate!
+    skip_before_action HrLite.config.authenticate_method, raise: false
+    layout "hr_lite/public"
+    rate_limit to: 10, within: 1.hour, only: :create, name: "hiring_reply",
+               with: -> { redirect_to hr_lite.hiring_reply_path(params[:token]), alert: "Too many tries. Please try again in an hour." }
+
+    before_action do
+      @reply = HiringReply.includes(candidate: :campaign).find_by!(token: params[:token].to_s)
+      @candidate = @reply.candidate
+    end
+
+    def show; end
+
+    def create
+      @reply.submit!(email: params[:email], interested: params[:interested].to_s, date: params[:date], slot: params[:slot], joining: params[:joining],
+                     yes_no: params.permit(*HiringReply::YES_NO.keys).to_h, alternate_phone: params[:alternate_phone].to_s.strip,
+                     files: params.fetch(:documents, {}).permit(*HiringReply::DOCUMENTS.fetch(@reply.round, {}).keys).to_h,
+                     kyc: params.permit(:aadhaar_number, :pan_number, :pan_pending, :no_salary_slips, :consent).to_h.symbolize_keys)
+      redirect_to hr_lite.hiring_reply_path(@reply.token)
+    rescue ArgumentError => e
+      flash.now[:alert] = e.message
+      render :show, status: :unprocessable_entity
+    end
+  end
+end

data/app/helpers/hr_lite/application_helper.rb

@@ -198,6 +198,7 @@ module HrLite
       "People" => '<path d="M16 21v-2a4 4 0 0 0-4-4H6a4 4 0 0 0-4 4v2"/><circle cx="9" cy="7" r="4"/><path d="M22 21v-2a4 4 0 0 0-3-3.9M16 3.1a4 4 0 0 1 0 7.8"/>',
       "Me" => '<circle cx="12" cy="8" r="4"/><path d="M4 21a8 8 0 0 1 16 0"/>',
       "Help" => '<circle cx="12" cy="12" r="9"/><path d="M9.1 9a3 3 0 0 1 5.8 1c0 2-3 3-3 3M12 17h.01"/>',
+      "Info" => '<circle cx="12" cy="12" r="9"/><path d="M12 11v6M12 7.5h.01"/>',
       "Hiring" => '<rect x="2" y="7" width="20" height="14" rx="2"/><path d="M16 21V5a2 2 0 0 0-2-2h-4a2 2 0 0 0-2 2v16"/>',
       "Admin" => '<path d="M12 22s8-4 8-10V5l-8-3-8 3v7c0 6 8 10 8 10z"/>',
       "More" => '<circle cx="5" cy="12" r="1.5"/><circle cx="12" cy="12" r="1.5"/><circle cx="19" cy="12" r="1.5"/>',

data/app/models/hr_lite/attendance_penalty.rb

@@ -36,5 +36,18 @@ module HrLite
     def self.days_for(minutes) = (minutes / 300) * 0.5
 
     def label = REASONS.fetch(reason)
+
+    # Why this row exists, naming the day and punch that caused it.
+    def cause
+      r = attendance_record
+      t = ->(at) { at.nil? ? "—" : at.in_time_zone(HrLite.config.time_zone).then { |l| l.strftime(l.to_date == r.date ? "%H:%M" : "%H:%M on %a %-d %b") } }
+      on = r.date.strftime("%a %-d %b")
+      why = case reason
+      when "late" then "You checked in at #{t[r.check_in_at]} on #{on}, after your slot."
+      when "late_carry" then "You checked in at #{t[r.check_in_at]} on #{on}, after 11:00, so +1h goes on your next 2 working days."
+      else "You checked out at #{t[r.check_out_at]} on #{on}, before that day's required checkout of #{t[r.required_check_out_at]}."
+      end
+      "#{why} So #{date.strftime('%a %-d %b')} needs #{minutes} min more before checkout."
+    end
   end
 end

data/app/models/hr_lite/hiring_campaign.rb

@@ -11,8 +11,10 @@ module HrLite
     scope :newest_first, -> { order(created_at: :desc) }
 
     # The pipeline list and "select all" on it are the same filter.
-    def pipeline(stage: nil, campus: nil)
+    def pipeline(stage: nil, campus: nil, replied: nil, round: nil)
       scope = candidates
+      scope = scope.where(id: HiringReply.responded.select(:candidate_id)) if replied.present?
+      scope = scope.where(id: HiringReply.responded.where(round: round).where.not(preferred_slot: nil).select(:candidate_id)) if round.present?
       scope = scope.where(stage: stage) if stage.presence_in(HiringCandidate::STAGES)
       scope = scope.where(campus: campus) if campus.present?
       scope.order(:name, :id)

data/app/models/hr_lite/hiring_candidate.rb

@@ -19,6 +19,7 @@ module HrLite
     belongs_to :campaign, class_name: "HrLite::HiringCampaign", inverse_of: :candidates
     has_many :messages, class_name: "HrLite::HiringMessage", foreign_key: :candidate_id, dependent: :restrict_with_error
     has_many :interviews, class_name: "HrLite::HiringInterview", foreign_key: :candidate_id, dependent: :restrict_with_error
+    has_many :replies, class_name: "HrLite::HiringReply", foreign_key: :candidate_id, inverse_of: :candidate, dependent: :restrict_with_error
 
     encrypts :phone, :date_of_birth
     normalizes :email, with: ->(email) { email.to_s.strip.downcase }
@@ -33,7 +34,7 @@ module HrLite
 
     # The one door for a stage change: refuses a move the pipeline does not
     # allow, needs a listed reason to reject, and writes the timeline row.
-    def move_to!(to, reason: nil, note: nil, round: self.round)
+    def move_to!(to, reason: nil, note: nil, round: self.round, actor: HrLite::Current.actor)
       raise ArgumentError, "#{stage_label} cannot move to #{to.humanize}." unless MOVES.fetch(stage).include?(to)
       raise ArgumentError, "Pick a rejection reason." if to == "rejected" && !REJECTION_REASONS.include?(reason)
       raise ArgumentError, "Write a note for “Other”." if reason == "Other" && note.blank?
@@ -41,10 +42,13 @@ module HrLite
       transaction do
         from = stage
         update!(stage: to, round: round, rejection_reason: (to == "rejected" ? [ reason, note.presence ].compact.join(": ") : rejection_reason))
-        log!("stage", from: from, to: to, reason: (reason if to == "rejected"))
+        log!("stage", actor: actor, from: from, to: to, reason: (reason if to == "rejected"))
       end
     end
 
+    # This round's reply link, made on first use (a template that names it).
+    def reply_for(round) = replies.find_or_create_by!(round: round)
+
     def log!(action, actor: HrLite::Current.actor, **changes)
       AuditLog.record!(action: "hiring.#{action}", subject: self, actor: actor, changes: changes.compact)
     end

data/app/models/hr_lite/hiring_reply.rb

@@ -0,0 +1,146 @@
+module HrLite
+  # A candidate's reply link for one interview round (@round1_link … @round3_link):
+  # the day and 2-hour slot they can do, an optional alternate phone, round 1's
+  # interest questions, and from round 2 their documents. One reply per link.
+  class HiringReply < ApplicationRecord
+    SLOTS = { "10-12" => "10 AM – 12 PM", "12-2" => "12 – 2 PM", "2-4" => "2 – 4 PM", "4-6" => "4 – 6 PM", "6-8" => "6 – 8 PM" }.freeze
+    SLOT_START = { "10-12" => "10:00", "12-2" => "12:00", "2-4" => "14:00", "4-6" => "16:00", "6-8" => "18:00" }.freeze
+    SLOT_CAPACITY = 4 # candidates per slot per day; HR calls each to confirm
+    JOINING = { "immediately" => "Immediately", "two_weeks" => "Within 2 weeks", "one_month" => "Within a month" }.freeze
+    YES_NO = { "stipend_ok" => "Fine with the stipend", "location_ok" => "Fine with the office location",
+               "schedule_ok" => "Fine with the schedule", "programme_ok" => "Commits to the programme" }.freeze
+    DOCUMENTS = { 2 => { "cv" => "CV", "photo_id" => "Photo ID" },
+                  3 => { "marksheets" => "Marksheets", "aadhaar" => "Aadhaar card", "pan" => "PAN card",
+                         "salary_slip_1" => "Salary slip (last month)", "salary_slip_2" => "Salary slip (2 months ago)",
+                         "salary_slip_3" => "Salary slip (3 months ago)" } }.freeze
+    PAN_FORMAT = /\A[A-Z]{5}[0-9]{4}[A-Z]\z/
+    # Verhoeff tables, for the Aadhaar check digit.
+    VERHOEFF_D = [ [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ], [ 1, 2, 3, 4, 0, 6, 7, 8, 9, 5 ], [ 2, 3, 4, 0, 1, 7, 8, 9, 5, 6 ],
+                   [ 3, 4, 0, 1, 2, 8, 9, 5, 6, 7 ], [ 4, 0, 1, 2, 3, 9, 5, 6, 7, 8 ], [ 5, 9, 8, 7, 6, 0, 4, 3, 2, 1 ],
+                   [ 6, 5, 9, 8, 7, 1, 0, 4, 3, 2 ], [ 7, 6, 5, 9, 8, 2, 1, 0, 4, 3 ], [ 8, 7, 6, 5, 9, 3, 2, 1, 0, 4 ],
+                   [ 9, 8, 7, 6, 5, 4, 3, 2, 1, 0 ] ].freeze
+    VERHOEFF_P = [ [ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 ], [ 1, 5, 7, 6, 2, 8, 3, 0, 9, 4 ], [ 5, 8, 0, 3, 7, 9, 6, 1, 4, 2 ],
+                   [ 8, 9, 1, 6, 0, 4, 3, 5, 2, 7 ], [ 9, 4, 5, 3, 1, 2, 6, 8, 7, 0 ], [ 4, 2, 8, 6, 5, 7, 3, 9, 0, 1 ],
+                   [ 2, 7, 9, 3, 8, 0, 6, 4, 1, 5 ], [ 7, 0, 4, 6, 9, 1, 3, 2, 5, 8 ] ].freeze
+    DOCUMENT_TYPES = %w[application/pdf image/jpeg image/png].freeze
+    DOCUMENT_MAX = 5.megabytes
+
+    belongs_to :candidate, class_name: "HrLite::HiringCandidate", inverse_of: :replies
+    has_many_attached :documents
+    encrypts :alternate_phone, :aadhaar_number, :pan_number
+    has_secure_token :token, length: 24
+
+    validates :round, inclusion: { in: 1..3 }
+
+    scope :responded, -> { where.not(responded_at: nil) }
+
+    def self.slot_full?(date, slot) = responded.where(preferred_date: date, preferred_slot: slot).count >= SLOT_CAPACITY
+
+    # The next ten interview days. Sunday is off unless the campaign allows it.
+    def self.dates(allow_sunday:, from: Date.current) = (1..20).map { |i| from + i }.reject { |d| d.sunday? && !allow_sunday }.first(10)
+
+    def self.aadhaar_valid?(number)
+      number.to_s.match?(/\A[2-9]\d{11}\z/) &&
+        number.reverse.chars.each_with_index.reduce(0) { |c, (digit, i)| VERHOEFF_D[c][VERHOEFF_P[i % 8][digit.to_i]] }.zero?
+    end
+
+    # What this round asks for; round 3 skips PAN and slips the candidate says they lack.
+    def documents_asked
+      asked = DOCUMENTS.fetch(round, {})
+      asked = asked.except("pan") if pan_pending
+      asked = asked.except("salary_slip_1", "salary_slip_2", "salary_slip_3") if no_salary_slips
+      asked
+    end
+
+    def masked_aadhaar = aadhaar_number && "XXXX XXXX #{aadhaar_number.last(4)}"
+    def masked_pan = pan_number && "XXXXX#{pan_number[5, 4]}X"
+
+    # Documents are stored encrypted; this is the only way back to the bytes.
+    def read_document(attachment) = ActiveRecord::Encryption.encryptor.decrypt(attachment.download)
+    def document_label(attachment) = documents_asked[attachment.filename.to_s.split("--").first] || "Document"
+
+    # Saves the reply, moves round 1's candidate to interested / not interested,
+    # puts it on their timeline and rings the HR person who emailed them.
+    def submit!(email: nil, interested: nil, date: nil, slot: nil, joining: nil, yes_no: {}, alternate_phone: nil, files: {}, kyc: {})
+      raise ArgumentError, "You have already replied. Thank you." if responded_at
+      # The link is personal: the email it was sent to proves the right person opened it.
+      raise ArgumentError, "That email does not match this link. Use the link from your own email." unless email.to_s.strip.casecmp?(candidate.email)
+
+      assign_kyc!(kyc) if round == 3
+
+      declined = round == 1 && interested == "no"
+      raise ArgumentError, "Tell us whether you want to go ahead." if round == 1 && !%w[yes no].include?(interested)
+
+      answers = round == 1 ? { "interested" => interested } : {}
+      unless declined
+        date = self.class.dates(allow_sunday: candidate.campaign.allow_sunday).find { |day| day.iso8601 == date.to_s }
+        raise ArgumentError, "Pick a day for the interview." unless date
+        raise ArgumentError, "Pick a time slot." unless SLOTS.key?(slot)
+        raise ArgumentError, "That slot just filled up. Pick another one." if self.class.slot_full?(date, slot)
+        raise ArgumentError, "That phone number does not look right." if alternate_phone.present? && !alternate_phone.to_s.gsub(/[\s-]/, "").match?(/\A\+?\d{7,15}\z/)
+
+        if round == 1
+          raise ArgumentError, "Tell us how soon you can join." unless JOINING.key?(joining)
+
+          answers.merge!("joining" => joining, **YES_NO.keys.to_h { |key| [ key, yes_no[key] == "yes" ? "yes" : "no" ] })
+        end
+        check_files!(files)
+      end
+
+      transaction do
+        update!(responded_at: Time.current, answers: answers, alternate_phone: alternate_phone.presence,
+                preferred_date: (date unless declined), preferred_slot: (slot unless declined))
+        files.slice(*documents_asked.keys).each do |kind, file|
+          # Encrypted before it reaches storage: a leaked blob is ciphertext.
+          cipher = ActiveRecord::Encryption.encryptor.encrypt(file.tempfile.read.b)
+          documents.attach(io: StringIO.new(cipher), filename: "#{kind}--#{file.original_filename}", content_type: "application/octet-stream",
+                           identify: false)
+        end
+        if round == 1
+          to = declined ? "not_interested" : "interested"
+          candidate.move_to!(to, actor: nil) if HiringCandidate::MOVES.fetch(candidate.stage).include?(to)
+        end
+        candidate.log!("replied", actor: nil, round: round, interested: answers["interested"],
+                                  slot: ([ date.strftime("%-d %b"), SLOTS[slot] ].join(", ") unless declined))
+      end
+      notify_sender
+    end
+
+    private
+
+    # Round 3's joining KYC. Errors name the field, never the number.
+    def assign_kyc!(kyc)
+      raise ArgumentError, "Tick the consent box to share your documents." unless kyc[:consent] == "1"
+
+      aadhaar = kyc[:aadhaar_number].to_s.gsub(/\s/, "")
+      raise ArgumentError, "That Aadhaar number does not look right." unless self.class.aadhaar_valid?(aadhaar)
+
+      self.pan_pending = kyc[:pan_pending] == "1"
+      pan = kyc[:pan_number].to_s.strip.upcase
+      raise ArgumentError, "That PAN does not look right." unless pan_pending || pan.match?(PAN_FORMAT)
+
+      self.no_salary_slips = kyc[:no_salary_slips] == "1"
+      self.aadhaar_number = aadhaar
+      self.pan_number = (pan unless pan_pending)
+    end
+
+    # Every asked document, a real PDF/JPG/PNG (read from the bytes, not the
+    # browser's claim), at most 5 MB.
+    def check_files!(files)
+      documents_asked.each do |kind, label|
+        file = files[kind]
+        raise ArgumentError, "Attach your #{label}." unless file.respond_to?(:original_filename)
+        raise ArgumentError, "#{label} must be a PDF, JPG or PNG." unless DOCUMENT_TYPES.include?(sniff(file))
+        raise ArgumentError, "#{label} must be 5 MB or smaller." if file.size > DOCUMENT_MAX
+      end
+    end
+
+    def sniff(file) = Marcel::MimeType.for(file.tempfile, name: file.original_filename).tap { file.tempfile.rewind }
+
+    def notify_sender
+      user = candidate.messages.where(status: "sent").order(:sent_at).last&.sent_by or return
+      HrLite.notify(user: user, kind: "hiring.reply", body: candidate.campaign.title, path: "/admin/hiring_candidates/#{candidate_id}",
+                    title: "#{candidate.name} replied to round #{round}#{": #{answers['interested'] == 'yes' ? 'interested' : 'not interested'}" if round == 1}")
+    end
+  end
+end

data/app/models/hr_lite/hiring_template.rb

@@ -4,7 +4,15 @@ module HrLite
   class HiringTemplate < ApplicationRecord
     has_many :messages, class_name: "HrLite::HiringMessage", foreign_key: :template_id, dependent: :restrict_with_error
 
+    # The emails the Selected / Rejected / On hold buttons send. One each; edited,
+    # never deleted (there is no destroy), and the purpose never changes.
+    PURPOSES = { "selected" => "Selected", "rejected" => "Rejected", "on_hold" => "On hold" }.freeze
+
     validates :name, :subject, :body, presence: true
+    validates :purpose, inclusion: { in: PURPOSES.keys }, uniqueness: true, allow_nil: true
+    attr_readonly :purpose
+
+    def self.for_decision(stage) = find_by(purpose: stage)
 
     scope :alphabetical, -> { order(:name) }
   end

data/app/services/hr_lite/hiring_merge.rb

@@ -6,13 +6,19 @@ module HrLite
     TOKEN = /(?<![\w.@])@([a-z][a-z0-9_]*)/
     GROUPS = { "Candidate" => %w[first_name name course branch campus],
                "Offer" => %w[position programme stipend ctc location schedule],
-               "Interview" => %w[interview_date interview_time meet_link sender_name] }.freeze
+               "Interview" => %w[interview_date interview_time meet_link sender_name],
+               "Reply links" => %w[round1_link round2_link round3_link] }.freeze
     RESERVED = GROUPS.values.flatten.freeze
 
     Result = Data.define(:subject, :body, :missing)
 
-    def initialize(candidate, sender_name:)
+    def self.tokens(text) = text.to_s.scan(TOKEN).flatten.uniq
+
+    # preview: true shows a label for each reply link instead of the real one, so
+    # nobody can open a candidate's link from a preview and answer as them.
+    def initialize(candidate, sender_name:, preview: false)
       @extra = candidate.extra.to_h.transform_keys(&:to_s)
+      @preview = preview
       @values = @extra.merge(reserved(candidate, sender_name))
     end
 
@@ -21,7 +27,8 @@ module HrLite
       fill = ->(text) {
         text.to_s.gsub(TOKEN) do
           key = Regexp.last_match(1)
-          value = @values[key].to_s.strip
+          value = @values[key]
+          value = (value.respond_to?(:call) ? value.call : value).to_s.strip
           next value unless value.empty?
 
           missing << "@#{key} (#{RESERVED.include?(key) || @extra.key?(key) ? 'empty' : 'unknown'})"
@@ -42,7 +49,9 @@ module HrLite
         "programme" => campaign.programme, "stipend" => campaign.stipend, "ctc" => campaign.ctc,
         "location" => campaign.location, "schedule" => campaign.schedule,
         "interview_date" => at&.strftime("%-d %B %Y"), "interview_time" => at&.strftime("%-l:%M %p"),
-        "meet_link" => interview&.meet_link, "sender_name" => sender_name }
+        "meet_link" => interview&.meet_link, "sender_name" => sender_name,
+        # Lazy: a round's link (and its row) is made only when a template names it.
+        **(1..3).to_h { |r| [ "round#{r}_link", -> { @preview ? "[#{candidate.name}'s round #{r} link]" : HrLite.public_url("/apply/#{candidate.reply_for(r).token}") } ] } }
     end
   end
 end

data/app/views/hr_lite/admin/hiring_campaigns/_form.html.erb

@@ -8,6 +8,7 @@
   <div class="hrl-field"><%= f.label :ctc, "Full-time CTC" %><%= f.text_field :ctc %></div>
   <div class="hrl-field"><%= f.label :location, "Work location" %><%= f.text_area :location, rows: 2 %></div>
   <div class="hrl-field"><%= f.label :schedule, "Work schedule" %><%= f.text_field :schedule %></div>
+  <div class="hrl-field"><label class="hrl-field--check"><%= f.check_box :allow_sunday %> Allow Sunday interviews (Sunday is off by default)</label></div>
   <% if campaign.persisted? %>
     <div class="hrl-field"><%= f.label :status %><%= f.select :status, [ %w[Open open], %w[Closed closed] ] %></div>
   <% end %>

data/app/views/hr_lite/admin/hiring_campaigns/show.html.erb

@@ -17,6 +17,12 @@
   </section>
 <% end %>
 
+<div class="hrl-kpis">
+  <% @kpis.each do |label, (count, filter)| %>
+    <a class="hrl-kpi hrl-kpi--link" href="<%= hr_lite.admin_hiring_campaign_path(@campaign, filter) %>"><div class="hrl-kpi__value"><%= count %></div><div class="hrl-kpi__label"><%= label %></div></a>
+  <% end %>
+</div>
+
 <% if @attention.any? %>
   <section class="hrl-card hrl-card--warn">
     <h2 class="hrl-card__title">Emails that need a look</h2>
@@ -56,6 +62,8 @@
         </select>
       </div>
     <% end %>
+    <label class="hrl-field--check"><input type="checkbox" name="replied" value="1" <%= "checked" if @replied %>> Replied via link</label>
+    <input type="hidden" name="round" value="<%= @round %>">
     <div class="hrl-form-actions"><button class="hrl-btn" type="submit">Filter</button></div>
   </form>
 </section>
@@ -72,8 +80,8 @@
             <% @templates.each do |template| %><option value="<%= template.id %>"><%= template.name %></option><% end %>
           </select>
         </div>
-        <label class="hrl-field--check"><input type="checkbox" name="all" value="1"> All <%= @total_count %> in this filter</label>
-        <input type="hidden" name="stage" value="<%= @stage %>"><input type="hidden" name="campus" value="<%= @campus %>">
+        <label class="hrl-field--check"><input type="checkbox" name="all" value="1" data-hrl-select-all="candidate_ids[]"> All <%= @total_count %> in this filter</label>
+        <input type="hidden" name="stage" value="<%= @stage %>"><input type="hidden" name="campus" value="<%= @campus %>"><input type="hidden" name="replied" value="<%= @replied %>"><input type="hidden" name="round" value="<%= @round %>">
         <div class="hrl-form-actions"><button class="hrl-btn hrl-btn--primary" type="submit">Review email</button></div>
       </div>
       <div class="hrl-table-wrap">

data/app/views/hr_lite/admin/hiring_candidates/show.html.erb

@@ -33,8 +33,10 @@
         <p class="hrl-small hrl-muted">Next step</p>
         <h2 class="hrl-card__title">Schedule round <%= @interviews.select { |i| %w[scheduled unknown].include?(i.status) }.map(&:round).max.to_i + 1 %></h2>
         <%= form_with url: hr_lite.admin_hiring_candidate_hiring_interviews_path(@candidate), method: :post, local: true do %>
-          <div class="hrl-field"><label for="date">Date</label><input type="date" name="date" id="date" required></div>
-          <div class="hrl-field"><label for="time">Time</label><input type="time" name="time" id="time" required></div>
+          <% picked = @next_reply %>
+          <% if picked %><p class="hrl-small">They picked <strong><%= picked.preferred_date.strftime("%A, %-d %B") %>, <%= HrLite::HiringReply::SLOTS[picked.preferred_slot] %></strong>. Call to confirm, then send the invite.</p><% end %>
+          <div class="hrl-field"><label for="date">Date</label><input type="date" name="date" id="date" required value="<%= picked&.preferred_date&.iso8601 %>"></div>
+          <div class="hrl-field"><label for="time">Time</label><input type="time" name="time" id="time" required value="<%= HrLite::HiringReply::SLOT_START[picked&.preferred_slot] %>"></div>
           <div class="hrl-field">
             <label for="minutes">Length</label>
             <select name="minutes" id="minutes"><% HrLite::Admin::HiringInterviewsController::LENGTHS.each do |m| %><option value="<%= m %>"><%= m %> minutes</option><% end %></select>
@@ -56,7 +58,7 @@
         <div class="hrl-form-actions hrl-hiring-decide">
           <% (manual - [ "rejected" ]).each do |to| %>
             <%= button_to to.humanize, hr_lite.stage_admin_hiring_candidate_path(@candidate), method: :patch, params: { to: to }, class: "hrl-btn",
-                          form: { data: { turbo_confirm: ("Mark #{@candidate.name} selected? This is final." if to == "selected") } } %>
+                          form: { data: { turbo_confirm: ("Mark #{@candidate.name} #{to.humanize.downcase}?#{" This is final." if to == "selected"}#{" They get the #{to.humanize} email." if HrLite::HiringTemplate::PURPOSES.key?(to)}" if HrLite::HiringTemplate::PURPOSES.key?(to)) } } %>
           <% end %>
         </div>
         <% if manual.include?("rejected") %>
@@ -72,7 +74,7 @@
                 </select>
               </div>
               <div class="hrl-field"><label for="note">Note (needed for “Other”)</label><textarea name="note" id="note" rows="2"></textarea></div>
-              <div class="hrl-form-actions"><button class="hrl-btn hrl-btn--danger" type="submit" data-turbo-confirm="Reject <%= @candidate.name %>? This is final.">Confirm rejection</button></div>
+              <div class="hrl-form-actions"><button class="hrl-btn hrl-btn--danger" type="submit" data-turbo-confirm="Reject <%= @candidate.name %>? This is final. They get the Rejected email.">Confirm rejection</button></div>
             <% end %>
           </details>
         <% end %>
@@ -80,6 +82,45 @@
     <% end %>
   </div>
 
+  <% @replies.each do |reply| %>
+    <section class="hrl-card">
+      <h2 class="hrl-card__title">Round <%= reply.round %> reply</h2>
+      <dl class="hrl-deflist">
+        <% if reply.round == 1 %><dt>Interested</dt><dd><%= reply.answers["interested"] == "yes" ? "Yes" : "No" %></dd><% end %>
+        <% if reply.preferred_slot %><dt>Slot</dt><dd><%= reply.preferred_date.strftime("%A, %-d %B") %>, <%= HrLite::HiringReply::SLOTS[reply.preferred_slot] %></dd><% end %>
+        <% if reply.answers["joining"] %>
+          <dt>Can join</dt><dd><%= HrLite::HiringReply::JOINING[reply.answers["joining"]] %></dd>
+          <% HrLite::HiringReply::YES_NO.each do |key, label| %><dt><%= label %></dt><dd><%= reply.answers[key] == "yes" ? "Yes" : "No" %></dd><% end %>
+        <% end %>
+        <% if reply.round == 3 %>
+          <% { "aadhaar" => [ "Aadhaar", reply.masked_aadhaar ], "pan" => [ "PAN", reply.masked_pan ] }.each do |field, (label, masked)| %>
+            <dt><%= label %></dt>
+            <dd>
+              <% if (full = @revealed&.dig(reply.id, field)) %>
+                <strong><%= full %></strong>
+              <% elsif masked %>
+                <%= masked %>
+                <%= button_to "Show full #{label}", hr_lite.reveal_admin_hiring_candidate_path(@candidate), params: { reply_id: reply.id, field: field }, class: "hrl-btn" %>
+              <% else %>
+                <span class="hrl-badge hrl-badge--warn">PAN pending: collect at joining</span>
+              <% end %>
+            </dd>
+          <% end %>
+          <% if reply.no_salary_slips %><dt>Salary slips</dt><dd>None (fresher)</dd><% end %>
+        <% end %>
+        <% if reply.alternate_phone.present? %><dt>Alternate phone</dt><dd><a class="hrl-btn" href="tel:<%= reply.alternate_phone.gsub(/[^\d+]/, "") %>">Call <%= reply.alternate_phone %></a></dd><% end %>
+        <dt>Replied</dt><dd><%= reply.responded_at.strftime("%-d %b %Y, %-l:%M %p") %></dd>
+      </dl>
+      <% if reply.documents.attached? %>
+        <div class="hrl-form-actions">
+          <% reply.documents.each do |doc| %>
+            <a class="hrl-btn" href="<%= hr_lite.document_admin_hiring_candidate_path(@candidate, attachment_id: doc.id) %>"><%= reply.document_label(doc) %></a>
+          <% end %>
+        </div>
+      <% end %>
+    </section>
+  <% end %>
+
   <section class="hrl-card">
     <h2 class="hrl-card__title">Profile from the sheet</h2>
     <dl class="hrl-deflist">

data/app/views/hr_lite/admin/hiring_templates/_form.html.erb

@@ -1,8 +1,16 @@
 <%= form_with model: template, url: (template.persisted? ? hr_lite.admin_hiring_template_path(template) : hr_lite.admin_hiring_templates_path), local: true do |f| %>
   <%= render "hr_lite/shared/form_errors", record: template %>
-  <div class="hrl-field"><%= f.label :name %><%= f.text_field :name, required: true %></div>
+  <% if template.new_record? && template.purpose %>
+    <input type="hidden" name="hiring_template[purpose]" value="<%= template.purpose %>">
+    <% if params[:candidate_id].present? %><input type="hidden" name="candidate_id" value="<%= params[:candidate_id] %>"><% end %>
+  <% end %>
+  <div class="hrl-field"><%= f.label :name, "Template name" %><%= f.text_field :name, required: true %></div>
   <div class="hrl-field"><%= f.label :subject %><%= f.text_field :subject, required: true %></div>
   <div class="hrl-field"><%= f.label :body, "Message" %><%= f.text_area :body, rows: 16, required: true %></div>
+  <% if HrLite.config.hiring.respond_to?(:draft_email) %>
+    <button class="hrl-btn" type="submit" name="ai" value="1" formnovalidate>Write with AI</button>
+    <p class="hrl-small hrl-muted">Paste or type the email the way you would write it to one person. AI fixes the format, names the template if it has no name yet, writes the subject, and swaps names and offer details for the fields below. Nothing is saved until you click Save.</p>
+  <% end %>
   <h3 class="hrl-small"><strong>Fields, filled per candidate</strong></h3>
   <% HrLite::HiringMerge::GROUPS.each do |group, names| %>
     <p class="hrl-small hrl-muted"><%= group %></p>

data/app/views/hr_lite/admin/hiring_templates/edit.html.erb

@@ -1,5 +1,8 @@
 <% content_for(:page_title) { @template.name } %>
-<div class="hrl-page__head"><h1 class="hrl-page__title"><%= @template.name %></h1></div>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title"><%= @template.name %></h1>
+  <% if @template.purpose %><p class="hrl-page__sub"><span class="hrl-badge">Decision email: <%= HrLite::HiringTemplate::PURPOSES[@template.purpose] %></span> Sent when you click <%= HrLite::HiringTemplate::PURPOSES[@template.purpose] %>. It can be edited, not deleted.</p><% end %>
+</div>
 
 <% if @preview %>
   <div class="hrl-flash <%= @ready == @campaign_size ? "hrl-flash--ok" : "hrl-flash--warn" %>">
@@ -31,6 +34,9 @@
           <span class="hrl-small hrl-muted"><%= HrLite.config.hiring&.sender&.dig(:email) || "The hiring mailbox" %> to <%= @preview_for.email %></span>
         </div>
         <div class="hrl-hiring-preview"><%= @preview.body %></div>
+        <% if (signature = HrLite.config.hiring.try(:signature)).present? %>
+          <div class="hrl-hiring-signature"><%= sanitize(signature) %></div>
+        <% end %>
       </article>
       <p class="hrl-small hrl-muted">Sent as plain text through Gmail, so it lands in the mailbox's Sent folder.</p>
     <% else %>

data/app/views/hr_lite/admin/hiring_templates/index.html.erb

@@ -3,9 +3,30 @@
   <h1 class="hrl-page__title">Hiring email templates</h1>
   <div class="hrl-page__actions"><a class="hrl-btn hrl-btn--primary" href="<%= hr_lite.new_admin_hiring_template_path %>">New template</a></div>
 </div>
+
 <section class="hrl-card">
+  <h2 class="hrl-card__title">Decision emails</h2>
+  <p class="hrl-small hrl-muted">Sent when you click Selected, Rejected or On hold on a candidate. You can edit them; they cannot be deleted.</p>
   <ul class="hrl-feed">
-    <% @templates.each do |template| %>
+    <% decisions = @templates.select(&:purpose).index_by(&:purpose) %>
+    <% HrLite::HiringTemplate::PURPOSES.each do |purpose, label| %>
+      <li class="hrl-feed__item"><div class="hrl-feed__body">
+        <% if (template = decisions[purpose]) %>
+          <a class="hrl-card__link" href="<%= hr_lite.edit_admin_hiring_template_path(template) %>"><%= label %>: <%= template.name %></a>
+          <span class="hrl-feed__meta"><%= template.subject %></span>
+        <% else %>
+          <strong><%= label %></strong> <span class="hrl-badge hrl-badge--warn">Not set</span>
+          <a class="hrl-btn" href="<%= hr_lite.new_admin_hiring_template_path(purpose: purpose) %>">Write the <%= label %> email</a>
+        <% end %>
+      </div></li>
+    <% end %>
+  </ul>
+</section>
+
+<section class="hrl-card">
+  <h2 class="hrl-card__title">Other emails</h2>
+  <ul class="hrl-feed">
+    <% @templates.reject(&:purpose).each do |template| %>
       <li class="hrl-feed__item"><div class="hrl-feed__body">
         <a class="hrl-card__link" href="<%= hr_lite.edit_admin_hiring_template_path(template) %>"><%= template.name %></a>
         <span class="hrl-feed__meta"><%= template.subject %></span>

data/app/views/hr_lite/admin/hiring_templates/new.html.erb

@@ -1,3 +1,6 @@
 <% content_for(:page_title) { "New template" } %>
-<div class="hrl-page__head"><h1 class="hrl-page__title">New hiring email</h1></div>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title"><%= @template.purpose ? "The #{HrLite::HiringTemplate::PURPOSES[@template.purpose]} email" : "New hiring email" %></h1>
+  <% if @template.purpose %><p class="hrl-page__sub">Sent every time someone clicks <%= HrLite::HiringTemplate::PURPOSES[@template.purpose] %> on a candidate. Paste what you would write, then use Write with AI to tidy it and add the fields.</p><% end %>
+</div>
 <section class="hrl-card"><%= render "form", template: @template %></section>

data/app/views/hr_lite/attendance/_penalties.html.erb

@@ -4,7 +4,7 @@
 <section class="hrl-card" id="penalties">
   <h2 class="hrl-card__title">Penalty hours</h2>
   <p><strong><%= hrl_duration(held * 60) %></strong> held · <%= pluralize(hrl_days(HrLite::AttendancePenalty.days_for(held)), "day") %><%= " of #{leave_type.name}" if leave_type %></p>
-  <p class="hrl-hint">Penalties add up until HR removes them.<% if leave_type %> Every 5 hours holds half a day of leave, which can't be applied for.<% end %></p>
+  <p class="hrl-hint">Penalties add up until HR removes them.<% if leave_type %> Every 5 hours holds half a day of leave, which can't be applied for.<% end %> To avoid more, check in by your slot and stay until the required checkout. If a punch was wrong, fix that day and ask HR to remove the penalties it caused.</p>
   <% HrLite::PenaltyRemoval.where(user_id: user.id).includes(:removed_by).order(created_at: :desc).each do |removal| %>
     <div class="hrl-feed__item hrl-small"><div class="hrl-feed__body">Removed <%= hrl_duration(removal.minutes * 60) %> on <%= removal.created_at.strftime("%-d %b %Y") %> by <%= hr_display_name(removal.removed_by) %>: <%= removal.reason %></div></div>
   <% end %>
@@ -16,7 +16,7 @@
     <% end %>
   <% end %>
 </section>
-<% penalties = HrLite::AttendancePenalty.where(user_id: user.id, date: month.all_month).order(:date, :id) %>
+<% penalties = HrLite::AttendancePenalty.where(user_id: user.id, date: month.all_month).includes(:attendance_record).order(:date, :id) %>
 <section class="hrl-card">
   <h2 class="hrl-card__title">Penalties in <%= month.strftime("%B") %></h2>
   <% if penalties.empty? %>
@@ -25,13 +25,19 @@
   <% penalties.each do |penalty| %>
     <div class="hrl-feed__item hrl-small">
       <div class="hrl-feed__body">
-        <strong><%= penalty.date.strftime("%a %-d %b") %></strong> ·
-        <span class="<%= class_names("hrl-badge", penalty.removed_at ? "hrl-badge--muted" : "hrl-badge--warn") %>">+<%= penalty.minutes %> min</span>
-        <%= penalty.label %>
+        <details class="hrl-why">
+          <summary>
+            <span><strong><%= penalty.date.strftime("%a %-d %b") %></strong> ·
+            <span class="<%= class_names("hrl-badge", penalty.removed_at ? "hrl-badge--muted" : "hrl-badge--warn") %>">+<%= penalty.minutes %> min</span>
+            <%= penalty.label %></span>
+            <%= hrl_icon("Info") %><span class="hrl-sr-only">Why?</span>
+          </summary>
+          <div class="hrl-muted"><%= penalty.cause %></div>
+        </details>
         <% if penalty.removed_at %>
           <div class="hrl-muted">Removed by HR: <%= penalty.removal_reason %></div>
         <% elsif local_assigns[:removable] %>
-          <%= form_with url: hr_lite.remove_penalty_admin_attendance_path(user.id, penalty_id: penalty.id), method: :post, local: true, class: "hrl-row" do %>
+          <%= form_with url: hr_lite.remove_penalty_admin_attendance_path(user.id, penalty_id: penalty.id), method: :post, local: true, class: "hrl-row hrl-mt" do %>
             <label class="hrl-sr-only" for="hrl-remove-<%= penalty.id %>">Reason to remove</label>
             <input type="text" class="hrl-input" name="removal_reason" id="hrl-remove-<%= penalty.id %>" required placeholder="Reason to remove">
             <button type="submit" class="hrl-btn">Remove</button>

data/app/views/hr_lite/hiring_replies/show.html.erb

@@ -0,0 +1,112 @@
+<% campaign = @candidate.campaign %>
+<% round = @reply.round %>
+<% content_for(:page_title) { campaign.position } %>
+<div class="hrl-page__head">
+  <h1 class="hrl-page__title"><%= campaign.position %></h1>
+  <p class="hrl-page__sub">This form is for <strong><%= @candidate.name %></strong>. Hi <%= @candidate.first_name %>, <%= round == 1 ? "thank you for your interest." : "congratulations on reaching round #{round}." %></p>
+</div>
+
+<% if @reply.responded_at %>
+  <section class="hrl-card">
+    <h2 class="hrl-card__title">Thanks, we have your answers</h2>
+    <p><%= @reply.answers["interested"] == "no" ? "We have noted that you do not want to go ahead. All the best." : "Our HR team will call you to confirm your round #{round} interview slot." %></p>
+  </section>
+<% else %>
+  <%= form_with url: hr_lite.hiring_reply_path(@reply.token), method: :post, local: true, multipart: true do %>
+    <section class="hrl-card">
+      <div class="hrl-field">
+        <label for="email">Your email (the one this link was sent to)</label>
+        <input type="email" name="email" id="email" autocomplete="email" required value="<%= params[:email] %>">
+      </div>
+    </section>
+
+    <% if round == 1 %>
+      <section class="hrl-card">
+        <fieldset class="hrl-field">
+          <legend><strong>Do you want to go ahead with the interview?</strong></legend>
+          <label class="hrl-field--check"><input type="radio" name="interested" value="yes" required <%= "checked" if params[:interested] == "yes" %>> Yes, I am interested</label>
+          <label class="hrl-field--check"><input type="radio" name="interested" value="no" <%= "checked" if params[:interested] == "no" %>> No, not now</label>
+        </fieldset>
+      </section>
+    <% end %>
+
+    <section class="hrl-card">
+      <h2 class="hrl-card__title"><%= round == 1 ? "If yes: pick" : "Pick" %> a day and one time slot for round <%= round %></h2>
+      <p class="hrl-small hrl-muted">Each slot is 2 hours. HR will call you to confirm.</p>
+      <fieldset class="hrl-field">
+        <legend>Day</legend>
+        <% HrLite::HiringReply.dates(allow_sunday: campaign.allow_sunday).each do |day| %>
+          <label class="hrl-field--check"><input type="radio" name="date" value="<%= day.iso8601 %>" <%= "checked" if params[:date] == day.iso8601 %>> <%= day.strftime("%A, %-d %B") %></label>
+        <% end %>
+      </fieldset>
+      <fieldset class="hrl-field">
+        <legend>Time slot</legend>
+        <% HrLite::HiringReply::SLOTS.each do |key, label| %>
+          <label class="hrl-field--check"><input type="radio" name="slot" value="<%= key %>" <%= "checked" if params[:slot] == key %>> <%= label %></label>
+        <% end %>
+      </fieldset>
+      <div class="hrl-field">
+        <label for="alternate_phone">Alternate phone number (optional)</label>
+        <input type="tel" name="alternate_phone" id="alternate_phone" inputmode="tel" autocomplete="tel" value="<%= params[:alternate_phone] %>">
+      </div>
+    </section>
+
+    <% if round == 1 %>
+      <section class="hrl-card">
+        <fieldset class="hrl-field">
+          <legend>How soon can you join?</legend>
+          <% HrLite::HiringReply::JOINING.each do |key, label| %>
+            <label class="hrl-field--check"><input type="radio" name="joining" value="<%= key %>" <%= "checked" if params[:joining] == key %>> <%= label %></label>
+          <% end %>
+        </fieldset>
+        <% { "stipend_ok" => "Are you fine with the monthly stipend#{" of #{campaign.stipend}" if campaign.stipend.present?}?",
+             "location_ok" => "Can you work from our office#{" at #{campaign.location}" if campaign.location.present?}?",
+             "schedule_ok" => "Are you fine with the work schedule#{": #{campaign.schedule}" if campaign.schedule.present?}?",
+             "programme_ok" => "Can you commit to the full programme#{" (#{campaign.programme})" if campaign.programme.present?}?" }.each do |key, question| %>
+          <fieldset class="hrl-field">
+            <legend><%= question %></legend>
+            <label class="hrl-field--check"><input type="radio" name="<%= key %>" value="yes" <%= "checked" if params[key] == "yes" %>> Yes</label>
+            <label class="hrl-field--check"><input type="radio" name="<%= key %>" value="no" <%= "checked" if params[key] == "no" %>> No</label>
+          </fieldset>
+        <% end %>
+      </section>
+    <% end %>
+
+    <% if round == 3 %>
+      <section class="hrl-card">
+        <h2 class="hrl-card__title">Joining details</h2>
+        <p class="hrl-small hrl-muted">Stored encrypted. Only our HR team can see them.</p>
+        <div class="hrl-field">
+          <label for="aadhaar_number">Aadhaar number</label>
+          <input type="text" name="aadhaar_number" id="aadhaar_number" inputmode="numeric" autocomplete="off" maxlength="14" required>
+        </div>
+        <div class="hrl-field">
+          <label for="pan_number">PAN</label>
+          <input type="text" name="pan_number" id="pan_number" autocomplete="off" maxlength="10" autocapitalize="characters">
+        </div>
+        <label class="hrl-field--check"><input type="checkbox" name="pan_pending" value="1" <%= "checked" if params[:pan_pending] == "1" %>> I don't have a PAN yet (HR will ask for it when you join)</label>
+        <label class="hrl-field--check"><input type="checkbox" name="no_salary_slips" value="1" <%= "checked" if params[:no_salary_slips] == "1" %>> I have no salary slips (fresher)</label>
+      </section>
+    <% end %>
+
+    <% kinds = HrLite::HiringReply::DOCUMENTS.fetch(round, {}) %>
+    <% if kinds.any? %>
+      <section class="hrl-card">
+        <h2 class="hrl-card__title">Your documents</h2>
+        <p class="hrl-small hrl-muted">PDF, JPG or PNG, up to 5 MB each. Stored encrypted.<%= " Skip PAN or salary slips if you ticked the box above." if round == 3 %></p>
+        <% kinds.each do |kind, label| %>
+          <div class="hrl-field">
+            <label for="doc_<%= kind %>"><%= label %><%= " (if you have it)" if kind.start_with?("salary_slip", "pan") %></label>
+            <input type="file" name="documents[<%= kind %>]" id="doc_<%= kind %>" accept=".pdf,.jpg,.jpeg,.png" <%= "required" unless kind.start_with?("salary_slip", "pan") %>>
+          </div>
+        <% end %>
+      </section>
+    <% end %>
+
+    <% if round == 3 %>
+      <label class="hrl-field--check"><input type="checkbox" name="consent" value="1" required> I agree to share these details and documents with <%= HrLite.config.company.call[:brand].presence || "the company" %> for hiring and joining.</label>
+    <% end %>
+
+    <div class="hrl-form-actions"><button class="hrl-btn hrl-btn--primary" type="submit">Send my answers</button></div>
+  <% end %>
+<% end %>

data/app/views/layouts/hr_lite/application.html.erb

@@ -121,6 +121,7 @@
   <%= javascript_include_tag "hr_lite/mention", defer: true %>
   <%= javascript_include_tag "hr_lite/nav", defer: true %>
 <%= javascript_include_tag "hr_lite/select_filter", defer: true %>
+<%= javascript_include_tag "hr_lite/select_all", defer: true %>
 <%= javascript_include_tag "hr_lite/search", defer: true %>
 <dialog class="hrl-search" data-hrl-search aria-label="Search">
   <form method="dialog" class="hrl-search__close"><button class="hrl-btn" type="submit">Close</button></form>

data/app/views/layouts/hr_lite/public.html.erb

@@ -0,0 +1,21 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <% company = HrLite.config.company.call %>
+  <title><%= [ content_for(:page_title), company[:brand].presence || company[:name] ].compact.join(" · ") %></title>
+  <meta name="viewport" content="width=device-width, initial-scale=1, viewport-fit=cover">
+  <meta name="robots" content="noindex, nofollow">
+  <%= csrf_meta_tags %>
+  <%= csp_meta_tag %>
+  <%= stylesheet_link_tag "hr_lite/hr_lite", media: "all" %>
+  <% HrLite.config.extra_stylesheets.each do |sheet| %><%= stylesheet_link_tag sheet, media: "all" %><% end %>
+</head>
+<body class="hrl-body">
+  <main id="hrl-main" class="hrl-public">
+    <% if company[:logo_url].present? %><img class="hrl-public__logo" src="<%= company[:logo_url] %>" alt="<%= company[:brand].presence || company[:name] %>"><% end %>
+    <% if flash[:alert].present? %><div class="hrl-flash hrl-flash--warn" role="alert"><%= flash[:alert] %></div><% end %>
+    <%= yield %>
+  </main>
+  <%= javascript_include_tag "hr_lite/confirm", defer: true %>
+</body>
+</html>

data/config/routes.rb

@@ -69,6 +69,10 @@ HrLite::Engine.routes.draw do
   get "career", to: "career#show"
   resources :appraisals, only: %i[index show]
 
+  # A candidate's reply page for one round, from @round1_link … @round3_link (no login: the token is the key).
+  get "apply/:token", to: "hiring_replies#show", as: :hiring_reply
+  post "apply/:token", to: "hiring_replies#create"
+
   namespace :admin do
     resources :policies, only: %i[index new create]
     resources :hiring_campaigns, except: %i[destroy] do
@@ -76,7 +80,7 @@ HrLite::Engine.routes.draw do
       resources :hiring_sends, path: "send", only: %i[new create]
     end
     resources :hiring_candidates, only: %i[show] do
-      member { patch :stage }
+      member { patch :stage; get :document; post :reveal }
       resources :hiring_interviews, path: "interviews", only: %i[create update destroy]
     end
     resources :hiring_templates, except: %i[show destroy]

data/db/migrate/20261022090000_create_hr_lite_hiring_replies.rb

@@ -0,0 +1,26 @@
+class CreateHrLiteHiringReplies < ActiveRecord::Migration[8.1]
+  # One reply link per candidate per interview round: their answers, the day
+  # and 2-hour slot they picked, an optional alternate phone, and (from round
+  # 2) their documents through Active Storage, stored encrypted. Round 3 adds
+  # the joining KYC: Aadhaar, PAN (or "PAN pending") and salary slips.
+  def change
+    create_table :hr_lite_hiring_replies do |t|
+      t.references :candidate, null: false, foreign_key: { to_table: :hr_lite_hiring_candidates }
+      t.integer :round, null: false
+      t.string :token, null: false
+      t.json :answers, null: false, default: {}
+      t.text :alternate_phone
+      t.text :aadhaar_number
+      t.text :pan_number
+      t.boolean :pan_pending, null: false, default: false
+      t.boolean :no_salary_slips, null: false, default: false
+      t.date :preferred_date
+      t.string :preferred_slot
+      t.datetime :responded_at
+      t.timestamps
+    end
+    add_index :hr_lite_hiring_replies, :token, unique: true
+    add_index :hr_lite_hiring_replies, %i[candidate_id round], unique: true
+    add_index :hr_lite_hiring_replies, %i[preferred_date preferred_slot]
+  end
+end

data/db/migrate/20261022090100_add_allow_sunday_to_hr_lite_hiring_campaigns.rb

@@ -0,0 +1,6 @@
+class AddAllowSundayToHrLiteHiringCampaigns < ActiveRecord::Migration[8.1]
+  # Sunday is off; HR can open it for one campaign's interview slots.
+  def change
+    add_column :hr_lite_hiring_campaigns, :allow_sunday, :boolean, null: false, default: false
+  end
+end

data/db/migrate/20261022120000_add_purpose_to_hr_lite_hiring_templates.rb

@@ -0,0 +1,8 @@
+class AddPurposeToHrLiteHiringTemplates < ActiveRecord::Migration[8.1]
+  # The email a decision button sends (selected / rejected / on_hold). One per
+  # purpose; nil for ordinary templates.
+  def change
+    add_column :hr_lite_hiring_templates, :purpose, :string
+    add_index :hr_lite_hiring_templates, :purpose, unique: true, where: "purpose IS NOT NULL"
+  end
+end

data/lib/hr_lite/version.rb

@@ -1,3 +1,3 @@
 module HrLite
-  VERSION = "0.61.0"
+  VERSION = "0.64.0"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: hr_lite
 version: !ruby/object:Gem::Version
-  version: 0.61.0
+  version: 0.64.0
 platform: ruby
 authors:
 - kshitiz sinha
@@ -75,6 +75,7 @@ files:
 - app/assets/javascripts/hr_lite/photo_crop.js
 - app/assets/javascripts/hr_lite/print.js
 - app/assets/javascripts/hr_lite/search.js
+- app/assets/javascripts/hr_lite/select_all.js
 - app/assets/javascripts/hr_lite/select_filter.js
 - app/assets/javascripts/hr_lite/share.js
 - app/assets/javascripts/hr_lite/tax_preview.js
@@ -141,6 +142,7 @@ files:
 - app/controllers/hr_lite/documents_controller.rb
 - app/controllers/hr_lite/employee_profiles_controller.rb
 - app/controllers/hr_lite/expenses_controller.rb
+- app/controllers/hr_lite/hiring_replies_controller.rb
 - app/controllers/hr_lite/holidays_controller.rb
 - app/controllers/hr_lite/home_controller.rb
 - app/controllers/hr_lite/hr_requests_controller.rb
@@ -215,6 +217,7 @@ files:
 - app/models/hr_lite/hiring_candidate.rb
 - app/models/hr_lite/hiring_interview.rb
 - app/models/hr_lite/hiring_message.rb
+- app/models/hr_lite/hiring_reply.rb
 - app/models/hr_lite/hiring_template.rb
 - app/models/hr_lite/holiday.rb
 - app/models/hr_lite/hr_request.rb
@@ -407,6 +410,7 @@ files:
 - app/views/hr_lite/event_mailer/leadership.text.erb
 - app/views/hr_lite/expenses/index.html.erb
 - app/views/hr_lite/expenses/new.html.erb
+- app/views/hr_lite/hiring_replies/show.html.erb
 - app/views/hr_lite/holidays/_next_holiday.html.erb
 - app/views/hr_lite/holidays/index.html.erb
 - app/views/hr_lite/home/_today_checkins.html.erb
@@ -457,6 +461,7 @@ files:
 - app/views/layouts/hr_lite/mailer.html.erb
 - app/views/layouts/hr_lite/mailer.text.erb
 - app/views/layouts/hr_lite/pdf.html.erb
+- app/views/layouts/hr_lite/public.html.erb
 - config/routes.rb
 - db/migrate/20260718190726_create_hr_lite_kudos.rb
 - db/migrate/20260718190727_create_hr_lite_kudo_mentions.rb
@@ -540,6 +545,9 @@ files:
 - db/migrate/20261021100300_create_hr_lite_hiring_messages.rb
 - db/migrate/20261021100400_create_hr_lite_hiring_interviews.rb
 - db/migrate/20261021100500_seed_hr_lite_hiring.rb
+- db/migrate/20261022090000_create_hr_lite_hiring_replies.rb
+- db/migrate/20261022090100_add_allow_sunday_to_hr_lite_hiring_campaigns.rb
+- db/migrate/20261022120000_add_purpose_to_hr_lite_hiring_templates.rb
 - lib/generators/hr_lite/install/install_generator.rb
 - lib/generators/hr_lite/install/templates/AFTER_INSTALL
 - lib/generators/hr_lite/install/templates/initializer.rb