# Open SafetyLog EHS Roadmap

A free, open-source (AGPL-3.0) accident and safety tracking system for manufacturing.

This is a living document. Update it as decisions are made or scope changes.

## Decisions

| Topic | Decision | Status |
| --- | --- | --- |
| License | AGPL-3.0-only | Decided |
| Frontend | React + Vite + TypeScript, Tailwind CSS v4 | Decided |
| Backend | Node (Fastify or Hono) + PostgreSQL + Drizzle ORM, shared Zod schemas | Proposed |
| Deployment | Self-hosted, single `docker compose up` (app + Postgres + file storage) | Proposed |
| Compliance scope | US OSHA first; data model kept extensible for other regions (e.g. RIDDOR) | Proposed |
| CI | Gitea Actions (`.gitea/workflows`): lint, typecheck, unit tests, build, e2e | Decided |
| Product name | Open SafetyLog EHS (replaced placeholder "IA Tracker" and the prototype's "Safesite" branding) | Decided |

## Phase 0: Foundation

- [x] AGPL-3.0 LICENSE
- [x] Convert to TypeScript
- [x] Split `App.jsx` into `pages/`, `components/`, `lib/`
- [x] Convert styling to Tailwind (remove hand-written `App.css`)
- [x] Remove unused template files
- [x] Bundle fonts locally (no Google Fonts dependency for offline/locked-down plant networks)
- [x] CI: lint, typecheck, unit tests (Vitest), build, e2e (Playwright)
- [x] Replace template README
- [x] CONTRIBUTING.md and CODE_OF_CONDUCT.md
- [x] About page with source-code link (AGPL section 13)
- [ ] Remaining setup items (name, CoC contact, final source URL, CI runner): see [TODO.md](TODO.md)

## Phase 1: Backend and data model

- Entities: Organization, Site → Area (location tree), User, Role, Incident (type, severity, status, timestamps, reporter or anonymous), InjuredPerson and injury details, Attachment, Investigation, RootCause, CorrectiveAction, Comment, AuditLog, HoursWorked
- Auth: email/password and magic links; SSO/OIDC later; role-based permissions
- REST API with pagination, filtering and sequential incident numbering

## Phase 2: Core workflow (MVP)

- Reporting that saves to the database, with photo upload
- Incident detail page: timeline, investigation, root-cause tools (5 Whys, fishbone), corrective actions (CAPA)
- Status workflow: Reported → Triage → Investigation → Corrective actions → Verification → Closed, with role-based transitions
- "My actions" list and overdue tracking
- Email notifications: assignment, due dates, high-severity alerts
- CSV and PDF export
- Dashboard metrics computed from real data

## Phase 3: Shop-floor reporting

- Installable PWA with offline queue (sync when connection returns)
- Printable QR codes per area that pre-fill the location
- Kiosk mode and anonymous reporting
- Multi-language support, Spanish first

## Phase 4: Compliance (US OSHA)

- Recordability wizard; days away / restricted / transferred tracking
- OSHA 300, 300A and 301 form generation; privacy-case handling
- ITA (Injury Tracking Application) CSV export
- Hours worked per site per month; TRIR, DART and lost-time rates

## Phase 5: Analytics

- Trends, location breakdown, top root causes, corrective-action closure time
- Leading vs lagging indicators; filters and saved dashboards

## Phase 6: Release v1.0

- Docker images, backup and restore
- Demo instance with seed data
- Documentation site and upgrade guide

## Later

Inspections and audit checklists, job safety analysis (JSA), training and certification records, management of change, SDS links, public API and webhooks.

## Known prototype gaps (to be resolved in Phases 1–2)

- All data is in memory and resets on refresh
- Dashboard, analytics and location figures are hardcoded
- Export, Add location, Settings, Resources, search, notifications and workspace switcher are non-functional