* feat(agi): refactor AGI XML generation and data handling
- Remove deprecated AGI field codes from field-codes.ts.
- Update generate-declaration.ts to include new employee fields and handle absence data with stable specification numbers.
- Enhance XML generation in xml-generator.ts to support new flags for housing benefits and adjusted benefits.
- Introduce new database migrations to support:
- `removed_from_agi` flag for tombstoning individuppgifter.
- `benefits_adjusted` flag for tracking adjustments to benefits.
- `franvaro_specifikationsnummer` for stable absence event identification.
- `housing_benefit_type` to differentiate between housing benefit types.
* feat: Implement strict validation for AGI employee data and introduce pre-flight validation schemas
- Added Zod schemas for validating employee data in AGI declarations to ensure all required fields are present and correctly typed, preventing silent errors during processing.
- Introduced AGI pre-flight validation schemas for Skatteverket endpoints to validate individual and head unit submissions before sending to the API.
- Created a new audit log table for tracking all outbound calls to Skatteverket, ensuring compliance and traceability for AGI and moms submissions.
- Implemented advisory locks in the database to manage concurrent updates to absence specification numbers, enhancing data integrity.
- Added compliance documentation for GDPR processing activities related to AGI and moms submissions, detailing data handling and retention policies.
* feat: Extend DELETE RLS policy to protect 'declined' signatures in årsredovisning
* fix: Update date handling in salary absence migrations to use immutable year-month key
* fix: Update SELECT policy in skatteverket_api_audit_log to use IN clause for company_id
* feat: Add skatteverket_api_audit_log and salary_absence_franvaro_audit tables with RLS policies and immutable triggers
* feat(enable-banking): add support for account selection and syncing
- Updated StoredAccount interface to include an 'enabled' flag for account syncing preferences.
- Enhanced ensureFiscalPeriod function to handle overlapping fiscal periods with posted entries and opening balances.
- Added tests for fiscal period validation and account syncing logic.
- Implemented AccountPickerDialog component for user account selection.
- Created API routes for PATCH /accounts and POST /sync to manage account syncing.
- Introduced 'pending_selection' status for bank connections to allow user account selection before syncing.
- Updated database migration to support new connection status and backfill existing accounts with enabled=true.
* feat(enable-banking): implement account selection and consent event logging
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(compliance): consume erp-mafia/compliancemaxx@v1
Adds the consumer side of the new compliancemaxx orchestrator:
- .github/workflows/compliance-pr.yml — single-job advisory check
that calls `uses: erp-mafia/compliancemaxx@v1` on every PR.
Threshold + skill selection live in .compliance/config.yml.
`fail-on-findings: false` keeps it strictly advisory while findings
bed in; flip to true after triage.
- .compliance/config.yml — bootstrap config: all 5 skills enabled
(oss-license, owasp-asvs-v5, iso-27001-2022, soc2, gdpr),
severity_threshold_to_block=critical, no suppressions yet.
The orchestrator code, skill manifests, and reference docs live in the
new public repo: https://github.com/erp-mafia/compliancemaxx
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore: retrigger compliance check
* chore(compliance): add full-swarm workflow (nightly + dispatch + label)
Adds the LLM-powered deep_audit alongside the existing PR-mode advisory
check. Triggers:
- 02:00 UTC nightly cron
- workflow_dispatch (manual)
- PRs labeled `compliance:full-audit`
Authenticates to AWS Bedrock via the existing AWS_ACCESS_KEY_ID/SECRET
repo secrets (same path swedish-compliance-review.yml already uses).
`fail-on-findings: false` keeps it observational while findings bed in.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mattsson