* fix(skattekonto): route AGI draw back to 2731 to match salary module (#1870)
Migration 20260519160000 moved the skattekonto AGI seed to 2730 while the
salary module kept crediting 2731, splitting the employer-contribution
liability across two accounts that never net at account level (both carry
SRU 7231, so only huvudbok reconciliation exposes the drift). Revert the
system seed to 2731: BAS 2026 defines 2731 as the reported-but-unpaid
arbetsgivaravgift liability (the accrual account is 2940), and the salary
ore-residual logic is built around 2731.
Historical 2730 debits since 2026-05-19 are left for per-company reclass
verifikat; the migration touches the system seed only.
Fixes#1870
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(skattekonto): bump migration version to avoid collision with 20260825120000_create_company_for_user
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(payroll): align remaining 2730 guidance surfaces on 2731 (#1870)
Skeptic regression finding: companies booking salary manually were taught
7510/2730 by in-product guidance, so the seed revert alone would re-create
the #1870 split mirrored for them. Align every guidance surface on 2731:
- packs/loneutbetalning.yaml legal_note
- MCP payroll-monthly skill (booking recipe and rate notes)
- swedish-payroll SKILL.md + references/bas-7xxx.md (2731 convention, 2730
group-account alternative, never mixed; accrual is 2940) + regenerated
agent atom seed (skills:generate -> 20260825180001)
- public/docs/systemdokumentation-mall.md
Also addresses the compliance review finding that the swedish-payroll skill
contradicted the migration.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* docs(legal): align in-repo privacy and DPA pages with actual AI subprocessor facts
The published marketing-site DPA claimed Anthropic PBC and OpenAI Inc (USA)
as AI subprocessors. Ground truth: AI inference runs Anthropic Claude models
operated by AWS via Amazon Bedrock in eu-north-1 (Stockholm); no data is sent
to Anthropic as a company and there is no third-country transfer. This commit
updates the in-repo /privacy and /dpa pages to state that fact explicitly,
discloses PostHog deny-by-default session-replay masking, and bumps the
last-updated dates to 2026-08-20. The marketing-site pages are outside this
repo and still need manual edits.
Part of #1674
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(legal): fix systemdokumentation AI integration row, defer page wording to #1766
Resolves the CodeRabbit findings on PR #1770 in one pass:
- public/docs/systemdokumentation-mall.md said transaction and document
data flows Accounted -> Anthropic -> Accounted. Corrected to Amazon
Bedrock (AWS, eu-north-1 Stockholm) with Anthropic Claude models
running inside Bedrock; data does not leave the EU.
- The privacy and DPA page edits this PR originally carried are dropped:
PR #1766 merged the same #1674 alignment first with wording pinned by
app/(public)/privacy/__tests__/ai-and-replay-disclosures.test.ts,
which forbids the DPA naming Anthropic and forbids the Bedrock row
asserting sub-processor status either way. Both pages are now
byte-identical to main.
Part of #1674
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* docs(legal): self-host note in systemdokumentation template AI row
Swedish compliance review on PR #1770: the blanket 'datan lamnar inte EU'
claim in the Amazon Bedrock integration row is only true for the hosted
default configuration. A self-hosted operator running AI_PROVIDER=anthropic
or a custom AI_BASE_URL endpoint who fills in this template unchanged would
produce systemdokumentation that misstates the data flow (BFNAR 2013:2
kap 8 requires the documentation to describe the actual system). Adds a
bracketed template note, in the same style as the existing integrations
placeholder, telling self-hosted operators to update the row to their
actual provider, region and data flow.
Part of #1674
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
PR 2 of the behandlingshistorik plan (stacked on #1787).
- lib/reports/behandlingshistorik-pdf-template.tsx: landscape A4 react-pdf
document. Fixed header (räkenskapsår, urval, legal reference, company) and
footer (page x of y, generated in Europe/Stockholm), repeated table header,
wrap={false} rows, no `break` props. Two sections in the order the reader
needs them: "Ändringar i bokföringssystemet" (p. 9.16 second paragraph)
then "Bokföringsposter i registreringsordning" (first paragraph). Meta row:
generated, programversion, antal händelser, källor. Details as one wrapped
paragraph per row (real-data render 371 events: 1.5 s, 23 pages). Glyphs the
bundled Helvetica lacks (arrow, true minus) are mapped to ASCII.
- GET /api/reports/behandlingshistorik?format=pdf with a 4 000-event guard
(413 REPORT_PDF_TOO_LARGE, CSV/XLSX remain complete); PDF first in the
export menu; catalog exports pdf+xlsx.
- lib/reports/app-version.ts shared by the route and the archive:
revision/systemdokumentation.json now carries system.version and a
behandlingshistorik block (where and how it is produced, p. 9.15); the
shipped systemdokumentation template §9.3 points at Rapporter >
Behandlingshistorik (PDF/CSV/Excel) as well as the backup ZIP.
- Settings values that are objects render as "key: value" pairs in every
format; report carries category_filter so the document states its urval.
- Tests: 4 PDF template tests (valid PDF, empty report, filtered range,
220-row pagination), route pdf 200 + 413, route "unknown format" moved off
pdf. Prod read-only render verified visually (header, sections, paging).
Claude-Session: https://claude.ai/code/session_01Kw2CFCEt8MxzbJiXMAgMVi
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
The downloadable BFL 5 kap. 11 § template (Hjälp > Dokumentmallar) had not
been touched since March and had drifted into describing a system we no
longer run. Users archive this document as räkenskapsinformation for 7
years, so the wrong facts were being filed as compliance evidence.
Corrected against the code:
- Auth was "Magic link via e-post (lösenordsfri)". It is e-post + lösenord
with TOTP two-factor, plus optional BankID (lib/auth/require-auth.ts,
lib/auth/bankid.ts).
- Access control claimed "en användare kan enbart se och redigera sin egen
data" with a single "Kontoägare" role. Data is company-scoped via RLS and
there are four roles, owner/admin/member/viewer
(20260330130000_multi_tenant_company_refactor.sql).
- Rättelse described storno only. Inline rättelse in the same verifikat has
existed since 20260723210000_verifikat_inline_rattelse.sql; the template
now documents both tracks and the rule that a locked or closed period
leaves storno as the only route.
- Voucher numbering claimed uniqueness "per räkenskapsår och användare" and
a single series. It is per company, fiscal year and series, and the series
is configurable per source type (lib/bookkeeping/engine.ts).
- Product is Accounted, not erp-base (lib/branding/service.ts).
- OpenAI is listed as an embeddings integration; only a stray env var
remains in lib/init.ts. Removed. Added Skatteverket, BankID and PostHog,
which were missing.
- Navigation paths were pre-redesign: Kontoplan is under Data, moms under
Skatt, and behandlingshistorik exports from Importera/Exportera >
Säkerhetsbackup, not the "Rapporter > Audit trail" that does not exist.
- BAS 2025/2026 -> BAS 2026.
Added the sections a systemdokumentation needs and this one lacked: API
keys and machine access (external agents can write to the ledger under
scoped keys and are logged as the actor), löner/AGI, anläggningsregister,
periodiseringar and dimensioner as delsystem, and säkerhetskopiering.
The granular "BFNAR 2013:2 punkt 9.x" citations are dropped rather than
renumbered; see DECISIONS.md.
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Broad update across dashboard pages, components, extensions, and lib code. Includes ESLint config additions, onboarding flow redesign, settings page refactor, help page content expansion, dead code removal, and test mock fixes. Adds dev docs and public assets.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Mattsson