Skip to content
SecoSOLVA

Build record

Changelog

Every increment of this platform, newest first — what was built, what it changed, and what it withholds.

  1. 0.15

    Seco brand applied end to end

    The prototype's working palette is replaced by the approved Seco identity — Brand Guidelines V9, Offline Assets Guidelines V6 and the English Style Guide — without touching a single component's structure. Token names are unchanged; their values are now the brand's.

    • ChangedPrimary palette only: Seco Blue #006CEA, Seco Yellow #FFB000, Seco Red #FF0000, White, Gray 1/2/3 and Black. No gradients, no colored backgrounds, no color on running type.
    • ChangedTypography is Roobert PRO with Arial as the sanctioned substitute; no webfont is loaded. Brand tracking applied (-8 headline, -10 body) and all-caps type removed, including stage names and labels.
    • ChangedCorners squared to 0 radius — the brand's clean sharp edges — and the Tri-Band lock-up now sits in both the portal top bar and the anonymous header. The wordmark never appears without the symbol.
    • ChangedCopy corrected to house style: the brand is Seco, never SECO in all caps. Seco Tools is reserved for the legal name.
    • SecurityStatus colors keep an AA-safe ink variant for text and glyphs so brand yellow, red and green never carry meaning at unreadable contrast.
    • Docsdocs/brand/tokens.json rewritten to mirror the brand tokens exactly, with the rules that govern them.

  2. 0.14

    Guided tutorials with narration and spotlight

    Narrated, self-advancing tours that walk the real screens and highlight the part of the page they are talking about — the portal explaining itself, rather than a training deck nobody opens.

    • Added/tutorials — four tours: portal walkthrough, project record and action log, enquiries and feedback, and the review instrument. Progress, resume and reset per tour.
    • AddedSpotlight overlay: the page dims except the anchored element, which keeps a carbide ring. The popup follows the target and waits for it when a step navigates first.
    • AddedNarration player with an autoplay preference — when the audio ends the tour advances itself. Mute and autoplay are remembered between sessions.
    • Changeddata-tour anchors added to the top bar, project list, gate rail, record header, summary strip, tabs, action log, enquiry form and list, feedback form, and the review instrument.
    • SecurityTours never navigate anywhere the viewer may not go: a step's project is resolved from the signed-in viewer's own project list, and the tutorial store holds preferences only — never identity or permission.

  3. 0.13

    Handover documentation and the security sweep

    The prototype was frozen for handover: every schema, permission and route decision written down, and the permission model tested exhaustively rather than by sample.

    • SecurityExhaustive leak sweep across 3,984 projections for 1,976 seeded viewers — no cross-account data reachable in any projection.
    • SecurityFixed a real defect found by the sweep: internal columns were present in the raw payload of a project projection even though no UI rendered them.
    • Docsdocs/data-model/ — SCHEMA.md, ERD.md, CHOICES.md, SCHEMA_ADDITIONS.md and the full SECURITY.md permission matrix with relationship paths.
    • Docsdocs/handover/ — ROUTE_ACCESS.md, WEB_API.md, DATA_ACCESS.md, RESPONSIVE.md, COMPONENTS.md, STATE.md and 21 verified TEST_SCENARIOS.md walkthroughs.
    • Docsdocs/brand/tokens.json and HANDOVER.md, mirroring the design tokens for the Power Pages team.
    • Removed46 unused shadcn components carrying hardcoded colours or local storage were deleted from the tree.

  4. 0.12

    The review instrument

    A UAT-only screen that renders a project exactly as a chosen external viewer would see it, next to the list of everything withheld and why.

    • Added/review/as-seen-by — pick a project and a seeded external, see the header, gate rail, actions, documents, proposals and plan they would get.
    • AddedExclusions panel: internal-only actions with counts, superseded proposals with counts, financials (unconditional), restricted-project documents, internal notes, internal effort estimates.
    • AddedassertNoCrossAccountLeak runs live against the projection and reports its result on screen.
    • SecurityFeature-flagged off in production and documented as must-remove-before-go-live in docs/handover/REVIEW_INSTRUMENT.md.

  5. 0.11

    The anonymous surface

    Public pages in a wider, calmer composition: one column, generous rhythm, no dense tables and no rail.

    • Added/ landing, /how-it-works using the gate rail as a teaching device, /support.
    • Added/privacy, /terms and /accessibility as honest placeholders — no invented legal copy.
    • Added/sign-in as a handoff to Sandvik tenant auth, not a credentials form.
    • ChangedThe authenticated project list moved to /projects so / could become anonymous.
    • SecurityZero-fetch rule enforced: no public route reaches src/services/dataverse. Routing decision recorded in docs/handover/ROUTE_ACCESS.md.

  6. 0.10

    Closure feedback and the closure notice

    Feedback at closure is mandatory in this process and completion sits near 85%. The design goal was to lift it: short, one screen, under two minutes.

    • Added/projects/:id/feedback — outcome against expectation, the working relationship, what they'd change, with free text given prominence rather than a trailing box.
    • AddedNomination model: the ask goes to the customer where the customer can be asked, otherwise to the requesting salesperson.
    • AddedClosure summary on the project page: what was delivered, final milestone dates, where documents stay reachable, and the date this contact's access ends.
    • SecurityFeedback fetch is Contact-scoped to rows the signed-in contact created. Internal feedback about the customer and closure scoring are never reachable.

  7. 0.9

    The enquiry surface

    The only write this platform makes across a system boundary — and it deliberately does not cross it directly.

    • Added/enquiry/new — one light screen, no wizard: objective, component or process, site, target timing, related project, optional attachments. Identity and organisation derived from session.
    • Added/enquiries — the contact's own enquiries with reference, summary, date, sync state and resulting project.
    • ChangedA customer enquiry writes to the local seco_opportunityintake table. An integration component creates the D365 record asynchronously; the portal never writes to D365.
    • ChangedOptimistic UI banned. Confirmation says RECEIVED, and the list shows the real state: Pending, Synced or Failed.
    • SecurityRequest verification token handled centrally in src/services/dataverse; client validation treated as courtesy only.

  8. 0.8

    Onboarding, profile and access transparency

    How an external gets in, what they can see about their own access, and how it ends.

    • Added/invite/:token — single-use, two-phase reveal, explicit failure states and an explanation of Sandvik tenant authentication.
    • Added/profile — self-scope only, with no colleague directory.
    • Added/profile/access — the contact can see their role and which projects they reach.
    • AddedClosure and dormancy warnings on a 60-day window, with dormancy sourced from Platform 2.
    • Docsdocs/handover/ACCESS_LIFECYCLE.md.

  9. 0.7

    Deliverables and Documents

    Acceptance state made visible where the work happens, and ITAR handled by absence rather than by a locked row.

    • AddedDeliverables tab with acceptance state surfaced through the action log.
    • AddedDocuments tab using the Power Pages file mechanism for uploads.
    • SecurityITAR projects return zero documents at the filter, with explanatory copy instead of a redacted list. Superseded documents excluded at the query.
    • SecurityVitest coverage over documentFilter().

  10. 0.6

    The Plan tab

    Read-only for externals at go-live, and a different instrument on each side of 900px.

    • AddedHorizontal Gantt of gates and milestones at ≥900px — filled and open markers, Seco assignees, today's date, horizontal scroll, lazy-loaded.
    • AddedBelow 900px the Gantt becomes a vertical milestone timeline: date, name, status glyph, owner.
    • AddedNative PDF export of the Gantt and CSV export of the milestone list.
    • SecurityInternal effort estimates excluded at the query via selectGateColumns.
    • DocsMobile decision recorded in docs/handover/RESPONSIVE.md.

  11. 0.5

    The action log

    The most important screen on the platform — where an external actually does something.

    • AddedMine (default, overdue first), All shared (grouped by project, collapsible) and Timeline views.
    • AddedPer action: title, description, assignee with avatar and organisation, mono due date, status, project and last activity. Overdue in --scrap with a day count; due within three days in --attention.
    • AddedExternals can complete assigned actions, comment in threads, and attach files except on restricted projects.
    • AddedResponsive: table ≥900, reduced-column table 600–899, stacked cards <600 with comments in a full-screen sheet.
    • AddedNotification bell in the top bar with the assigned-actions count and list.
    • SecurityInternal-only actions excluded at the query level using the permission-model filters.

  12. 0.4

    The project record page

    One page per project, with the gate rail sticky at the top and phasing stated rather than implied.

    • AddedEyebrow, project name, PRJ-ID, sticky gate rail, summary strip and tabs (Overview · Action log · Plan · Deliverables · Documents) with tab state in the URL.
    • AddedSummary strip: current stage, next milestone and date, Seco lead, open actions assigned to me, start date, target completion — and no financial facts.
    • AddedP0 tabs active (Overview, Action log, Documents); P1 tabs shown as clearly marked increments.
    • SecurityInternal costs, margin, rates, internal notes and assessment trails are not fetched, not just not rendered.

  13. 0.3

    Portal shell, project list and the gate rail

    The frame everything authenticated hangs from.

    • AddedHorizontal top bar: Seco identity left, project switcher and account menu right, switching available in one interaction from anywhere.
    • AddedBreakpoints fixed at <600 phone, 600–899 tablet portrait, 900–1279 tablet landscape, ≥1280 laptop.
    • AddedResponsiveList — semantic table at ≥600, cards below — sorted by needs-my-attention by default.
    • AddedThe gate rail as an engineering dimension line: hairline spine with datum ticks, collapsing to current stage plus count on mobile.
    • AddedSessionProvider for identity switching and src/lib/portalClock.ts for deterministic time.
    • ChangedWCAG 2.2 AA throughout, with 44×44px minimum touch targets.

  14. 0.2

    Domain layer and deterministic seed

    src/domain compiles with zero React imports. No UI in this increment.

    • Addedsrc/domain/types, choices.ts and the rule modules: enquiry, actions, participation, projection, onboarding.
    • AddedDeterministic seed — 258 accounts and 2,191 contacts across the seeded project population.
    • AddedDataverseServices mock with simulated latency and transient failures, so error states are designed rather than discovered.

  15. 0.1

    The permission model

    Built before the domain layer and before any screen, because on Power Pages it is the only thing standing between a customer and another customer's data.

    • SecuritywebRoles.ts, scopes.ts, permissions.ts, rowFilters.ts, redactions.ts and audit.ts across 33 tables: 128 permission entries, 66 of them denials.
    • SecurityOData row-filter generators and the four web roles: Anonymous, Authenticated, Customer, Partner.
    • DocsTwo ambiguities in SECURITY.md logged rather than guessed: SOW status integers and portal activity scopes.

  16. 0.0

    Skeleton and design tokens

    Platform 3 of an eight-platform programme for Seco Tools. No features — structure and vocabulary only.

    • AddedDesign tokens in src/styles/tokens.css: graphite, carbide, swarf, coolant, pass, scrap.
    • AddedRepository structure: routes, components, features, domain, mock services.
    • AddedThe SPINE landing composition and the knowledge/ folder holding the programme's source briefs.