# Build brief — a focused alternative to Darwinbox

> **Verdict:** Not faithfully · **Buildability:** 13/100 · **Category:** HR
> **Source:** https://www.canitbevibecoded.com/darwinbox
> Independent editorial assessment from Can It Be Vibe Coded? Not affiliated with, endorsed by, or derived from Darwinbox. Verify current pricing and capabilities before acting.

## Context

**Darwinbox** — Enterprise HR platform covering hiring, onboarding, attendance, leave, payroll and performance for the whole org.

This is not a tool you use alone, it is the system of record for every employee your company has. The parts that look buildable, a leave tracker and an org chart, are the cheap 10 percent. The expensive 90 percent is statutory payroll across multiple countries, tax filings, audit trails, role-based access that HR and legal will actually sign off on, and the fact that finance, IT and the auditors all already read from it. A personal replacement makes no sense because there is no personal version of a company's payroll compliance. If you are a founder with eight people, a spreadsheet plus your accountant beats both this and a DIY build.

This brief describes a focused, single-operator replacement for the part of Darwinbox that is genuinely reproducible. It is deliberately narrower than the product it replaces, and it says so in writing. Build the useful core; do not pretend to have rebuilt the rest.

## What you are building

A self-hosted employee directory with leave balances, approval requests and a CSV export you hand to whoever actually runs payroll.

- Run internal workflows such as time-off requests, onboarding checklists, and review cycles.
- A responsive interface with real empty, loading, success, and error states.

## Requirements

### Functional

- Node 20 and a machine to run it on.
- Someone external doing actual payroll and tax filing.

### Non-functional

- Accessibility: semantic markup, labelled controls, visible focus, and reduced-motion support.
- Security: server-side secrets, validated input, and no credentials in the client bundle.
- Reliability: retries with backoff on external calls, and a clear failure state when a provider is down.
- Portability: the operator can export their data and leave without losing it.

## Implementation brief

Build a self-hosted internal HR record app for a small team. Not payroll, not compliance, just records and leave.

Stack, no substitutions:
- Next.js 15, App Router, TypeScript, Tailwind.
- SQLite via better-sqlite3, file at ./data/hr.db, schema created on first run.
- No auth provider, no cloud, no telemetry. Single shared password from HR_PASSWORD in .env, checked in middleware, plus an ADMIN_EMAILS list in .env that unlocks admin views.

In scope:
1. Employees table: name, work email, job title, department, manager (self-referencing), start date, employment type, location, status (active, on leave, exited), notes. Full CRUD for admins, read-only directory for everyone.
2. Org chart rendered from the manager field as nested lists, no graph library.
3. Leave: policies table (name, days per year, carry-over cap), balances computed per employee per calendar year, requests with start date, end date, half-day flag, reason, status (pending, approved, rejected).
4. Approval flow: a request goes to the employee's manager, manager sees a queue, approve or reject with a comment. Every state change writes an append-only audit row with actor, timestamp and old/new values.
5. Working-day math that skips weekends and a holidays table admins can edit. Store all dates as ISO strings, no timezone conversion.
6. Reports: leave taken per employee per year, headcount by department, and a CSV export of employees plus approved leave for whoever actually runs payroll.
7. Seed script with 12 fake employees, 2 policies and a few requests so the app is not empty on first load.

Out of scope, do not build: salary fields, payslips, tax logic, expenses, recruitment, performance reviews, mobile apps, email sending, any integration.

Deliverables: working app on npm run dev, npm run seed, a .env.example, and a README that states plainly that this is a record keeper and that payroll and statutory filing are handled by a human accountant outside this system.

## Delivery standard

- Inspect the repository first, then write a short implementation plan before writing code.
- Deliver the smallest complete end-to-end workflow first; every primary control must work against persisted data.
- Use real validation and storage; never substitute fake dashboards, decorative controls, hard-coded success states, or mock integrations.
- Include responsive layouts plus genuine empty, loading, success, validation, and failure states.
- Keep secrets server-side in environment variables, provide .env.example, and never commit credentials or user data.
- Add structured logs around every external call and return actionable errors without leaking sensitive details.
- Write unit tests for the core logic and one automated test of the main user journey.
- Finish with a README covering setup, architecture, data location, backups, tests, deployment, and known limitations.

## Acceptance criteria

- [ ] A clean install starts the app using only the README and .env.example.
- [ ] The primary journey works from first visit through saved result, reload, edit, export, and deletion where applicable.
- [ ] Invalid input, missing configuration, provider failure, and an empty database each have a usable state.
- [ ] The interface works at 390px and 1440px, is keyboard navigable, and shows visible focus on every control.
- [ ] Tests, type checking, linting, and a production build all pass with no ignored failures.
- [ ] No part of the interface implies a live integration, security guarantee, or scale capability that was not actually built and verified.

## Non-goals

Do not build these, and do not claim to have replaced them:

- Statutory payroll, tax and provident fund compliance across jurisdictions, which is the entire product.
- Audit trails and access controls that survive an actual audit or an employment dispute.
- Integrations with finance systems, background check vendors, job boards and identity providers.
- Mobile apps that non-technical employees will use for attendance and expense claims.
- Someone to blame, and to call, when a pay run goes wrong on the 30th.

## What you still own after launch

- Run migrations, backups, restores, and dependency updates.
- Test the critical journey after every model, API, or hosting change.
- Monitor failures and fix the edge cases a first prompt will miss.
- Maintain every third-party integration as APIs and OAuth rules change.

## Risk

**High consequence.** Use this as a prototype or personal aid. Keep a qualified human and an established provider in the loop for consequential decisions.

Editorial confidence in this assessment: medium. No reviewed project implementation is linked yet.

---

Generated by [Can It Be Vibe Coded?](https://www.canitbevibecoded.com) · Full report: https://www.canitbevibecoded.com/darwinbox