Site Ledger

A charitable endowment is building a university hospital, and the site's weekly payroll lived in one hand-typed Excel workbook: more than 5,000 shift rows, four linked sheets, and corrections that overwrote whatever was there before. It worked, but every payday depended on someone typing carefully, and a disputed week could not be traced back to anything.

The rules in that sheet had already survived months of real payroll, so they were carried over exactly: a 10 hour regular cap, overtime paid at 1.5x only once a person approves it, and a Saturday cutoff that moves an afternoon check-in into the following pay week so a shift running into Sunday is never split in two. Lateness became its own approval rather than an automatic deduction, so a foreman can sign off the overtime on a shift while still reviewing the lateness on it.

Workers scan a laminated QR badge at a gate tablet with a USB scanner. The server stamps the time, never the device, and punches are append-only: a correction points back at the row it replaces instead of overwriting it. Each week closes on a signed statement that stores a hash of the document, so if the data underneath ever changes the system flags it, and payroll staff export the same layout they already sign off on.

It runs on plain PHP 8 and MySQL on shared hosting, with no framework and no build step, because that is what the client's hosting runs. That ruled out a few libraries, so the QR encoder and the .xlsx writer are written from scratch. Access is locked down with mandatory TOTP two-factor sign-in, login throttling, CSRF tokens, and a kiosk that only works on a tablet paired through a one-time link.