Skip to main content
CyberOS HR is the single source of truth for everyone who works at your company — employees, contractors, and interns alike. It serves HR admins, managers, and members themselves, covering the full arc from pre-hire candidate to final offboarding settlement. The module is Vietnamese-labour-law-first by design: Decree 145/2020 working-hour caps, Decree 13/2023 maternity and paternity entitlements, and PDPL Art. 38 data-protection rules are schema fields, not free-text comments. HR also acts as the Member-id spine for every downstream module — REW, LEARN, ESOP, TIME, CHAT, and AUTH all consume the single canonical roster HR provides.
HR is a P1 module — currently in planned/design phase and not yet generally available. Features described here reflect the planned P1 design.

​
Member lifecycle state machine

A member moves through a defined set of states from the moment an offer letter is generated to the moment the employment relationship ends. Each state transition fires events that downstream modules consume automatically — you never need to manually update AUTH, TIME, or ESOP separately.
1

Pre-hire → Offer

HR/Ops generates an offer letter via the contract engine. The candidate receives a WebAuthn e-sign link through DOC. The member row is created in pre_hire status and does not yet consume a licence seat.
2

Offer → Probation

The candidate signs and the contract’s start_date is reached. Status moves to probation. AUTH provisions a subject account with time-limited scopes. The onboarding orchestrator fires immediately.
3

Probation → Active

After the default 60-day probation window (configurable per contract), HR/Ops marks probation passed. Status becomes active. Full scopes apply. Leave accrual begins. ESOP founding-grant eligibility is evaluated.
4

Active → On Leave

Any approved leave request of five or more days transitions the member to on_leave. TIME marks the calendar; CHAT sets an away status automatically.
5

Active → Sabbatical

When the sabbatical eligibility tick reaches five continuous years and the member opts in, status becomes sabbatical. Vesting continues; KB authorship requirements apply.
6

Any → Suspended

HR/Ops or CHRO can place a member in suspended status pending investigation. AUTH scopes are restricted; the member cannot submit timesheets or leave requests.
7

Active → Terminating → Terminated

The CHRO initiates termination. CEO co-sign is required for Bad-Leaver ESOP branch decisions. Once both signatures are recorded, the offboarding orchestrator runs: AUTH revokes all sessions within a 5-second SLO, REW computes final pay, ESOP branches to Good or Bad Leaver, and asset-return tasks are opened.
Every state transition writes an immutable audit row to the memory module and emits a NATS event (e.g. hr.member.joined, hr.member.terminated). Downstream modules consume these events; you do not need to trigger them manually.

​
Onboarding orchestration

When a new member transitions to active, HR fires a multi-module onboarding playbook automatically. The entire fan-out runs as an idempotent saga — if one downstream step times out, it retries without re-executing steps that already succeeded.
1

AUTH — Account Provisioning

AUTH creates a subject record, assigns role-scoped permissions, and sends the member a temporary passkey-enrolment link. This happens first; all subsequent steps depend on a live identity.
2

LEARN — Role Enrolment

LEARN seeds the member’s skill profile and enrols them in the role-based reading list and any mandatory onboarding modules for their discipline.
3

KB — Access Grant

KB grants read access to the documentation scopes appropriate for the member’s role level. Restricted documents remain gated until the manager explicitly adds scopes.
4

PROJ — Ramp-Plan Issues

PROJ creates the structured ramp-plan issues: shadow these engagements, read these memory entries, complete the onboarding rubric by day 30.
5

CHAT — Workspace Provisioning

CHAT adds the member to the default workspaces (#general, their team channel, and any channels specified by the manager).
6

Checklist Visibility

The day-by-day onboarding checklist is visible to the manager, the new hire, and the CHRO simultaneously. Any step blocked for more than 24 hours triggers an automated alert.
The onboarding orchestrator carries an idempotency key per step. If the playbook is re-fired (e.g. after a system restart), only incomplete steps execute — already-provisioned accounts are not duplicated.

​
Leave management

HR tracks eight leave types, each with a Vietnamese statutory basis. Entitlements are first-class schema fields — they accrue automatically, enforce caps at write time, and are auditable by a Decree 13/2023 inspector without any manual data export.

​
Leave type catalogue

​
Annual leave accrual

Annual leave accrues automatically each quarter based on the rules in Decree 145/2020. You do not need to run a manual accrual job — the system updates leave_balance.annual_remaining at each quarter boundary.
The accrual is computed lazily at quarter boundaries rather than in real time, which keeps audit outputs deterministic and reproducible. The exact accrual date is visible in leave_balance.last_accrual_at.

​
Sick leave self-reporting

Members self-report sick leave. The system validates the submission against the BHXH-tier cap at write time and rejects any request that would exceed the statutory ceiling. If a medical certificate is required (requests ≥ 3 days), the system marks the request as pending until the document is attached or waived by the approving manager.

​
Contract types

HR supports five contract types, each with automatic renewal-reminder logic.

Indefinite

Open-ended employment. No effective_to. Amendments append a supersession row; the original contract is never mutated.

Fixed-Term

Has a defined effective_to. The system sends a renewal reminder 90 days before expiry so you never miss the statutory window.

Probation

60-day default (configurable). Transitions automatically to indefinite or fixed-term on pass, or triggers offboarding on fail.

Part-Time

Pro-rated leave entitlements and timesheet limits. Decree 145/2020 overtime caps apply proportionally.

Contractor

No BHXH/BHYT/BHTN obligations. Treated as deferred-compensation scope in REW; no leave accrual.
Missing a fixed-term renewal triggers a Vietnamese labour-law compliance issue. The 90-day reminder is automated, but confirming the renewed contract before effective_to is a manual CHRO obligation.

​
PII protection

HR stores government-issued ID photos (CCCD) in a separate KMS keyspace from all other HR data. This means a query against the member table cannot accidentally over-fetch CCCD data — the photo columns live in an isolated cccd_record table encrypted under a distinct key.
Every read of a CCCD photo generates a severity-1 access audit row in the memory module. Bulk exports of CCCD photos are structurally blocked — the admin REST endpoint returns a 30-second pre-signed S3 URL only, one record at a time.
Key PII boundaries enforced at the schema level:
  • CCCD photos — distinct KMS key, sev-1 audit on every read, never resolvable through GraphQL.
  • Contract PDFs — KMS-wrapped, stored in S3 with 10-year object-lock, accessible via time-limited pre-signed URLs only.
  • Compensation data — structurally absent from all HR tables. REW owns all compensation numbers (see REW).

​
Performance signals

HR aggregates read-only performance signals from three modules to support 1:1 preparation and quarterly reviews. HR never writes to these signals and never holds compensation numbers — REW owns those.
HR reads calibration drift rates and blocker authoring rates from PROJ. These surface in the manager’s 1:1 prep dashboard as context, not as evaluation scores.
Aggregated performance signals are inputs to a human decision — they are never applied automatically to compensation. REW’s compensation change flow requires CHRO + CFO co-sign regardless of what HR signals indicate.

​
Vietnamese labour law compliance

CyberOS HR enforces Vietnamese regulatory requirements as hard system constraints, not advisory warnings.
The standard overtime limit is 200 hours per year. With employee consent and MoLISA notification, the cap rises to 300 hours. TIME rejects any timesheet submission that would push a member past the applicable cap; HR exposes the member’s current cap-status via an MCP read tool so the CUO router can surface it in context.
Maternity leave is six months (Labour Code Art. 139), extended for multiple births. Paternity leave ranges from 5 to 14 working days depending on birth circumstances (Decree 152/2020 Art. 34). HR requires HR/Ops to attach the statutory-basis tag when approving either leave type, creating an auditable eligibility record.
Members can request a full DSAR export of their HR data (profile, leave records, contracts, non-compensation documents) within 30 days of request. Compensation data is excluded from the HR-scoped DSAR — that export runs separately through REW.
Vietnamese social-insurance numbers (BHXH, BHYT, BHTN) are first-class profile fields, not free-text notes. Decree 152/2020 employee contribution rates (BHXH 10.5%, BHYT 1.5%, BHTN 1%) are version-pinned parameters consumed by REW during the monthly payroll cycle.