What we shipped, in plain language.

Server-rendered pages pulled executable JavaScript and CSS from four public content delivery networks, with no integrity checking, and at least one reference was unpinned — it resolved to whatever the current release happened to be. A compromised package would have executed in a logged-in user’s session with no deployment on our side. All of these assets are now served from our own static files, removing the third party entirely.

Observation showed the main application needs no relaxation of the script policy, while a number of older server-rendered pages still carry inline scripts. The strict policy is applied to the application and the relaxed one only to those legacy pages, so a new page inherits the strict policy automatically rather than being missed off a list.

A new CRP report loads planned and released production against each work centre’s available capacity per period, so an overloaded work centre is visible before the schedule is committed rather than after it slips.

Production orders and their operations are shown on a Gantt chart with their dependencies, and the scheduling dashboard was rebuilt around it.

The effect of the factory calendar — holidays and non-working days — on scheduled production is calculated and reported, so a plan is not quietly assumed to run through a shutdown.

The automated web security baseline scan now has a checked-in, reproducible configuration, so a scan result can be compared with the previous one rather than re-derived each time.

Three live credentials were found in the source tree, including a database password written into the build log of every build and the standard administrator password every new workspace was provisioned with — one password, all workspaces, published in the code. All are now supplied from the environment or a managed credential store, and the retired signing key literal was replaced with an obvious placeholder.

The production planning layout file was four separate templates concatenated into one, so it failed to compile and nothing in that section could be displayed; the schedule dashboard, production order list and production order detail pages additionally had no template at all. All three now render.

The process map read the wrong lifecycle field for Opportunities, which failed the whole case list. The field is now resolved per record type.

Rows on the Pending Goods Receipt grid appeared only after something forced an internal refresh — changing the page size, or visiting the pivot tab and coming back. The grid now refreshes once its rows arrive.

The report-only Content Security Policy shipped with the security hardening work carried nowhere to send reports, so nothing was ever collected and an empty result was indistinguishable from a clean policy. Violations are now received, deduplicated and summarised, in both the formats browsers use, so the observation week the hardening plan depends on can actually run.

The report-only policy permitted every external host, so it reported nothing and the empty violation table read as “the policy is clean” when it meant “the policy asks nothing”. It is now a strict measurement policy, and a liveness marker distinguishes a genuinely clean result from a reporting pipeline that is not delivering — the exact ambiguity the monitor exists to end.

Asset lines are exempt from the sales order requirement that applies to standard purchase lines — capital expenditure has no sales order, and forcing one would attach a machine to an unrelated order and consume its budget. Capex is controlled against the Internal Order on the line instead, and a line with no internal order is reported as uncontrolled rather than silently passed.

An asset could previously only be bought by pretending it was stock — received into a storage location and debited to inventory — or by raising an order with no material at all, which could not be received and had to be coded by hand at invoice time. Neither produced an asset record. A purchase order line can now be marked as capital expenditure: assets are provisioned when the order is approved, an Asset Receipt document capitalises them, and the vendor invoice clears the same clearing account the receipt credited.

A line for ten machines creates ten assets, so partial disposal, per-unit custodians and per-unit serial numbers stay possible, and the receipt value is split across them. The capitalisation threshold is tested per asset rather than per line — four chairs at ₹3,200 are four low-value items, not one ₹12,800 asset. An ordered asset carries no capitalisation date, so it cannot depreciate before it arrives, and a new Capex on Order page shows what is committed but not yet received. Freight and duty are added prospectively, without restating depreciation already posted.

Material recorded at the gate can now be turned into a goods receipt directly from the gate entry, with a pending-receipt worklist showing what has arrived at the gate and is still awaiting a receipt, so the gate record and the stock posting stay linked.

The invoice column on the GR/IR report did not resolve the invoice for every line; the lookup has been corrected.

The copilot deliberately cannot post, reverse, cancel, delete or pay — those are decisions with an accounting consequence. It can block an invoice that has not yet been posted, and link a requisition only when exactly one unambiguous candidate exists. Every attempt is recorded, refusals included. Findings can be mirrored into the Management by Exception cockpit.

Eight detectors ship — three for maverick buying, two for process bottlenecks and three for duplicate payments. Each raises a finding carrying the evidence behind it, so the worklist can be worked rather than merely read. A finding that comes back keeps its original first-seen date, and one that has been dismissed with a reason is never raised again.

Stage dwell is benchmarked against that stage’s own 90th percentile from the mined event log rather than a hand-set number of days, so the threshold tracks how fast the business actually runs. A stage with too few observations refuses to produce a benchmark instead of inventing one.

Every finding is explained from its own evidence at scan time, at no cost. An AI explanation is available per finding on demand and falls back to the written one on failure — an audit control that goes dark when a credit balance runs out is not a control. Confidence is shown as Established / Strong match / Possible, never as a percentage.

Requests for a deactivated workspace were dropped in a way that counted towards the automatic ban list, so one out-of-date link could ban a whole office or a shared mobile carrier range. They now answer with a proper “workspace unavailable” page, and the ban list is reserved for hostnames that were never issued. The office IP allow-list — which only ever covered one tenant — has been removed rather than extended.

Every write from the Service Entry Sheet page was refused with a security error since 31 July, so a sheet could be listed but never created, edited, submitted, approved or posted. Reads kept working, which made it look like a permissions problem. The page now uses the shared API client, which carries the session and workspace identity on every request.

The down payment request and detail screens were rebuilt, the GL posting for an advance was corrected, and the service behind them was simplified so a request, its approval, its payment and its later adjustment against an invoice behave consistently.

Down payments are included in the trace, since money can leave against an order before any invoice exists, but an advance already adjusted against one of the listed invoices is netted off the stage total. Where a stage cannot be read, its totals are shown as blank rather than zero, and no finding is raised from a stage that was never read.

A new PO History page walks the whole procure-to-pay journey around one order — the MRP requirement that caused it, the purchase requisition, the order, goods receipts or service entry sheets, invoice verification and posting, and the vendor payment — with a per-line matrix and a reconciliation of ordered against received, invoiced and paid. Nothing is stored: the trace follows the documents themselves, so it can never disagree with them.

Questions arrive as “the vendor is asking about invoice INV-4471”, not as a PO number. The page can be searched by requisition, MRP run, goods receipt, the vendor’s own delivery note, service entry sheet, vendor invoice (ours or the supplier’s number), payment or UTR. The order shown is in the address, so the answer can be pasted into a ticket.