HR Cases — confidential case management for Workforce

HR Cases lets your HR staff track confidential personnel matters — investigations, complaints, accommodations, discipline — without exposing internal notes to the rest of the org.

What's stored, and who sees what:

• `orgs/{orgId}/hrCases/{caseId}` — the full HR record. Includes title, category, description, severity, assignee, internal investigation notes, status. Visible ONLY to designated HR staff (and org owners/admins when no HR staff are designated yet).
• `orgs/{orgId}/workers/{workerId}/caseResolutions/{caseId}` — a *sanitized* projection automatically written when a case is resolved. Includes the resolution summary and the date, NOT the internal notes or description. Visible to the employee whose case it is.

This split is the point of the module: an employee should see what HR officially decided about them, but they should never see the raw investigation file.

Roles:

• **HR staff** — designated by an owner via the People tab's worker form ("HR Staff" toggle). Once one or more HR staff are designated, only they see hrCases. The roster lives at `orgs/{orgId}/hrStaff/{userId}` and the org doc carries an `hrStaffCount` denormalized for rules speed.
• **No HR staff designated** — falls back to admin-level access (owners + admins see hrCases). Useful for small orgs where HR is informal.
• **The subject worker** — sees only their own caseResolutions, never the underlying hrCase. If the case is reopened (status back off "resolved"), the projection is auto-pulled.

To open a case: Workforce → HR Cases tab → "+ New case". Pick a worker, category, severity, title, description. Status starts at "open." Investigation notes stay HR-only.

To resolve a case: open the case, set status to "Resolved", write a resolution summary (required — the projection won't write without one), and save. The cleaned summary appears in the worker's "My HR Records" within seconds.

Categories: ships with the standard set (complaint, investigation, discipline, accommodation, performance, separation, other). Customize via the HR Cases admin sub-tab.

Audit: every status transition, edit, and assignment writes to `orgs/{orgId}/hrCases/{caseId}/history` (HR-only). Helpful when defending decisions to outside counsel.

Confidentiality enforced by Firestore rules — there's no path for a non-HR worker to read hrCases directly. The projection is the only HR-touched data they're ever served.