Workforce Operations.
Phone-first. Kitchen-honest.
Provisioning, scheduling, geofenced clock-in, templated tasks with photo evidence, offline-survivable handovers, payslips, leave, advances, and Web Push notifications — every part of running a workforce, from one operating system.
Workforce Operations · Deep dive
The HR module operators actually use.
HornbillOS is a complete operating system for your food business. Workforce Operations is one module — the one that turns scheduling, clock-in, tasks, and payroll from four spreadsheets and three WhatsApp groups into one phone-first system that staff actually open.
Today · Doha · Closing shift
Salim Hassan
Clocked inLock back door + check freezer
Closing
Empty grease trap + clean fryer
Closing
Reconcile till + drop deposit
Custody
Write handover for opening shift
Handover
HornbillOS · Push
Leave approved
May 12 → May 14
Pillar 01
People & Provisioning
Add a new hire in 60 seconds. They log in by phone with an OTP, on whatever device they own. One identity flows across Admin, OPS, Employee, and TV portals — no duplicate accounts, no shared passwords.
- Phone-based OTP login — no passwords, no resets
- Add Employee → instantly phone-ready, with duplicate detection
- BotID-protected forms; row-level security per company and branch
- Per-portal route guards — staff land where their role belongs
“We hired a new line cook on Tuesday. He still couldn’t log in on Friday.”
— The problem this pillar removes
Pillar 02
Shifts & Attendance
Schedule a week in one screen. Clock-in is geofenced to the branch. Off-site clock-ins flag amber for review — the manager always gets the truth, the staff member never gets blocked.
- Day / Week shift scheduler with min, max, and preferred staffing
- Live cell colours: green = preferred met, amber = under, red = over
- Geofenced clock-in with per-branch radius (default 150 m)
- On-site / off-site / no-GPS pills with logged distance for audit
“Half the team clocked in on time. We later found out they were 3 km from the branch.”
— The problem this pillar removes
Pillar 03
Tasks & Handovers
The closing checklist stops being a paper napkin. Six task categories, photo evidence with the rear camera, an offline outbox that survives a flat battery, and a handover note that the next shift actually reads.
- Templated tasks across 6 categories — opening, closing, prep, kitchen, FOH, custody
- Photo evidence — rear-camera capture, auto-compressed to ≤1280px / 82%
- Offline outbox — task completes + handover saves queue in IndexedDB and drain on reconnect
- Bidirectional bridge: production batches in OPS auto-create employee tasks
“The closing checklist gets ticked on a paper napkin — and lost.”
— The problem this pillar removes
Pillar 04
Self-Service & Audit
Payslips, leave, advances — on the same phone the employee already uses. Every leave decision triggers a Web Push. Every clock-in, photo, and handover lives in an auditable trail. HR stops being a WhatsApp queue.
- Payslip + payroll history, leave balance, salary advance application — all in the employee app
- Web Push notifications for leave / advance decisions (per-device opt-in)
- Weighted performance % per shift instance, visible to managers
- Employee documents + bank IBAN/SWIFT in scoped storage buckets
“Three staff WhatsApping me at 11 PM asking when payday is.”
— The problem this pillar removes
Where each capability lives
14 capabilities · 4 portals
| Capability | Admin | Employee | OPS | TV |
|---|---|---|---|---|
| Phone-OTP identity | ||||
| Add Employee + provisioning | — | — | — | |
| Week-grid shift scheduler | — | — | — | |
| Today’s shift + clock in/out | — | — | — | |
| Geofenced clock-in (branch radius) | — | — | ||
| Task templates + completion | — | |||
| Photo evidence (rear-camera) | — | — | ||
| Offline outbox (IDB queue) | — | — | — | |
| Shift handover notes | — | — | ||
| Production batch ↔ employee task bridge | — | |||
| Leave / advances + push decisions | — | — | ||
| Payslips + payroll history | — | — | ||
| Performance % (weighted) | — | — | — | |
| Documents + bank IBAN/SWIFT | — | — |
This is one module of twelve
Workforce Operations is the floor. The operating system is the building.
The same employee who clocks in here is the one who runs the production batch in OPS, generates the receipt your customer takes home, and contributes to the P&L the owner reads on Monday morning. Workforce Operations doesn’t live in a silo — it’s wired into every other module of HornbillOS.
Operator scenarios
The same week. Before HornbillOS and after.
These scenarios are drawn from the operators who built HornbillOS — Jouzu, Chicken Express, Uncle Tetsu, ProGreen, ProPasta. Real shifts, real Mondays.
Tuesday morning — new hire
Before
A new line cook starts Tuesday. HR fills out a paper form, IT creates an account in two systems, the manager prints a shift roster, the new hire borrows someone else's phone to check today's tasks. By Friday, he still can't log in cleanly.
After
Manager opens Add Employee, types a phone number, hits send. Sixty seconds later the new hire receives an OTP, opens the employee app on his own phone, sees today's shift, and can clock in. Identity flows across Admin, Employee, OPS, and TV — no duplicate accounts, no shared passwords.
4:00 PM — the staffing wobble
Before
The Sunday brunch shift looks fine in the spreadsheet — until two staff text in sick at 11. The manager only finds out when the floor's already down. Coverage gaps surface mid-rush, never before.
After
The week-grid scheduler shows green / amber / red borders per shift cell against the branch's preferred staffing config. Drop below minimum and the cell turns amber — the manager sees the problem the moment it opens, and re-assigns from the same screen.
11:48 PM — clock-in from somewhere
Before
A staff member taps clock-in on the way home. He's "on time" in the system. Three weeks later you discover several team members were doing the same — the audit trail shows nothing.
After
Geofenced clock-in checks the staff's GPS against the branch radius (default 150 m, configurable per branch). Outside the radius, a soft-warn dialog appears — never blocks, always flags. The shift card shows an amber "off-site" pill the next time anyone opens it, with the logged distance.
Friday 1:30 AM — the closing shift
Before
The closing checklist is a laminated A4 on the kitchen wall. Items get ticked, photos sometimes get sent to a manager group, the next shift opens with no idea what was left undone. Three weeks of "lost handover" complaints.
After
Six categories of templated tasks on the employee's phone. Photo evidence is captured rear-camera, compressed locally, uploaded to a scoped storage bucket. The handover note saves into the next shift's home screen. If the kitchen Wi-Fi drops, completes queue in IndexedDB and drain on reconnect — nothing is lost.
Sunday morning — payday questions
Before
Three staff WhatsApp the owner at 9 AM asking when payday is. One asks for a pay slip. Another wants to apply for an advance. The owner spends Sunday on admin instead of the menu.
After
Payslip + payroll history live in the employee's phone. Leave applications and salary advances submit from the same app. Approvals trigger a Web Push to the staff member's device — no WhatsApp queue, no Sunday admin.
How it stays honest
Built for the kitchen, not the boardroom.
Workforce software usually fails on the floor — bad signal, dead batteries, people who don’t want to learn a new app. Workforce Operations is engineered around those realities.
RLS + BotID + audit trail
Row-level security on every employee table. Vercel BotID protecting Add Employee + sensitive forms. Every clock-in, photo, and handover lives in an auditable timeline.
Offline-survivable
Task completes and handover saves queue in an IndexedDB outbox per device. Drain happens on reconnect, on tab focus, and on first mount. Staff never lose a closing checklist to a flat cell signal.
Web Push, no app
Leave decisions, advance approvals, and shift changes deliver via W3C Web Push to whatever phone the staff already use. Per-device opt-in, VAPID-signed, broken endpoints auto-pruned.
Phone-first, no install
Phone OTP login, browser-based, works on every device. No app store distribution, no apk sideload, no MDM rollout. Same URL on iOS Safari, Android Chrome, or whatever's in someone's pocket.
FAQ
Operator questions, honest answers.
Do staff need a special device or download?+
No. The employee app runs in the browser on whatever phone the staff member already owns. Sign-in is by phone OTP, no app store, no apk sideload. Push notifications and offline-task queueing work via standard web APIs.
What happens if the kitchen Wi-Fi drops?+
Task completes and handover saves are queued in an IndexedDB outbox on the device. A header pill shows the queued count. The queue drains automatically on reconnect, on tab focus, and on next app open. Staff see "Task saved offline — will sync when reconnected" instead of an error.
Is geofenced clock-in a hard block?+
No — by design. A hard block is operationally fragile (GPS noise, indoor signal loss, branch coordinates slightly off). Off-site clock-ins are recorded with the measured distance and flagged amber for manager review. The staff member is never stranded; the manager always gets the truth.
How is sensitive data isolated between brands and branches?+
Every employee table — employees, attendance, leave, payroll — is protected by row-level security policies keyed off the user's company memberships. A query from one brand cannot return another brand's data even if the application code asks for it. Add Employee + other sensitive forms are additionally protected by Vercel BotID, which soft-rejects unverified bots.
Does this replace our existing HR / payroll software?+
For most operators, yes — for the operational core: scheduling, attendance, tasks, payslip distribution, leave, advances. For statutory payroll filing in your jurisdiction, HornbillOS exports clean data your accountant can use. Many groups also keep Zoho Books wired in for vendor + expense bookkeeping.
How does the employee app stay in sync with what's happening in the kitchen?+
When OPS creates a production batch (say, "20 baked cheesecakes for tomorrow"), an employee task is auto-created and linked. Completing the task in the employee app marks the batch as ready in OPS — and vice versa. The sync is loop-safe (only fires on actual state changes), so the two surfaces never diverge.
Workforce Operations is one of twelve modules.
Request a walkthrough of the whole operating system — Admin, OPS, Kitchen Display, Storefront, Aggregator Control, and the rest.