Developer Offboarding Guide: Drop — Fintech Payment App

Developer Offboarding Guide: Drop — Fintech Payment App

Project: Drop — Remittance + QR Payments Version: 1.0 Date: 2026-02-23 Author: John (AI Director) Status: Approved Reviewers: Alem Bašić (CEO)

Document History

1. Offboarding Overview

Developer: {DEVELOPER_NAME} Last Session: {LAST_DATE} Manager: John (AI Director) Offboarding Coordinator: John (AI Director) Security Review: John (AI Director) + Alem Bašić (CEO)

Departure type: Agent session completion / Agent role change / Human developer departure

Drop offboarding context: Because Drop uses an AI-native team (Builder agents, Validator agents), most "offboarding" is agent session completion — no persistent access to revoke. Human developer offboarding is documented in full below for Alem Bašić or any future human team members.

Handoff started: {HANDOFF_START} Access revocation deadline: Same day for involuntary; planned for voluntary

2. Access Revocation Checklist

For AI agent team members (Builder / Validator agents): Agent sessions are ephemeral — no persistent credentials. Verify:

• Agent session terminated in Claude Code / Mission Control
• No API keys or secrets were stored in agent memory or session files
• All in-progress work committed or documented in Mission Control

For human developers (Alem Bašić or future hires):

Code & Version Control

• GitHub (alai-org) — remove from organization and all Drop repositories
• SSH keys — remove from GitHub: Settings > SSH and GPG keys
• Personal access tokens — revoke all tokens in GitHub settings
• Fly.io — remove from drop-app app team (fly.io dashboard → Members)

Cloud Infrastructure (Fly.io)

• Fly.io team — remove from drop-app org/team
• Fly.io deploy tokens — revoke any personal deploy tokens
• SSH keys on Fly.io machines — remove from ~/.ssh/authorized_keys on app machines

Secrets & Credentials — CRITICAL FOR FINTECH

Drop handles financial data. All shared secrets must be rotated immediately on any departure:

• Vaultwarden (vault.basicconsulting.no) — remove user account; rotate all shared vault items they had access to
• JWT_SECRET — rotate immediately; rotate all active user sessions (deploy new secret)
• BAAS_API_KEY — rotate with BaaS partner (SpareBank1 / Swan) — Phase 2
• SUMSUB_API_KEY — rotate with Sumsub — Phase 2
• Database URL / password — rotate Fly.io PostgreSQL password (Phase 1+)
• GitHub Actions secrets — rotate any deploy keys / secrets in repo settings

All secrets known to this developer:

Third-Party Services

• alai-talk.slack.com — deactivate account; remove from #drop, #drop-security channels
• Mission Control — remove any permanent task assignments

Access revocation completion signed off by: John (AI Director) + Alem Bašić (CEO) on {DATE}

3. Knowledge Transfer

Active Projects & Ownership Transfer

Ongoing Work Documentation

Documentation written during knowledge transfer:

• All in-progress PRs reviewed and commented
• Active branches documented and either merged or closed
• Ongoing investigations/research notes written up in comms/decisions/
• Architecture decisions in progress documented as ADRs
• Pending operational tasks documented in docs/OPERATIONS/

Key Contacts & Relationships

Drop-Specific Tribal Knowledge Capture

Knowledge transfer sessions:

Capture questions answered:

1. What breaks in production that only you know how to fix? → SQLite concurrent write limit (200 users); documented in NFR-S01
2. What shortcuts or workarounds exist? → Mock BaaS in NEXT_PUBLIC_SERVICE_MODE=mock; documented in CLAUDE.md
3. What external services have non-obvious quirks? → Sumsub webhook signature validation; documented in sumsub-integration.test.ts
4. What technical debt exists? → Documented in docs/CROSS-CUTTING/tech-debt-log.md
5. Upcoming risks? → BaaS partner not confirmed; SQLite concurrent limit; documented in risk-register.md

4. Code Ownership Transfer

CODEOWNERS Update

# Review current code ownership assignments
# (No formal CODEOWNERS file yet — John (AI Director) owns all Drop code)

# Transfer to new agent/developer:
# Update CLAUDE.md "Builder" and "Validator" role assignments
# Update Mission Control task ownership

• Mission Control task ownership transferred
• New builder/validator agents briefed on active tasks
• John (AI Director) notified of any in-flight architecture decisions

PR Review Reassignment

• Open PRs awaiting review: reassigned to Validator Agent (new session)
• In-progress PR review responsibilities communicated to John (AI Director)

5. Asset Return

Drop is AI-native — no physical hardware assets for agent team members.

For human developer offboarding:

IT coordinator: Alem Bašić (CEO) — contact@alai.no

6. Exit Interview Topics

For human developers leaving the Drop project:

Exit interview conducted by: John (AI Director) + Alem Bašić (CEO) (joint, async OK) Format: Written notes in comms/decisions/YYYY-MM-DD-exit-{name}.md

Topics to cover:

• What did you learn from working on a fintech pass-through payment system?
• Were there any technical decisions you disagreed with? (ADR feedback)
• What gaps exist in the documentation or test coverage?
• Any concerns about the codebase security or compliance you want to flag?
• What would you do differently in Phase 1?

Exit notes: Stored in comms/decisions/ (confidential — CEO + AI Director access only)

7. Final Checklist Sign-Off

John (AI Director) Sign-Off

• All access revocation items completed
• JWT_SECRET and all shared secrets rotated
• Knowledge transfer complete (ADRs, decisions, tribal knowledge documented)
• Code ownership transferred in Mission Control
• All open PRs and tasks handed off
• Security audit log reviewed for last 30 days (no anomalies)

John (AI Director): John | Date: {DATE} | Signature: Approved (AI)

Developer Sign-Off

• All work documented and handed off to new owner
• No Drop production credentials retained on personal devices
• Exit interview/notes completed

Developer: {DEVELOPER_NAME} | Date: {DATE} | Signature: ___________

CEO Sign-Off (Alem Bašić)

• Vaultwarden access revoked
• Fly.io team membership confirmed removed
• Shared BaaS/financial credentials confirmed rotated
• Business relationships (BaaS, Finanstilsynet, Sumsub contacts) transferred

Alem Bašić (CEO): | Date: {DATE} | Signature: ___________

Related Documents

• Developer Onboarding Guide
• Coding Standards
• Security Audit Report

Approval