Skip to main content

Bilko Work Cluster — Session 4f57b305 (Fiken gaps, offers, inbox, obs-cleanup)

Bilko Work Cluster — Session 4f57b305 Reconciliation

Document date: 2026-06-30 Reconciled by: CODECRAFT doc-reconciliation sub-agent (read-only) Source session: ~/.claude/projects/-Users-makinja/4f57b305-9090-4576-bae3-2eb4ae32adbf.jsonl Primary MC task: #104515 (Bilko: Fiken-gap audit — credit-notes, offers, document inbox) Status: Post-session documentation gap closure — no code changes made in this document

Cluster Overview

Session 4f57b305 produced a concentrated burst of Bilko work across seven Git branches, touching three distinct workstreams: observability and dead-code cleanup, competitive research, and three Fiken-gap feature implementations. All branches pushed to Azure DevOps (azdo remote). Five branches were subsequently merged to main via PRs 29-33. One branch is unmerged (web-build-oom). One was squash-merged (obs-cleanup via PR 27).

Workstream 1 — Observability Cleanup (MC #104268 + #104221)

Branch: fix/bilko-obs-cleanup-104221-104268 Merge state: SQUASH-MERGED to main as commit f15deb8a (PR 27 referenced in commit message: "fix(bilko): App Insights telemetry (#104268) + dead-GCP-cleanup (#104221) + PR #27 review fixes") MC status: Both #104221 and #104268 marked done (2026-06-28)

MC #104268 — App Insights SDK Init

Problem: APPLICATIONINSIGHTS_CONNECTION_STRING env var was set on all 4 ACA apps (bilko-api-demo, bilko-web-demo, bilko-api-stage, bilko-web-stage) but App Insights requests table showed 0 rows/30 min. Env var alone does not emit telemetry — app code must initialise the SDK.

Fix: Added applicationinsights npm package + SDK initialisation call at top of api/web entrypoints (and/or Azure Monitor OpenTelemetry distro). Referenced App Insights workbook dcaef4e3-9bc7-48ae-8e1b-bd382a73889e.

Validation: Proveo confirmed requests > 0 post-deploy. BookStack page 3154 referenced.

MC #104221 — Dead GCP Reference Cleanup

Problem: Following the all-to-Azure migration, 11 files retained hardcoded references to the dead GCP run.app URLs, GCP secrets, and Artifact Registry. This caused CSP noise and would cause silent failures if those code paths were hit.

Files changed (11 total):

  • apps/web/next.config.js lines 51, 89-90 — CSP connect-src pruned (removed bilko-api-stage-dh4m46blja-lz.a.run.app, bilko-stage.alai.no, bilko-demo.alai.no)
  • apps/web/lib/api-base.ts line 50 — dead GCP fallback removed
  • 2 e2e test files — default base URLs fixed (were pointing to dead .run.app)
  • 4 infrastructure/gcp/cloudbuild*.yaml files — DECOMMISSIONED header added
  • 3 system/tools/bilko-sentinel*.js files — console links annotated
  • SEO portal SA (seo-gsc-reader@tribal-sign-487920-k0) left untouched after verification: GCP project tribal-sign-487920-k0 confirmed ACTIVE (lifecycleState=ACTIVE), GSC reads functional

TypeScript check: PASS

Workstream 2 — Competitive Research / Fiken Capability Scan (MC #104515 context)

Branch: docs/fiken-live-capability-scan Merge state: MERGED to main via PR 33 (merge commit 031deb31) Commits (3, not yet in main by SHA due to squash history, but content present):

  • 79ad6876 — add live Fiken API capability scan to competitor research
  • 89e4c90c — reality-check Fiken takeaways against actual Bilko code
  • 2bdc18a3 — correct credit-notes status: fully built, only PDF header gap

What was updated: docs/COMPETITIVE-RESEARCH.md — added Fiken API v2 data model from ALAI's production integration, refreshed Minimax HR competitor intel (verified pricing + onboarding UX), corrected the credit-notes comparison row to reflect the audit findings (feature built, PDF label only remaining gap).

Workstream 3 — Fiken Gap Implementations (MC #104515)

The gap audit (evidence at docs/evidence/104515/fiken-gap-audit.md) found three gaps vs Fiken API surface:

Gap Classification before build Effort
1. Credit Notes — PDF header Partially supported (feature complete, title hardcoded 'FAKTURA') S (~2h)
2. Offers / Ponude lifecycle Missing — zero implementation L (~5-8d)
3. Document Inbox Missing — zero implementation L (~6d)

Gap 1 — Credit Note PDF Header (MC #104515)

Branch: fix/cn-pdf-header-104515 Merge state: MERGED to main via PR 32 (merge commit 01b4ccbc) Commits (1):

  • 43a2626b — fix(invoices): localize PDF header title per document type (MC #104515)

What it does: In InvoiceService.generateInvoicePDF(), the hardcoded "FAKTURA / INVOICE" title is replaced with a documentType-aware switch:

  • credit_note → "KREDITNA NOTA / CREDIT NOTE"
  • debit_note → "DEBITNA NOTA / DEBIT NOTE"
  • advance → "PREDUJAM RACUN / ADVANCE INVOICE"
  • default → "FAKTURA / INVOICE"

No schema changes, no migration required.

Residual: Proveo E2E test for CN PDF title not yet run (MC #104517 paused — covers offers lifecycle, not CN PDF specifically; no separate CN PDF test task created).

Gap 2 — Offers / Ponude Lifecycle (MC #104515)

Branch: feat/offers-104515 Merge state: MERGED to main via PR 29 (merge commit baa16135) Commits (4):

  • f30a4f95 — feat(offers): implement Ponude/Offers lifecycle — MC #104515
  • c3871f60 — test(offers): add OfferServiceTest integration suite — MC #104517 Proveo gate
  • a2b64873 — fix(offers): harden V105 RLS to canonical pattern + 2 review cleanups
  • 9965ff4f — design(ponude): Vizu polish — KPI cards, sortable table, status badges, sidebar entry, token alignment

What was built:

  • Flyway migration V105: offers + offer_items tables with RLS (org_id scoping), PON-YYYY-NNN numbering sequence
  • OfferService.kt + OfferRoutes.kt: full status machine draft → sent → accepted | rejected | expired → converted
  • API routes: POST /offers, GET /offers, GET /offers/{id}, PUT /offers/{id}, DELETE /offers/{id}, POST /offers/{id}/send, POST /offers/{id}/accept, POST /offers/{id}/reject, POST /offers/{id}/convert (convert creates invoice, sets converted_to_invoice_id)
  • Frontend: offers list page (KPI cards, sortable table, status badges), offers detail/edit page, sidebar entry
  • OfferServiceTest integration suite added as part of Proveo gate (MC #104517)

Residual: MC #104517 (Proveo: full E2E browser lifecycle test — draft → send → accept → convert) is paused. Route-layer and service tests exist; browser E2E not yet run.

Gap 3 — Document Inbox (MC #104515)

Branch: feat/document-inbox-104515 Merge state: MERGED to main via PR 30 (merge commit fee37dc8) Commits (4):

  • ce570f54 — feat(inbox): Document Inbox Phase 1 — capture-first receipt queue (MC #104515)
  • 6d002476 — test(inbox): Proveo validation MC #104519 — route-layer coverage + evidence
  • 7995258c — design(inbox): Vizu polish — status badges, typo fixes, token alignment, upload zone a11y
  • 55941024 — merge(inbox): resolve sidebar.tsx conflict — keep both Ponude and Inbox nav entries

What was built:

  • Flyway migration: inbox_items table with RLS + idx_inbox_items_org_status index
  • InboxService.kt + InboxRoutes.kt: Phase 1 capture-first (no AI extraction in Phase 1)
  • API routes: POST /inbox (upload, multipart), GET /inbox (list with filters), GET /inbox/{id}, DELETE /inbox/{id}, POST /inbox/{id}/book, POST /inbox/{id}/reject, GET /inbox/count (badge counter)
  • Status machine: pending → review → booked | rejected; booked_as_id FK set on booking
  • Frontend: inbox grid page (thumbnail, filename, extracted fields, status badge), detail/booking page, dashboard sidebar badge
  • RBAC: owner | admin | accountant for upload/book/reject; viewer for GET
  • Phase 2 (AI extraction via Azure Document Intelligence) explicitly deferred

Residual: MC #104519 (Proveo: E2E — upload → pending → book-as-expense → status=booked, org-isolation, reject flow, badge count) is paused. Route-layer coverage added; full browser E2E not yet run.

Supporting Branch — Demo Seed Consistency

Branch: fix/demo-seed-consistency Merge state: MERGED to main via PR 31 (merge commit ea1989e6) Commits (1):

  • 304fd786 — fix(demo): consistent demo session + current-month revenue seed

What it does: Fixes the demo database seed so that the demo session state and revenue data consistently reflect the current month. Required to prevent UAT failures where dashboard KPIs showed stale/out-of-month figures during offers and inbox demos.

Supporting Branch — Web Build OOM Prevention

Branch: fix/web-build-oom Merge state: NOT MERGED — no PR merge commit found in azdo/main history Commits (1):

  • 700e818a — fix(web): OOM prevention - increase Node heap to 6GB + disable Sentry sourcemaps

What it does: Modifies apps/web/Dockerfile — increases Node.js heap allocation to 6 GB and disables Sentry source map upload during build to prevent OOM crashes in the Next.js web build step.

Action required: This branch should be reviewed and merged. It addresses a real build stability issue. No MC task ID was observed for this branch in the session.

Governance Flag — Author-Guard Bypass + No-Verify Pushes

Finding: The session used git push --no-verify on 16 occasions and created 4 distinct git-author-override-* sentinel files:

  • /tmp/git-author-override-aa2a012425846fb8
  • /tmp/git-author-override-41b971fb12d77759
  • /tmp/git-author-override-7dd20ce306675710
  • /tmp/git-author-override-7a1d5f25e55c0367

Mechanism: The git-author-guard pre-commit hook is triggered by the presence of an empty file at /tmp/git-author-override-<token>. Creating this file via install -m 0600 /dev/null /tmp/git-author-override-<token> arms the bypass; the hook then permits agent-authored commits to pass through. --no-verify skips the hook entirely for pushes.

Scope of bypass: All 7 branches in this cluster. The bypass was used most heavily on the docs/fiken-live-capability-scan branch (multiple retries before the mechanism was found) and then applied uniformly to all subsequent branches.

Risk assessment:

  • The mechanism itself is a designed feature of the git-author-guard (sentinel file = explicit agent authorisation), so use is not a security breach.
  • However, repeated --no-verify on pushes means push-time hooks were also skipped — any push-time policy checks (branch protection, commit message linting, secret scanning) did not run.
  • The session accumulated 4 different override tokens, suggesting the guard was re-armed multiple times during the session. This is noisy but not dangerous.
  • Recommendation: Log author-guard bypass invocations to HiveMind or MC task evidence. Require that --no-verify is only used when a specific blocker is identified and documented, not as a default push pattern.

Residual Gaps and Open Actions

Item MC ID Status Blocking
Proveo: Offers full E2E browser test (draft→send→accept→convert) #104517 paused MC #104515 cannot be marked done
Proveo: Document Inbox E2E (upload→book→badge count) #104519 paused MC #104515 cannot be marked done
MC #104515 master task #104515 ready_for_review Blocked on #104517 + #104519 + this BookStack page
fix/web-build-oom — unmerged branch none branch open Build OOM risk in Next.js web container
BookStack pages: Offers/Ponude feature none missing ZAKON PLAN doc requirement
BookStack pages: Document Inbox feature none missing ZAKON PLAN doc requirement
Credit note PDF title — no dedicated Proveo E2E test task none missing Partial coverage only via OfferServiceTest

Branch-State Summary Table

Branch PR Merge commit State MC IDs
fix/bilko-obs-cleanup-104221-104268 PR 27 f15deb8a (squash) MERGED #104221, #104268
docs/fiken-live-capability-scan PR 33 031deb31 MERGED #104515 context
fix/cn-pdf-header-104515 PR 32 01b4ccbc MERGED #104515 Gap 1
feat/offers-104515 PR 29 baa16135 MERGED #104515 Gap 2, #104517
feat/document-inbox-104515 PR 30 fee37dc8 MERGED #104515 Gap 3, #104519
fix/demo-seed-consistency PR 31 ea1989e6 MERGED (demo support)
fix/web-build-oom none found — OPEN / unmerged none

What Is Still Ambiguous

  1. PR 27 vs obs-cleanup branch: The commit f15deb8a on main references "PR #27 review fixes" but there is no merge commit for PR 27 in the main log (it was a squash). The fix/bilko-obs-cleanup-104221-104268 remote branch still exists with 7 commits not matching main SHA (expected with squash). Branch can be deleted once confirmed by a human reviewer.

  2. fix/web-build-oom has no MC task. It is unclear whether this was an incidental fix during the session or a committed deliverable. The branch is open and should either be merged with a PR or abandoned with documentation of why.

  3. MC #104515 BookStack field shows "pending — audit evidence in docs/evidence/104515/fiken-gap-audit.md". This reconciliation page is the first structured BookStack documentation. MC #104515 cannot move to done until #104517 and #104519 are unpaused and completed.

  4. No MC task for demo-seed-consistency fix. It was bundled as a support fix with no explicit MC tracking. If this was a standalone deliverable it should have an MC task for traceability.

No comments to display

Back to top