Overview

Drop Srbija v2 — Project Status

Drop Srbija v2 — Project Status

Last Updated: 2026-04-17
Status: Phases 0-4 Complete | Phases 5-6 CEO-Gated

Current State

Drop Srbija v2 is a complete rebuild of the Serbian payment app using ALAI's standard tech stack. The project has completed foundational infrastructure, security hardening, full backend/frontend implementation, comprehensive testing, and production-ready deployment configuration.

Completed Phases

Phase Status Completion Date Evidence
Phase 0: Security Hardening ✅ Complete 2026-04-17 5 P0 fixes, Makefile port, security CI
Phase 1: Frontend Port ✅ Complete 2026-04-17 30 pages, 6 SR components, 1721/1777 vitest pass
Phase 2: Backend Modules ✅ Complete 2026-04-17 20 modules, 22 migrations, 617 tests pass
Phase 3: Testing & Observability ✅ Complete 2026-04-17 Test pyramid, LGTM stack, Sentry, 52% coverage
Phase 4: Infrastructure ✅ Complete 2026-04-17 Terraform, Caddy, backup/DR, CI/CD

CEO-Gated Phases (Pending)

Phase Blocker Target
Phase 5: NBS IPS Integration Bank partnership + credentials Q3 2026
Phase 6: Production Deployment Legal entity + Azure subscription Q3 2026

Key Metrics

Decisions Locked In

Next Actions (CEO Required)

Documentation Structure

This BookStack book documents the complete Drop Srbija v2 rebuild:

Project Repository: ~/ALAI/products/DropSrbija
Current Branch: develop
Latest Commit: 2d3ab09aa — test(coverage): add H2-backed service tests, raise coverage to 52%

Drop Srbija v2 — Tech Stack

Drop Srbija v2 — Tech Stack

ALAI Standard Stack (CEO Decision 2026-03-17)

Backend

Component Version Purpose
Kotlin 2.1.0 Primary backend language (ALAI standard)
Ktor 3.1.2 Async HTTP framework, netty transport
Exposed 0.58.0 Kotlin-native ORM, DSL-based
PostgreSQL 16 Primary database (port 5436)
Flyway 10.21.0 Database migrations (22 scripts V1-V22)
HikariCP 6.2.1 Connection pooling
Koin 4.0.2 Dependency injection
JWT (nimbus-jose-jwt) 9.46.1 Authentication tokens (HS256)
Kotest 5.9.1 Testing framework (79 test files, 617 tests)
Testcontainers 1.20.4 Integration tests (PostgreSQL in Docker)

Frontend

Component Version Purpose
Next.js 15.1.3 React framework, app router, server components
React 19.0.0 UI library
TypeScript 5.7.2 Type safety
Tailwind CSS 4.0.0 Utility-first CSS
shadcn/ui Latest Component library (ALAI standard)
Lucide React Latest Icon library (ALAI standard)
next-intl Latest i18n (Serbian sr-RS + English fallback)
Vitest Latest Unit testing (1721 passing / 1777 total)
Playwright Latest E2E testing (15 journeys)

Database

Component Purpose
PostgreSQL 16 Primary database
Port 5436 (separate from Drop Norway 5433, Bilko 5434)
Timezone UTC+0 (TIMESTAMP WITH TIME ZONE)
Tables 22 (via Flyway V1-V22)
RLS PostgreSQL Row-Level Security for multi-tenancy

Database Tables

22 tables across 22 Flyway migrations:

  1. V1: users, phone_verifications, recipients, transactions, nbs_ips_logs, merchants, settings
  2. V2: nbs_ips_logs ISO20022 fields
  3. V3: linked_accounts
  4. V4: transaction idempotency_key_hash
  5. V5: kyc_sessions
  6. V6: users JMBG fields (encrypted + hash)
  7. V7: aml_flags
  8. V8: disclosure_acknowledged
  9. V9: complaints
  10. V10: phone_verifications max_attempts
  11. V11: audit_log
  12. V12: data_access_requests
  13. V13: recipients enhanced (IBAN, country)
  14. V14: merchants (business_name, national_id, bank_account, fee_rate, qr_hmac_key)
  15. V15: exchange_rates
  16. V16: notifications
  17. V17: webhook_deliveries
  18. V18: user_consents
  19. V19: feature_flags
  20. V20: withdrawal_requests
  21. V21: cards_scaffold (stub for Phase 2)
  22. V22: disputes

Infrastructure

Component Purpose
Azure Container Apps Backend + frontend hosting
Azure Container Registry Docker image registry
Azure Database for PostgreSQL Managed PostgreSQL 16
Azure Cache for Redis Session store, rate limiting
Azure DNS drop.rs domain management
Azure Key Vault Secrets management
Caddy Reverse proxy (prod/staging/dev profiles)
Terraform IaC (11 modules)

Observability

Component Purpose
OpenTelemetry Distributed tracing (backend + frontend)
Sentry Error tracking (client + server + edge)
Prometheus Metrics collection
Grafana Dashboards (3: overview, infra, errors)
Loki Log aggregation
Tempo Trace storage
LGTM Stack Grafana + Loki + Tempo + Mimir (docker-compose profile)

Testing

Type Framework Coverage
Backend Unit Kotest 617 tests (79 files)
Backend Integration Testcontainers 11 tests (real PostgreSQL)
Frontend Unit Vitest 1721 passing / 1777 total
E2E Journeys Playwright 15 journeys
Load Testing k6 4 scenarios
Accessibility axe-core 23 rules
Contract Testing Pact 12 interactions
Visual Regression Playwright Baseline snapshots

Coverage Gates

CI/CD

Workflow Trigger Purpose
test.yml PR, push to develop/main Unit + integration tests
quality-gate.yml PR Coverage gate enforcement
security.yml PR, push CORS, rate limiting, EnvGuard checks
accessibility.yml PR, push axe-core a11y testing
contract.yml PR, push Pact contract testing
k6.yml PR, push to main Load testing (4 scenarios)
backup-verify.yml Daily Backup/DR verification
build.yml Push to develop Docker image build
deploy-staging.yml Push to develop Staging deployment
deploy-production.yml Tag v* Production deployment
sonar.yml PR, push SonarCloud static analysis

Security

Component Purpose
CORS Configured via CORS.kt plugin
Rate Limiting RateLimit.kt plugin (10 OTP/hour, 50 tx/hour)
EnvGuard Startup validation (12 required env vars)
AuditLogger V11 migration, logs all sensitive actions
JWT HS256 Stateless auth (24h expiry)
SHA-256 Hashing OTP codes, idempotency keys
PostgreSQL Encryption JMBG encrypted (KMS key rotation in Azure)
mTLS NBS IPS API calls (Phase 5)

Configuration

Environment Variables (12 required)

# Database
DATABASE_URL=postgresql://localhost:5436/dropsrbija_dev
DATABASE_USER=dropsrbija
DATABASE_PASSWORD=<secret>

# API
PORT=3002
JWT_SECRET=<64+ bytes>
JWT_EXPIRY_SECONDS=86400

# NBS IPS (Phase 5)
NBS_IPS_ENDPOINT=https://ips.nbs.rs/api/v1
NBS_IPS_API_KEY=<secret>

# Redis
REDIS_URL=redis://localhost:6380

# Frontend
NEXT_PUBLIC_API_URL=http://localhost:3003
NEXT_PUBLIC_APP_LANGUAGE=sr

Development Setup

Prerequisites

Quick Start

# Full stack
docker-compose up

# Or separate services
docker-compose up postgres redis -d
cd backend && ./gradlew run
cd frontend && npm run dev

Services

Comparison to Drop Norway

Aspect Drop Norway Drop Srbija
Backend Hono + TypeScript Kotlin + Ktor
Frontend Next.js 15 Next.js 15 (1:1 copy)
Auth BankID Phone OTP
Payment Rails PSD2 Open Banking NBS IPS
Currency NOK RSD (+ EUR corridor)
Database Port 5433 5436
Issuer "drop-api" "dropsrbija-api"

Last Updated: 2026-04-17
Source: /Users/makinja/ALAI/products/DropSrbija

Drop Srbija v2 — Legal Entity

Drop Srbija v2 — Legal Entity

Decision: ALAI Tech d.o.o. (D9)
Date: 2026-04-16
Status: CEO Approved (Incorporation Pending)

Entity Structure

Drop Srbija operates as a product line under ALAI Tech d.o.o., not as a separate legal entity.

Corporate Hierarchy

ALAI Holding AS (Norway, org.nr 932 516 136)
    └── ALAI Tech d.o.o. (Serbia, PIB TBD)
            ├── Drop Srbija (product brand)
            ├── Bilko (product brand)
            └── Tok (product brand)

Legal Name vs Trade Names

Rationale (D9)

Context: Early Drop Srbija documentation referenced "Drop Srbija d.o.o." as a separate entity. This implied separate incorporation per product line.

Decision: Single Serbian subsidiary for all ALAI Serbian operations.

Why:

  1. Corporate Simplicity: One entity, not 3+ separate d.o.o.s
  2. Cost Efficiency: One incorporation, one tax filing, one audit (vs 3x overhead)
  3. Capital Pooling: EUR 125,000 NBS PI license capital serves all products
  4. Regulatory Efficiency: Single NBS/Poverenik/APML relationship
  5. Brand Architecture: Legal entity = ALAI Tech, product brands = Drop/Bilko/Tok

Alternatives Rejected:

Entity Details (Pending Incorporation)

Regulatory Implications

Payment Institution License

ALAI Tech d.o.o. will apply for Payment Institution (PI) license from NBS in Year 2 (after agent model Year 1 proves market fit).

Agent Registration (Year 1)

ALAI Tech d.o.o. will register as an agent of a licensed bank (target: Raiffeisen Banka or BPS) for Drop Srbija Year 1 launch.

Data Controller

ALAI Tech d.o.o. is the data controller under ZZPL (Serbian GDPR equivalent):

All legal documents updated in commit 07b6550 to reference ALAI Tech d.o.o.:

  1. NBS PI License Application Package — Applicant: ALAI Tech d.o.o.
  2. Privacy Policy — Data Controller: ALAI Tech d.o.o.
  3. Framework Contract — Service Provider: ALAI Tech d.o.o.
  4. DPIA — Controller: ALAI Tech d.o.o.
  5. Incident Notification Template — Reporting Entity: ALAI Tech d.o.o.

See: ~/ALAI/products/DropSrbija/legal/ (pending Lexicon final review)

Next Steps (CEO Required)

1. Incorporate ALAI Tech d.o.o.

Timeline: 4-6 weeks
Cost: ~EUR 1,500 (incorporation fees + notary)

Requirements:

2. Engage Serbian Lawyer

Role:

Estimated Cost: EUR 3,000-5,000 (incorporation + Year 1 support)

3. Register Agent Status

After incorporation:

Consequences

✅ Pros:

❌ Cons:

⚠️ Mitigation:

Decision Log: 05-decision-log.md
Lexicon Review: Pending final sign-off
Next Action: CEO engagement of Serbian lawyer (srpski advokat)

Drop Srbija v2 — Team Roster

Drop Srbija v2 — Team Roster

Last Updated: 2026-04-17

Core Team

Role Agent/Company Contribution
Product Owner Alem Basic (CEO) Vision, funding decisions, bank partnership
Chief Architect Petter Graff (CodeCraft) Backend architecture, Kotlin/Ktor implementation
Frontend Lead Brad Frost (Vizu) Drop Norway 1:1 port, Serbian localization
QA Lead Angie Jones (Proveo) Test pyramid, E2E journeys, validation evidence
Security Lead Parisa Tabriz (Securion) Phase 0 security hardening, CORS, rate limiting
DevOps Lead Kelsey Hightower (FlowForge) Terraform, Caddy, Azure Container Apps, backup/DR
Fintech Advisor Markos Zachariadis (Finverge) NBS IPS integration, bank partnership strategy
Legal Compliance Thaer (Lexicon) ZZPL compliance, NBS PI license application
Documentation Skillforge BookStack docs, runbooks, decision log
Orchestrator John (ALAI Director) Task routing, progress tracking, evidence collection

Specialist Agents by Phase

Phase 0: Security Hardening (Securion)

Deliverables:

Phase 1: Frontend Port (Vizu)

Deliverables:

Phase 2: Backend Modules (CodeCraft)

Deliverables:

Phase 3: Testing & Observability (Proveo + AgentForge)

Deliverables:

Phase 4: Infrastructure (FlowForge)

Deliverables:

Domain Experts (Advisory)

Expert Company Domain Consulted On
Markos Zachariadis Finverge Fintech regulation NBS IPS integration, bank partnership strategy
Thaer Lexicon Legal compliance ZZPL, ZPNFTM, NBS PI license
Parisa Tabriz Securion Security Phase 0 hardening, security CI
Angie Jones Proveo QA Test pyramid, validation evidence

Supporting Teams

Company Role Deliverables
CodeCraft Backend development Kotlin/Ktor modules, database schema, tests
Vizu Frontend development Next.js 15 port, Serbian localization, components
Proveo Quality assurance Test pyramid, E2E journeys, validation matrix
Securion Security Phase 0 hardening, CORS, rate limiting, audit logging
FlowForge DevOps Terraform, Caddy, Azure deployment, backup/DR
Finverge Fintech advisory Bank partnership pitch, regulatory strategy
Lexicon Legal compliance ZZPL, ZPNFTM, NBS PI license application
Skillforge Documentation BookStack pages, runbooks, decision log
AgentForge AI/ML (future) Fraud detection (Phase 7), credit scoring (Phase 8)

Communication Channels

Escalation Path

  1. Tactical Issues (bugs, test failures): → John → Specialist agent
  2. Architectural Decisions (D10-D14): → Petter Graff → Alem (CEO approval)
  3. Legal/Compliance: → Thaer (Lexicon) → Alem (final sign-off)
  4. Regulatory Strategy: → Markos (Finverge) → Alem
  5. Security Incidents: → Parisa (Securion) → John → Alem (within 4h)

Agent Autonomy Levels

Level Description Examples
L0: Query Answer questions, no code changes Documentation lookup, status check
L1: Execute Run commands, tests, builds ./gradlew test, npm run build
L2: Edit Modify code, commit changes Bug fixes, test additions
L3: Design Propose architecture, review PRs New module design, tech stack choice
L4: Decide Make binding decisions (CEO-gated) Legal entity, bank partnership, budget

Drop Srbija Agent Levels:

Team Principles

  1. Evidence Over Claims: All "done" reports include L2+ machine-verified evidence
  2. Specialist Routing: John routes tasks to company/agent with domain expertise
  3. No Generic Builders: Every task goes to named specialist agent, not "builder" or "minion"
  4. Documentation Required: Skillforge creates BookStack page for every system built
  5. Validation Required: Proveo validates every "done" claim with real evidence
  6. CEO Gates Major Decisions: D10+ architectural decisions require Alem approval

Org Chart: ~/ALAI/org/ORGCHART.md
Specialist Mapping: ~/system/agents/specialist-mapping.json
Agent Permissions: ~/.claude/projects/-Users-makinja/memory/project_agent_permission_system.md