# Hallucination Analysis (Feb 2026)

# Drop — Hallucination Analiza
**Datum:** 2026-02-09
**Analyst:** John (AI Director)
**Kontekst:** Kod nastao kao demo (nije prošao factory workflow)

---

## Executive Summary

Backend je solidan (22 API rute, sve realne). Frontend ima 3 stranice sa mock podacima umjesto pravih API poziva. Dokumentacija zaostaje ~2 faze za kodom. Phantom integracije (Wise, Swan, Thunes, Sumsub, Stripe) navedene u docs ali nemaju ni liniju koda.

**Ukupna tačnost dokumentacije:** ~65%

---

## Kritični problemi

### 1. Tri stranice koriste lažne podatke

| Stranica | Problem | Potreban fix |
|----------|---------|--------------|
| `/send` | Klik "Bekreft og send" samo mijenja UI step, NE poziva API | Wire `POST /api/transactions/remittance` |
| `/scan` | Koristi `mockMerchant` iz mock-data.ts, nema QR payment | Wire `POST /api/transactions/qr-payment` |
| `/merchant` | Komplet dashboard je hardcoded mock data | Wire `GET /api/merchants/dashboard` + `/api/merchants/transactions` |

**Impakt:** Korisnik misli da je poslao novac, ali ništa se ne dešava u bazi.

### 2. Phantom integracije — 0 koda

| Integracija | Claim u docs | Stvarnost |
|------------|-------------|-----------|
| Wise API | "Mock → real later" | 0 referenci u kodu |
| Swan BaaS | "Mock → real later" | 0 referenci u kodu |
| Thunes | "Remittance provider" | 0 referenci u kodu |
| Sumsub KYC | "Mock identity verification" | 0 referenci u kodu |
| Stripe Issuing | "Mock card management" | 0 referenci u kodu |

### 3. Nula testova

- 0 test fajlova (izvan node_modules)
- 0 test skripti u package.json
- Test plan je prazan template
- Pipeline kaže "Validator assigned" — nikad pokrenut

---

## Srednje ozbiljni problemi

### 4. Pipeline status zaostaje 2 faze
- PIPELINE.md kaže: "Design (Phase 3)"
- Stvarnost: Implementacija 70%+ gotova (20 API ruta, 10 stranica)

### 5. ~40% koda nedokumentirano
Ove feature nemaju ni riječ u arhitekturi ili brief-u:
- Merchant sistem (register, dashboard, QR, transactions)
- Recipients CRUD API
- Exchange rates API
- Health check endpoint
- /onboarding, /scan, /topup stranice

### 6. Legal compliance violation
- Odluka (ADR): "Ne koristiti riječ 'banking' bez licence"
- Stvarnost: UI tekst sadrži "bank account" na više mjesta

### 7. localStorage — phantom feature
- Project brief navodi "localStorage persistence" kao Must Have
- Stvarnost: 0 referenci na localStorage u kodu

---

## Šta radi ispravno

### Dependencies — ČISTO
- 0 phantom zavisnosti
- `npm run build` prolazi
- `npx tsc --noEmit` — 0 TypeScript grešaka
- Svih 12 runtime deps postoji u node_modules

### API rute — 22/22 REALNE
Svaka ruta ima:
- Prave DB operacije (ne stubovi)
- Error handling sa HTTP status kodovima
- Input validacija
- Auth/authorization provjere
- Rate limiting na javnim endpointima
- Transaction atomicity za multi-step operacije

### Auth — 100% implementiran
- JWT via jose library
- httpOnly cookies (XSS zaštita)
- signToken/verifyToken/requireAuth middleware

### SQLite baza — ispravna
- 6 tabela (users, recipients, merchants, transactions, exchange_rates, cards)
- Seed data funkcionalan
- Parameterized SQL (injection zaštita)

### Frontend — 7/10 stranica spojeno na API
- dashboard, login, onboarding, cards, history, topup — REAL
- send (djelimično — rates i recipients sa API, ali submit je mock)
- scan, merchant — MOCK

---

## Brojke

| Kategorija | Rezultat |
|-----------|---------|
| API rute | 22/22 real (100%) |
| Dependencies | 0 phantom, build OK |
| TypeScript errors | 0 |
| Stranice | 7/10 real, 3/10 mock |
| Komponente | 7 korištenih, 7 orphaned |
| Testovi | 0 |
| Ext. integracije | 0/5 implementirano |
| Dokumentacija | ~65% tačna |

---

## Orphaned komponente (instalirane, nikad korištene)

- alert, avatar, select, separator, sheet, skeleton, sonner

---

## Fajlovi analizirani

- 20 API route fajlova u `src/app/api/`
- 10 page.tsx fajlova u `src/app/`
- 14 komponenti u `src/components/`
- 5 lib fajlova u `src/lib/`
- package.json, PIPELINE.md, architecture-document.md, project-brief.md, project.json, CLAUDE.md