QODY Phase 1 Provisioning Gate + Integracioni Deploy (MC 105075+105077)

QODY Phase 1 Provisioning Gate + Integracioni Deploy — ZAVRŠENO (MC #105075 + #105077)

Datum: 2026-07-08 | Live demo: rg-qody-demo, revizije int105077 (api--int105077b, guest--int105077, admin--int105077), sve 100% traffic, sve 200.

Šta je deployano (integrisano, jedan konzistentan build)

Spojene 3 feature-grane u jedan qody-api/guest/admin build (merge branch feat/qody-105077-integration, commit 27a8250):

Monri plaćanje (#105048) — per-venue, webhook, potpis
SSE payment confirmation (#105069 BUG B) — gost vidi "plaćeno" potvrdu
nginx :8080 fix (#105069 BUG A) — gost više ne vidi chrome-error nakon plaćanja
Provisioning gate (#105075) — concierge model
Admin redesign (#105067) + owner lock screen + super-admin wizard

Migracije: V25 → V26_monri → V27_provisioning_gate (čist redoslijed).

Concierge model (CEO odluka 2026-07-08) — LIVE

Super-admin (SnowIT) postavlja SVE (org+venue+meni+stolovi+QR+plaćanje) preko 6 superadmin-scoped ruta
Vlasnikov admin ZAKLJUČAN ("u pripremi") dok venue nije ACTIVE; server-side gate 403 na owner /admin/*
Cash-only može ACTIVE bez Monri (Monri opcija, ne uslov)
activate re-validira checklist server-side (meni+stolovi/QR+radno vrijeme+payment-decision)

Proveo cross-role UAT + adversarial bypass — PASS 6/6 (raw HTTP, teži od browsera)

Provisioning flow end-to-end: onboard→invite→menu→tables→hours→cash-only→activate ACTIVE ✓
Checklist enforcement: activate prije kompletiranja → 422 missing[] (server-side) ✓
Owner lock: 403 non-ACTIVE, 200 nakon aktivacije ✓
Adversarial bypass (kritično): owner JWT → /admin/ non-ACTIVE = 403; owner → /superadmin/ = 403 (ne može escalirati); impersonation PENDING = blokiran** ✓
Regresija: Monri webhook 400 (živ), guest menu, health/RLS PASS — NEregresirano ✓
Cash-only reaches ACTIVE bez Monri ✓

Incident tokom deploya (uhvaćen, vraćen)

Prvi pokušaj: api build iz pogrešnog konteksta (repo-root umjesto apps/api) → deployao mrtav image → qody-api health 000 → rollback na 0000080 (Monri) u minuti → rebuild iz ispravnog apps/api konteksta → uspjeh. Ranije: gate-only api (iz main, bez Monri) regresirao Monri → rollback. Pouka: qody-api build-grana MORA imati sve žive feature; api build kontekst = apps/api.

Follow-up (ne-blokirajuće)

Concern 4c: impersonation PENDING vraća generic 404 (short-circuit prije guard poruke); security property drži (bez tokena), ali poruka ne stiže — developer 5min trace.
Demo cleanup (#105068): UAT-105077-Venue (2f21abce), UAT-105077-Venue-B (31605010) suspended; + stray #105067 (Basic Cafe ...003, UAT-105067bc f7028415).
#105077 merge NIJE pushan na azdo (guard #104976) — image-only deploy; kod na feat/qody-105077-integration lokalno.

Evidence: ~/system/evidence/105077/uat/uat-report.md