# QODY Phase 1 Provisioning Gate + Integracioni Deploy (MC 105075+105077)

# QODY Phase 1 Provisioning Gate + Integracioni Deploy — ZAVRŠENO (MC #105075 + #105077)

**Datum:** 2026-07-08 | **Live demo:** rg-qody-demo, revizije int105077 (api--int105077b, guest--int105077, admin--int105077), sve 100% traffic, sve 200.

## Šta je deployano (integrisano, jedan konzistentan build)
Spojene 3 feature-grane u jedan qody-api/guest/admin build (merge branch feat/qody-105077-integration, commit 27a8250):
- **Monri plaćanje** (#105048) — per-venue, webhook, potpis
- **SSE payment confirmation** (#105069 BUG B) — gost vidi "plaćeno" potvrdu
- **nginx :8080 fix** (#105069 BUG A) — gost više ne vidi chrome-error nakon plaćanja
- **Provisioning gate** (#105075) — concierge model
- **Admin redesign** (#105067) + owner lock screen + super-admin wizard

Migracije: V25 → V26_monri → V27_provisioning_gate (čist redoslijed).

## Concierge model (CEO odluka 2026-07-08) — LIVE
- Super-admin (SnowIT) postavlja SVE (org+venue+meni+stolovi+QR+plaćanje) preko 6 superadmin-scoped ruta
- Vlasnikov admin ZAKLJUČAN ("u pripremi") dok venue nije ACTIVE; server-side gate 403 na owner /admin/*
- Cash-only može ACTIVE bez Monri (Monri opcija, ne uslov)
- activate re-validira checklist server-side (meni+stolovi/QR+radno vrijeme+payment-decision)

## Proveo cross-role UAT + adversarial bypass — PASS 6/6 (raw HTTP, teži od browsera)
1. Provisioning flow end-to-end: onboard→invite→menu→tables→hours→cash-only→activate ACTIVE ✓
2. Checklist enforcement: activate prije kompletiranja → 422 missing[] (server-side) ✓
3. Owner lock: 403 non-ACTIVE, 200 nakon aktivacije ✓
4. **Adversarial bypass (kritično): owner JWT → /admin/* non-ACTIVE = 403; owner → /superadmin/* = 403 (ne može escalirati); impersonation PENDING = blokiran** ✓
5. Regresija: Monri webhook 400 (živ), guest menu, health/RLS PASS — NEregresirano ✓
6. Cash-only reaches ACTIVE bez Monri ✓

## Incident tokom deploya (uhvaćen, vraćen)
Prvi pokušaj: api build iz pogrešnog konteksta (repo-root umjesto apps/api) → deployao mrtav image → qody-api health 000 → rollback na 0000080 (Monri) u minuti → rebuild iz ispravnog apps/api konteksta → uspjeh. Ranije: gate-only api (iz main, bez Monri) regresirao Monri → rollback. Pouka: qody-api build-grana MORA imati sve žive feature; api build kontekst = apps/api.

## Follow-up (ne-blokirajuće)
- Concern 4c: impersonation PENDING vraća generic 404 (short-circuit prije guard poruke); security property drži (bez tokena), ali poruka ne stiže — developer 5min trace.
- Demo cleanup (#105068): UAT-105077-Venue (2f21abce), UAT-105077-Venue-B (31605010) suspended; + stray #105067 (Basic Cafe ...003, UAT-105067bc f7028415).
- #105077 merge NIJE pushan na azdo (guard #104976) — image-only deploy; kod na feat/qody-105077-integration lokalno.

Evidence: ~/system/evidence/105077/uat/uat-report.md