QODY Phase 1 Provisioning Gate + Integracioni Deploy (MC 105075+105077)

QODY Phase 1 Provisioning Gate + Integracioni Deploy — ZAVRŠENO (MC #105075 + #105077) 
 Datum: 2026-07-08 | Live demo: rg-qody-demo, revizije int105077 (api--int105077b, guest--int105077, admin--int105077), sve 100% traffic, sve 200. 
 Šta je deployano (integrisano, jedan konzistentan build) 
 Spojene 3 feature-grane u jedan qody-api/guest/admin build (merge branch feat/qody-105077-integration, commit 27a8250): 
 
 Monri plaćanje (#105048) — per-venue, webhook, potpis 
 SSE payment confirmation (#105069 BUG B) — gost vidi "plaćeno" potvrdu 
 nginx :8080 fix (#105069 BUG A) — gost više ne vidi chrome-error nakon plaćanja 
 Provisioning gate (#105075) — concierge model 
 Admin redesign (#105067) + owner lock screen + super-admin wizard 
 
 Migracije: V25 → V26_monri → V27_provisioning_gate (čist redoslijed). 
 Concierge model (CEO odluka 2026-07-08) — LIVE 
 
 Super-admin (SnowIT) postavlja SVE (org+venue+meni+stolovi+QR+plaćanje) preko 6 superadmin-scoped ruta 
 Vlasnikov admin ZAKLJUČAN ("u pripremi") dok venue nije ACTIVE; server-side gate 403 na owner /admin/* 
 Cash-only može ACTIVE bez Monri (Monri opcija, ne uslov) 
 activate re-validira checklist server-side (meni+stolovi/QR+radno vrijeme+payment-decision) 
 
 Proveo cross-role UAT + adversarial bypass — PASS 6/6 (raw HTTP, teži od browsera) 
 
 Provisioning flow end-to-end: onboard→invite→menu→tables→hours→cash-only→activate ACTIVE ✓ 
 Checklist enforcement: activate prije kompletiranja → 422 missing[] (server-side) ✓ 
 Owner lock: 403 non-ACTIVE, 200 nakon aktivacije ✓ 
 Adversarial bypass (kritično): owner JWT → /admin/ non-ACTIVE = 403; owner → /superadmin/ = 403 (ne može escalirati); impersonation PENDING = blokiran** ✓ 
 Regresija: Monri webhook 400 (živ), guest menu, health/RLS PASS — NEregresirano ✓ 
 Cash-only reaches ACTIVE bez Monri ✓ 
 
 Incident tokom deploya (uhvaćen, vraćen) 
 Prvi pokušaj: api build iz pogrešnog konteksta (repo-root umjesto apps/api) → deployao mrtav image → qody-api health 000 → rollback na 0000080 (Monri) u minuti → rebuild iz ispravnog apps/api konteksta → uspjeh. Ranije: gate-only api (iz main, bez Monri) regresirao Monri → rollback. Pouka: qody-api build-grana MORA imati sve žive feature; api build kontekst = apps/api. 
 Follow-up (ne-blokirajuće) 
 
 Concern 4c: impersonation PENDING vraća generic 404 (short-circuit prije guard poruke); security property drži (bez tokena), ali poruka ne stiže — developer 5min trace. 
 Demo cleanup (#105068): UAT-105077-Venue (2f21abce), UAT-105077-Venue-B (31605010) suspended; + stray #105067 (Basic Cafe ...003, UAT-105067bc f7028415). 
 #105077 merge NIJE pushan na azdo (guard #104976) — image-only deploy; kod na feat/qody-105077-integration lokalno. 
 
 Evidence: ~/system/evidence/105077/uat/uat-report.md