# drop-full-delivery-plan

# Plan: Drop Full Delivery (#7187)

## Research Summary

Full codebase audit completed (2026-04-06). Drop is 65-70% feature complete, 40% production ready.

**What exists:**
- Landing page with waitlist form (PostgreSQL-backed) — 13 languages
- Next.js web app: 27 pages, 72 API routes, CSRF/CSP security
- Hono/TS backend: 27 route modules, 20 DB tables, demo mode
- React Native/Expo mobile: 18 screens, BankID WebView, biometrics
- BankID mock + Bank mock (PISP/AISP simulation) — fully implemented
- Docker Compose (postgres, redis, api, app)
- 11 GitHub Actions workflows (CI/CD)
- 561 test files (mixed quality)

**What's missing:**
- Production deploy to Azure (currently Vercel/Fly.io)
- Comprehensive E2E test suite (~100 scenarios, currently ~3)
- CI/CD targeting Azure (currently Fly.io)
- Browser verification that bugs are fixed post-deploy
- Native mobile builds tested on device

**CEO constraints:**
- Deploy to Azure (NOT Vercel)
- Everything that exists must WORK in demo
- ~100 E2E scenarios covering all user flows
- CI/CD triggers Playwright on every push to dev/main
- Native apps for iOS + Android

## Objective

Deploy Drop to Azure with a fully functional demo (BankID mock + Bank mock), 100+ E2E test scenarios with CI/CD integration, and verified native mobile builds.

## Team Orchestration

### Team Members

| ID | Name | Role | Agent Type | Model |
|----|------|------|------------|-------|
| TL | Petter Graff | Team Lead / Architect | persona (petter-graff) | sonnet |
| B1 | infra-builder | Azure deploy + Docker + CI/CD | builder (flowforge) | sonnet |
| B2 | e2e-builder | Playwright E2E test suite (~100 scenarios) | builder (codecraft) | sonnet |
| B3 | mobile-builder | Native mobile build verification + fixes | builder (paul-hudson) | sonnet |
| B4 | landing-builder | Landing page Azure deploy + form verification | builder (frontend-builder) | sonnet |
| V1 | drop-validator | Validate all phases | validator | sonnet |
| D1 | Jake Wharton | Android advisory (consulted by B3) | persona (jake-wharton) | sonnet |
| D2 | Thaer Sabri | Payments domain advisory (consulted by TL) | persona (thaer-sabri) | sonnet |

### Step-by-Step Tasks

---

#### Phase 1: Azure Infrastructure + Deploy (B1)

**Task 1.1:** Dockerize and deploy Drop full stack to Azure
- Owner: B1 (flowforge)
- BlockedBy: none
- Description:
  - Use existing Docker Compose as base (postgres:16, redis:7, drop-api, drop-app)
  - Deploy to Azure VM 4.223.110.181 or new Azure Container Apps
  - Configure DNS: app.getdrop.no → Azure (not Vercel)
  - Configure DNS: getdrop.no → Azure (static landing from landing/)
  - Set DROP_MODE=demo, SEED_DEMO=true
  - Ensure PostgreSQL persistent volume
  - Ensure Redis for rate limiting/sessions
  - Configure SSL/TLS (Let's Encrypt or Azure managed cert)
  - Set environment variables (DATABASE_URL, JWT_SECRET, PII_ENCRYPTION_KEY, etc.)
- Files owned: docker-compose.production.yml, infrastructure/, .github/workflows/deploy*.yml
- Acceptance:
  - [ ] app.getdrop.no loads on Azure (not white page)
  - [ ] getdrop.no landing loads with waitlist form
  - [ ] Waitlist form submits and stores in PostgreSQL
  - [ ] Demo login works at app.getdrop.no/login
  - [ ] Health endpoint returns 200: app.getdrop.no/api/health
  - [ ] SSL certificate valid

**Task 1.2:** Configure CI/CD for Azure deploy
- Owner: B1 (flowforge)
- BlockedBy: 1.1
- Description:
  - Update .github/workflows/ci.yml to run Playwright E2E on every push to dev/main
  - Create .github/workflows/deploy-azure.yml for production deploy to Azure
  - Trigger: push to main → build → test → deploy
  - Trigger: push to dev → build → test (no deploy)
  - Use GitHub Actions with SSH deploy or Azure CLI
- Files owned: .github/workflows/
- Acceptance:
  - [ ] Push to dev triggers lint + test + Playwright
  - [ ] Push to main triggers lint + test + Playwright + Azure deploy
  - [ ] Failed tests block deploy

---

#### Phase 2: E2E Test Suite (B2) — PARALLEL with Phase 1

**Task 2.1:** Create comprehensive Playwright E2E test suite (~100 scenarios)
- Owner: B2 (codecraft)
- BlockedBy: none (can write tests against local docker compose)
- Description:
  - Use existing playwright.config.ts as base
  - Create organized test structure in src/drop-app/tests/e2e/
  - All tests run against demo mode (DROP_MODE=demo)
  - Test categories and approximate scenario counts:

  **Authentication (12 scenarios):**
  - Demo login happy path
  - Demo login with different users (standard, merchant, admin)
  - Login form validation (empty, invalid email, wrong password)
  - Logout
  - Session expiry handling
  - CSRF protection verification
  - Rate limiting on login
  - BankID mock flow initiation
  - Register new account
  - Register validation (age <18, invalid phone)
  - Auth redirect (unauthenticated user → login)
  - Multiple device session handling

  **Onboarding (8 scenarios):**
  - Complete onboarding flow
  - Skip optional steps
  - KYC verification mock
  - Phone number validation (+47 only)
  - Age verification (must be 18+)
  - Terms acceptance required
  - Back navigation during onboarding
  - Resume incomplete onboarding

  **Dashboard (8 scenarios):**
  - Dashboard loads with balance
  - Recent transactions display
  - Quick action buttons work
  - Pull-to-refresh behavior
  - Empty state (new user)
  - Currency display (NOK)
  - Navigation to all sections
  - Notification badge count

  **Send Money / Remittance (15 scenarios):**
  - Send to existing recipient
  - Add new recipient + send
  - Amount validation (min, max, decimal)
  - Currency selection (30+ countries)
  - Fee calculation display (0.5%)
  - Exchange rate display
  - Confirmation screen
  - Transaction success
  - Transaction failure handling
  - Receipt generation
  - Send again from history
  - Rate lock (30-min expiry)
  - Insufficient balance handling
  - AML threshold warning
  - Cancel mid-transaction

  **QR Payments (8 scenarios):**
  - Generate QR code (merchant)
  - Scan QR code (customer)
  - QR payment confirmation
  - QR payment success
  - Invalid QR code handling
  - QR amount pre-filled
  - QR payment receipt
  - Merchant dashboard after QR payment

  **Bank Accounts (6 scenarios):**
  - View linked accounts
  - Link new bank account (AISP mock)
  - Refresh balance
  - Multiple accounts display
  - Unlink account
  - Consent renewal flow

  **Transaction History (10 scenarios):**
  - List all transactions
  - Filter by date range
  - Filter by type (sent/received)
  - Search transactions
  - Transaction detail view
  - Receipt download/view
  - CSV export
  - Pagination/infinite scroll
  - Empty state
  - Transaction status indicators

  **Merchant (8 scenarios):**
  - Register as merchant
  - Merchant dashboard loads
  - QR code generation
  - Sales overview
  - Transaction list (merchant view)
  - Settlement statement
  - Merchant profile edit
  - Merchant fee display

  **Profile & Settings (12 scenarios):**
  - View profile
  - Edit personal details
  - Change language (nb, en, etc.)
  - Notification preferences toggle
  - Security settings
  - Biometric lock toggle (face unlock)
  - Privacy policy accessible
  - Terms of service accessible
  - GDPR data export request
  - GDPR objection/rectification
  - Help/FAQ accessible
  - Complaint filing

  **Notifications (5 scenarios):**
  - Notification list loads
  - Mark as read
  - Mark all as read
  - Unread count badge
  - Empty notifications state

  **Edge Cases & Error Handling (8 scenarios):**
  - Network error handling
  - 500 server error display
  - 404 page
  - Session expired mid-action
  - Concurrent tab handling
  - Mobile viewport responsiveness
  - Accessibility (keyboard navigation)
  - Input sanitization (XSS prevention)

  **TOTAL: ~100 scenarios**

- Files owned: src/drop-app/tests/e2e/**
- Acceptance:
  - [ ] 100+ test scenarios written
  - [ ] All tests pass against local Docker compose (demo mode)
  - [ ] Tests organized by feature area
  - [ ] Each test has descriptive name
  - [ ] Tests are independent (no order dependency)
  - [ ] Test report generated (HTML reporter)

---

#### Phase 3: Landing Page Azure Deploy (B4) — PARALLEL with Phase 1 & 2

**Task 3.1:** Deploy landing page to Azure
- Owner: B4 (frontend-builder)
- BlockedBy: none
- Description:
  - Landing page is static HTML (landing/index.html + api/waitlist.js)
  - Deploy static files via Nginx on Azure VM or Azure Static Web Apps
  - Waitlist API needs Node.js runtime (serverless or Express wrapper)
  - Configure getdrop.no DNS → Azure
  - Ensure DATABASE_URL for waitlist PostgreSQL
  - Verify form submission works end-to-end
- Files owned: landing/, nginx configs
- Acceptance:
  - [ ] getdrop.no loads landing page
  - [ ] Waitlist form submits successfully
  - [ ] Email stored in PostgreSQL waitlist_signups table
  - [ ] All 13 language variants accessible
  - [ ] SSL certificate valid
  - [ ] Mobile responsive

---

#### Phase 4: Mobile Build Verification (B3) — PARALLEL

**Task 4.1:** Verify and fix React Native mobile builds
- Owner: B3 (paul-hudson persona for iOS guidance)
- BlockedBy: none
- Description:
  - Verify iOS build compiles (EAS Build)
  - Verify Android build compiles (EAS Build)
  - Test demo mode on iOS Simulator
  - Test demo mode on Android Emulator
  - Verify BankID WebView integration in demo mode
  - Verify biometric auth flow
  - Fix any build errors
  - Document build steps
  - Consult jake-wharton persona for Android-specific issues (Samsung Knox, biometric)
- Files owned: src/drop-mobile/
- Acceptance:
  - [ ] iOS build compiles without errors
  - [ ] Android build compiles without errors
  - [ ] Demo login works on iOS Simulator
  - [ ] Demo login works on Android Emulator
  - [ ] Navigation through all 18 screens works
  - [ ] Biometric auth prompt appears

---

#### Phase 5: Validation (V1) — AFTER Phases 1-4

**Task 5.1:** Validate entire Drop deployment
- Owner: V1 (validator)
- BlockedBy: 1.1, 1.2, 2.1, 3.1, 4.1
- Description:
  - Browser verification: app.getdrop.no loads and demo works
  - Browser verification: getdrop.no form submits
  - Run full Playwright E2E suite against Azure deployment
  - Verify CI/CD pipeline triggers correctly
  - Verify mobile builds
  - Check HiveMind updates from all builders
  - Run qa-19.js quality gate
- Acceptance:
  - [ ] app.getdrop.no renders (NOT white page) — Playwright screenshot
  - [ ] getdrop.no waitlist form submits — Playwright screenshot
  - [ ] E2E suite: 90%+ pass rate on Azure
  - [ ] CI/CD: test push to dev triggers workflow
  - [ ] Mobile: builds compile
  - [ ] qa-19.js score >= 17/19

---

## Validation Commands

```bash
# Health check
curl -s https://app.getdrop.no/api/health | jq .

# Landing page
curl -s -o /dev/null -w "%{http_code}" https://getdrop.no

# Waitlist form
curl -s -X POST https://getdrop.no/api/waitlist -H "Content-Type: application/json" -d '{"email":"test@test.com"}'

# Run E2E tests against Azure
cd ~/ALAI/products/Drop/src/drop-app && BASE_URL=https://app.getdrop.no npx playwright test

# CI/CD verification
gh workflow list -R ALAI/Drop
gh run list -R ALAI/Drop --limit 5

# QA gate
node ~/system/tools/qa-19.js check 7187

# Mobile builds
cd ~/ALAI/products/Drop/src/drop-mobile && eas build --platform all --profile preview --non-interactive
```

## Execution Order

```
Phase 1 (B1: Azure infra)  ──┐
Phase 2 (B2: E2E tests)    ──┼──→ Phase 5 (V1: Validate all)
Phase 3 (B4: Landing)      ──┤
Phase 4 (B3: Mobile)       ──┘
```

All 4 builder phases run IN PARALLEL. Validator runs after all complete.

## Risk Mitigations

| Risk | Mitigation |
|------|------------|
| Azure VM resource limits (4GB RAM) | Use Container Apps if needed, or scale VM |
| DNS propagation delay | Pre-configure Azure IP, use low TTL |
| Playwright flaky on CI | Use retry: 1, serial mode for auth tests |
| Mobile EAS build queue | Use local builds as fallback |
| Hook permission blocks | Builders use worktree isolation |

## Notes

- Backend is Hono/TS (migration to Kotlin pending MC #5124) — we deploy CURRENT stack, not migrated
- BankID + Bank mock already exist — no need to build from scratch
- Demo mode (DROP_MODE=demo) is the target, not production with real banking
- Cards feature stays disabled (feature-flagged off)