drop-full-delivery-plan Plan: Drop Full Delivery (#7187) Research Summary Full codebase audit completed (2026-04-06). Drop is 65-70% feature complete, 40% production ready. What exists: Landing page with waitlist form (PostgreSQL-backed) — 13 languages Next.js web app: 27 pages, 72 API routes, CSRF/CSP security Hono/TS backend: 27 route modules, 20 DB tables, demo mode React Native/Expo mobile: 18 screens, BankID WebView, biometrics BankID mock + Bank mock (PISP/AISP simulation) — fully implemented Docker Compose (postgres, redis, api, app) 11 GitHub Actions workflows (CI/CD) 561 test files (mixed quality) What's missing: Production deploy to Azure (currently Vercel/Fly.io) Comprehensive E2E test suite (~100 scenarios, currently ~3) CI/CD targeting Azure (currently Fly.io) Browser verification that bugs are fixed post-deploy Native mobile builds tested on device CEO constraints: Deploy to Azure (NOT Vercel) Everything that exists must WORK in demo ~100 E2E scenarios covering all user flows CI/CD triggers Playwright on every push to dev/main Native apps for iOS + Android Objective Deploy Drop to Azure with a fully functional demo (BankID mock + Bank mock), 100+ E2E test scenarios with CI/CD integration, and verified native mobile builds. Team Orchestration Team Members ID Name Role Agent Type Model TL Petter Graff Team Lead / Architect persona (petter-graff) sonnet B1 infra-builder Azure deploy + Docker + CI/CD builder (flowforge) sonnet B2 e2e-builder Playwright E2E test suite (~100 scenarios) builder (codecraft) sonnet B3 mobile-builder Native mobile build verification + fixes builder (paul-hudson) sonnet B4 landing-builder Landing page Azure deploy + form verification builder (frontend-builder) sonnet V1 drop-validator Validate all phases validator sonnet D1 Jake Wharton Android advisory (consulted by B3) persona (jake-wharton) sonnet D2 Thaer Sabri Payments domain advisory (consulted by TL) persona (thaer-sabri) sonnet Step-by-Step Tasks Phase 1: Azure Infrastructure + Deploy (B1) Task 1.1: Dockerize and deploy Drop full stack to Azure Owner: B1 (flowforge) BlockedBy: none Description: Use existing Docker Compose as base (postgres:16, redis:7, drop-api, drop-app) Deploy to Azure VM 4.223.110.181 or new Azure Container Apps Configure DNS: app.getdrop.no → Azure (not Vercel) Configure DNS: getdrop.no → Azure (static landing from landing/) Set DROP_MODE=demo, SEED_DEMO=true Ensure PostgreSQL persistent volume Ensure Redis for rate limiting/sessions Configure SSL/TLS (Let's Encrypt or Azure managed cert) Set environment variables (DATABASE_URL, JWT_SECRET, PII_ENCRYPTION_KEY, etc.) Files owned: docker-compose.production.yml, infrastructure/, .github/workflows/deploy*.yml Acceptance: app.getdrop.no loads on Azure (not white page) getdrop.no landing loads with waitlist form Waitlist form submits and stores in PostgreSQL Demo login works at app.getdrop.no/login Health endpoint returns 200: app.getdrop.no/api/health SSL certificate valid Task 1.2: Configure CI/CD for Azure deploy Owner: B1 (flowforge) BlockedBy: 1.1 Description: Update .github/workflows/ci.yml to run Playwright E2E on every push to dev/main Create .github/workflows/deploy-azure.yml for production deploy to Azure Trigger: push to main → build → test → deploy Trigger: push to dev → build → test (no deploy) Use GitHub Actions with SSH deploy or Azure CLI Files owned: .github/workflows/ Acceptance: Push to dev triggers lint + test + Playwright Push to main triggers lint + test + Playwright + Azure deploy Failed tests block deploy Phase 2: E2E Test Suite (B2) — PARALLEL with Phase 1 Task 2.1: Create comprehensive Playwright E2E test suite (~100 scenarios) Owner: B2 (codecraft) BlockedBy: none (can write tests against local docker compose) Description: Use existing playwright.config.ts as base Create organized test structure in src/drop-app/tests/e2e/ All tests run against demo mode (DROP_MODE=demo) Test categories and approximate scenario counts: Authentication (12 scenarios): Demo login happy path Demo login with different users (standard, merchant, admin) Login form validation (empty, invalid email, wrong password) Logout Session expiry handling CSRF protection verification Rate limiting on login BankID mock flow initiation Register new account Register validation (age <18, invalid phone) Auth redirect (unauthenticated user → login) Multiple device session handling Onboarding (8 scenarios): Complete onboarding flow Skip optional steps KYC verification mock Phone number validation (+47 only) Age verification (must be 18+) Terms acceptance required Back navigation during onboarding Resume incomplete onboarding Dashboard (8 scenarios): Dashboard loads with balance Recent transactions display Quick action buttons work Pull-to-refresh behavior Empty state (new user) Currency display (NOK) Navigation to all sections Notification badge count Send Money / Remittance (15 scenarios): Send to existing recipient Add new recipient + send Amount validation (min, max, decimal) Currency selection (30+ countries) Fee calculation display (0.5%) Exchange rate display Confirmation screen Transaction success Transaction failure handling Receipt generation Send again from history Rate lock (30-min expiry) Insufficient balance handling AML threshold warning Cancel mid-transaction QR Payments (8 scenarios): Generate QR code (merchant) Scan QR code (customer) QR payment confirmation QR payment success Invalid QR code handling QR amount pre-filled QR payment receipt Merchant dashboard after QR payment Bank Accounts (6 scenarios): View linked accounts Link new bank account (AISP mock) Refresh balance Multiple accounts display Unlink account Consent renewal flow Transaction History (10 scenarios): List all transactions Filter by date range Filter by type (sent/received) Search transactions Transaction detail view Receipt download/view CSV export Pagination/infinite scroll Empty state Transaction status indicators Merchant (8 scenarios): Register as merchant Merchant dashboard loads QR code generation Sales overview Transaction list (merchant view) Settlement statement Merchant profile edit Merchant fee display Profile & Settings (12 scenarios): View profile Edit personal details Change language (nb, en, etc.) Notification preferences toggle Security settings Biometric lock toggle (face unlock) Privacy policy accessible Terms of service accessible GDPR data export request GDPR objection/rectification Help/FAQ accessible Complaint filing Notifications (5 scenarios): Notification list loads Mark as read Mark all as read Unread count badge Empty notifications state Edge Cases & Error Handling (8 scenarios): Network error handling 500 server error display 404 page Session expired mid-action Concurrent tab handling Mobile viewport responsiveness Accessibility (keyboard navigation) Input sanitization (XSS prevention) TOTAL: ~100 scenarios Files owned: src/drop-app/tests/e2e/** Acceptance: 100+ test scenarios written All tests pass against local Docker compose (demo mode) Tests organized by feature area Each test has descriptive name Tests are independent (no order dependency) Test report generated (HTML reporter) Phase 3: Landing Page Azure Deploy (B4) — PARALLEL with Phase 1 & 2 Task 3.1: Deploy landing page to Azure Owner: B4 (frontend-builder) BlockedBy: none Description: Landing page is static HTML (landing/index.html + api/waitlist.js) Deploy static files via Nginx on Azure VM or Azure Static Web Apps Waitlist API needs Node.js runtime (serverless or Express wrapper) Configure getdrop.no DNS → Azure Ensure DATABASE_URL for waitlist PostgreSQL Verify form submission works end-to-end Files owned: landing/, nginx configs Acceptance: getdrop.no loads landing page Waitlist form submits successfully Email stored in PostgreSQL waitlist_signups table All 13 language variants accessible SSL certificate valid Mobile responsive Phase 4: Mobile Build Verification (B3) — PARALLEL Task 4.1: Verify and fix React Native mobile builds Owner: B3 (paul-hudson persona for iOS guidance) BlockedBy: none Description: Verify iOS build compiles (EAS Build) Verify Android build compiles (EAS Build) Test demo mode on iOS Simulator Test demo mode on Android Emulator Verify BankID WebView integration in demo mode Verify biometric auth flow Fix any build errors Document build steps Consult jake-wharton persona for Android-specific issues (Samsung Knox, biometric) Files owned: src/drop-mobile/ Acceptance: iOS build compiles without errors Android build compiles without errors Demo login works on iOS Simulator Demo login works on Android Emulator Navigation through all 18 screens works Biometric auth prompt appears Phase 5: Validation (V1) — AFTER Phases 1-4 Task 5.1: Validate entire Drop deployment Owner: V1 (validator) BlockedBy: 1.1, 1.2, 2.1, 3.1, 4.1 Description: Browser verification: app.getdrop.no loads and demo works Browser verification: getdrop.no form submits Run full Playwright E2E suite against Azure deployment Verify CI/CD pipeline triggers correctly Verify mobile builds Check HiveMind updates from all builders Run qa-19.js quality gate Acceptance: app.getdrop.no renders (NOT white page) — Playwright screenshot getdrop.no waitlist form submits — Playwright screenshot E2E suite: 90%+ pass rate on Azure CI/CD: test push to dev triggers workflow Mobile: builds compile qa-19.js score >= 17/19 Validation Commands # Health check curl -s https://app.getdrop.no/api/health | jq . # Landing page curl -s -o /dev/null -w "%{http_code}" https://getdrop.no # Waitlist form curl -s -X POST https://getdrop.no/api/waitlist -H "Content-Type: application/json" -d '{"email":"test@test.com"}' # Run E2E tests against Azure cd ~/ALAI/products/Drop/src/drop-app && BASE_URL=https://app.getdrop.no npx playwright test # CI/CD verification gh workflow list -R ALAI/Drop gh run list -R ALAI/Drop --limit 5 # QA gate node ~/system/tools/qa-19.js check 7187 # Mobile builds cd ~/ALAI/products/Drop/src/drop-mobile && eas build --platform all --profile preview --non-interactive Execution Order Phase 1 (B1: Azure infra) ──┐ Phase 2 (B2: E2E tests) ──┼──→ Phase 5 (V1: Validate all) Phase 3 (B4: Landing) ──┤ Phase 4 (B3: Mobile) ──┘ All 4 builder phases run IN PARALLEL. Validator runs after all complete. Risk Mitigations Risk Mitigation Azure VM resource limits (4GB RAM) Use Container Apps if needed, or scale VM DNS propagation delay Pre-configure Azure IP, use low TTL Playwright flaky on CI Use retry: 1, serial mode for auth tests Mobile EAS build queue Use local builds as fallback Hook permission blocks Builders use worktree isolation Notes Backend is Hono/TS (migration to Kotlin pending MC #5124) — we deploy CURRENT stack, not migrated BankID + Bank mock already exist — no need to build from scratch Demo mode (DROP_MODE=demo) is the target, not production with real banking Cards feature stays disabled (feature-flagged off)