drop-mvp-pipeline-plan

Plan: Drop MVP Pipeline A-Z

Research Summary

Actual State (13.02.2026)

Phase 4 (Implementation) — 95% done, NOT 80% as PIPELINE.md says:

• 12 frontend pages: ALL wired to real API routes via fetch()
• 24+ API routes: ALL working (auth, transactions, cards, merchants, rates, etc.)
• SQLite DB: 6 tables + seed data, parameterized queries
• Auth: JWT httpOnly cookies, rate limiting
• Validation: hardened (backend + frontend), 18+ age check
• Services: mock-swan/stripe/sumsub with config toggle (expected for MVP)
• Rebrand: ALL pages rebranded to Stitch design
• Tests: 126 unit + 91 e2e = 217 ALL GREEN

What's actually missing for MVP-ready:

1. Full remittance E2E flow test (register → login → send money → verify)
2. .env.example + environment config for production
3. Docker build verification (Dockerfile exists but untested)
4. SQLite → needs volume mount for persistence in Docker
5. 5 test iterations per testing.md standard
6. Deploy to staging (Railway/Hetzner — cost analysis says 10-170 NOK/mo)
7. Domain config (getdrop.no)
8. Landing page deploy (static HTML, separate from app)
9. PIPELINE.md outdated — needs update

Infrastructure already built:

• Dockerfile: 3-stage build, standalone output ✅
• docker-compose.yml: app + postgres, healthchecks ✅
• next.config.ts: standalone, CSP headers, security headers ✅
• Cloud cost analysis: done ✅

NOTE: docker-compose.yml has postgres service but app uses SQLite. For MVP: deploy with SQLite + volume (Railway/Fly persistent disk). PostgreSQL migration is Phase 2 (200+ users) per cost analysis.

Objective

Take Drop from "works on localhost" to "deployed MVP on staging with full test coverage." 4 phases, no detours, no cosmetics.

Team Orchestration

Team Members

ID	Name	Role	Agent Type
B1	flow-test-builder	Write full remittance E2E flow + missing flow tests	builder
V1	test-validator	Run all 5 test levels, 5 iterations, verify coverage	validator
B2	deploy-prep-builder	Create .env.example, fix docker-compose for SQLite, test Docker build	builder
V2	deploy-validator	Verify Docker image builds and runs correctly	validator
B3	staging-builder	Deploy to Railway/Hetzner, configure domain, SSL	builder
V3	staging-validator	Verify staging is live, all pages load, API responds	validator
B4	pipeline-closer	Update PIPELINE.md, close MC tasks, create post-mortem	builder

Step-by-Step Tasks

Phase 1: Complete Implementation (finish Phase 4)

Task 1: Write missing E2E flow tests + update PIPELINE.md status

• Owner: B1
• BlockedBy: none
• Files:
  • tests/e2e/full-flows.spec.ts (NEW)
  • project/PIPELINE.md (UPDATE)
  • .env.example (NEW)
• Instructions:
  1. Read existing test files to understand patterns
  2. Write full E2E tests for:
     • Complete registration → login → dashboard flow
     • Login → send money (remittance) → verify transaction in history
     • Login → scan QR → pay → verify in history
     • Login → view cards → order virtual card
     • Login → view accounts → check balances
     • Login → profile → logout → redirect to login
  3. Create .env.example with all required vars:

     JWT_SECRET=change-me-in-production
     NODE_ENV=production
     NEXT_PUBLIC_SERVICE_MODE=mock
     

  4. Update PIPELINE.md Phase 4 status to 100%
  5. Run tests, fix any failures
• Acceptance:
  • full-flows.spec.ts has 6+ complete user journey tests
  • All E2E tests pass (existing + new)
  • .env.example exists with documented vars
  • PIPELINE.md Phase 4 marked complete

Phase 2: Testing (5 iterations per testing.md)

Task 2: Run 5 test iterations across all levels, fix failures

• Owner: V1
• BlockedBy: 1
• Instructions:
  1. Read ~/system/rules/testing.md for requirements
  2. Run iteration 1: npx vitest run + npx playwright test
  3. Log results to tests/logs/iteration-1.txt
  4. Fix any failures found
  5. Repeat for iterations 2-5
  6. Check coverage: npx vitest run --coverage (target 80%+)
  7. Run regression tests: npx vitest run tests/regression/
  8. Run performance tests: npx vitest run tests/performance/
  9. Final summary of all 5 iterations
• Acceptance:
  • 5 iterations logged in tests/logs/
  • ALL tests pass on iteration 5
  • Coverage report generated
  • No regressions
  • Performance benchmarks baselined

Phase 3: Deploy to Staging

Task 3: Prepare Docker for SQLite deployment

• Owner: B2
• BlockedBy: 2
• Files:
  • docker-compose.yml (UPDATE — add SQLite volume, remove postgres for MVP)
  • docker-compose.production.yml (NEW — for future postgres)
  • Dockerfile (UPDATE if needed)
• Instructions:
  1. Read existing Dockerfile and docker-compose.yml
  2. Create docker-compose.mvp.yml for SQLite deployment:
     • App service with SQLite volume mount
     • JWT_SECRET from env
     • Health check on /api/health
     • No postgres (not needed for MVP)
  3. Keep existing docker-compose.yml as docker-compose.production.yml (postgres version)
  4. Test: docker build -t drop-app . — must succeed
  5. Test: docker run -p 3000:3000 -e JWT_SECRET=test drop-app — must serve pages
  6. Verify /api/health, /login, /onboarding all respond 200
• Acceptance:
  • Docker image builds successfully
  • Docker container starts and serves pages
  • /api/health returns 200
  • SQLite data persists across container restart (volume)
  • docker-compose.mvp.yml works with docker-compose -f docker-compose.mvp.yml up

Task 4: Validate Docker deployment

• Owner: V2
• BlockedBy: 3
• Acceptance:
  • Docker build < 2 minutes
  • Image size < 500MB
  • Container starts in < 10s
  • All API endpoints respond correctly
  • No security warnings in container logs

Task 5: Deploy to staging (Railway or Hetzner)

• Owner: B3
• BlockedBy: 4
• Instructions:
  1. Read cloud-cost-analysis.md for recommended approach
  2. Option A (Railway): railway init + railway up — easiest, persistent disk
  3. Option B (Hetzner): Docker deploy to existing VPS if available
  4. Configure:
     • JWT_SECRET (generate secure random)
     • NODE_ENV=production
     • Domain: staging.getdrop.no or drop-staging.alai.no
  5. Set up SSL (Let's Encrypt / Cloudflare)
  6. Verify all pages load on staging URL
  7. Deploy landing page (static HTML) to same domain or subdomain
• Acceptance:
  • Staging URL accessible via HTTPS
  • All 12 app pages load correctly
  • Login + registration flow works end-to-end
  • API health check passes
  • Landing page live

Task 6: Validate staging deployment

• Owner: V3
• BlockedBy: 5
• Instructions:
  1. Hit staging URL — verify HTTPS, correct domain
  2. Test all pages load (no 404, no 500)
  3. Test registration flow end-to-end
  4. Test login with demo credentials
  5. Test send money flow
  6. Test QR scan flow
  7. Check security headers (CSP, HSTS, X-Frame-Options)
  8. Check mobile responsiveness (375px viewport)
• Acceptance:
  • All pages load via HTTPS
  • Registration + login works
  • Core flows work (send, scan, cards)
  • Security headers present
  • Mobile-friendly

Phase 4: Close Pipeline

Task 7: Update PIPELINE.md, close tasks, create summary

• Owner: B4
• BlockedBy: 6
• Instructions:
  1. Update PIPELINE.md:
     • Phase 4: ✅ Done
     • Phase 5: ✅ Done (5 iterations, all pass)
     • Phase 6: ✅ Done (staging live at URL)
     • Phase 7: 🔄 Monitoring
  2. Close related MC tasks: #526, #608, #791-793 (update status)
  3. Create post-mortem summary:
     • What was built
     • Test results
     • Staging URL
     • Known limitations (mock services, SQLite, no BankID)
     • Next steps for production (partner agreements, PostgreSQL, Finanstilsynet)
  4. Post summary to HiveMind
• Acceptance:
  • PIPELINE.md fully updated
  • MC tasks updated
  • Post-mortem written
  • HiveMind updated
  • Alem can access staging URL

Validation Commands

# Phase 1 — Tests
cd ~/ALAI/products/Drop/src/drop-app
npx vitest run                    # Unit tests
npx playwright test               # E2E tests

# Phase 2 — Coverage
npx vitest run --coverage

# Phase 3 — Docker
docker build -t drop-app .
docker run -p 3001:3000 -e JWT_SECRET=test123 drop-app
curl http://localhost:3001/api/health

# Phase 4 — Staging
curl -I https://staging.getdrop.no
curl https://staging.getdrop.no/api/health

Risk Register

Risk	Impact	Mitigation
Docker build fails (native deps)	Blocks deploy	better-sqlite3 needs python/g++ in Dockerfile — already there
Railway free tier limits	Slow staging	Upgrade to $5/mo Starter — within budget
SQLite concurrent writes	Data corruption under load	MVP only, < 200 users. PostgreSQL in Phase 2
No real BankID	Can't verify real users	Expected for MVP. Mock BankID with DOB field
No partner APIs (Swan/Stripe/Sumsub)	All transactions are mock	Expected. Partner agreements are business tasks, not code

Timeline

Phase	Tasks	Parallel?	Estimated
1: Complete impl	Task 1	Solo	1 builder
2: Testing	Task 2	Solo (blocked by 1)	1 validator
3: Deploy	Tasks 3-6	B2→V2→B3→V3 sequential	2 builders + 2 validators
4: Close	Task 7	Solo (blocked by 6)	1 builder

Total: 4 builders + 3 validators = 7 agent tasks