QODY Prod Onboarding UAT Findings 2026-07-08 (MC #105046)

MC #105046 — QODY Prod Onboarding UAT Findings (FAZA 1, READ-ONLY)

Date: 2026-07-08 Scope: admin.qody.ba (rg-qody-prod, qody-prod-db) — add-restaurant/onboarding wizard + prod DB audit Method: Direct psql query against qody-prod-db.postgres.database.azure.com (qody_flyway, read-only SELECTs only, no writes performed) + live browser check of admin.qody.ba. Constraint: No prod data was modified in this investigation. Session token budget was exhausted mid-way through the planned Playwright wizard walkthrough (see Limitation below) — DB findings are complete and are the primary evidence.

Finding 1 (CONFIRMED, root cause identified): Live test data exists in PROD

Prod DB (rg-qody-prod / qody-prod-db) currently contains 1 test organization + 1 test venue + 1 test staff account, created via the real superadmin onboarding API, not the demo environment:

audit_log (only 3 rows exist in the entire prod table) confirms the sequence, all against venue 5d46da81...:

1. merchant_onboarded (venue) @ 08:32:15.05
2. owner_invited (staff) @ 08:32:15.06
3. invite_accepted (staff) @ 08:32:17.28 — actor is the UAT staff row itself, meaning the invite flow was actually exercised end-to-end (email/token accepted) live against prod.

Root cause: Flyway V25 "owner provisioning" was installed on prod at 08:21:59, ~10 minutes before the test data was created. This migration corresponds to the new owner-provisioning feature scoped in MC #104856 (superadmin merchant onboarding — org+venue+OWNER account+invite). Someone (or an automated post-deploy verification step) then ran a live functional test of the new onboarding + invite-accept flow directly against admin.qody.ba/api.qody.ba PROD, using an @alai.no throwaway address and an "MC104856 UAT..." naming convention that makes intent explicit (test, not a real merchant). This is a ZAKON PI2 violation: post-deploy verification must not exercise write-paths against prod with fabricated data — verification should have run against rg-qody-demo or used a scoped/cleaned-up test harness.

Cleanup was incomplete: only the venue row was soft-deleted. The organization row and the staff (owner login) row were left live. There is no evidence of a DELETE/cleanup audit entry for org or staff — the onboarding/offboarding code path has no organization-level or staff-level teardown, so a manual venue-only soft-delete leaves orphaned org + a still-functional staff login in prod.

This directly matches the CEO's report of "test podataka u prod" on admin/app.qody.ba.

Finding 2 (CONFIRMED, product bug — pre-existing, documented in MC #104856): Onboarding wizard produces unusable venues

MC #104856 (open, plan-stage, owner: john) already documents via tool-verified inspection on 2026-07-06 that:

SuperAdminService.onboardMerchant() ONLY inserted org + venue row + audit log. It did NOT create an owner staff/login, deliver credentials, scaffold menu/tables/QR, or start Stripe/Monri — venue existed but was unusable.

Flyway V25 ("owner provisioning", installed 2026-07-07 08:21:59) appears to be a partial fix shipped ahead of the full MC #104856 plan/build cycle — it added the owner-invite step (confirmed by the owner_invited / invite_accepted audit rows above), but:

• It was deployed and verified live against prod data rather than demo (Finding 1).
• It's unclear from DB state alone whether menu/tables/QR scaffolding, Stripe/Monri setup, and email delivery are complete — MC #104856's scope (3 surfaces: superadmin-driven onboarding, self-serve signup, oversight console) is still open/unbuilt as a whole.

Limitation: A full live Playwright walkthrough of the add-restaurant wizard (to enumerate UI/UX errors with screenshots per the task's ask) was started (login page loaded successfully at admin.qody.ba) but could not be completed — the session's token budget was exhausted before the wizard steps could be exercised. This sub-task is incomplete and must be re-run (see Recommended Fix Tasks #3 below). Per this investigation's read-only mandate, the wizard was deliberately NOT submitted to completion to avoid creating additional prod test data — any live UAT of the wizard should run against rg-qody-demo, not prod, to prevent repeating Finding 1.

Finding 3 (informational): Only 2 venues total exist in prod

Full venue enumeration (all rows, no filtering) returned exactly 2 rows: the system QODY Platform Admin venue (org 00000000-...0001, legitimate platform-internal row from initial prod seed 2026-06-29) and the MC104856 UAT Test Venue from Finding 1. No other test/demo entities exist in prod — the "test data" the CEO is seeing is specifically this one MC #104856 UAT artifact (org+venue+staff), not a broader seeding problem.

Recommended Fix Tasks (Phase 2)

1. [H] Clean up orphaned prod test data — soft-delete or hard-delete organization row ff7536bd-b355-4007-bac1-a02c4fb2bc11 and staff row 50afd2ed-9bfd-48c8-afe2-4ba1762b93bf (and any dependent password_reset_tokens/refresh_tokens/staff_totp rows) in rg-qody-prod. Requires explicit CEO/FlowForge-approved prod write (this phase was read-only only). Owner: FlowForge, with Proveo verification.
2. [H] Add cascade teardown to venue soft-delete — SuperAdminService venue-delete path must cascade to org (if no other venues) and staff (owner login) so a partial soft-delete can never again leave a live login/org behind. Owner: CodeCraft, tied to MC #104856 build phase.
3. [H] Re-run full Playwright add-restaurant/onboarding wizard UAT — on rg-qody-demo, not prod — enumerate all UI/UX errors with screenshots (this task's original ask, not completed here due to budget exhaustion). Owner: Proveo.
4. [M] Fix ZAKON PI2 post-deploy verification process for QODY — post-deploy write-path verification (e.g. onboarding, invite-accept) must run against rg-qody-demo seeded data or a disposable test fixture with mandatory automated cleanup, never live prod with hand-rolled "UAT Test" naming. Owner: FlowForge + john (process fix).
5. [M] Complete MC #104856 plan/build — the underlying onboarding-wizard gaps (owner provisioning was only partially, ad-hoc shipped as V25) still need the full phase-gated plan → CEO review → build cycle per MC #104856's own instructions. Owner: Petter Graff (plan lead) per MC #104856.

Evidence Files

• /tmp/verify-105046/db-organizations.txt
• /tmp/verify-105046/db-venues.txt
• /tmp/verify-105046/db-staff.txt
• /tmp/verify-105046/db-audit-log.txt