# Handoff — after refinement-phase-0 (Local end-to-end bring-up)

**Date:** 2026-07-12 · **Track:** integration (both projects) · **Unlocks:** every other refinement phase.

## What the frontend can now do
- **Actually call the backend cross-origin.** The API now has a CORS policy (`BalinyaarWebClient`) allowing
  `http://localhost:3000` (config `Cors:AllowedOrigins`, default in Dev) with the four headers the client
  sends (`Authorization`, `Content-Type`, `Accept-Language`, `Idempotency-Key`). A browser at `:3000` calling
  `https://localhost:5002` is no longer blocked by same-origin policy.
- **Stand the stack up in ~5 minutes** via `dev/post-phase/refinement/RUNBOOK.md` (dev-cert trust → local SQL
  Server via `docker compose` → connection string via `dotnet user-secrets` → `dotnet run` + `npm run dev`).
- **Complete a real login end-to-end.** Request an OTP, read the 6-digit code from the **server console**
  (`MOCK SMS — OTP code … for phone ending in …`) or from the Development-only helper
  `GET /api/v1/dev/last_otp/{phone}`, verify → real tokens + `/me`.

## What did NOT change (important)
- **No `USE_*_MOCK` flag was flipped.** `auth` is still the only real client domain; the home/search/bookings
  are still in-browser mocks until [Refinement Phase 4](../../../post-phase/refinement/refinement-phase-4-frontend-de-mock.md).
- **No client app code changed** — only verified `client/.env.development` (already `https://localhost:5002`)
  and added the runbook. If you run the API elsewhere, override with `client/.env.local`.
- **Auth crypto, the money path, and the `ApiResult` envelope are untouched.**

## New endpoint (Development only — not a contract)
- `GET /api/v1/dev/last_otp/{phone}` → `{ data: { phone, code } }` when a code was issued, else 404. **404 in
  every non-Development environment** (the capture isn't even wired there). For manual/e2e login only;
  superseded by real SMS in [Refinement Phase 8](../../../post-phase/refinement/refinement-phase-8-external-rails.md).
  Do not build client features on it.

## Gotchas
- The API binds **HTTP/2** (`Kestrel:Protocols = Http2`, for gRPC). Browsers negotiate h2-over-TLS via ALPN
  automatically, so `fetch` works; `curl` needs `--http2`.
- The dev HTTPS cert **must be trusted** (`dotnet dev-certs https --trust`) or `fetch` to `:5002` fails with an
  opaque network error.
- Committed `appsettings*.json` connection strings are **placeholders** — the API will not boot until you set
  `ConnectionStrings:SqlServer` via user-secrets (or the `ConnectionStrings__SqlServer` env var).