hamid
76 lines
4.8 KiB
Markdown
76 lines
4.8 KiB
Markdown
# Status — where the project actually is
|
|
|
|
> Last verified: 2026-08-02 against commit `b876490`. Populated by phase 4 of the
|
|
> [documentation clean-up chain](../../archive/clarify-chain/README.md).
|
|
|
|
This is the page you open after two weeks away. "What's left?" now has one honest answer instead of five
|
|
unreconciled ledgers.
|
|
|
|
## The picture in one table
|
|
|
|
| | Count |
|
|
| --- | --- |
|
|
| Flows: built · partial · mocked · not started | 1 · 15 · 7 · 0 (of 23) |
|
|
| Business areas covered (of 14) | 14 — none orphaned; **area 13 (Tax, Invoicing & Legal) is weakest** |
|
|
| Backlog items — open + deferred | **262** (`BL-001`…`BL-262`) |
|
|
| — blocker | 18 |
|
|
| — major | 86 |
|
|
| — minor | 115 |
|
|
| — deferred (has a pull-trigger) | 43 |
|
|
| Backlog items — closed this phase | 88 |
|
|
| Raw candidate rows harvested (pre-dedup, across 10 sources) | ~700 |
|
|
|
|
Full detail: [backlog.md](backlog.md) (open) · [backlog-closed.md](backlog-closed.md) (closed) ·
|
|
[implemented.md](implemented.md) (business-area overlay) · [decisions.md](decisions.md) (the ADR log).
|
|
|
|
## The five things standing between here and a usable product
|
|
|
|
1. **Admin RBAC is structurally dead ([BL-001](backlog.md#blockers-18)/[BL-002](backlog.md#blockers-18)).**
|
|
`DynamicPermissionService` grants only the literal role `admin`, which no seeded account holds — every
|
|
admin surface 403s. This one root cause independently degrades **11 of 14 business areas**
|
|
([implemented.md](implemented.md#cross-cutting-the-rbac-finding)). Highest leverage fix in the backlog.
|
|
2. **The two real money rails both dead-end before completion.** Card payment redirects to a host that
|
|
doesn't exist and nothing fires the PSP webhook locally ([BL-005](backlog.md#blockers-18)); no BNPL
|
|
gateway is ever seeded, so every BNPL call 400s, and the wizard's own mock cross-imports a store that
|
|
404s on any real booking id ([BL-007](backlog.md#blockers-18)/[BL-008](backlog.md#blockers-18)). Neither
|
|
money path can be walked end-to-end from a browser today.
|
|
3. **Five domains are 100% client-mocked while a working server sits behind them** — verification, refunds,
|
|
nurse payouts, patient/care records, and the entire partner-center portal
|
|
([BL-009](backlog.md#blockers-18), [BL-010](backlog.md#blockers-18), [BL-011](backlog.md#blockers-18),
|
|
[BL-012](backlog.md#blockers-18), [BL-013](backlog.md#blockers-18)). Three of the five would also *break*
|
|
on a naive flip — the client and server DTO shapes have drifted.
|
|
4. **The booking payment window lies to the customer.** Deadline timestamps ship with no timezone, so in
|
|
Tehran a 30-minute countdown renders as ~4 hours and the request silently expires while the timer still
|
|
shows time left ([BL-006](backlog.md#blockers-18)).
|
|
5. **Two pre-launch security items are live right now.** The repo's committed credentials (DB `sa`, both
|
|
encryption-key halves, three third-party API keys) have never been rotated
|
|
([BL-003](backlog.md#blockers-18)), and a Development-only OTP-read endpoint is reachable on the
|
|
production domain because the deployment runs as Development
|
|
([BL-004](backlog.md#blockers-18)).
|
|
|
|
## Where to go next
|
|
|
|
| Question | Answer |
|
|
| --- | --- |
|
|
| Is flow X built? | [docs/flows/index.md](../flows/index.md) — the status table, 23 flows |
|
|
| How do I test it? | [docs/flows/testing-setup.md](../flows/testing-setup.md) |
|
|
| What's the client↔server contract? | [docs/integration/index.md](../integration/index.md) |
|
|
| What are the hard rules? | [docs/rules/index.md](../rules/index.md) |
|
|
| What's open, and how bad is it? | [backlog.md](backlog.md) |
|
|
| What's already closed? | [backlog-closed.md](backlog-closed.md) |
|
|
| Which business area is built vs. mocked? | [implemented.md](implemented.md) |
|
|
| Why was X built that way? | [decisions.md](decisions.md) |
|
|
| What's next, in order? | [docs/roadmap/index.md](../roadmap/index.md) |
|
|
|
|
## How this file's numbers were produced
|
|
|
|
Five ledgers — the [hardening issues list](../../archive/post-phase/hardening/issues.md) (18 items, all
|
|
unticked since 2026-07-16), the [67-REQ contract ledger](../../archive/build-chain/working-context/frontend/requests/for-backend.md),
|
|
53 phase reports' own "Follow-ups" sections, 22 backend hand-off files' deferrals, and two rounds of raw
|
|
manual-testing notes — were harvested in full, then every hardening item, every REQ, and every manual-testing
|
|
bullet was **re-verified against the code at `b876490`**, not trusted as filed. Phase 3's **283
|
|
already-verified flow gaps** (each with a live code trace, several walked against a booted server) are this
|
|
phase's primary, freshest input and form the backbone of [backlog.md](backlog.md). Nothing here is copied
|
|
from a stale document without a fresh check — the phase-chain's own rule (["verify, don't
|
|
copy"](../../archive/clarify-chain/README.md#non-negotiables-for-every-phase)) held throughout.
|