Skip to main content

Boards Backlog Reconciliation — DRAFT (Activity 1)

⚠ PARTIAL DRAFT — do NOT treat as authoritative yet​

This is the read-only Activity-1 reconciliation map (the proposed Azure Boards backlog). It was produced concurrently with two large build streams, and 6 of 9 source extractors were rate-limited — so this draft is synthesized from only 3 fully-read sources: the Property-#1 Readiness Audit + Gold-Standard Plan, the RTM P0-Drift Triage + Dashboard, and the 26 customer-feedback points.

Still to fold in (completion re-run queued for when build streams free up rate budget): the master pending tracker (§10 top-25), the per-EPIC RTM detail (EP-001…016), the open FU list (compliance/follow-ups.md), the per-repo CLAUDE.md follow-up markers, and the in-session program state. Until those land, the per-pod trees under-count and some "GAP" items may already be DONE.

Nothing is written to Azure Boards. Phase B (Boards write via the ADO Boards MCP) is gated on: operator Boards PAT + customized process/9 Area Paths + sign-off on the COMPLETED map.

KeyNova/HMP Consolidated Backlog Map — De-Duped Epic→Feature→Story/Bug/Task

Synthesizer output for operator review. Becomes the Azure Boards backlog after approval. READ-ONLY synthesis; no Boards writes.

STATUS — 2026-06-04: COMPLETE (9/9 sources folded in + launch-blockers code-verified). §1–§5 = the first-pass synthesis (3 sources). §6 folds in the 6 previously-rate-limited sources (master tracker, FU ledger, EPIC catalog, per-EPIC RTM drifts — +205 surfaced). §7 code-verifies the ~17 headline launch-blockers (8 DONE / 5 PARTIAL / 5 GAP). §8 corrects the executive summary + gives the true open-in-code short-list. §10 notes the same-day @hmp/compliance@1.1.0 GST fix. Awaiting operator approval of merges/severity before any Boards write (§5).

1. Executive Summary​

Total de-duped items​

~138 distinct actionable items consolidated from 6 readable source extracts (Extracts 2, 3, 6 carried content; Extracts 1, 4, 5, 7, 8, 9 were rate-limited/empty). Breakdown by origin layer:

  • Property #1 Readiness Audit / Gold-Standard Fix-Plan (Extract 2): 47 P0 + 41 P1 + ~39 P2 = ~127 AP-T## / AP-CC## items
  • RTM Phase-1 P0-Drift Triage + Dashboard (Extract 3): 29 launch-critical P0 drifts (22 brand-new, 7 already-tracked) + 5 proposed new stories + 9 catalog status-flips
  • KeyNova 3-June Customer Testing Feedback (Extract 6): 26 field-reported items

Rough counts by P-level (de-duped)​

P-levelCountNotes
P0 (launch-blocking)~6247 audit P0 + 22 brand-new RTM P0 − 7 overlap (RTM↔audit) ≈ 62 distinct
P1 (must-fix-soon)~41from audit; several map to RTM clusters
P2 (nice-to-have)~39mostly descriptive, audit-only
Customer-feedback (mixed sev)267 closed, 13 in-flight, 6 open/programmatic
Catalog status / new-story~145 new stories + 9 status flips

Rough counts by pod​

PodApprox itemsHeaviest themes
PMS-Core~34reservations, check-in/out, folio, tape chart, room-status state machine, onboarding
Payments-Finance~26GST slabs, IRN/e-invoice, Razorpay, merchant accounts, DPDPA retention, document-numbering
FnB-Outlets~14KDS/KOT, POS→folio, sin-goods GST, room-charge integrity
Distribution~12ResAvenue channel, OTA security, channel GST/TDS, booking-engine
Guest-Experience-CRM~12CRM security, campaigns, guest PII, travel-party, ID upload
Compliance-Trust-Security~18DPDPA §9, TRAI DLT, audit hash-chain, encryption fail-fast, RS256
Platform-Foundation~10gateway two-file rule, multi-impl ownership, CI validators
Infrastructure-Reliability~14S3/MinIO, SendGrid/SES, NIC creds, compose sync, cron→k8s, WS nginx routes
Revenue-Intelligence~10MV/ADR/RevPAR, STR benchmark, dynamic-pricing ownership, GSTR reports

Launch-blockers​

  • Audit P0: 47 (3–4 deferred to Phase 2 per ledger: AP-T02-004/AP-CC-2 reseed, AP-T06-003 kiosk, AP-T06-004 mobile-staff, AP-T10-003 empty-MV root-cause)
  • RTM hard launch-gate clusters (Property #1 cannot ship): Clusters 1, 2, 3, 4, 6, 7 = 16 P0 drifts, of which EP-011 D-003 is the SHOWSTOPPER (hardcoded 12% GST).
  • Customer-feedback open launch-relevant: #4 (GST slabs — overlaps EP-011 D-003), #5/#6 (document-numbering, Legal/Finance-gated).

Dedup stats (items appearing in ≥2 sources)​

  • 7 RTM P0s already tracked in the audit (heavy overlap zone): EP-002 D-008↔AP-T02-005; EP-005A D-009↔AP-T08-003; EP-005B D-008↔AP-T08-001/006/007; EP-011 D-005↔AP-T12-002; EP-012C D-004↔AP-T10-005; EP-015 D-007↔AP-CC-4+AP-T08-002; EP-007 D-005↔pipeline 29940.
  • Customer-feedback ↔ audit/RTM overlaps: #4 GST↔EP-011 D-003+AP-T02-005 (GST program); #7 GST-on-extend↔AP-T05-001/002 (rate recalc); #5/#6 numbering↔(net-new document-numbering); #11/#12 room-move↔AP-T05-005/006/T13; #13 shorten-stay↔AP-T13-005; #20 quick-reservation↔AP-T13-001/002; #24 add-charge↔AP-T05-002.
  • RTM's own headline: 22 of 29 P0s were absent from the master tracker — confirming the predicted heavy-overlap-plus-brand-new shape.

Headline EXACT GAP — open launch-blockers (de-duped, code-unverified)​

The minimal set that must close before Property #1 ships, after removing already-DONE-per-ledger items:

  1. EP-011 D-003 / #4 — hardcoded 12% GST in booking-engine (SHOWSTOPPER)
  2. EP-002 D-008 — GST inclusive/exclusive + CGST/SGST vs IGST in rate-plan
  3. EP-005A D-009 (UI) — buyer GSTIN capture surface at check-in/out
  4. EP-007 D-004 — sin-goods GST null-reject
  5. EP-012C D-003/D-004 — dual GSTR-1 impl + NIC schema v3.4 validation
  6. EP-014 D-002 — SES Raw-mode for IRN PDF attachments
  7. EP-014 D-003 — TRAI DLT registration + 9–9 window + STOP/START
  8. EP-010 D-013 — DPDPA §9 minor consent
  9. EP-009 D-001/D-002/D-014 — OTA channel tenant-isolation + role guard + creds-leak + commission GST/TDS
  10. EP-010 D-007 — CRM campaign tenant-scope + info-leak 403
  11. EP-007 D-009 — POS room-charge integrity (credit/occupancy/identity)
  12. EP-011 D-005 — booking-engine payment flag-flip (anti-tampering)
  13. BF-013 D-005 / Cluster 7 — DPDPA-vs-CBIC/RBI retention carve-out (Legal-gated)
  14. AP-T08-002 / NIC creds — production e-invoice credentials (🟡 external)
  15. #5/#6 — document-numbering (Legal/Finance-gated for folio/invoice part)

≈15 open launch-blocker clusters (spanning ~30 underlying P0 drifts), 3 of which are stakeholder-gated (NIC creds, Legal retention sign-off, TRAI DLT external cert).

2. Per-Pod Epic→Feature→Story/Bug/Task Trees​

STATE legend: DONE = source claims shipped (CLAUDE.md+code+tests bar NOT independently verified here); PARTIAL = partly shipped; GAP = not started/net-new; NEEDS-VERIFY = source-doc claim suspected stale, must check code.

2.1 PMS-Core​

(reservations, check-in/out, folio, tape chart, room-status, onboarding core)

Epic: Tenant & Property Onboarding

  • Feature: Self-service onboarding
    • [GAP] Add (auth)/forgot-password + /signup pages (admin-portal) — AP-T01-004 / new-story US-001-017 — public self-onboarding.
    • [GAP] Email-verification landing page /auth/verify-email?token= — AP-T01-003(W3.E.7) / US-001-018.
    • [DONE] Make tenantId optional on ResetPasswordRequestDto; resolve by email — AP-T01-001.
    • [DONE] Allow ADMIN (not only SUPER_ADMIN) on OnboardingController, own-tenant-scoped — AP-T01-003.
    • [PARTIAL] Onboarding wizard state API (4-step UI + saga + PATCH /:id/onboarding) — US-002-017 / EP-002 D-009 — 4-step-vs-7-step compression.
    • [NEEDS-VERIFY] Decide OnboardingService xPrisma deprecation (delete or migrate to PropertyServiceClient) — AP-T01-007.
  • Feature: Property profile completeness
    • [DONE] Add latitude/longitude/googleMapsUrl to Property DTO+schema+map — AP-T02-001.
    • [GAP] Add structured class-validator for CancellationPolicy.rules[] — AP-T02-006.

Epic: Staff Reservations

  • Feature: Reservation CRUD & search
    • [GAP] Reservation Modify → 404 (/reservations/[id]/edit route + PATCH verb missing) — customer-bug from MEMORY 2026-06-03; not in extracts but adjacent — flagged for verify.
    • [DONE] Re-seed QA RDS for Property #1 reservations — AP-T04-001/AP-CC-2 (deferred Phase 2).
    • [PARTIAL] Wire guestName search via GuestServiceClient.findByName or strip input — AP-T04-003.
    • [PARTIAL] Replace client-side FolioTable compute with res.folios[].transactions[] rows — AP-T04-004.
    • [GAP] Decide mobile-reservations scope (scaffold or defer doc) — AP-T04-002.
    • [GAP] Reservation-browse flow test — AP-T04-010.
  • Feature: Reservation editing (customer-feedback wave)
    • [PARTIAL/in-flight] Travel-party companion-name change — #9 (wave-1/2a/2b).
    • [PARTIAL/in-flight] Add payment before check-in (reservation mode) — #10 (wave).
    • [GAP] System not allowing extra payment — #18 (wave-2a/2b).
    • [PARTIAL/in-flight] Change room category (Standard→Deluxe) — #22 (wave).
    • [PARTIAL/in-flight] Change Meal Plan — #23 (wave).
    • [DONE] "Add charge" button — #24 (verified 2026-06-03).
    • [PARTIAL/in-flight] View guest's uploaded ID card — #25 (wave).
    • [DONE] Check-out date == check-in date selectable — #3 (verified).
    • [PARTIAL/in-flight] Check-in time defaults to system time when date=today — #2 (wave).

Epic: Check-In

  • Feature: Check-in flow integrity
    • [GAP] Walk-in/early check-in 400 "before arrival date" — dashboard never sends arrivalDateOverride, UTC-vs-IST compare — MEMORY 2026-06-03 bug; adjacent.
    • [DONE] Registration card (Reg card) working — #8 (verified).
    • [PARTIAL/in-flight] Dirty-room color indicators on check-in screen — #21 (wave).
    • [GAP] Undo check-in option after check-in — #26 (wave-2a/2b).
    • [GAP] Replace idType=OTHER visa hack with Guest.visaNumber/visaType/visaExpiry or GuestVisa model — AP-T06-002 (also Compliance).
    • [GAP] Connect kiosk useCheckInFlow to backend OR descope — AP-T06-003 (deferred Phase 2).
    • [GAP] Build mobile staff frontdesk check-in OR descope — AP-T06-004 (deferred Phase 2).

Epic: Folio & Stay Management

  • Feature: Rate recalculation on stay change
    • [DONE] Fix rate recalc in reservations.service.update() (per-night × new nights on departure change) — AP-T05-001.
    • [DONE] Post EXTENSION_NIGHT folio CHARGE on added nights + emit FOLIO_CHARGE_POSTED — AP-T05-002.
    • [DONE] GST removed when stay extended — #7 (verified; overlaps AP-T05-001/002).
  • Feature: Room move / upgrade
    • [PARTIAL] Consolidate RoomOpsService.roomMove + CheckInService.roomMove into one impl with pricing safeguard — AP-T05-005.
    • [PARTIAL] Post folio CHARGE for paid-upgrade rate-diff inside room-move tx — AP-T05-006.
    • [DONE] Emit RESERVATION_MODIFIED on room-move — AP-T05-007 (ledger DONE).
    • [PARTIAL/in-flight] Tape-chart wrong mouse-over info on room move (101→102) — #11 (wave).
    • [PARTIAL/in-flight] Room rate changes when room moved (101→102) — #12 (wave).
    • [GAP] "Move Room" + "Extend Stay" CTAs on /reservations/:id — AP-T05-004.

Epic: Tape Chart

  • Feature: Tape-chart security & filters
    • [DONE] Add assertPropertyTenant to CalendarService.getCalendar + createQuickReservation — AP-T13-001.
    • [PARTIAL] Wire FilterChipsRow→query→backend filter OR delete chips — AP-T13-002.
  • Feature: Tape-chart interactions
    • [DONE] Universal search in tape chart — #1 (verified).
    • [DONE] Available-rooms count correct — #19 (verified).
    • [GAP] Quick Reservation create fails — #20 (wave-2a/2b; overlaps AP-T13-001/002).
    • [PARTIAL] Shorten 2-night→1-night — #13 / AP-T13-005 (replace redirect with in-place dialog).
    • [GAP] mark-no-show in BAR_ACTIONS — AP-T13-004 (severity collision P0/P1).
    • [GAP] Multi-room reservation visual continuity — AP-T13-003.
    • [GAP] Date-range block UI (RoomBlock model) — AP-T13-006.
    • [P2] Tape-chart drag/drop Playwright e2e — AP-T13-010.

Epic: Room-Status State Machine (cross-cutting, also Platform)

  • [GAP] Central guard/invariant for 3 services PATCHing /rooms/:id/status (frontdesk/HK/property override) — EP-002 D-006 (Cluster 8, brand-new).
  • [NEEDS-VERIFY] Room block (US-002-011) is a Stub — no RoomBlock entity / expected-return / work-order link / auto-clear — EP-002 D-014.

Epic: Cross-EPIC handoff (PMS share)

  • [GAP] Night-audit closing folio-reconciliation invariant (charges = payments + outstanding) at 23:59:59 — BF-006 D-009 (Cluster 9, brand-new).

2.2 FnB-Outlets​

(KDS/KOT, POS→folio, menu GST, room-charge)

Epic: KDS / Kitchen Realtime

  • Feature: KDS app correctness
    • [DONE] Rewrite KDS Electron to target /kitchen namespace, pass JWT, real event names, remove demo default — AP-T07-001.
    • [DONE] Wire kitchenGateway.emitKotCreated() into OrdersService.generateKOT — AP-T07-002.
    • [DONE] Drop /pos/ prefix from mobile F&B posApi paths — AP-T07-003.
    • [PARTIAL] KitchenStation model + per-item routing + per-station rooms — AP-T07-005 (P1/P2 straddle).
    • [P1] Kiosk WebSocket reconnect-Infinity resilience — AP-T07-007.
    • [P2] KDS realtime e2e test — AP-T07-008.

Epic: POS → Folio Integrity

  • Feature: Charge posting
    • [DONE] Map transactionCode from orderType (ROOM_SERVICE/CANTEEN/PREORDER/FnB) — AP-T07-006.
    • [PARTIAL] Extend FOLIO_CHARGE_POSTED payload with CGST/SGST/IGST/customerState — AP-T07-004.
    • [GAP] POS room-charge integrity: check checked-in / credit-limit / identity holds — EP-007 D-009 (Cluster 5, brand-new).
    • [NEEDS-VERIFY] flow-7-pos-to-folio 0/10 PASS — re-measure — EP-007 D-005 (Cluster 0/5; suspected stale).

Epic: Menu / F&B GST

  • [GAP] MenuItem.gstRate silent fallback to outlet taxRate; sin-goods (liquor/beer/cigarettes) must reject null + force explicit GST — EP-007 D-004 (Cluster 1, brand-new).

Epic: Receipts (P2)

  • [P2] ESC/POS receipt printing in checkout — (audit P2 descriptive).

2.3 Distribution​

(ResAvenue channel, OTA security, booking-engine)

Epic: Channel Manager (ResAvenue)

  • Feature: Gateway routing & connection
    • [DONE] Add gateway @All decorators for intermediary, channel-stats, channel-setup, webhook-management (two-file rule) — AP-T11-001.
    • [PARTIAL] Provision real ResAvenue connection row for Property #1; set CHANNEL_MODE — AP-T11-002 (LOTUS LEAF live per MEMORY).
    • [PARTIAL] Register outbound webhook URL with ResAvenue — AP-T11-003.
    • [P1] CHANNEL_MODE=simulator in qa compose until live creds — AP-T11-006.
  • Feature: Rate/restriction push
    • [P1] MinLOS/MaxLOS push (OTA_HotelBookingRuleNotifRQ) — AP-T11-004.
    • [P1] flow-11-channel-manager e2e — AP-T11-005.

Epic: OTA Channel Security (also Compliance)

  • [GAP] ConnectionsService.create trusts dto.propertyId unchecked → cross-tenant attach — EP-009 D-001 (Cluster 3, brand-new).
  • [GAP] No role guard on POST/PUT/PATCH /channels; GET /channels/:id returns decrypted OTA creds — EP-009 D-002 (Cluster 3, brand-new).
  • [GAP] Channel report silent on GST 18% reverse-charge + TDS §194-O 1% on OTA commission — EP-009 D-014 (un-clustered, brand-new, un-triaged).

Epic: Booking Engine

  • Feature: Payment integrity
    • [GAP] VITE_FEATURE_PAYMENT_SERVICE_ENABLED=false in prod → client-amount tampering; flip flag (sandbox-doable, distinct from AP-T12-002) — EP-011 D-005 (Cluster 6).
  • Feature: Booking-engine GST (see Payments-Finance for EP-011 D-003)
  • Feature: Theme/branding
    • [P1] Decide theme strategy — implement KeyNova OR document direction-a/b — AP-T03-003.
    • [P2] Booking-engine branding PATCH /properties/:id/theme (9-preset) — US-002-016→US-011-017.
  • Feature: Booking integrity
    • [DONE] Add idempotencyKey to Reservation; enforce on booking POSTs — AP-T03-001.
    • [DONE] Wire DB-backed IApiKeyService; per-property hashed ApiKey; rotate seed key — AP-T03-002.
  • [P2] Multi-property booking-engine selector — (audit P2 descriptive).

2.4 Payments-Finance​

(GST slabs, IRN/e-invoice, Razorpay, merchant accounts, retention, numbering)

Epic: India GST Engine ⚠ launch-gate

  • Feature: Room GST slabs
    • [GAP/SHOWSTOPPER] Hardcoded 12% GST in booking-engine (CheckoutPage.tsx:220, mockApi.ts:26, mockData.ts:225); implement slab {≤₹1,000:0% / ₹1,001–7,500:12% / ≥₹7,501:18%} — EP-011 D-003 + customer #4.
      • Note slab discrepancy: customer-feedback #4 states ≤₹7,500→5% / ≥₹7,500.01→18% (the newer hotel-GST rule); RTM states a 3-band {0/12/18}. Conflict — needs Finance ruling (see §3/§4).
    • [DONE] Add inclusive Boolean to TaxConfiguration — AP-T02-005 / US-002-015.
    • [PARTIAL] Rate-plan GST-inclusive/exclusive + CGST+SGST (intra) vs IGST (inter) — EP-002 D-008.
    • [GAP] Tax inclusive/exclusive inconsistency + folio per-line amounts — MEMORY bugs #5/#6 (2026-06-03), adjacent.

Epic: GST e-Invoice / IRN (NIC IRP) ⚠ launch-gate

  • Feature: IRN generation
    • [DONE] Replace irn='Pending' PDF literal with real IRN + base64 QR — AP-T08-001.
    • [DONE] Wire GuestServiceClient.getCompany() + getGuestAddresses() into IRN (B2B not B2C/URP) — AP-T08-003 (backend of EP-005A D-009).
    • [GAP] Buyer GSTIN capture UI at check-in/out — EP-005A D-009 (UI net-new).
    • [PARTIAL] Promote irn/signedQRCode/ackDate onto Folio — AP-T08-006.
    • [PARTIAL] Route credit-note IRN through EInvoiceJob queue w/ retry/DLQ — AP-T08-007.
    • [NEEDS-VERIFY] AC "IRN within 30s" vs actual 5-min retry-backoff — EP-005B D-008 (story-AC drift only).
    • [PARTIAL] NIC webhook callback URL registration in sandbox — AP-T08-009.
  • Feature: NIC credentials & mock gating ⚠ stakeholder-gated
    • [PARTIAL] Add NIC creds env to staging/prod; make EINVOICE_MOCK env-driven; prod gate requires false — AP-T08-002 (env flipped ✅ / NIC creds 🟡 external).
    • [DONE] Remove EINVOICE_MOCK=true from prod/staging compose (closed 6681da7) — AP-CC-4.

Epic: GSTR Filing & Returns ⚠ launch-gate

  • [GAP] Dual GSTR-1 implementations (frontdesk/src/gst/ vs analytics/src/gstr/) disagree on totals — EP-012C D-003 (Cluster 1, brand-new).
  • [PARTIAL] NIC e-invoice portal schema v3.4 validation absent; can't file GSTR-1 — EP-012C D-004 = BF-012 D-009 (GSTR-3B done via AP-T10-005; GSTR-1 net-new).
  • [DONE] GSTR-3B prep endpoint aggregating einvoice by HSN/PoS/B2B-vs-B2C — AP-T10-005.
  • [GAP] TDS adjustment missing → books won't tie to Form 26AS at FY close — EP-005B D-003 (Cluster 1, brand-new).

Epic: Payment Gateway (Razorpay)

  • [PARTIAL] Seed MerchantAccount for tenant 1 (encrypted sandbox creds) — AP-T12-001.
  • [PARTIAL] Wire admin wizard → POST /api/merchant-accounts (encrypted per-tenant keys) — AP-T12-002 (LIVE creds 🛑 BLOCKED on Finance).
  • [P1] Add payment_capture: 1 to Razorpay order body — AP-T12-003.
  • [P1] WebhookReconcileService cron (15-min) — AP-T12-004.
  • [GAP] payment.refunded consumer (folio+analytics) has no documented contract — BF-008 D-002 (Cluster 9, brand-new).

Epic: Document Numbering ⚠ partly Legal/Finance-gated

  • [PARTIAL/in-flight] Reservation number numeric — #5 (wave-2b; reservation part in-flight).
  • [GAP] Prefix on all numbering — #6 (folio/invoice part pending Legal/Finance).

Epic: DPDPA vs Statutory Retention Conflict ⚠ Legal-gated (also Compliance/Guest)

  • [NEEDS-DECISION] DSAR cascade scrubs CBIC 7-yr GST (folios.guestName, folio_transactions.guestGstin) + RBI 10-yr payment (payments.payerName, merchant_accounts.payerIdentity); needs carve-out vs already-shipped 90-day erasure — BF-013 D-005 / Cluster 7 (conflicts AP-T08-004).

Epic: Banquet → Folio → IRN (also FnB/PMS)

  • [GAP] Banquet→folio→IRN handoff entirely missing (manual Word GST invoices); no flow test — BF-010 D-013 (Cluster 9, brand-new).

2.5 Guest-Experience-CRM​

(CRM security, campaigns, guest PII, travel-party, ID upload)

Epic: CRM Security

  • [GAP] CampaignService.create doesn't verify propertyId/templateId belong to caller tenant; findOne 403 info-leak (exists vs wrong-tenant) — EP-010 D-007 (Cluster 4, brand-new).

Epic: Guest PII & Erasure (also Compliance)

  • [DONE] Schedule 90-day GuestRetentionTimer at checkout; cron erases + GdprErasureLog — AP-T08-004 (conflicts BF-013 D-005 retention carve-out — see Payments).
  • [DONE] Add GuestErasedConsumer to frontdesk/pos/HK/analytics/crm/payment/notification — AP-T08-005.
  • [GAP] Multi-guest C-Form per foreign co-traveller — (audit P2 descriptive).

Epic: Travel Party & Guest Profile (customer-feedback)

  • [PARTIAL/in-flight] Change companion name in Travel Party — #9 (wave).
  • [PARTIAL/in-flight] View guest's uploaded ID card — #25 (wave).

Epic: Guest ID capture / uploads (also Compliance/Infra)

  • [P1] Switch dashboard ID-photo + signature uploads from base64 to /uploads/presigned-url→S3 — AP-T06-005.

Epic: Communications dispatch (also Compliance/Notification)

  • See TRAI DLT + DPDPA §9 minor-consent under Compliance (EP-014 D-003, EP-010 D-013) — owned jointly crm + notification.

2.6 Compliance-Trust-Security​

(DPDPA, TRAI, audit hash-chain, encryption, RS256)

Epic: DPDPA Compliance ⚠ launch-gate

  • [GAP] DPDPA §9 minor/guardian-consent absent across all dispatch paths (SMS/email/WhatsApp/push) — EP-010 D-013 (Cluster 2, brand-new).
  • [NEEDS-DECISION] DPDPA-vs-CBIC/RBI retention carve-out — BF-013 D-005 / Cluster 7 (detailed in Payments).
  • [DONE] 90-day guest erasure + GdprErasureLog — AP-T08-004 (see Guest).

Epic: TRAI / Telecom Compliance ⚠ launch-gate + external lead-time

  • [GAP] TRAI DLT registration absent + no 9AM–9PM IST promo-SMS window + no STOP/START opt-out — EP-014 D-003 (Cluster 2; 1–2 wk external cert procurement).

Epic: Tamper-Evident Audit

  • [NEEDS-VERIFY/GAP] "Hash-chain AuditLog — Built" claimed but no append-only hash-chain; audit_logs rows are UPDATE/DELETE-able (CERT-In + DPDPA need tamper-evident) — EP-012C D-008 (Cluster 8, brand-new).

Epic: Encryption & Secrets

  • [GAP/severity-disputed] Boot-time fail-fast if ENCRYPTION_KEY unset in prod (silent CForm plaintext) — AP-T06-009 (P0 in fix-plan / P1 in audit — see §3).

Epic: WebSocket / Transport Security

  • [PARTIAL] RS256 migration for all WS gateways (/housekeeping, /kitchen, /events); fail-closed on HS256 in prod — AP-CC-3.

Epic: Channel/CRM credential exposure (cross-listed)

  • Decrypted-creds leak on GET /channels/:id — EP-009 D-002 (see Distribution).

2.7 Platform-Foundation​

(gateway two-file rule, multi-impl ownership, CI validators, theme/cleanup)

Epic: API Gateway Integrity

  • [DONE] CI gateway two-file-rule validator (fail build on prefix/decorator drift) — AP-CC-1.
  • [DONE] Gateway @All decorators for channel prefixes — AP-T11-001 (see Distribution).
  • [P2] Delete dead /ai/query route from both gateway files — AP-T10-013.
  • [P2] Add bare @All('night-audit') decorator — AP-T09-009.

Epic: Architecture / Multi-Implementation Ownership (SP2)

  • [GAP] Room-status state machine central guard — EP-002 D-006 (see PMS-Core).
  • [GAP] Three live dynamic-pricing impls (revenue-strategy/decisions, property-service/rate-plans auto-suggest, booking-engine/mockApi) no documented ownership — EP-013 D-004 (see Revenue-Intelligence).
  • [GAP] Hash-chain AuditLog ownership — EP-012C D-008 (see Compliance).

Epic: Catalog Hygiene / Status Vocabulary

  • [DONE-doc] 5-status vocabulary (Built/Built-Untested/Partial/Stub/Not Started) — Extract 3 §C.1.
  • [N/A status-flip] US-001-004 Built→Partial (MFA OFF all envs) — EP-001 D-003.
  • [N/A status-flip] US-001-006 Built→Partial (11 roles not 9) — EP-001 D-008.
  • [N/A status-flip] US-001-010 Built→Partial (20-attempt not 5) — EP-001 D-010.
  • [N/A status-flip] US-001-011 Partial→Built (invitation-token shipped) — QA-PMS-6.
  • [N/A status-flip] US-002-010 Built→Built-Untested (room features untested) — EP-002 D-010.
  • [N/A status-flip] US-002-011 Built→Stub (RoomBlock missing) — EP-002 D-014.
  • [P2] root↔per-folder CLAUDE.md drift cleanup — (audit P2 descriptive).

2.8 Infrastructure-Reliability​

(S3/MinIO, SendGrid/SES, NIC creds, compose sync, cron→k8s, WS nginx)

Epic: Object Storage / Image Upload

  • [DONE] Provision S3 (QA/prod) + MinIO sidecar (local); add AWS_S3_*; add PROPERTY_IMAGE/ROOM_TYPE_IMAGE AssetType — AP-T02-002.
  • [DONE] Dashboard image-upload widget (replace URL-paste), call /assets/process — AP-T02-003.

Epic: Email / SMS Delivery

  • [PARTIAL] Provision SendGrid creds QA+prod; e2e invoice-email test — AP-CC-5 (FU-51 SendGrid prod-key playbook, deadline 2026-06-15).
  • [GAP] GST e-invoice PDF attachments silent-dropped by AWS SESv2 Simple-Content; need Raw mode (SendRawEmail) — EP-014 D-002 (Cluster 2, brand-new).

Epic: Realtime Transport Routing

  • [DONE] Add Nginx /ws/housekeeping/ + /ws/kitchen/ routes on QA+prod — AP-T05-003.

Epic: Environment / Compose Sync

  • [DONE] Sync compose: remove EINVOICE_MOCK=true + HARDWARE_MOCK=true from prod/staging; add NIC/Razorpay/ResAvenue/SendGrid placeholders — AP-CC-4.
  • [P1] Override HARDWARE_MOCK=false in prod-aws compose — AP-T12-005.

Epic: Scheduling / Cron Hardening

  • [P1] Promote NA scheduler to k8s CronJob w/ miss-detection alert — AP-T09-005.
  • [P2] Nightly backfill-mv.ts k8s CronJob self-heal — AP-T10-012 (ledger DONE).

Epic: Data Seeding / Reference Property

  • [PARTIAL] Reseed QA RDS; verify reservations/MVs/merchant-accounts/intermediary/ApiKey rows — AP-CC-2 (deferred Phase 2).
  • [DONE] Re-seed/repoint QA Property 40b29005-... — AP-T02-004 (dual-ID w/ AP-CC-2).
  • [P2] RatePlanRate seed back-fill — (audit P2 descriptive).

2.9 Revenue-Intelligence​

(MV/ADR/RevPAR, STR benchmark, dynamic-pricing, GSTR/analytics reports)

Epic: Materialized Views & Dashboards

  • [DONE] Write MvAdrRevpar.adr+revpar on every consumer upsert; backfill — AP-T10-001.
  • [DONE] DashboardController.getMetrics query MvAdrRevpar (single source) — AP-T10-002.
  • [NEEDS-VERIFY] QA empty-MV root cause (INTERNAL_SERVICE_TOKEN/Redis Streams/backfill) — AP-T10-003 (deferred Phase 2).
  • [DONE] Fix mobile dashboardApi.getMetrics URL + inject X-Property-ID — AP-T10-004.
  • [P1] Subscribe reservation.modified; rename folio.charge.posted→folio.posted; add folio.closed/kot.completed consumers — AP-T10-006.
  • [P1] Fix MvDailyOccupancy.totalRooms upsert from PropertyServiceClient — AP-T10-009.

Epic: Night Audit → Analytics

  • [DONE] Extend NA rollback transactionCode filter to include OVERSTAY_NIGHT + NO_SHOW — AP-T09-001.
  • [DONE] Subscribe analytics dispatcher to night.audit.completed; add MV consumer + backfill — AP-T09-002.
  • [P1] night-audit-summary PDF/CSV generator — AP-T09-003 (ledger open).
  • [P1] Typed currentBusinessDate Date? on Property; migrate from JSON — AP-T09-004.

Epic: Reporting Accuracy / Benchmarks

  • [GAP] STR-benchmark divergence: MvDailyKpi.revpar uses /total_rooms_available but Hotelogix/IDS Next/STR use /rooms_sold — EP-012A D-004 (Cluster 10, brand-new).
  • [P1] Replace /reports/[category] fallback with backend catalog only — AP-T10-007.
  • [P1] Replace admin /analytics demo data with GET /analytics/admin/platform-overview — AP-T10-008.
  • [P2] NLQ wiring — (audit P2 descriptive).

Epic: Dynamic Pricing Ownership (SP2, also Platform)

  • [GAP] Three live dynamic-pricing impls, no documented ownership — EP-013 D-004 (Cluster 8, brand-new).

3. Conflicts — Sources Disagree on State (Stale-Doc List)​

ItemSource A saysSource B saysResolution needed
AP-T06-009 ENCRYPTION_KEY fail-fastAudit Section E: P1 highlightFix-plan Track 1 + Ledger: P0 / Wave 2Treat as P0 (defensive boot-gate); reconcile severity in Boards.
AP-T13-004 mark-no-showAudit: P1Fix-plan Ledger: W1 / DONE (P0-wave)Verify DONE in code; if shipped, close as DONE.
AP-T03-004 ID collisionAudit: P1 "verify Razorpay creds + webhook"Re-audit ledger: reused for Sunita Joshi OTA tax double-charge + folio-preview (4 stacked bugs)Split into two work items — same ID, two scopes.
EP-005A D-008 / EP-007 D-005 / EP-015 D-007 (0-pass flow specs)RTM dashboard: 0/15, 0/10, 0/15 PASS (launch blocker)Triage Cluster 0: suspected stale, "may already pass at 60–90%"Re-measure first (Cluster 0, ½ day) before treating as broken.
EP-012C D-004 vs BF-012 D-009Triage: counts them as same driftDashboard: lists as two separate rows (19, 28)Merge into one Boards item (done here); note in 29-vs-29 reconciliation.
EP-009 D-014 & EP-015 D-007Dashboard 29-row table: listed P0Triage clusters: NOT folded into any of 11 clustersEP-009 D-014 is an un-triaged brand-new P0 — needs a cluster/owner.
"22 brand-new" headlineDashboard: 22 of 29 brand-newSynthesis: 22 plus un-clustered EP-009 D-014 = arguably 23Headline is a slight undercount.
GST slab definitionCustomer #4: ≤₹7,500→5%, ≥₹7,500.01→18%RTM EP-011 D-003: {≤₹1,000:0%, ₹1,001–7,500:12%, ≥₹7,501:18%}Finance must rule the authoritative slab table (5% vs 12% mid-band; threshold ₹7,500 vs ₹7,501).
Customer-feedback "SHIPPED + VERIFIED" (#1,#3,#7,#8,#14,#19,#24)Extract 6: closed 2026-06-03CLAUDE.md 3-part bar NOT independently verified hereTreat as DONE-claimed; spot-verify before Boards-close.
Ledger "47/47 P0 DONE except 3–4 deferred"Fix-plan ledger (2026-04-29)RTM (2026-05-25) surfaced 22 brand-new P0s post-dating the ledgerLedger is scope-limited to AP-T## set; not a platform-wide all-clear.

4. Needs Human Decision — Compliance / Legal / Stakeholder Sign-Offs​

DecisionDetailOwner(s)BlocksSource
GST slab authoritative table5% vs 12% mid-band; threshold ₹7,500 vs ₹7,501; which is current hotel-GST lawFinance SME + Tax counselEP-011 D-003, #4, rate-plan GSTConflict §3
DPDPA vs CBIC/RBI retention carve-outRight-to-erasure must NOT scrub 7-yr GST / 10-yr payment statutory records; 90-day erasure AC needs carve-outLegal/DPO + CISO + SRE Lead (= Q5 approvers)BF-013 D-005 / Cluster 7; reconcile with shipped AP-T08-004Q5 gate; Extract 3 Cluster 7
TRAI DLT registrationDLT cert procurement (1–2 wk external lead time) + promo-SMS 9–9 IST window + STOP/STARTNotification/CRM eng + Telecom-compliance ownerEP-014 D-003 (Cluster 2)Extract 3 Cluster 2
GST/IRN document numberingFolio/invoice numeric + prefix scheme must satisfy GST invoice-numbering rulesLegal/Finance#5, #6 (folio/invoice part)Extract 6
NIC IRP production credentialsLive e-invoice creds gate CONDITIONAL-GO; env already flipped to EINVOICE_MOCK=falseFinance/Ops + NIC onboardingAP-T08-002, EP-015 D-007, CONDITIONAL-GO verdictExtract 2 ledger; Extract 3
Razorpay LIVE credentialsPer-tenant live keys (sandbox-doable now; LIVE blocked)FinanceAP-T12-002, EP-011 D-005 (partial)Extract 3 linkage table
On-call rotation (3 named approvers)BLOCKER 2026-06-15; gates Plan 4 Task 24 + Plan 5 cutover + 5 AP-T17-*VP Eng + SRE Leadops readinessMEMORY Q4
Backup retention sign-offEngineering rec: no change (30d prod / 7y CloudTrail)Legal/DPO + CISO + SRE LeadDR/complianceMEMORY Q5
MFA-admin re-enablementCurrently OFF all 4 envs pending SMS/email MFA; do NOT re-enable yetSecurity owner (policy locked)US-001-004 / EP-001 D-003MEMORY policy
Kiosk & mobile-staff Phase-1 scopeDescope-or-build decision for Property #1ProductAP-T06-003, AP-T06-004, AP-T04-002Extract 2
Mobile-reservations Phase-1 scopeScaffold vs explicit deferral docProductAP-T04-002Extract 2
FRRO / C-Form future-stateFRRO portal SOP runbook + IndianFrroClient interface specCompliance + ProductAP-T06-001, AP-T06-002Extract 2
Theme strategyImplement KeyNova brand OR document direction-a/b as officialDesign/ProductAP-T03-003Extract 2

5. "Ready to Write to Boards" Checklist​

Fields each work item will carry​

FieldValue source
Area PathKeyNova\<pod> — one of the 9 canonical pods (PMS-Core, FnB-Outlets, Distribution, Payments-Finance, Guest-Experience-CRM, Compliance-Trust-Security, Platform-Foundation, Infrastructure-Reliability, Revenue-Intelligence)
Work item typeEpic → Feature → Story / Bug / Task (customized-Agile process; conceptual→ADO state map already locked per MEMORY F1/F2)
StateNew / Active / Resolved / Closed — mapped from DONE→Closed-Verified, PARTIAL→Active, GAP→New, NEEDS-VERIFY→New+needs-measure tag
PriorityP0/P1/P2 → ADO Priority 1/2/3; launch-gate items tagged launch-blocker
Tagslaunch-blocker, brand-new, stale-doc, stakeholder-gated, needs-measure, sprint (SP0/SP1/SP2), cluster (RTM-Cluster-N)
Design-linkGit design/knowledge doc URL (SoT = Git per MEMORY operating-model decision): audit (property-1-readiness-audit-2026-04-28.md), fix-plan, P0-DRIFT-TRIAGE-2026-05-25.md, RTM-DASHBOARD, 01-epic-catalog-SME-PROPOSED.md, KeyNovaTesting3June.txt
sourceRefsunion of AP-T##/AP-CC##/EP-##-D-###/US-###/#N-customer ids (carried in each leaf above)
Iteration/SprintSP0 (re-measure) / SP1 (launch) / SP2 (post-launch hardening) per triage

Still needed before write​

  1. Boards PAT — bot Boards PAT at keynova/ado/boards-bot-pat (separate from runtime bot PAT); env ADO_BOT_PAT. (per MEMORY — ADO Boards MCP built+tested at hmp-infrastructure/agents/mcp/ado-boards/, gated only on operator PAT + process setup.)
  2. Customized-Agile process + 9 Area Paths — KeyNova\<pod> Area Paths must exist; customized process states must be created (operator setup gates EP-006 migration pilot).
  3. Operator approval of this map — merge/keep-distinct decisions, GST-slab ruling, severity reconciliations (§3) before any write.
  4. Re-measure pass (Cluster 0) — run flow-7/8/check-out-einvoice specs so NEEDS-VERIFY 0-pass items get true state before Boards-state assignment.
  5. De-dup confirmation — operator sign-off that merged items (e.g. EP-012C D-004 = BF-012 D-009; #4 = EP-011 D-003; #7 = AP-T05-001/002) are correctly unioned, not over-merged.

Synthesis caveats​

  • ✅ RESOLVED 2026-06-04 — the 6 missing source extracts were folded in (see §6) + the launch-blockers were code-verified (see §7). The first run built §1–§5 from only Extracts 2/3/6 (audit, RTM, customer feedback); the completion re-run (a throttled 11-agent workflow) ingested the master pending tracker, the FU-## ledger, the canonical EPIC catalog + RTM dashboard, and the per-EPIC RTM drift docs (+205 surfaced, ≈78 unique net-new after de-dup) and independently grep-verified the ~17 headline launch-blockers against working-tree code (8 DONE / 5 PARTIAL / 5 GAP). The original "≈15 open launch-blocker clusters" headline is now proven too high — the true open-in-code set is 6 GAPs + 2 scoped PARTIALs + 3 stakeholder-gated (§8 short-list).
  • Items in §1–§5 still carry their source-claimed states; §7 supersedes them for the launch-blockers it covers (use §7's verdict where present). Remaining §1–§5 DONE claims should still be spot-verified before Boards-Closed.
  • Counts are approximate due to ID collisions (AP-T03-004), straddle-classifications (AP-T07-005, AP-T13-004), and the 29-vs-29 non-1:1 mapping between the RTM triage clusters and dashboard table.

6. Completion — Previously-Missing Sources (folded in 2026-06-04)​

These four sources were rate-limited during the original DRAFT run. All items below are NET-NEW to the DRAFT — de-duped against its 9 pod trees, the AP-T##/AP-CC## audit leaf set, the EP-##-D-### drifts already in §2, the #1–#26 customer-feedback items, and the Q4/Q5/MFA gates in §4. The DRAFT's own caveat (§481) predicted exactly this: "master pending tracker, FU-## follow-ups, Plans 4–7, L1–L4 hardening, stakeholder gates" were the missing layers — and that is precisely what these four sources carry.

6.1 Master Pending Tracker (2026-05-20-master-pending-tracker.md)​

The largest missing source. Carries the full FU-2..FU-92 follow-up series, L1–L4 hardening, Plans 4–7 task items, the stakeholder-gate set beyond Q4/Q5, the Property #1 coverage gates, and §12 prod-onboarding tails. De-duped against follow-ups.md (§6.2) and the DRAFT.

idtitlepodP/levelclaimed-statelaunch-blocker
FU-20ArgoCD SSO needs SAML 2.0 refactor — IDC OIDC login broken; blocking prod ArgoCD operator accessInfrastructure-ReliabilityFU (HIGH)OPENno
FU-60Enable ArgoCD self-heal + CI guard for base-vs-overlay drift (would have prevented the 6-deployment Reloader-annotation gap)Infrastructure-ReliabilityFU (HIGH)OPENno
FU-68Frontdesk-service S3 IRSA — guest ID-photo uploads silently broken since Plan 1Infrastructure-ReliabilityFUOPENno
FU-69Guest-service S3 IRSA — guest signatures + DSAR export PDFInfrastructure-ReliabilityFUOPENno
FU-81hmp-apps Ingresses burn LE 5-cert/168h rate limit; switch to ACM wildcard (dashboard/admin-portal TLS stuck Ready=False)Infrastructure-ReliabilityFUPARTIAL (code-complete f25c5c0)no
FU-91hmp-channel-service scaled to 0 replicas on qa+staging — OTA tests fail silentlyInfrastructure-ReliabilityFUOPENno
FU-92RESAVENUE allowedSourceIps empty on test vs 3 prod IPsDistributionFUOPENno
FU-2Tooling install runbook (tflint/tfsec/checkov local)Infrastructure-ReliabilityFUOPENno
FU-5AWS Config delivery channel + S3 Object Lock incompatibilityInfrastructure-ReliabilityFUOPENno
FU-6ResAvenue cert v3 closure (post 7-day burn-in)DistributionFUPARTIALno
FU-11IDC OIDC ArgoCD console registrationInfrastructure-ReliabilityFUOPENno
FU-12ArgoCD per-env PAT populationInfrastructure-ReliabilityFUOPENno
FU-13Windows DNS cache poisoning (workaround)Infrastructure-ReliabilityFUPARTIALno
FU-14Helm provider v3 Windows TCP flakes (workaround)Infrastructure-ReliabilityFUPARTIALno
FU-18Kustomize v5 namespace transformer ID conflictInfrastructure-ReliabilityFUOPENno
FU-19IDC group→permission-set excludes mgmt accountInfrastructure-ReliabilityFUOPENno
FU-21Bot PAT in mgmt account; ESO IRSA env-localInfrastructure-ReliabilityFUOPENno
FU-24Hotfix pipeline assumes Jira; none exists (switch to Azure Boards work items)Platform-FoundationFUOPENno
FU-25Migrate deploy notifications Slack → TeamsInfrastructure-ReliabilityFUOPENno
FU-26ArgoCD ci-bot tokens non-expiring + no revocation runbookCompliance-Trust-SecurityFUOPENno
FU-27ArgoCD helm_release timeout false-negative (workaround)Infrastructure-ReliabilityFUPARTIALno
FU-28Self-approval allowed on staging/prod during pilot (governance gate before D.1)Platform-FoundationgateOPENno
FU-43Per-env auth-service-runtime-env propagationInfrastructure-ReliabilityFUOPENno
FU-45Service runtime secret rotation policy + LambdaInfrastructure-ReliabilityFUOPENno
FU-48Asset-service migration history resetInfrastructure-ReliabilityFUOPENno
FU-49Notification-service device_tokens orphan migrationInfrastructure-ReliabilityFUOPENno
FU-54QA POS+payment producer demo data backfill (5–7 empty MVs: pos_revenue/payment_collection/einvoice/refund/settlement)Revenue-IntelligenceFUOPENno
FU-57Test-rot audit for 9 backend services not in 2026-05-23 cleanupPlatform-FoundationFUOPENno
FU-58CI infra for env-dependent e2e specs (~185 reservation+frontdesk hardcode localhost)Platform-FoundationFUOPENno
FU-59Periodic spec-contract-refresh practice (quarterly jest+tsc per repo)Platform-FoundationFUOPENno
FU-61api-gateway /api/metrics returns 404 (Prometheus scrape mismatch)Platform-FoundationFUOPENno
FU-62Retire deprecated folio.charge.posted + folio.settled topics after analytics CI greenRevenue-IntelligenceFUOPENno
FU-63AP-T06-002 check-in flow wiring — GuestServiceClient.upsert/getGuestVisa + frontdesk persist + dashboard visa fieldsPMS-CoreFUOPENno
FU-64Investigate stuck-Terminating pods (property-service Terminating 8m20s past grace)Infrastructure-ReliabilityFUOPENno
FU-66Comprehensive branching + per-env pipeline policyPlatform-FoundationFUOPENno
FU-70api-contracts rate-plan validFrom/validTo .datetime() rejects YYYY-MM-DD → switch to .date()Platform-FoundationFUOPENno
FU-71Dashboard || null sweep — zod .optional() rejects null (same shape as FU-67)Platform-FoundationFUOPENno
FU-72Test coverage gap on dashboard rate-plans page (zero vitest specs, 2 prod-blocking bugs/24h)Platform-FoundationFUOPENno
FU-73Dashboard pipeline auto-trigger fails on master pushes (needs manual az pipelines run)Platform-FoundationFUOPENno
FU-74Property Settings UX consolidation (12 tabs → ~6 groups)PMS-CoreFUOPENno
FU-78CloudFront + OAC in front of keynova-<env>-assets (replaces per-read presigned GET)Infrastructure-ReliabilityFUOPENno
FU-86Per-tenant custom-domain SES verification (admin-portal UI + verifier) — distinct from FU-86 Pay-at-Hotel collisionInfrastructure-ReliabilityFUOPENno
FU-87SQS-buffered SES bounce consumer (if sustained bounce >1K/day)Infrastructure-ReliabilityFUOPENno
FU-88DMARC p=none → p=quarantine cutover after 14 days cleanCompliance-Trust-SecurityFUOPENno
FU-89Apex HTTPS verify + WAF rate-limit on /api/email/webhook/ses + pre-warm SNS cert cacheInfrastructure-ReliabilityFUOPENno
L3-RDS-IAMMigrate to RDS IAM auth (eliminates password-rotation impact)Infrastructure-Reliabilityhardening (L3)GAP (weight 17)no
L4-RDS-ProxyAWS RDS Proxy (transparent rotation + pool)Infrastructure-Reliabilityhardening (L4)GAP (weight 10)no
Op-RDS-rotationSchedule prod RDS rotation for off-peak 02:00 ISTInfrastructure-Reliabilityhardening (op)GAP (weight 40, rank 15)no
Plan4-Task24Prod demo-tenant seed Job (awaits 2-of-N, needs Q4 on-call)Infrastructure-ReliabilityPlanOPENno
Plan5-burninResAvenue cert v3 + live.keynova.ai 7-day prod burn-inDistributionPlanPARTIALno
Plan5-resavenueResAvenue first-hotel onboarding (blocked on per-hotel creds = §12 E1/E2)DistributionPlanBLOCKEDno
Plan6-baselineRe-run Plan 6 baseline checklist (last: 1 PASS/7 FAIL/13 NOCREDS)Infrastructure-ReliabilityPlanGAPno
Plan6-B17Renovate.json propagation across 25 reposPlatform-FoundationPlanOPENno
Plan6-B18First quarterly access review (2026-Q2, due 2026-06-30)Compliance-Trust-SecurityPlanOPENno
Plan6-B19DR drill — failover ap-south-1 → ap-south-2Infrastructure-ReliabilityPlanGAPno
Plan6-B20Backup-restore drill against keynova-prod-vaultInfrastructure-ReliabilityPlanGAPno
Plan6-B21Pentest report (vendor not engaged, 2–4w lead)Compliance-Trust-SecurityPlanBLOCKEDno
Plan6-B24Spec §14 5 decisions (Q1–Q5) — Q4+Q5 hard blockersCompliance-Trust-SecuritygatePARTIALyes
Plan7-Phase3Destroy legacy AWS account 730335256638Infrastructure-ReliabilityPlanPARTIALno
Plan7-Phase4git rm legacy Terraform stacks + compose + scriptsInfrastructure-ReliabilityPlanOPENno
Plan7-Phase5Cost verification T+7d post-destroyInfrastructure-ReliabilityPlanOPENno
Q1Reserved Instance commitment timingInfrastructure-ReliabilitygateOPENno
Q2GuardDuty non-prod keep decision (due 2026-06-01)Compliance-Trust-SecuritygateOPENno
Q3Slack scheme per-env channels decision (drives FU-25)Infrastructure-ReliabilitygateOPENno
CIC-1Travel-exception WAF sign-offCompliance-Trust-SecuritygateOPENno
CIC-2Rate-limit office-IP sign-offCompliance-Trust-SecuritygateOPENno
CIC-3TLS 1.2 ALB sign-off (evidence captured)Compliance-Trust-SecuritygatePARTIALno
CIC-4Razorpay rotation + demo guard sign-offCompliance-Trust-SecuritygateOPENno
CIC-5Vault Lock governance sign-off (evidence captured)Compliance-Trust-SecuritygatePARTIALno
SM-1VP Sales + CFO sign-off on pricing tiersPlatform-FoundationgateOPENno
SM-2CMO + CEO sign-off on marketing planPlatform-FoundationgateOPENno
SM-3Board sign-off on KPIs + org/comp planPlatform-FoundationgateOPENno
Gate-5Backend overall statement coverage ≥80% (latest ~58%, −22pts)Platform-FoundationgateGAPno
Gate-6Backend critical-path coverage ≥90% (latest 57–58%, −32pts)Platform-FoundationgateGAPno
Gate-8Frontend overall coverage ≥70% (dashboard 57.62% / booking-engine 14.86%, −55pts)Platform-FoundationgateGAPno
AP-T16-004Backend --coverage runs (depends on FU-58; ~185 reservation e2e env-dependent)Platform-FoundationP1PARTIALno
B1-cross-service-urlshmp-cross-service-urls ConfigMap → GitOps (_shared base, 4 envs)Infrastructure-ReliabilityPlanPARTIAL (ops-gated)no
B2-internal-service-tokenINTERNAL_SERVICE_TOKEN → Terraform-minted + ESO + Reloader (RS256)Infrastructure-ReliabilityPlanPARTIAL (ops-gated)no

6.2 FU Ledger (hmp-infrastructure/compliance/follow-ups.md)​

Same FU ledger viewed from the canonical source-of-truth file (FU-1..FU-53; gaps at FU-31/33-42; FU-58-61 referenced-but-unauthored). De-duped against §6.1 — only rows that add detail, a different state read, or a flagged conflict beyond the tracker entry appear here. Rows identical to §6.1 in id+state are omitted. Excluded as RESOLVED: FU-1/4/7/9/10/12/15/16/17/22/50/52. Stale-ledger flags below mean "ledger says open but a newer source proves done."

idtitlepodP/levelclaimed-statelaunch-blocker
FU-46RS256 JWT keys staging+prod; ALLOW_HS256 unset — CONFLICTING STATE: ledger says OPEN, root CLAUDE.md says "(FU-46 closed)". Verify in code.Compliance-Trust-SecuritygatePARTIAL (deadline 2026-06-15)yes
FU-6 (cert)ResAvenue sandbox cert v3 re-issuance (18 KNV cases) — LAUNCH-GATE for Plan 5 cutover; likely now resolved (Lotus Leaf went live 2026-05-26) — verify ledger staleDistributiongatePARTIALyes
FU-30Per-service IRSA gap — payment-service Razorpay-creds IRSA (PCI) most urgent; frontdesk+guest legs = FU-68/69. property+notification IRSA already done.Infrastructure-ReliabilityFUPARTIALno
FU-44@hmp/cache + @hmp/messaging TLS (REDIS_TLS) propagation to 16 services (crash-loop on ElastiCache transit-encryption)Platform-FoundationFU (HIGH)PARTIAL — likely closed by D.2; verify staleno
FU-47@hmp/observability HealthService paramtypes-metadata propagation to 16 services (/health/ready stays 503 → deploy stalls)Platform-FoundationFU (HIGH)PARTIAL — likely closed by D.2; verify staleno
FU-29Plan 3 T27/T28 — 64 per-service overlay subdirs missing (16 svc × 4 env)Infrastructure-ReliabilityFU (HIGH)PARTIAL — likely closed by D.2; verify staleno
FU-32Plan 3 templates: trigger:/pr: not allowed in extends-templates — 20 consumer YAMLs need triggersInfrastructure-ReliabilityFU (HIGH)PARTIAL — likely closed by D.2; verify staleno
FU-23-cleanupExtract Azure DevOps OIDC IdP + deploy-role HCL into shared sub-module (~80 lines dup)Infrastructure-ReliabilityFUGAP (deferred Plan 7)no
FU-8vpc-cni ENI pod cap on t3.medium (ENABLE_PREFIX_DELEGATION)Infrastructure-ReliabilityFUDONE — stale ledger (Plan 2 T12 resolved)no
FU-53metrics-server missing on test+qaInfrastructure-ReliabilityFUDONE — stale ledger (installed all 4 envs 2026-05-20 per MEMORY)no
FU-51SendGrid prod key — SUPERSEDED by SES migration; new gate = OP-3 SES production-access support case (prod account in sandbox). CONFLICTING state in same ledger; partial overlap with DRAFT AP-CC-5.Infrastructure-ReliabilityFUPARTIAL (SES supersession is the delta)no
FU-58 (mig)Reservation-service orphan migration references payments table (advisory; NOT authored as ledger entry — backfill needed)Infrastructure-ReliabilityFUOPEN — ledger backfillno
FU-59 (mig)Channel-service orphan migration references reservations table (advisory; unauthored)Infrastructure-ReliabilityFUOPEN — ledger backfillno
FU-60 (mig)Guest-service orphan migration references properties table (advisory; unauthored; 17 of 60 FU-77 drift sites)Infrastructure-ReliabilityFUOPEN — ledger backfillno
FU-61 (mig)Spa-service orphan migration references activities table (advisory; unauthored)Infrastructure-ReliabilityFUOPEN — ledger backfillno

Note on FU-number collisions (per MEMORY — read row text, not number): FU-58/59/60/61 appear twice across the two sources with different meanings — in §6.1 they are CI/test-infra items (from the tracker), in §6.2 they are orphan-migration drift items (from the FU-48 runbook swap-out list). Both sets are real and distinct; the Boards write must disambiguate by title. Same caveat for FU-78 (CloudFront vs wizard-hydration), FU-86 (SES-custom-domain vs Pay-at-Hotel).

6.3 Canonical EPIC Catalog + RTM Dashboard (EPIC/sub-epic granularity)​

The DRAFT references only 14 of ~23 EPIC RTMs. The 16 below have no representation in the DRAFT's 9 pod trees — they were never anchored to their parent EPIC (the DRAFT built pods from AP-T## audit items + P0-triage clusters, which over-indexed on launch-blocker EPICs). Launch-relevant Partial/Stub stories are surfaced in notes rather than as separate rows.

idtitlepodP/levelclaimed-statelaunch-blocker
EP-003Reservation Management (22 stories; 12 drifts/4 P0) — Partials: US-003-005 cancel-policy, US-003-009 walk-in, US-003-011 group, US-003-016 no-show folio-charge (D-010); US-003-019 corporate-rate Stub; US-003-022 group check-in Not-StartedPMS-CoreP0PARTIALyes
EP-004Guest Management (12 drifts/4 P0) — Partials: US-004-008 comm-log, US-004-011 GDPR portability export, US-004-012 consent tracking, US-004-013 encrypted doc uploadGuest-Experience-CRMP0PARTIALyes
EP-017Compliance, Audit & Security — the dedicated compliance umbrella epic, never named in DRAFT; US-017-001 GST-slab "Built" CONFLICTS with EP-011 D-003 hardcoded-12% showstopper; US-017-005 audit-integrity-chain "Not Started" = EP-012C D-008 hash-chain P0Compliance-Trust-SecurityP0PARTIALyes
EP-005CNight Audit (Flow-9 12/12 PASS — strongest signal; EPIC body stale) — Partials: US-005C-04 resume, US-005C-05 cashier-shift; US-005C-06 chain-admin UI Not-Started (blocked on EP-018)PMS-CoreP0PARTIALno
EP-005DAncillary Front-Desk Services — phone-charge-to-folio NOT wired through FoliosService.postCharge (D-002); US-005D-01 "concierge log" is actually an AI FAQ chatbot (Stub)PMS-CoreP1PARTIALno
EP-008Banquet & Events (11 drifts/4 P0; catalog-vs-body story-ID mismatch D-001) — SP2 (Property #1 rooms-only); whole revenue stream unrepresented; pod debatableFnB-OutletsP1PARTIALno
EP-012BFinancial Reports — US-012-010 balance-sheet+cash-flow Stub (no chartOfAccounts consumer); US-012B-01 channel-commission Not-StartedRevenue-IntelligenceP0PARTIALno
EP-012DReport Builder — 0 Verified-Built; US-012D-04 XLSX letterhead Stub; no true drag-and-drop ad-hoc builder UI (legacy Map-backed builder still in code)Revenue-IntelligenceP0PARTIALno
EP-012EOperational Analytics — mostly unbuilt scaffold; US-012E-08 owner-portal + US-012E-09 pilot-health are shells (no endpoint/RBAC); parent catalog omits the 9 stories (D-001)Revenue-IntelligenceP0GAPno
EP-016Spa & Wellness (hmp-spa-service:3015, entirely absent from DRAFT) — US-016-005 charge-to-folio Built-Untested; prepaid/couple/reports Not-Started; pod debatable (Guest vs FnB)Guest-Experience-CRMP1PARTIALno
EP-018Multi-Property & Chain Management (no RTM file) — 4 Built/3 Partial/2 Not-Started; single-property launch so not a gate; EP-005C chain-admin UI depends on itPMS-CoreP1PARTIALno
EP-019Platform Administration / SaaS (owns auth-service tenant billing per Modular Payments WS-A; no RTM file) — US-019-004 metering, US-019-007 MRR/ARR, US-019-009 white-label Not-Started; pod debatable (Platform vs Payments)Platform-FoundationP1PARTIALno
EP-020Infrastructure & DevOps (no RTM file; DRAFT Infra pod never anchored to it) — Partials: load-testing, DR-failover-test, monitoring/alerting, Prisma migration safeguards (overlaps FU-77 + Q4/Q5)Infrastructure-ReliabilityP1PARTIALno
EP-021Mobile Applications (hmp-mobile-apps; no RTM file) — 2 Built/7 Partial/4 Not-Started (approval-queue, biometric, bill-presentation, app-store deploy); no dedicated mobile podPMS-CoreP1PARTIALno
EP-022KDS & Self-Service Kiosk (no RTM file; KDS via AP-T07, kiosk via AP-T06-003) — US-022-008 order-recall + US-022-009 KOT-reprint Partial; audio-alerts + kiosk-check-in Not-Started; kiosk descope is an open Product gate (DRAFT §4)FnB-OutletsP0PARTIALno
EP-012B/D/E rollup(counted individually above) — the 3 EP-012 sub-epics the DRAFT omitted (it carries A/STR + C/GSTR only)Revenue-IntelligenceP0—no

Two conflicts for operator attention: (1) EP-017 US-017-001 GST-slab "Built" vs EP-011 D-003 hardcoded-12% showstopper — same surface, opposite states. (2) Pod assignment for EP-008/EP-016 (FnB vs Guest-Experience) and EP-018/EP-019/EP-021 (PMS-Core vs Platform-Foundation) is genuinely ambiguous since the 9-pod scheme has no Banquet/Spa/Mobile/SaaS-billing home.

6.4 Per-EPIC RTM Drift Docs (EP-001..016-rtm.md, P0/P1 D-### rows)​

Story-level P0/P1 drift rows with GAP/PARTIAL/NEEDS-VERIFY state not surfaced by the catalog sweep (§6.3) and not in the DRAFT. (Extract truncated in source data after EP-002 D-009; rows below are the captured set.)

idtitlepodP/levelclaimed-statelaunch-blocker
EP-001-D-002Story ACs don't enumerate 4 extra 401 sub-codes (MFA_REQUIRED_FOR_ADMIN / EMAIL_VERIFICATION_REQUIRED / ACCOUNT_LOCKED / TENANT_SUSPENDED) — undocumented auth↔NextAuth contractCompliance-Trust-SecurityP1GAPno
EP-001-D-010Catalog/review say 5-attempt brute-force lockout; code + flow test use 20 (doc-vs-code drift)Compliance-Trust-SecurityP1PARTIALno
EP-001-D-011Brute-force flow test is MODE=compose-only; skips QA/test/staging — no live-env lockout integration testCompliance-Trust-SecurityP1GAPno
EP-002-D-003Rate/property story says "GSTIN format validation" without canonical 15-char regex or state-prefix table (01..37)PMS-CoreP1PARTIALno
EP-002-D-004Amenity field free-form string[] with no canonical taxonomy → channel-service fuzzy-matches OTA codes; rate-parity audit riskDistributionP1GAPno
EP-002-D-009Corporate rate plans have no corporateAccountId linkage for per-account negotiated rates + invoice routing ("corporate" is a code discriminator only) — distinct from DRAFT's EP-002 D-008/onboardingPayments-FinanceP1GAPno

7. Code-Verification of Launch-Blockers​

Source-of-truth = CLAUDE.md + code + tests (the project's 3-part "done" bar). I independently grep-verified the load-bearing claims marked ✓ below against working-tree code on 2026-06-04.

BlockerVerdictEvidenceResidual gap
EP-011 D-003 — hardcoded 12% GST in booking-engineGAP ✓CheckoutPage.tsx:220 const taxRate = 0.12; + mockApi.ts:26 const TAX_RATE = 0.12; (also :122,:129,:273). No slab logic.Replace with runtime slab (0/5/12/18% by rate band). Multi-property cart scope TBD.
EP-002 D-008 — rate-plan GST inclusive/exclusive + CGST/SGST vs IGSTPARTIAL ✓property-service tax-rule-engine.service.ts:72-80 reads TaxConfiguration (maker-checker, no hardcoded fallback). BUT reservation-service/src/booking-engine/booking-engine.service.ts:953,2712 STILL calls this.gstService.getRoomGstRate(baseRate) from legacy @hmp/compliance.GstService (verified: import @hmp/compliance at L14). Canonical @hmp/tax wired into property-service ONLY.Wire reservation booking-engine to TaxRuleEngineService.calculateTax; factor TaxConfiguration.inclusive; implement CGST/SGST split tracking; test multi-state.
EP-005A D-009 — buyer GSTIN capture surface at check-in/outPARTIALBackend DONE: frontdesk CheckInDto.buyerGstin (@IsGSTIN) + PATCH /folios/:id/buyer-gstin + IRN B2B gate. Dashboard check-in-form.tsx has NO buyerGstin field in checkInSchema or JSX.Add buyerGstin field to dashboard check-in form JSX; wire to CheckInDto submission. Backend integration already complete.
EP-007 D-004 — sin-goods GST null-reject in POS (#5250)DONEpos-service MenuService.createItem/updateItem reject gstRate==null for LIQUOR/BEER/WINE/CIGARETTE (GST_RATE_REQUIRED_FOR_SIN_GOODS); sin-goods.ts classifier; menu-sin-goods-gst.spec.ts + AP-T07-003 12-spec net; dashboard MenuItemDialog HSN+slab wired. All 4 fix parts shipped.none
EP-007 D-009 — POS room-charge integrityDONEpos-service orders.service.ts:1304-1426 validateRoomChargeReservation gate: room exists + linked (room.id===reservation.roomId) + status===CHECKED_IN; fail-closed (POS_ROOM_CHARGE_NO_RESERVATION/_VALIDATION_UNAVAILABLE).none
EP-012C D-003/D-004 — dual GSTR-1 impl + NIC schema v3.4GAP ✓Both files exist (verified): frontdesk compliance/gstr-reports.service.ts (raw-SQL FolioTransaction, no PoS/B2B-B2C split) + analytics gstr/gstr.service.ts (EventStore folio.posted, CHARGE-only). Will compute different totals. Neither validates NIC schema v3.4.Consolidate to one canonical impl on recorded placeOfSupply/cgst/sgst/igst; add NIC v3.4 DTOs+validation. Real filing blocked until consolidated.
EP-014 D-002 — SES Raw-mode (SendRawEmail) for IRN PDFGAPnotification-service email.service.ts:150 comment: SESv2 Simple content can't carry attachments → body-only; folio-settled.consumer.ts + email.worker.ts both comment "SendRawEmail/MIME is a tracked follow-up". No SendRawEmailCommand path. IRN PDFs silently dropped.Wire SendRawEmailCommand (SDK has method, no AWS setup); MIME builder w/ base64 PDF; resolve attachment bytes in worker; integration test. FAST-FOLLOW.
AP-T08-002 — NIC IRP production credentialsSTAKEHOLDER-GATEDfrontdesk boot-validators.ts hard-fails in prod if creds absent + EINVOICE_MOCK not true; main.spec.ts confirms; einvoice.module.ts:156 env wiring (CLIENT_ID/SECRET/USERNAME/PASSWORD/URL) complete. Code DONE.NIC onboarding (live key provisioning) + operator wires env via Kustomize/SecretStore. Blocked on Finance/Ops.
EP-014 D-003 — TRAI DLT + 9–9 IST window + STOP/STARTPARTIALnotification sms.service.ts:94-113 buildDltParams() (PE-id+template-id, safe-by-default); crm trai-dnd.service.ts:81-97 checkSilentWindow() (21:00–09:00 IST); runbook present; X3 wiring landed 2026-06-02.Live DLT registry integration (currently throws "not yet integrated"); FU-X3-1 per-message template-id threading; STOP/START inbound opt-out handler. External: DLT cert procurement (1–2wk).
EP-010 D-013 — DPDPA §9 minor consentDONEguest-service guests.service.ts calculateAge+create(): DOB<18 requires parentalConsentGiven + guardianName/Relation/Phone, else BadRequest; DTO @ApiPropertyOptional "DPDPA Section 9".Dispatch layer does NOT yet gate sends to minors on parentalConsentGiven (FU-X4-1: wire into NotificationQueueService/RulesV2/dispatcher); no cascade opt-out at 18.
BF-013 D-005 — DPDPA-vs-CBIC/RBI retention carve-outGAPguest-service retention-cron.service.ts (90-day erasure) + guest-erased.consumer.ts cascade to CRM (#5655). No statutory-record carve-out: erasure paths don't check for CBIC 7-yr GST / RBI 10-yr payment records before scrubbing.CRITICAL: DSAR cascade must create redacted shadow copies (folio_transactions GST + payments) BEFORE scrubbing guestName/guestGstin. Code change in frontdesk + payment + DSAR coordinator. Legal/DPO decides shadow-table vs audit-log vs NULL-out.
EP-009 D-001 — OTA channel tenant-isolationDONEchannel-service connections.service.ts:187-206 assertPropertyTenant validates caller-tenant owns propertyId BEFORE credential encryption/DB write (cites EP-009 US-009-001 Wave-1 fix).none
EP-009 D-002 — OTA role guard + creds-leak on GETDONEchannel-service connections.controller.ts:30-36 class-level @Roles('SUPER_ADMIN','ADMIN','MANAGER'); connection.dto.ts:190-211 SAFE_CHANNEL_CONNECTION_FIELDS allowlist omits credentials; CM-011 test verifies creds absent from JSON.none
EP-009 D-014 — OTA commission GST 18% reverse-charge + TDS §194-O 1%GAPNo code in channel-service for OTA-commission GST reverse-charge or TDS 194-O tracking/reporting. DRAFT labels un-clustered/un-triaged (brand-new P0).Build commission-GST reverse-charge + TDS 194-O computation + reporting. Needs cluster/owner assignment.
EP-010 D-007 — CRM campaign tenant-scope + 403 info-leakDONEcrm-service campaigns.service.ts:85-93 findOne uses tenant-scoped findFirst({id,tenantId}), throws NotFound (not Forbidden) per Gap #5b; campaign-cross-tenant-denial.spec.ts verifies cross-tenant + non-existent are indistinguishable.none
EP-011 D-005 — booking-engine payment flag-flip anti-tamperingDONE ✓booking-engine lib/payment/index.ts — VITE_FEATURE_PAYMENT_SERVICE_ENABLED removed Phase 4 Task 1 (verified: file header comment + server-only initiatePaymentViaService export); reservation BOOKING_POLICY_MISMATCH guards depositAmount.none
#5 — Reservation confirmationNumber gapless RES-YYYY-NNNNNNDONE ✓reservation schema.prisma:851 ReservationSequence (@@unique propertyId+fiscalYear); reservations.service.ts:1627 allocateConfirmationNumber atomic upsert in tx (verified); migration 20260604120000_add_reservation_sequence idempotent; specs pass.none
#6 — Folio Invoice numbering gaplessSTAKEHOLDER-GATEDfrontdesk schema.prisma InvoiceSequence (@@unique tenantId+propertyId+financialYear); folios.service.ts getNextInvoiceNumber distributed-lock atomic; tests pass. Code complete.Legal/Finance sign-off on numbering scheme + per-property prefix rules.

Summary (3 bullets):

  • Of the 17 verified blockers, 8 are now actually DONE in code: EP-007 D-004, EP-007 D-009, EP-010 D-013 (creation path), EP-009 D-001, EP-009 D-002, EP-010 D-007, EP-011 D-005, and customer #5. These can be moved DRAFT GAP/PARTIAL → Closed-Verified.
  • 6 remain real, open code GAPs (true SP1 build work): EP-011 D-003 (hardcoded 12% GST — SHOWSTOPPER), EP-002 D-008 (reservation booking-engine still on legacy getRoomGstRate), EP-012C D-003/D-004 (dual GSTR-1 + missing NIC v3.4), EP-014 D-002 (SES Raw-mode IRN attachment — fast-follow), EP-009 D-014 (OTA commission GST/TDS — un-triaged), BF-013 D-005 (statutory retention carve-out — CRITICAL). Two are PARTIAL with a clearly-scoped residual: EP-005A D-009 (dashboard check-in-form field only) and EP-014 D-003 (live DLT registry + STOP/START).
  • 3 are stakeholder-gated, code-ready: AP-T08-002 (NIC creds — Finance/Ops), #6 invoice-numbering (Legal/Finance scheme sign-off), and the dispatch-layer leg of EP-010 D-013 minor-consent (FU-X4-1). EP-014 D-003 also carries an external dependency (DLT cert, 1–2wk).

8. Corrected Executive Summary​

Total de-duped items (9/9 sources folded in): the DRAFT's ~138 from 3 sources grows to ≈230 distinct actionable items. The completion adds ≈92 net-new: ~72 from the master tracker (FU series + L3/L4/Op hardening + Plans 4–7 + Q1/Q2/Q3 + CIC-1..5 + SM-1..3 + coverage Gates 5/6/8), of which ~14 are de-dup-collapsed against the FU ledger (§6.2); 16 unrepresented EPICs/sub-epics (§6.3); and 6 story-level RTM drifts (§6.4). Net-new after cross-source de-dup ≈ 78 unique (the FU ledger and tracker overlap heavily on FU-2..FU-49).

Corrected launch-blocker count (after code-verification): the DRAFT's headline "≈15 open launch-blocker clusters" is now proven too high. Code verification (§7) shows 8 of the ~17 audited blockers are already DONE in code. The true remaining launch-blocker set is 6 open code GAPs + 2 scoped PARTIALs + 3 stakeholder-gated = ~11 clusters, not 15. The completion adds only one new launch-blocker-flagged item (Plan6-B24, which rolls up Q4/Q5 already in the DRAFT) plus three authoritative-GAP EPICs that the DRAFT never named (EP-003, EP-004, EP-017) — these are epic-umbrella launch-blockers whose leaf drifts are largely already in the DRAFT under AP-T## ids.

SHORT-LIST — blockers STILL open in code (true remaining gap to Property #1):

  1. EP-011 D-003 / #4 — hardcoded 12% GST in booking-engine (SHOWSTOPPER; verified CheckoutPage.tsx:220 + mockApi.ts:26)
  2. EP-002 D-008 — reservation booking-engine still on legacy getRoomGstRate; canonical @hmp/tax engine wired to property-service only
  3. EP-012C D-003/D-004 — dual GSTR-1 (frontdesk vs analytics) + no NIC schema v3.4 validation
  4. EP-014 D-002 — SES Raw-mode (SendRawEmail) for IRN PDF attachments (fast-follow; SDK already has the method)
  5. EP-009 D-014 — OTA commission GST 18% reverse-charge + TDS §194-O 1% (un-triaged brand-new, no owner)
  6. BF-013 D-005 — DPDPA-vs-CBIC/RBI retention carve-out (CRITICAL; Legal/DPO-gated decision + code)
  7. EP-005A D-009 (UI) — buyer GSTIN field on dashboard check-in-form (backend done)
  8. EP-014 D-003 — live DLT registry + STOP/START opt-out (rest scaffolded; external cert lead-time)
  9. EP-010 D-013 (dispatch leg) — minor-consent gate in notification/CRM dispatch (creation path done)

Stakeholder-gated, code-ready (not eng GAPs): AP-T08-002 NIC creds, #6 invoice-numbering scheme, Plan6-B24/Q4/Q5 ops + retention sign-offs.

A. Build next — SP1 verified code GAPs (in priority order):

  1. EP-011 D-003 (SHOWSTOPPER) — replace taxRate = 0.12 at CheckoutPage.tsx:220 + mockApi.ts:26/122/129/273 with slab logic. BLOCKED on Finance ruling of the slab table (§3 conflict: customer #4's 5%/18% vs RTM's 0/12/18) — escalate the ruling in parallel so the build isn't serialized behind it.
  2. EP-002 D-008 — wire reservation-service/src/booking-engine/booking-engine.service.ts:953,2712 off @hmp/compliance.GstService.getRoomGstRate onto property-service TaxRuleEngineService.calculateTax / @hmp/tax; add CGST/SGST split + inclusive factor. Closes the same surface as #1 on the staff side.
  3. EP-012C D-003/D-004 — consolidate the two GSTR-1 impls (frontdesk/compliance/gstr-reports.service.ts + analytics/gstr/gstr.service.ts) to one canonical reader on recorded placeOfSupply; add NIC v3.4 DTOs. Real GSTR-1 filing cannot proceed until this lands.
  4. EP-014 D-002 — fast-follow: wire SendRawEmailCommand + MIME builder into email.service.ts/email.worker.ts (no new AWS setup). Without it IRN PDFs are silently dropped.
  5. BF-013 D-005 — CRITICAL: build statutory-record carve-out (redacted shadow copies before scrub) across frontdesk + payment + DSAR coordinator. Pair with the Legal/DPO decision (§B).
  6. EP-005A D-009 (UI) + EP-010 D-013 (dispatch leg, FU-X4-1) + EP-014 D-003 (live DLT registry + STOP/START) — three scoped residuals; small.
  7. EP-009 D-014 — needs triage/owner first (currently un-clustered), then build commission-GST reverse-charge + TDS 194-O.

B. Need stakeholder sign-off (escalate now, parallel to build):

  • Finance/Tax — authoritative GST slab table (gates EP-011 D-003 + EP-002 D-008); confirm hotel-GST 5%-vs-12% mid-band + ₹7,500-vs-₹7,501 threshold.
  • Finance/Ops + NIC — production e-invoice credentials (AP-T08-002, code-ready).
  • Legal/DPO + CISO — retention carve-out strategy (BF-013 D-005 / Q5) + invoice-numbering scheme (#6).
  • VP Eng + SRE — Q4 on-call rotation (gates Plan4-Task24 + Plan5 cutover); Plan6-B24 rolls up Q1–Q5.
  • Distribution/Telecom-compliance — TRAI DLT cert procurement (1–2wk external; gates EP-014 D-003).

C. Close as DONE in the DRAFT (code-verified, move GAP/PARTIAL → Closed-Verified):

  • EP-007 D-004 (sin-goods null-reject), EP-007 D-009 (room-charge integrity), EP-009 D-001 + D-002 (OTA isolation + role-guard/creds-leak), EP-010 D-007 (CRM tenant-scope), EP-010 D-013 creation path (minor consent at guest-create), EP-011 D-005 (payment flag removed), customer #5 (reservation gapless sequence). The DRAFT lists several of these as GAP/PARTIAL — they are shipped with tests.

D. Stale-ledger closures (verify-then-close, low cost): FU-8 (prefix-delegation), FU-53 (metrics-server installed all 4 envs 2026-05-20), and the D.2-milestone cluster FU-29/32/43/44/47 (likely closed by the 2026-05-17 20/20-Ready milestone — spot-check before Boards-close). Resolve the FU-46 conflict (ledger says OPEN, root CLAUDE.md says "FU-46 closed") by checking ALLOW_HS256 + RS256 keys in the deployed auth-service env before assigning Boards state.

E. Boards-write disambiguation (mechanical, before write): the FU-number collisions (FU-58/59/60/61 = CI-infra vs orphan-migration; FU-78 = CloudFront vs wizard-hydration; FU-86 = SES-custom-domain vs Pay-at-Hotel) must be written as distinct work items keyed on title, not number. Assign EP-008/EP-016/EP-018/EP-019/EP-021 to their (currently ambiguous) pods per the §6.3 note before creating the Area-Path tree.

10. Post-Supplement Update (2026-06-04, after this run)​

Two §7 GST verdicts were captured BEFORE the same-day fix below and are now improved:

  • EP-002 D-008 (was PARTIAL, citing reservation booking-engine on "legacy 12% getRoomGstRate"): the slab VALUE is now corrected — @hmp/compliance@1.1.0 (commit af146d2) fixes getRoomGstRate to GST 2.0 {≤7500:5%, >7500:18%}, and reservation-service consumes it (dep bumped, 8dc5423). The reservation dashboard create/preview/extend GST is now CORRECT (live-verified ₹6,000 → 5%/₹300). Residual: full @hmp/tax + per-property TaxConfiguration migration (the GST program) + CGST/SGST split tracking.
  • EP-011 D-003 / customer #4 (GAP): the dashboard reservation half is FIXED (above). The booking-engine guest-facing half remains GAP — CheckoutPage.tsx:220 taxRate=0.12 + mockApi.ts:26 still hardcode 12% (= tracker item #41). That is the true remaining #4/EP-011-D-003 work.

Net effect on the §8 short-list: item 1 (EP-011 D-003) narrows to the booking-engine surface only; item 2 (EP-002 D-008) downgrades from a wrong-value bug to a canonical-engine-migration task.