KeyNova / HMP — Go-Live Readiness Audit
Date: 2026-04-25 Style: Big-Four operational readiness review (Deloitte / EY / KPMG / PwC) Method: 5 parallel domain auditors scored 422 individual checks against code evidence. Slice files: A · B · C · D · E
Bottom line
🔴 NOT GO-LIVE READY. Cumulative 20 P0 blockers across reservations, billing, OTA channels, India regulatory compliance, tenant-isolation security, and live-mode integrations.
The platform's architecture is sound — there is no need to throw out modules. The blockers are fillable: each is a discrete code change or vendor configuration. Estimated remediation: 3–4 weeks with two parallel tracks (engineering + compliance).
Master scorecard
| # | Domain | Slice | ✅ Done | ⚠️ Partial | 🔴 Stub | ❌ Missing | P0 | Verdict |
|---|---|---|---|---|---|---|---|---|
| 1 | Reservations | A | ✓ | ⚠️ × 4 | — | — | 3 | 🔴 |
| 2 | Front Desk | A | ✓ | ⚠️ × 4 | — | — | 0 | ⚠️ |
| 3 | Folio & Billing | A | ✓ | ⚠️ × 1 | — | — | 1 | 🔴 |
| 4 | Housekeeping | B | 19/25 | 4 | 2 | 0 | 0 | 🟢 |
| 5 | F&B / POS | B | 28/35 | 5 | 2 | 0 | 0 | 🟢 |
| 6 | Banquet & Events | B | 10/14 | 3 | 1 | 0 | 0 | 🟢 |
| 7 | Spa | B | 7/10 | 2 | 1 | 0 | 0 | 🟢 |
| 8 | Channel Manager | C | 65 % | 4 | 2 | 1 | 2 | ⚠️ |
| 9 | Revenue & Rates | C | 90 % | 2 | 0 | 0 | 1 | 🟢 |
| 11 | Reports & Analytics | C | 70 % | 5 | 3 | 1 | 1 | ⚠️ |
| 10 | CRM & Loyalty | E | 38/84 | 25 | 14 | 7 | 4 | 🔴 |
| 14 | Master Data | E | (in 38) | (in 25) | (in 14) | (in 7) | 1 | 🔴 |
| 15 | Integrations | E | (in 38) | (in 25) | (in 14) | (in 7) | 3 | 🔴 |
| 12 | India Compliance | D | 8 | 12 | 8 | 4 | 8 | 🔴 |
| 13 | Security & Tech | D | 28 | 8 | 2 | 2 | 1 | ⚠️ |
| TOTAL across 422 checks | 20 | 🔴 |
P0 Go-Live Blockers (must fix before opening doors to a real hotel)
A. Revenue & operational integrity (4)
| ID | Slice | Item | Why it's a blocker | Est. effort |
|---|---|---|---|---|
| P0-1 | A | No refund posting on reservation cancellation | Cancellation fee calculated but never posted to folio → revenue reconciliation breaks; no audit trail of refund | 3 d |
| P0-2 | A | Overbooking workflow incomplete | Buffer calc exists but no acceptance/rejection/overflow routing → guests arrive at full hotel | 4 d |
| P0-3 | A | Negative payment amounts blocked at folio | Defense-in-depth check rejects negatives → blocks refund posting once P0-1 wires it up | 1 d |
| P0-4 | A | Per-room edits within multi-room booking blocked | Group of 3 rooms wants to extend 1 room → must cancel all 3 and rebook | 4 d |
B. India regulatory compliance (9)
| ID | Slice | Item | Regulation | Est. effort |
|---|---|---|---|---|
| P0-5 | D | GST exemption flag not wired into invoice calc | GST Act | 2 d |
| P0-6 | D | Reverse Charge Mechanism (RCM) flag missing | GST §9(3) for B2B > ₹5 L | 3 d |
| P0-7 | D | Monthly GSTR-1 / 3B export missing | GST returns | 5 d |
| P0-8 | D | Sequential, gap-free invoice numbering not guaranteed per FY/branch | GST Rule 46 | 2 d |
| P0-9 | D | E-Invoice NIC API integration only stubbed (IRN + signed QR + ACK) | CBIC e-invoicing | 8 d |
| P0-10 | D | Foreigner C-Form: visa fields missing, no PDF export, no check-in enforcement | FRRO | 4 d |
| P0-11 | D | TDS on agent commissions (10 %) and TCS on luxury rate (1 % > ₹7.5 K) not implemented | IT Act | 3 d |
| P0-12 | D | Children's data (< 18) parental-consent flow missing | DPDPA §9 | 2 d |
| P0-13 | D | PCI DSS scope not formally assessed (SAQ / ASV) | PCI DSS | 7 d |
C. Channel & integrations (4)
| ID | Slice | Item | Why blocker | Est. effort |
|---|---|---|---|---|
| P0-14 | C | OTA booking-ingestion incomplete (cron-only, 1 h latency, webhook receiver not persisting) | Direct OTA bookings will be missed | 5 d |
| P0-15 | C | No cross-channel double-book detection | Same room sold on Booking.com + Expedia simultaneously | 4 d |
| P0-16 | C | E-Invoice compliance reports return empty (no EventStore consumer) | Same as P0-9 — required for tax submission | 3 d |
| P0-17 | E | Razorpay LIVE not staged — only sandbox | No real payments accepted | 2 d (config + test) |
D. Tenant isolation & cross-cutting (3)
| ID | Slice | Item | Why blocker | Est. effort |
|---|---|---|---|---|
| P0-18 | E | CRM (campaigns / loyalty / feedback / revenue) controllers lack @CurrentTenant() | Cross-tenant data leak under any auth user | 1 d |
| P0-19 | E | Master data (Property / Room / RatePlan) endpoints don't validate tenant ownership | Same leak class | 2 d |
| P0-20 | E | Email + SMS in simulator mode (SendGrid + Twilio creds missing) | No guest communication on confirmation, OTPs, etc. | 1 d (config) |
Total P0 effort: ≈ 64 person-days. With 3 engineers in parallel = 3 weeks calendar.
Stub register (catalogued by priority — what you specifically asked for)
These are every "Coming in Phase 2" / TODO / placeholder discovered, prioritised so we know what to clean up after the go-live blockers.
Priority 1 — operational, but workable in Phase 1
| Module | Stub | File:line |
|---|---|---|
| Housekeeping | Room enrichment for arrivals/departures (ReservationServiceClient call) | hmp-housekeeping-service/.../rooms.service.ts:145 |
| Housekeeping | DND preference enrichment (GuestServiceClient) | rooms.service.ts:160 |
| POS | Bill email endpoint (/orders/:id/email) | hmp-pos-service — no route yet |
| POS | Happy-hour / time-based pricing | PricingRuleService (in-memory only) |
| Banquet | Pre-function setup checklist | events module — JSON-only |
| Banquet | Post-function teardown checklist | same |
| Banquet | Floor-plan visual editor | currently raw string field |
| Banquet | Puppeteer rootless mode | contracts.service.ts:380 (BNQ-027) |
| Spa | Folio posting (currently stub) | hmp-spa-service |
| Spa | Therapist commission tracking | stub |
| CRM | Pricing-rule persistence (in-memory → Prisma/Redis) | CRM service |
| CRM | Drip-campaign step persistence | CRM service |
| CRM | Feedback trigger queue persistence | CRM service |
| CRM | Email bounce/complaint webhook (SendGrid) | CRM service |
| Reservations | Confirmation e-mail / SMS wiring untested e2e | reservations |
| Front Desk | Cash drawer variance manager-approval UI | front-desk |
Priority 2 — Phase-2 features, defer
| Module | Stub | File:line |
|---|---|---|
| Front Desk | Late-checkout charge auto-post in some flows | frontdesk |
| Reports | Predictive / BI reports | reports module |
| Reports | Competitor intelligence | reports module |
| HK | Lost & Found page (UI placeholder) | dashboard |
| HK | Inventory reorder UI | dashboard |
| Marketplace | Plugin marketplace pages | dashboard |
| Settings | /settings/compliance | dashboard |
| Settings | /settings/currency | dashboard |
| Settings | /settings/in-room-tech | dashboard |
| Settings | /settings/integrations/sap | dashboard |
| Settings | /settings/integrations/tally | dashboard |
| Settings | /settings/integrations/whatsapp | dashboard |
| FrontDesk | /front-desk/phone (PBX integration) | dashboard |
Priority 3 — code-quality TODOs
| Module | Stub | File:line |
|---|---|---|
| HK | auto-reorder.service.ts cross-DB access | STRICT-TODO |
| Banquet | costing.service.ts cross-DB access | STRICT-TODO |
| POS | main.ts:15 missing @types | STRICT-TODO |
| Spa | main.ts:15 missing @types | STRICT-TODO |
| HK | Task DTO missing @Sensitive decorator | task.dto.ts:120 |
Priority 4 — vendor configuration (ops, not code)
| Module | Item |
|---|---|
| Integrations | Razorpay LIVE credentials stage |
| Integrations | SendGrid API key + sender domain SPF/DKIM |
| Integrations | Twilio Account SID/Token + DLT registration |
| Integrations | WhatsApp Business — Meta flows + creds |
| Integrations | NIC e-invoice production credentials |
| Integrations | OTA channel auth (Booking.com / Expedia / Agoda / MakeMyTrip) |
| Integrations | Hardware vendor adapters (key-card, ID-scanner, terminal printer) |
Compliance register (India regulatory)
| Regulation | Status | Notes |
|---|---|---|
| GST — CGST/SGST/IGST | ⚠️ Partial | core calc OK; exemption + RCM + GSTR export missing (P0-5..7) |
| GST — invoice numbering | 🔴 Stub | gap-free per-FY-per-branch sequence missing (P0-8) |
| E-Invoice (NIC) | 🔴 Stub | type stubs only (P0-9) |
| FRRO C-Form | 🔴 Stub | data captured but no PDF / portal export (P0-10) |
| TDS on commissions | ❌ Missing | (P0-11) |
| TCS on luxury rate | ❌ Missing | (P0-11) |
| DPDPA — consent | ✅ Done | capture + immutable audit |
| DPDPA — DSAR | ✅ Done | export + erasure |
| DPDPA — children | ❌ Missing | (P0-12) |
| TRAI DND | ⚠️ Partial | infra hooks; DLT registration not staged (P1) |
| CERT-In | ⚠️ Partial | logging in place; 6-h notification process undocumented (P1) |
| PCI DSS | 🔴 Stub | no SAQ/ASV (P0-13); no card data stored ✅ |
Risk register (top 15, cross-domain)
| # | Risk | Likelihood | Impact | Mitigation |
|---|---|---|---|---|
| 1 | Refund cannot be processed | HIGH | HIGH | P0-1 + P0-3 |
| 2 | Cross-tenant data leak via CRM | HIGH | HIGH (legal) | P0-18 |
| 3 | OTA double-booking | MED | HIGH | P0-14 + P0-15 |
| 4 | E-invoice non-compliance → GST penalty | HIGH | HIGH | P0-9 |
| 5 | C-Form non-compliance → FRRO penalty | MED | HIGH (legal) | P0-10 |
| 6 | Razorpay live not configured → no payments | HIGH | HIGH | P0-17 |
| 7 | Email/SMS in simulator → guest comms broken | HIGH | MED | P0-20 |
| 8 | Per-room edit forces full cancel | MED | MED | P0-4 |
| 9 | Overbooking guest turn-away | MED | HIGH | P0-2 |
| 10 | Invoice gap → GST audit risk | LOW | HIGH | P0-8 |
| 11 | TDS not deducted on commissions → IT recovery | LOW | MED | P0-11 |
| 12 | DPDPA children's data complaint | LOW | HIGH | P0-12 |
| 13 | PCI scope blow-up if assessor finds card data leak | LOW | HIGH | P0-13 |
| 14 | Manager variance bypass | LOW | MED | UI gate (P1) |
| 15 | Confirmation email not delivered | MED | LOW | P1 e2e + bounce |
Recommended remediation plan
Track 1 — Engineering (3 engineers × 3 weeks)
Week 1
- P0-1 + P0-3 + P0-4 (refund, negatives, per-room edits) — Slice A
- P0-18 + P0-19 (tenant isolation guards) — Slice E
- P0-17 + P0-20 (Razorpay live + email/SMS production credentials) — Slice E
Week 2
- P0-2 (overbooking routing) — Slice A
- P0-14 + P0-15 (OTA booking ingestion + double-book detection) — Slice C
- Top 6 P1s from Slice B (bill email, ReservationServiceClient enrichment, Puppeteer sidecar, validators)
Week 3
- E2E regression on the full reservation lifecycle (create → check-in → folio → check-out → cancel/refund)
- E2E OTA round trip
- P1 hardening (state persistence, bounce handling, locking)
Track 2 — Compliance (compliance lead + 1 engineer × 4 weeks)
Week 1
- P0-5 + P0-6 + P0-8 (GST exemption / RCM / numbering) — Slice D
- P0-12 (children's consent) — Slice D
- DLT registration filing (TRAI prerequisite — long lead time)
Week 2
- P0-7 (GSTR-1 / 3B export) — Slice D
- P0-11 (TDS / TCS) — Slice D
- NIC e-invoicing access provisioning (long lead time)
Week 3
- P0-9 (NIC integration build) — Slice D
- P0-10 (C-Form PDF + check-in enforcement) — Slice D
Week 4
- P0-13 (PCI DSS SAQ assessment, third-party ASV scan) — Slice D
- Compliance sign-off package (Legal, Finance, Security)
Sign-off gates before opening doors
- ✓ All 20 P0 closed and regression-tested
- ✓ Razorpay LIVE end-to-end transaction (auth + capture + refund + webhook) on each merchant account
- ✓ NIC e-invoice IRN generated against live test invoice
- ✓ FRRO C-Form export tested
- ✓ Tenant isolation pen-test (attempt cross-tenant read on every CRM endpoint)
- ✓ DR drill (kill primary DB, verify RTO < 1 h, RPO < 15 min)
- ✓ 24-h soak test on staging with realistic load
- ✓ Compliance dossier signed by Legal, Finance, Security, Operations heads
What's strong (positive findings worth preserving)
- Architecture is sound — microservice boundaries match domain shape; no big rewrites needed.
- Slice B is GREEN — Housekeeping, F&B/POS, Banquet, Spa are launch-ready (76 % done, no P0).
- Auth & audit infrastructure is solid — RS256 JWT, MFA TOTP, brute-force lockout, tamper-evident audit logs (SHA-256 chain), 7-yr retention.
- Encryption at rest for Aadhaar / identity fields (AES-256-GCM).
- DPDPA core — consent, DSAR, erasure all present.
- Backup & DR — daily RDS snapshots, PITR, RTO < 1 h, RPO < 5 min, monthly restore test.
- Reservation/folio happy-path test coverage is dense (200 + test files across the two services).
- Reservations chip-driven hub consolidation just shipped — UX baseline is in good shape.
- Tape Chart redesign just shipped with continuation arrows + keyboard shortcuts.
Files
- This master report:
hmp-docs/docs/platform-registry/golive-readiness-2026-04-25.md - Slice A:
golive-audit-2026-04-25/A-reservations-frontdesk-folio.md - Slice B:
golive-audit-2026-04-25/B-hk-pos-banquet-spa.md - Slice C:
golive-audit-2026-04-25/C-channel-revenue-reports.md - Slice D:
golive-audit-2026-04-25/D-compliance-security.md - Slice E:
golive-audit-2026-04-25/E-crm-masterdata-integrations.md