Skip to content

Task 18: Master Execution Plan — Prioritized Work Queue

Overview

Single prioritized list of all POC and post-POC work, ordered for sequential execution. Use this as the backlog once approval is received.

Last updated: 2026-04-16 (P1 complete — demo-ready)

Execution Priorities at a Glance

Priority Label When Effort Status
P1 POC Demo Critical Execute first, one by one ~3 days ✅ COMPLETE (24/24 sub-tasks) — end-to-end verified on live Velocity staging with real SES email delivery
P2 Drop 1 Beta After POC approval/demo ~2-3 weeks Not started
P3 Drop 2 (Verification) After Drop 1 signoff ~3-4 weeks Not started
P4 Production Hardening Before general availability ~1-2 weeks Not started

P1 Progress: ✅ 24 of 24 sub-tasks complete — POC is demo-ready. Backend Foundation (P1.1), CIH Integration (P1.2), Business Logic Fixes (P1.3), Frontend Polish (P1.4), and Verification (P1.5) all done. End-to-end flow confirmed against live Velocity staging: SuperAdmin creates org → KYB review → enable issuer (creates tenant on CIH) → Admin login → issue Past Employment credential via real CIH API → AWS SES delivers real email to verified inbox → candidate clicks claim link → lands on claim page → scans working Velocity-compatible QR code. Multi-tenant isolation verified at both the query-scope level (17 sites enforcing orgId: organizationId) and via API probe. Known issues + demo limitations documented in Task 21 (13 items, 5 talking points). Post-demo backlog starts with Task 20 code cleanup (P4.4) and Drop 1 Beta work (P2).

PRIORITY 1 — POC Demo Critical (Execute First)

Goal: Complete end-to-end working POC with real Velocity CIH integration.

Total effort: ~21 hours / ~3 working days (updated 2026-04-15 — added UI data-mapping work from Task 19)

Execute in This Order

P1.1 — Backend Foundation (Sequential, ~5 hours) ✅ COMPLETE (2026-04-15)

Step Task From Effort Status
1.1.1 Add CIH env vars to .env + keys.json to config/ Task 09 30 min ✅ Done
1.1.2 Create velocity-staging.config.ts config module Task 09 1 hr ✅ Done
1.1.3 Create migration for credential_manifest_id + deep_link_url columns Task 09 30 min ✅ Done
1.1.4 Create EncryptedColumnTransformer (AES-256-GCM) Task 15 1 hr ✅ Done (15 tests passed)
1.1.5 Fix deprecated createCipher in velocity-tenant.service.ts Task 15 30 min ✅ Done (9 tests passed)
1.1.6 Create Global Exception Filter Task 17 2 hrs ✅ Done (29 tests passed)

P1.2 — CIH Integration (Sequential, ~8 hours)

Step Task From Effort Status
1.2.1 Create new cih-api.service.ts (HTTP client wrapper) Task 09 2 hrs ✅ Done (10 tests passed against staging)
1.2.2 Remove isPocMode mock from velocity-registrar.service.ts Task 09 1 hr ✅ Done (5 tests passed against staging)
1.2.3 Wire velocity-tenant.service.ts to real CIH tenant create Task 09 1 hr ✅ Done (11 tests passed against staging)
1.2.4 Replace MockVCLProvider with cih-api.service.ts delegation Task 09 2 hrs ✅ Done (12 tests passed, real CIH verified)
1.2.5 Wire manual-credential.service.ts to real credential create Task 09 1 hr ✅ Done (end-to-end tenant→service→depot→credential verified on live CIH; credential 69dfe1691788f7af31e8edba created)
1.2.6 Wire credential revoke + issue-links refresh Task 09 1 hr ✅ Done (revoke verified end-to-end: CIH /credentials/delete → getCredentials confirms removal; 4 tests passed)

P1.3 — Business Logic Fixes (Sequential, ~1 hour) ✅ COMPLETE (2026-04-16)

Step Task From Effort Status
1.3.1 Fix KYB auto-approval bypass in organization.service.ts Task 16 30 min ✅ Done — org now starts in DRAFT/PENDING; tenant creation moved to enableIssuerCapabilities. Also fixed stale-entity save race in the same flow. E2E walkthrough passed
1.3.2 Replace new Error() with NestJS exceptions in 4 services Task 17 2-3 hrs ✅ Done — 19 conversions across 8 services (NotFound/BadRequest/Conflict/BadGateway/Unauthorized/InternalServerError). Bootstrap/transformer paths intentionally left as native Error

P1.4 — Frontend Polish (Sequential, ~5 hours) ✅ COMPLETE (2026-04-16)

Step Task From Effort Status
1.4.1 Add QR code generation to claim page GAP-01 / UI-06 1 hr ✅ Done — qrcode.react installed; QR renders from CIH-minted deepLinkUrl with fallback to legacy synthetic URL
1.4.2 Show real DID + tenant ID on org detail pages Task 09 / UI-07 30 min ✅ Done — relabeled to "Velocity Tenant ID", monospace styling, added tenant status chip + tenantCreatedAt timestamp
1.4.3 Add typed error response interface + update api.ts Task 17 1 hr ✅ Done — created api-error.ts with ApiErrorResponse / NormalizedApiError + toApiError() + formatApiError(); response interceptor logs normalized errors; migrated RegistrationForm as first consumer
1.4.4 Setup Complete screen — real Org ID + DID (replace hardcoded "ORG-2024-001234") Task 19 / UI-01 30 min ✅ Done — removed 'ORG-' + Date.now() and 'ADMIN-' + Date.now() fakes; Summary card now shows real organizationId, organizationDid (monospace), real kybStatus + status chips, tenant status + caption explaining it's created after KYB approval
1.4.5 Credential Dashboard — real candidate rows + stats + new deep link/QR columns Task 19 / UI-02+03 1.5 hrs ✅ Done — backend CredentialResponseDto gained deepLinkUrl + credentialManifestId; frontend table has new "Deep Link" (copy-to-clipboard) and "QR" (modal with scannable QR) columns; migrated error handling to toApiError()
1.4.6 Header — real user name + org context (replace hardcoded "John Smith") Task 19 / UI-04 15 min ✅ Done — avatar renders real initials, user name + role shown on desktop, org chip tooltip reveals the full organizationDid
1.4.7 Manual credential form — add org DID banner Task 19 / UI-05 15 min ✅ Done — "Issuing on behalf of..." banner with monospace DID, tenant status chip, warning fallback if DID missing
1.4.8 KYB Records table — fix "Invalid Date" when submittedAt/reviewedAt are null (show "—" instead) UI bug 15 min ✅ Done — null-guarded submittedAt; upgraded '-' to '—' for consistency
1.4.9 Restrict credential type dropdown to MVP scope per v3.0 PDF PDF alignment 30 min ✅ Done — added MVP_SUPPORTED_CREDENTIAL_TYPES = [EmploymentPastV1.1] allowlist. Filtered 4 endpoints on /credential-types controller (types/categories/templates/template-by-type) + 3 on /issuer/manual-credentials (types/templates/create). Guards reject direct-API bypass with a structured 400

P1.5 — Verification (Sequential, ~2 hours) ✅ COMPLETE (2026-04-16)

Step Task Effort Status
1.5.1 End-to-end test: SuperAdmin creates org → KYB → Admin login → Issue credential via real CIH → Claim via QR 1 hr ✅ Done — walked live against staging. Credential 69e0dfff1788f7af31e8edca minted, real SES email delivered, claim page + QR both functional from the user's perspective
1.5.2 Test multi-tenant isolation (Org A can't see Org B data) 30 min ✅ Done — 17 query sites confirmed to scope by orgId: organizationId; API probe as curo superadmin returned 0 employees while DB has 3 across other orgs
1.5.3 Verify tenant ID 69df3e9a1788f7af31e8edb1 still works on staging 15 min ✅ Done — CIH tenants/get, issuer-services/get, credentials/get all return expected state
1.5.4 Document known issues / demo limitations 15 min ✅ Done — Task 21: 13 known issues + 5 demo talking points

P1 completion criteria: - ✅ Real credential issued via CIH API (not mock) - ✅ QR code visible on claim page - ✅ Dashboard shows real Velocity offer IDs - ✅ No isPocMode code paths remaining - ✅ Error responses are consistent JSON format - ✅ End-to-end demo scenario runs cleanly

PRIORITY 2 — Drop 1 Beta (After POC Approval)

Goal: Full feature parity with v3.0 Drop 1 requirements (issuance side).

Total effort: ~2-3 weeks

P2.1 — Essential Beta Features (~1 week)

# Task From Effort
2.1.1 CSV/Excel export of credentials + status GAP-03 1-2 days
2.1.2 Candidate-centric search and view GAP-04 2-3 days
2.1.3 Organisation branding UI (logo, colors, T&Cs) GAP-02 3-5 days
2.1.4 Enhanced dashboard stats (auth rates, integration health) GAP-15 2-3 days

P2.2 — Automation & Integration (~1 week)

# Task From Effort
2.2.1 Registrar API for automated org creation GAP-09 3-5 days
2.2.2 Compliance/audit report UI (query audit_logs) GAP-16 3-5 days
2.2.3 Reminder/nudge email system GAP-06 2-3 days
2.2.4 CI/CD pipeline (GitHub Actions, automated deploy) GAP-17 3-5 days

P2.3 — Security Hardening (~3-4 days)

# Task From Effort
2.3.1 Encrypt OAuth tokens in accounts table Task 15 2 hrs
2.3.2 Encrypt session tokens Task 15 1 hr
2.3.3 Encrypt PII fields in employees, users, candidates Task 15 1 day
2.3.4 Encrypt credential_offers.payload Task 15 2 hrs
2.3.5 Encrypt audit_logs JSONB state Task 15 3 hrs
2.3.6 Implement data retention policies Task 15 1 day

P2.4 — Deployment Readiness (~2 days)

# Task From Effort
2.4.1 Move all hardcoded credentials to env vars Task 16 1 hr
2.4.2 Rotate exposed Auth0 Management API credentials Task 16 1 hr
2.4.3 Enable JWT audience validation Task 16 15 min
2.4.4 JWT organization context validation Task 16 2 hrs
2.4.5 Real service endpoint URL (not placeholder) Task 09 30 min
2.4.6 Remove console.log from production code Task 17 30 min

PRIORITY 3 — Drop 2 (Disclosure & Verification)

Goal: Implement credential disclosure, presentation, and verification flows.

Total effort: ~3-4 weeks

P3.1 — Disclosure System (~2 weeks)

# Task From Effort
3.1.1 Create disclosure request entity + service + controller GAP-05 3-4 days
3.1.2 Disclosure email + landing page + QR code GAP-05 3-4 days
3.1.3 Wallet integration for presentation submission GAP-05 2-3 days
3.1.4 Store and display received presentations GAP-05 2 days
3.1.5 Disclosure search/list + CSV export GAP-05 1-2 days

P3.2 — Verification System (~2 weeks)

# Task From Effort
3.2.1 Integrate POST /operator/presentations/check GAP-07 2-3 days
3.2.2 Display 5 verification checks (issued to, issuer, expired, tampered, revoked) GAP-07 2 days
3.2.3 Store verification results in verification_reports GAP-07 1 day
3.2.4 PDF report generation GAP-08 3-5 days
3.2.5 Download PDF from verification detail page GAP-08 1 day

P3.3 — Credits/Vouchers System (~1 week)

# Task From Effort
3.3.1 Platform pool of verification credits v3.0 doc 3-4 days
3.3.2 Voucher exchange via Registrar v3.0 doc 2-3 days

PRIORITY 4 — Production Hardening

Goal: Meet all non-functional and compliance requirements before GA.

Total effort: ~1-2 weeks

P4.1 — Compliance (~1 week)

# Task From Effort
4.1.1 GDPR: Data subject access request endpoint GAP-14 2 days
4.1.2 GDPR: Right to erasure workflow GAP-14 2 days
4.1.3 GDPR: Consent management GAP-14 1-2 days
4.1.4 UKDIATF compliance review (legal + code) v3.0 TBD (legal)
4.1.5 SOC 2 preparation and audit v3.0 TBD (external)

P4.2 — Security Hardening (~1 week)

# Task From Effort
4.2.1 Third-party penetration testing v3.0 1 week (external)
4.2.2 DDoS protection (Cloudflare / AWS Shield) v3.0 1 day
4.2.3 WAF configuration v3.0 2 days
4.2.4 Audit log immutability (append-only, signed) Task 15 3 days
4.2.5 Key rotation automation Task 15 2 days
4.2.6 HSM evaluation for key management Task 15 TBD

P4.3 — Operations & Polish (~1 week)

# Task From Effort
4.3.1 Account expiration & reactivation GAP-13 2-3 days
4.3.2 User profile management UI GAP-10 1-2 days
4.3.3 Passkey UI implementation GAP-12 2-3 days
4.3.4 Help system / Zendesk integration GAP-11 2-3 days
4.3.5 Payments (Stripe) GAP-18 1 week
4.3.6 Disaster recovery plan v3.0 2-3 days
4.3.7 99.9% SLA monitoring / alerting v3.0 2-3 days

P4.4 — Housekeeping (very low priority, ~1 hour)

# Task From Effort Status
4.4.1 Code cleanup audit — remove dead controllers, superseded components, mock stat stubs, and deprecated wrappers Task 20 ~1 hr across 3 risk tiers ⏳ Deferred — do not execute before POC demo signoff

The Full List — One Source

Priority Scope Items Total Effort
P1 POC Demo 22 sub-tasks ~3 days
P2 Drop 1 Beta 20 sub-tasks ~2-3 weeks
P3 Drop 2 11 sub-tasks ~3-4 weeks
P4 Production 16 sub-tasks ~2-3 weeks
Total End-to-end 65 tasks ~2-3 months to full production

Weekly Sprint Schedule (Suggested)

Week 1 (POC)

  • Days 1-2: P1.1 + P1.2 (backend foundation + CIH integration)
  • Day 3: P1.3 + P1.4 (business logic fixes + frontend polish)
  • Day 4: P1.5 (testing + demo prep)
  • Day 5: Demo buffer / bug fixes

Week 2-4 (Drop 1 Beta)

  • Week 2: P2.1 (essential beta features)
  • Week 3: P2.2 (automation + CI/CD)
  • Week 4: P2.3 + P2.4 (security + deployment readiness)

Week 5-8 (Drop 2)

  • Week 5-6: P3.1 (disclosure system)
  • Week 7-8: P3.2 (verification + PDF reports)

Week 9-10 (Production Hardening)

  • Week 9: P4.1 + P4.2 (compliance + security)
  • Week 10: P4.3 (operations + polish)

Week 11-12 (Testing / GA prep)

  • Penetration testing (external)
  • UAT / beta testing
  • SOC 2 audit prep
  • GA deployment

Approval Gates

Before starting each priority level, confirm:

Before P1

  • Client contract signed
  • Approval to begin implementation
  • POC demo date agreed

Before P2

  • P1 POC demo successful
  • Client feedback collected
  • Drop 1 scope finalized

Before P3

  • Drop 1 Beta signoff
  • Drop 2 scope finalized (may include/exclude Reclaim Protocol)

Before P4

  • Drop 2 feature complete
  • Pre-GA readiness review
  • Pen testing engagement agreed

Summary

If You Have 1 Week

Execute P1 only. You'll have a working POC with real Velocity integration.

If You Have 1 Month

P1 + P2. Full Drop 1 Beta ready for customer pilot.

If You Have 3 Months

All priorities. Production-ready, compliant, fully tested platform.

Reference Documents

All priorities reference these source documents:

Next Action

Wait for approval to start P1.1.1 (environment setup).

Once approved, we execute P1 tasks sequentially. Each task is small enough to complete and verify before moving to the next, so we can halt cleanly at any point if priorities shift.