Foodtruck Order

Current State

This file is the current implementation snapshot and validation checkpoint. Historical execution details remain in Git and immutable records such as the Epic 003 specification; the latest continuation notes are in AI handover.

Active work

Epic 004 (behavior-preserving refactoring) is complete through REF-TASK-019, and Epic 005's Mocking Bird checkout specification is complete. Epic 006's SEC-TASK-001 and SEC-TASK-002 repository implementations are in progress: hosted URL schemes and frontend absolute API bases are constrained to HTTPS at credential boundaries, and expired account-throttle keys are reclaimed on attempts. Focused acceptance tests and deployment documentation are being completed. Staging/production TLS, headers, cookies, process topology, edge limits, and business privacy/retention decisions remain unverified or external. See Epic 006 and AI handover for details.

Epic 008 (Full Surfboard ECR integration) implementation complete through REF-TASK-031. All ECR integration test coverage now at 100% across statements, branches, functions, and lines. Phase 1 tasks ECR-TASK-001 through ECR-TASK-012: Complete (gateway skeleton and shift operations coded and fully verified). Phase 2 foundation tasks ECR-TASK-013 through ECR-TASK-031: Complete (idempotency and reconciliation safeguards verified with focused tests).

Implementation status:

Known limitations

Standalone requirements are indexed at docs/specs/standalone. STANDALONE-001 is implemented as an authenticated delivered-order history page with durable delivery snapshots, expanded order details, scenario-linked frontend/backend tests, and desktop and mobile browser coverage. pnpm quality, documentation generation/site checks, and focused scenario tests passed for this revision. Full frontend and backend pnpm test:coverage also passed at 100% across statements, branches, functions, and lines; see the requirement record. The detail panel uses the table's body2 type scale and shows timestamps before timeline events.

STANDALONE-002 keeps the Mocking Bird console visible by default in local Vite and Docker Compose environments while excluding it from hosted builds. The shell preserves authenticated navigation from cached user data during a transient non-401 session refresh error; route guards still handle session verification. Automated checkout remains fake-backed; hosted staging/production select Surfboard through external environment configuration. See the requirement and AI handover for scenario evidence and validation.

Epic 007's full-refund flow is complete. REFUND-TASK-001 through REFUND-TASK-007 are implemented. Task 005 adds safe eligibility projection and the confirmed active-KDS detail-menu action. Task 006 adds the corresponding expanded-history action and accessible refunded total, notice, and refund timestamp. Task 007 adds desktop/mobile browser journeys and final release evidence. Focused component/API tests, PostgreSQL integration, browser E2E, pnpm docs:build, pnpm quality, and pnpm validate:docker pass. See the task index and AI handover.

Mocking Bird checkout now settles with providerPaymentReference and paymentMethod: "card", so orders created through Mocking Bird checkout satisfy the refund eligibility check and the Refund Order Action renders in the KDS and order history UIs for local manual testing.

Latest local validation checkpoint

STANDALONE-002 validation passed locally with Node 24.21.0 and pnpm 10.34.5.

REFUND-TASK-001 validation passed locally: pnpm quality; 148 focused backend unit tests; and 42 PostgreSQL integration tests spanning refund operations and existing order persistence/history. REFUND-TASK-002 validation passed: 93 focused Surfboard/application tests and pnpm quality. The refund integration database ran against the existing Docker PostgreSQL service on port 55432. The REFUND-TASK-003 validation passed: 40 focused backend tests, 41 frontend API/console tests, pnpm quality, and pnpm docs:build. The full build, suite/coverage, supply-chain, documentation site check, and Docker validation requested for Epic 007 completed with REFUND-TASK-007: build, tests, coverage, quality, supply-chain checks, docs build/site check, and Docker validation passed.

REFUND-TASK-005 validation passed: 18 focused KDS/queue tests, 7 refund OpenAPI/HTTP tests, 17 frontend refund API tests, and 5 PostgreSQL refund-operation integration tests against Docker PostgreSQL on port 55432. pnpm docs:build and pnpm quality passed.

REFUND-TASK-006 validation passed: 26 focused history/KDS component tests, 7 refund OpenAPI/HTTP tests, and 6 PostgreSQL refund-operation integration tests against Docker PostgreSQL on port 55432. pnpm docs:build and pnpm quality passed.

Implemented system

The repository contains the local MVP path developed through Epic 003:

The authoritative per-task status remains the Epic 003 task index. Tasks marked In progress there have repository implementations but await that index's required external/hosted completion evidence; do not silently promote them from this summary.

Blocked external integration

MVP-TASK-034 remains Blocked. The repository-side Surfboard payment slice is implemented and tested, while local/test behavior remains fake-backed. Do not invent fiscal payloads or mark the task implemented until a human supplies the external Demo prerequisites through the deployment secret system and the required evidence can be collected.

The complete decision, known unknowns, safety constraints, and handoff are in ADR 004. In summary, continuation requires the approved port design; Demo URL and credentials; merchant/store and networked EMV terminal; confirmed Demo ECR/register/control-unit facts; public HTTPS webhook subscription and secret; confirmed receipt sequenceNumber semantics; and a separately triggered redacted Demo smoke. No Live call is authorized. Provider idempotency, Demo ECR availability, Skatteverket integration, X reports, and PAYMENT_PROCESSED semantics remain unclaimed where ADR 004 records them as unknown.

REF-TASK-019 validation checkpoint

Local validation used Node 24.21.0 and pnpm 10.34.5. Against baseline d5f0420^, the route/OpenAPI surface, root and workspace manifests, backend environment configuration, and frontend page registry were unchanged. A TypeScript runtime/AST comparison found all 912 flattened locale keys and copy values unchanged; stable scenario IDs in backend, frontend, and E2E tests also matched. Query-key values were compared across the old order API and moved capability modules. The route registrars retain named operations and service mappings; OpenAPI contract tests and the backend suite cover the HTTP surface.

pnpm docs:build, pnpm docs:site:check, and pnpm quality passed after the documentation edits. The quality gate reported only the unrelated health-route OpenAPI 4xx documentation warning and Redux Toolkit TypeDoc inheritance warning.