Skip to content

NepWalk MVP — Build Tasks (v2)

Build window: Thu 17 – Wed 30 Sep 2026. Saturdays off. Created 17 Sep 2026.

Rules

  • Tick [x] when the done-when line is true, not when code is written.
  • Tags: [docs] nepwalk-docs · [be] nepwalk-be · [fe] nepwalk-fe · [ops] deploy/infra.
  • TDD for auth, planning rules and money.
  • If a day overruns, move the leftover to the next day and note it in the Slip log. Don't skip the Wed 23 checkpoint.
  • Never cut: F0 security + orgId, F1 nights strip, F2 rules, F3 rule questions, F6 tracker, F7 drafts.

Schedule

The original Day 1 (Wed 16) was missed, so Days 1 and 2 share Thu 17. orgId and the deploy moved to Fri 18. Every later day shifted by one. F10 AI moves to October by default.

Build day Date Focus
1 Thu 17 (first half) Docs + FE auth + merge decision
2 Thu 17 (second half) BE security fixes
3 Fri 18 Schema: orgId + item types + trip pax · prod deploy
4 Sun 20 F1 itinerary builder UI
5 Mon 21 F2 rules R1–R5
6 Tue 22 F2 rules R6–R10 · F3 questions panel
7 Wed 23 F4 vendors · F5 places · cut-line checkpoint
8 Thu 24 F6 services + booking tracker
9 Fri 25 F7 WhatsApp drafts + group summary
10 Sun 27 F8 commission ledger
11 Mon 28 F9 traveller day view + share tokens
12 Tue 29 Example request end-to-end · fixes · missed rules
13 Wed 30 Bug bash on phone · backup restore · inquiry form · launch

Build day 1 — Thu 17 Sep, first half

  • [x] [docs] Write scope.md (authoritative MVP scope)
  • [x] [docs] Write tasks.md (this file)
  • [x] [fe] Expand nepwalk-fe/CLAUDE.md (approved 17 Sep): stack, commands, design-system rules, design brief pointer, known issues
  • [x] [fe] Merge vs rebuild (timebox 1 h): (17 Sep: merged → branch feat/mvp-base, build passes; decision P11) try merging origin/feat/trip_management into the working branch.
  • Done when: merged and building, or a decision is recorded in decisions.md to rebuild the pages on existing components.
  • [x] [fe] Fix auth: ~~store the access token and send Authorization: Bearer~~ ✅ (already on dev) · ~~redirect to /login~~ ✅ · ~~AuthCallback reads data~~ ✅ · remaining: store refreshToken and send { refreshToken } to /auth/refresh, save the new tokens, retry; logout clears both. (17 Sep: done on feat/mvp-base, commit e66befe; founder-tested)
  • Done when: login → trips list loads the user's own trips with no 401.

Extra fixes found during day 2 testing (17 Sep, founder-tested):

  • [x] [be] Update itinerary accepted no category (400) → fixed
  • [x] [fe] Edit/delete/reorder activity and delete day called non-existent routes → fixed to nested routes

Extra fixes found during day 1 testing (17 Sep, founder-tested):

  • [x] [be] Local DB created (decision P12) · CORS allows PUT/PATCH/DELETE (c72a56e) · 3 dead seed photos → Wikimedia (52a1c8d)
  • [x] [fe] CoverImage fallback for missing/broken photos (6ec2d68)

✅ Build day 1 done — 17 Sep.

Build day 2 — Thu 17 Sep, second half

Chunk A done 17 Sep (founder-tested): read access, templates, reorder + itinerary edit fixes — BE 5c5e391, FE da77fab, 23 e2e tests; both repos pushed as feat/mvp-base. Chunk B done 17 Sep (founder-tested): required JWT secrets, refresh-token jti, CORS allowlist — BE 3c6ab4b, 30 e2e tests.

  • [x] [be] Auth guard on GET /trips/:id, /days/:id, /itineraries/:id. Only members (or later a valid share token) can read.
  • [x] [be] GET /trips/public/:slug returns 404 unless isPublic
  • [x] [be] Templates list/get/apply scoped to owner
  • [x] [be] Itinerary reorder rejects IDs that don't belong to the day
  • [x] [be] Fail at startup if JWT_SECRET is missing (no 'default-secret')
  • [x] [be] CORS: restrict origin to the frontend URL from env (currently origin: true reflects any site with credentials). (17 Sep: done; PUT/PATCH/DELETE allowed too.)
  • [x] [be] Refresh tokens: add a unique jti so two tokens issued in the same second differ (today an old refresh token can be reused after rotation); JWT_REFRESH_SECRET required at startup (no 'refresh-secret' fallback)
  • [x] [be] Tests for all of the above.
  • Done when: npm test passes, and tests prove 401/404 for non-members and private trips.

✅ Build day 2 done — 17 Sep.

Build day 3 — Fri 18 Sep

  • [ ] [be] One migration:
  • Organization model + seed "NepWalk Ops"
  • orgId on Trip
  • Itinerary.type enum (STAY, FLIGHT, TRANSFER, VEHICLE, PLACE, MEAL, FREE, CUSTOM)
  • STAY check-in/check-out
  • FLIGHT/TRANSFER from/to/time/mode
  • Itinerary.placeId/vendorId (nullable)
  • Trip pax enrolled / expected max / lock date, room mix, leader contact
  • [ ] [be] Scope every trip/day/itinerary query by orgId.
  • Done when: a test proves a second org can't read the first org's trips.
  • [ ] [be] Time rules (05:00–23:00, no overlap) apply only to PLACE/MEAL/CUSTOM
  • [x] [ops] Backend live on Render: https://nepwalk-be.onrender.com (Docker; prisma migrate deploy runs on start). (17 Sep)
  • [x] [ops] Frontend live on Vercel: https://nepwalk-fe.vercel.app (NEXT_PUBLIC_API_URL=https://nepwalk-be.onrender.com/api/v1); connected to the backend. Database: Neon. Vercel's Next.js CVE PR (15.3.8) merged. (17 Sep)
  • [ ] [fe] Upgrade next to 15.5.25 (+ eslint-config-next), axios, and npm audit fix: 15.3.8 still has 29 advisories (2 critical)
  • [ ] [ops] Render env: FRONTEND_URL = Vercel URL, new random JWT_SECRET + JWT_REFRESH_SECRET, GOOGLE_CALLBACK_URL = https://nepwalk-be.onrender.com/api/v1/auth/google/callback → then merge the chunk B PR
  • [ ] [ops] Database backups (Neon): confirm the plan's restore window; its plan, expiry and backup/export option; schedule a nightly pg_dump if the plan has none
  • [ ] [ops] Cold starts (~50 s on the free plan): upgrade or keep-warm before the group leader uses the link
  • [ ] [fe] Remove the Render deploy job from .github/workflows/deploy.yml and render.yaml if the frontend moves to Vercel
  • Done when: the API health endpoint is reachable over HTTPS and one backup file exists.
  • [ ] Fri 6–7 pm: weekly review (founder)

Build day 4 — Sun 20 Sep

  • [ ] [fe] Trip basics form: pax (enrolled / expected max / lock date), leader contact, room mix
  • [ ] [fe] Nights strip: whole trip on one line; city blocks from STAY items; empty nights red
  • [ ] [fe] Moves: one tap ✈ flight / 🚐 road + time between city blocks
  • [ ] [fe] Day list showing typed items; add/edit/delete items.
  • Done when: the reference case can be entered by hand in under 10 minutes.

Build day 5 — Mon 21 Sep

  • [ ] [be] planning module (pure functions, no DB): R1 night coverage · R2 city continuity · R3 transfers · R4 check-in timing · R5 rooms & vehicle
  • [ ] [be] Reference-case fixture + tests.
  • Done when: tests prove 13 nights, the 9 Jan gap, 6 rooms / 78 room-nights, 7 services (6 transfer legs grouped), the Hiace flag and the early check-in request.

Build day 6 — Tue 22 Sep

  • [ ] [be] R6 connection risk · R7 weather risk · R8 missing info · R9 peak dates (config table) · R10 headcount not final — with tests
  • [ ] [be] Question model + endpoints; rule questions generated on every itinerary edit
  • [ ] [fe] Questions panel: why · category · blocks-booking · status; tick → "Compose message" → wa.me link; record answers.
  • Done when: the reference case shows the full rule question list and one composed WhatsApp message.

Build day 7 — Wed 23 Sep

  • [ ] [be] Vendor model (NepWalk-wide) + CRUD; verification fields; commission %; status
  • [ ] [be] Place model (NepWalk-wide) + seed ~15 places (KTM valley + PKR), photo + credit
  • [ ] [fe] Vendor list/form; place picker in the day list (replaces the 7-field form; "custom item" fallback)
  • [ ] [fe] Remove office wording ("ACTIVE PLAN", "Trip ID", "Publish") and duplicate time display
  • [ ] Cut-line checkpoint (evening). If behind, move to October: F10, F9 polish, F5 photos, the commission "invoiced" state + receivables screen. Record the outcome in the Slip log.

Build day 8 — Thu 24 Sep

  • [ ] [be] Service model: type, dates, qty, details, vendor, linked itinerary items, status (to request → on hold → requested → confirmed / declined → cancelled / completed), release-by date, confirmation ref, who/when, evidence note, orgId
  • [ ] [be] Services generated from the rules output; re-generate safely on edits (no duplicates)
  • [ ] [fe] Bookings panel: assign vendor, change status, record confirmation.
  • Done when: the reference case shows 7 services and one can be moved to confirmed with a ref.

Build day 9 — Fri 25 Sep

  • [ ] [be] messages module: hotel / vehicle / flight vendor sheets (monospace) + wa.me links
  • [ ] [be] "Booked for you" summary (confirmed items only; pending marked; no prices)
  • [ ] [fe] Copy / open-in-WhatsApp buttons on each service and on the trip.
  • Done when: the drafts for the reference case read correctly on a phone.
  • [ ] Fri 6–7 pm: weekly review (founder)

Build day 10 — Sun 27 Sep

  • [ ] [be] Commission fields on Service: vendor price, currency, %/amount, status expected/invoiced/collected + date; paymentFlow enum
  • [ ] [be] Trip money summary + global receivables list; tests for the money math (zero, refund, rounding)
  • [ ] [fe] Money tab.
  • Done when: totals match a hand-calculated sheet.

Build day 11 — Mon 28 Sep

  • [ ] [be] ShareToken (revocable, orgId); share endpoint returns no prices, commissions or emails
  • [ ] [fe] Traveller day view per design brief: day buttons, cards (time · title · duration · one line), travel connectors, "🌙 Tonight", driver/guide call + WhatsApp, "⏳ Pending", emergency numbers, print CSS
  • [ ] [be] Access tests: no token = no trip; revoked token fails; changed IDs fail.
  • Done when: the share link opens on a phone and the network tab shows no private data.

Build day 12 — Tue 29 Sep

  • [ ] Run the example request end-to-end with no dev tools or DB edits (scope §7 item 2)
  • [ ] Compare with manual reasoning; add a rule + test for every miss; log misses in decisions.md
  • [ ] If the church group leader has shared preferences: draft the real trip (2 options)

Build day 13 — Wed 30 Sep — launch

  • [ ] Bug bash on a real phone
  • [ ] Backup-restore test into a fresh container
  • [ ] F11: Tally/Google Form linked from the landing page
  • [ ] Check every acceptance item in scope §7
  • [ ] Prod launch; send the group leader the link/summary; ask what's confusing
  • [ ] Post-MVP plan review (founder)

October backlog (after launch)

  • [ ] F10 AI assist via OpenRouter (prefill + question suggestions), redaction, AiRun log
  • [ ] Anything moved at the Wed 23 checkpoint
  • [ ] [be] Rewrite google-oauth.stress.spec.ts for Fastify (res.raw.writeHead); it currently crashes its worker
  • [ ] [ops] Production env: set FRONTEND_URL (or CORS_ORIGINS) and real JWT_SECRET / JWT_REFRESH_SECRET before deploying the backend
  • [ ] Vendor confirmation link
  • [ ] Brand token unification (green)
  • [ ] Team dev onboarding via decisions.md + scope.md + tasks.md + CLAUDE.md

Slip log

Date What slipped Moved to Why
2026-09-17 Build day 1 (Wed 16) not started Thu 17 with day 2; orgId + deploy → Fri 18; all later days +1; F10 → Oct Missed day