# Launch readiness

### TB-028 — End-to-end QA pass across booking, payment and messaging flows

- **Size:** M
- **Hours:** 11
- **Scope:** MVP

End-to-end QA pass across booking, payment and messaging flows

Size reason: M — cross-module regression testing is where most launch bugs surface, even though no single feature is complex.

**Acceptance criteria**

- Full owner journey (search, book, pay, message, rate) is tested end-to-end and passes
- Full walker journey (onboard, accept, chat, get paid) is tested end-to-end and passes
- Found bugs are logged with severity and linked to a fixing ticket
- No blocking bugs remain on the payment or booking state-machine critical path before sign-off

### TB-029 — Security review: auth, payment webhooks, admin routes

- **Size:** M
- **Hours:** 11
- **Scope:** MVP

Security review: auth, payment webhooks, admin routes

Size reason: M — reviewing money and admin surfaces for authorization gaps is essential before real users touch real payments.

**Acceptance criteria**

- Payment webhook endpoints verify signatures and reject tampered/unsigned requests
- Admin routes enforce role checks server-side, not just via hidden UI
- Auth session/token expiry and storage are reviewed and confirmed secure
- All findings are documented with severity and remediation status before launch

### TB-030 — Production deployment and monitoring setup

- **Size:** M
- **Hours:** 11
- **Scope:** MVP

Production deployment and monitoring setup

Size reason: M — a first production deploy needs error tracking, alerts and a rollback plan, not just a build.

**Acceptance criteria**

- Production environment variables are configured with no secrets committed to the repo
- Error tracking captures and alerts on real production errors
- Uptime/health-check monitoring is configured with alerting
- A documented rollback procedure exists and has been tested at least once