Week 1 Sprint — Discovery, Foundations & First Deliverables
20 Mar 2026 → 27 Mar 2026 · 6 Engineers + Delta Orchestration · Day 1 audits complete
Sprint Progress14%
6 of 42 tasks complete (Day 1 audits ✅)
🚨 P0 Alerts — Action Required
Live Bug: seo_monitor_settings table missing from DB schema
Signup and login flows reference this table — throwing 500 errors in production right now. Needs immediate patch.
.env files are world-readable (chmod 644)
API keys and secrets readable by any process on the server. Fix: chmod 600 on all .env files. Awaiting Lonzo sign-off.
Clinic subdomains serving HTTP only — no TLS
Patient-facing *.dentalhelp.co.nz sites are unencrypted. NZ Privacy Act IPP 5 violation risk. Wildcard cert needed.
Stripe billing is dead — no checkout, no webhooks
SDK installed, keys configured, but zero API calls implemented. Billing page shows "coming soon." Clinics cannot pay.
No email system installed
No Resend, SendGrid, Postmark, or Nodemailer. Zero transactional email capability for a healthcare SaaS. Critical gap.
📊 Sprint KPIs
6
Day 1 Tasks Done
All audits complete ✅
5
P0 Issues
Awaiting action
8
High Issues
Day 2–5 targets
20+
API Endpoints Live
Not greenfield ✅
0
Test Coverage
Starting Day 2
6
Days Remaining
Ends 27 Mar 2026
📅 7-Day Sprint Timeline
Agent
Day 1
Mar 20
Mar 20
Day 2
Mar 21
Mar 21
Day 3
Mar 22
Mar 22
Day 4
Mar 23
Mar 23
Day 5
Mar 24
Mar 24
Day 6
Mar 25
Mar 25
Day 7
Mar 26
Mar 26
🔧 Apex
Audit ✓
Models + DB fix
JWT + CORS
CRUD verify
Rate limit + helmet
OpenAPI docs
QA handoff
🎨 Blaze
Audit ✓
Design tokens
Component lib
Login + Dashboard
Booking UI
Mobile pass
QA handoff
⚙️ Nexus
Audit ✓
Arch diagram + swap
Envs + wildcard SSL
CI/CD
Monitoring
Backup
Runbook
🛡️ Shield
Scan ✓
Auth deep-dive
PII/PHI map
Privacy Act gap
Audit log plan
Hardening report
Compliance v1
🔌 Flux
Audit ✓
Integration roadmap
Pipeline design
Stripe checkout
Stripe webhooks
Email + SMS
Test report
🧪 Orion
QA design ✓
10 test cases
Staging connect
API tests
UI tests
Integration tests
Bug report v1
👥 Agent Status — Day 1 Reports
🔧
Apex
Backend Engineer · API · Database · Auth
Day 1 ✓
7-Day Progress
1Done
2Models
3JWT fix
4CRUD
5Harden
6Docs
7Handoff
Stack confirmed: Node 22 · Express · PostgreSQL · TypeScriptDone
20+ API endpoints already live (not greenfield)Done
Core data models documentedDay 2
OpenAPI docs publishedDay 6
Zero critical security gapsDays 3–5
Day 1 Key Findings
P0seo_monitor_settings table missing — signup/login 500 errors in prod
P0JWT secret is weak and predictable (not cryptographically random)
HIGHNo rate limiting on /auth/login — brute force unmitigated
HIGHCORS set to wildcard * — too open for healthcare data
GOOD25+ DB tables exist covering full PMS, SEO, LinkedIn, Voice
🎨
Blaze
Frontend Engineer · UI · Dashboard · Portal
Day 1 ✓
7-Day Progress
1Done
2Tokens
3Comps
4Screens
5Booking
6Mobile
7Handoff
Stack confirmed: Next.js 16 · React 19 · TypeScript · Tailwind 4Done
Login, signup, main dashboard screens already existDone
Design token file consolidatedDay 2
Patient portal screens (zero exist)Day 4
Appointment booking UIDay 5
Day 1 Key Findings
GOOD15 dashboard screens exist, live API wiring already in place
P0No patient portal screens at all — highest priority gap
HIGHAuth tokens in localStorage — not httpOnly cookies (security risk)
HIGHNo shared component library — no Button, Card, Input primitives
INFONo .env files present — needs NEXT_PUBLIC_API_URL to run locally
⚙️
Nexus
DevOps · AWS · CI/CD · Monitoring
Day 1 ✓
7-Day Progress
1Done
2Arch
3Envs+SSL
4CI/CD
5Monitor
6Backup
7Runbook
Full stack mapped: EC2 · Nginx · PM2 · Docker · Postgres · RedisDone
Architecture diagramDay 2
Dev / staging / prod environmentsDay 3
CI/CD pipeline activeDay 4
Monitoring + alerts liveDay 5
Day 1 Key Findings
P0Clinic subdomains HTTP only — no TLS for patient-facing sites
HIGHAPI restarted 14x, Dashboard 11x — silent crashes, no alerting
HIGHNo swap — OOM risk with 8 Node processes + Docker
HIGHapi/ and clinic-sites/ have no git — code only on this one server
NOTEiptables blocking DB ports externally (despite bind config)
🛡️
Shield
Security · Compliance · NZ Privacy Act
Day 1 ✓
7-Day Progress
1Done
2Auth
3PII Map
4Privacy
5Audit log
6Harden
7Checklist
Security surface scan completeDone
NZ Privacy Act gap analysisDay 4
0 critical unmitigated vulnsDays 2–6
Audit logging plan signed offDay 5
Compliance checklist v1Day 7
Day 1 Key Findings
CRITZero MFA — single-factor auth for clinics and platform admin
CRIT.env files world-readable (rw-rw-r--) — must chmod 600 now
HIGHCORS wildcard + credentials:true — allows cross-site credential abuse
HIGHNo Nginx security headers (HSTS, CSP, X-Frame-Options missing)
GOODbcrypt cost 12 ✅ · SQL injection protected ✅ · SSH locked to VPC ✅
🔌
Flux
Data & Integrations · Payments · Comms · Pipelines
Day 1 ✓
7-Day Progress
1Done
2Roadmap
3Pipeline
4Stripe↗
5Stripe✓
6Email+SMS
7Report
Integration audit complete — full landscape mappedDone
Claude, LinkedIn, Twilio Voice, ElevenLabs — all liveDone
Stripe checkout + webhooks live in stagingDays 4–5
Email integration live (Resend recommended)Day 6
SMS appointment reminders firingDay 6
Day 1 Key Findings
LIVEClaude AI · LinkedIn OAuth · Twilio Voice · ElevenLabs — working
P0Stripe: SDK installed, keys set — but zero API calls. Billing is broken.
P0Email: nothing installed at all. No transactional email capability.
HIGHSMS reminders: Twilio account exists but reminder flow never fires
HIGHNo Stripe webhook handler — subscription status can never update
🧪
Orion
QA Engineer · Testing · Bug Triage · Regression
Day 1 ✓
7-Day Progress
1Done
210 Tests
3Staging
4API tests
5UI tests
6Int. tests
7Bug report
QA process designed + tooling selectedDone
Severity scale: P1–P4 defined (P1/P2 = release blockers)Done
≥10 test cases written and executedDay 2
Bug report with severity ratingsDay 7
Regression suite running in CIDay 7
Day 1 Key Findings
HIGHZero existing test coverage across entire codebase
TOOLAPI: Jest + Supertest · UI/E2E: Playwright · CI: GitHub Actions
DEPNeeds staging URL from Nexus by Day 3
DEPNeeds Stripe test keys from Flux by Day 6
DEPNeeds GitHub Actions write access for CI setup
⚠️ Risk Register — Updated Day 1
| Risk | Owner | Severity | Mitigation | Status |
|---|---|---|---|---|
| seo_monitor_settings missing — live 500 errors on signup/login | Apex | P0 | Add migration to initDB() on Day 2 | ⚡ Active |
| .env files world-readable — secrets exposed | Shield | P0 | chmod 600 — awaiting Lonzo approval | ⏳ Pending |
| Clinic subdomains HTTP only — NZ Privacy Act risk | Nexus + Shield | P0 | Wildcard SSL cert — Day 3 | ⚡ Active |
| No email system — zero transactional email capability | Flux | P0 | Install Resend — Day 6 | ⚡ Active |
| Stripe billing non-functional — clinics cannot pay | Flux | P0 | Build checkout + webhooks Days 4–5 | ⚡ Active |
| JWT secret weak + no rate limiting on auth | Apex + Shield | High | Rotate secret + add express-rate-limit Day 3–5 | Planned |
| Auth tokens in localStorage (not httpOnly cookies) | Blaze + Shield | High | Migrate to httpOnly cookies — Day 2–3 | Planned |
| No git on api/ and clinic-sites/ — single point of failure | Nexus | High | Init git repos + push to remote Day 2 | Planned |
| API crashing 14x, no alerting or visibility | Nexus | High | Root cause + monitoring setup Day 2–5 | Planned |
| No patient portal — core product gap | Blaze | Medium | Build Days 4–6 | Queued |
🎯 Week 1 Definition of Done
🔧 Backend
DB bug patched · JWT hardened · Rate limiting on auth · CORS locked · OpenAPI docs live
🎨 Frontend
Design tokens extracted · Component lib scaffolded · Patient portal + booking UI built · Mobile-ready
⚙️ Infra
Wildcard SSL · Swap added · Git on all repos · CI/CD running · Monitoring active · Backups verified
🛡️ Security
.env secured · MFA plan · Nginx headers · Privacy Act gap analysis · Compliance checklist v1
🔌 Integrations
Stripe checkout + webhooks live · Email via Resend · SMS reminders firing · Integration roadmap published
🧪 QA
≥10 test cases run · Bug report v1 with severity ratings · Regression suite in CI · Staging connected