Homepage

Handover: KumoHQ → FLIN

This is the dated transfer snapshot for FLIN's in-house engineering and product team. It covers who owns which account, what to transfer and in what order, what is due soon, what is still open with FLIN, and every known issue with a recommended fix. Everything else lives in the permanent docs (see the reading order), which your team should keep up to date. This file is a snapshot and is not meant to be maintained.

Last verified: 2026-10-12 against main @ a270f1d (live infra/EAS/Trigger.dev checks on the same date).

Markers used: TODO(handover) is a fact or decision only KumoHQ or FLIN can supply. ⚠️ marks something taken from earlier team notes that could not be re-verified in code or live.

Contents

• Reading order
• State of the system on 2026-10-12
• After the handover: who does what
• Act now
• Accounts and access
• Transfer checklist
• Deadlines
• Open threads with FLIN
• Known issues and recommended fixes
• Questions only KumoHQ or FLIN can answer
• Material that is not in git

Reading order

State of the system on 2026-10-12

Since 2026-10-06, production in Indonesia holds only Test users plus whoever signed up after the 1.1.0 release. Every other account was purged that day ⚠️ (from team notes); the manual RDS snapshot flin-prod-pre-user-purge-20261006 is the only copy of the earlier data (see operations.md).

After the handover: who does what

Decided 2026-10-12:

• FLIN owns and operates everything. That means every account, every vendor contract (CIBI and Onfido included), production, releases and on-call, for both countries.
• KumoHQ stays on as FLIN's contractor for the Philippines. It builds the PH adapters (CIBI, Onfido), app changes and the PH go-live checklist through pull requests to main that FLIN reviews. Splitting ownership by country is not possible: there is one codebase and one app binary, and a merge to main deploys both servers. Every PH PR runs the Indonesia regression guard in engineering-rules.md.
• KumoHQ access is scoped, MFA-protected and ends at PH launch, not at the end of the handover. It covers the PH AWS account, the Trigger.dev "Flin" org (to create the PH project), Expo and the stores (to ship the PH-capable build), and error tracking. In the ID AWS account, read-level access is enough for the regression-guard plan check. The PH launch date is TODO(handover).
• Vendor credentials for PH work (CIBI and Onfido UAT/sandbox) reach KumoHQ through FLIN's password manager, never by email.

Act now

These are live today. They are listed again under known issues.

1. A legacy Trigger.dev project is still sending notifications. proj_wwkvmnfyahwgpebjuuaz in the KumoHQ Trigger.dev org (the jobs project before 2026-07-27) still runs notification-tick every 30 minutes and due-date-reminders daily against a database that is not ID prod. It sent a notification on 2026-10-11. Someone with access to that org should find which database it uses, disable its schedules, then delete the project (operations.md#88-triggerdev-operations).
2. The Trigger.dev staging environment of the current project sends real Debt Discipline due-date notifications. Check which server its SERVER_URL points at.
3. Metabase is reachable from the whole internet. Its role can read every column, including NIK, phone numbers and KTP fields. Put the allowlist back (operations.md#3-metabase-indonesia-only).
4. Finfra AFPI credentials expire 2026-11-25 ⚠️ (date recorded in team notes when the pair was set; SSM shows both parameters rotated on 2026-09-07, which is consistent). Get the next key pair from Finfra before then. The previous expiry went unnoticed for three days ⚠️ and blocked onboarding (operations.md#63-rotation-notes-per-secret).
5. The live "upgrade" push series quotes the wrong price. It says Rp29.000 and "Today only"; the real price is Rp 25.000 with no discount (packages/notifications/src/series.ts, copy.ts). Fixing it needs only a server deploy.
6. Download the 1.1.0 store binaries from EAS before 2026-11-05, when EAS deletes the build artifacts. No git tag marks the release commit; tag 2ac427939 as app-v1.1.0.
7. Security clean-up. The admin, staging-host and shared-account items under Security. Full detail is in the private report delivered separately (not in this repo).

Accounts and access

Verified facts only. Owner after handover and Transfer action are for KumoHQ and FLIN to fill in during review.

Transfer checklist

Order matters. Each step says what breaks if it is skipped or done out of order.

1. Fill in the accounts table together, KumoHQ and FLIN.

2. Give FLIN admins access to every account before removing anyone. That means both AWS accounts (with MFA), Expo (Owner), App Store Connect, Play Console, both Trigger.dev orgs, Cloudflare, GitHub, Firebase, Bugsink, Metabase and the vendor portals. If skipped: you can lose the only person able to sign builds, renew certificates or rotate a key.

3. Rotate every secret KumoHQ set or can read. All prod secrets were put in SSM by KumoHQ, and the Terraform-generated ones have never been rotated (operations.md#6-secrets-and-rotation). Pairs that must change together:

   • JOBS_API_SECRET in SSM and in the Trigger.dev environment. Otherwise every cron call gets 401.
   • BETTER_AUTH_SECRET also keys the /reports/:token links, which are 5-minute HMAC tokens. ⚠️ Rotating it should sign every user out; this has not been tested.
   • Vendor keys: rotate at the vendor first, then update SSM, then force a new deployment.

4. The repository stays in the KumoHQ org (decided 2026-10-12). If it ever moves out, rewire these in the same change:

   • The ID CodePipeline source, a console-owned GitHub OAuth-app connection on KumoHQ/flin.
   • The PH CodeConnections connection (github_repo in infra/terraform/envs/{prod,ph-prod}/main.tf), which an org admin approves in the console.
   • The TRIGGER_ACCESS_TOKEN Actions secret.

   If skipped: merges stop deploying, silently, because nothing alerts on pipeline failure.

5. Trigger.dev: decide whether the "Flin" org stays where it is or moves. If the project changes, update project in apps/jobs/trigger.config.ts, mint a new TRIGGER_ACCESS_TOKEN, and set SERVER_URL and JOBS_API_SECRET in the new environments. Kill the legacy KumoHQ project either way.

6. Bugsink (decided: KumoHQ hosts until 1.2.0, then FLIN's own instance): The server DSN changes with an SSM update and a new deployment. The app DSN is baked into each store build (apps/native/lib/sentry.ts, EAS env), so app errors keep going to the old instance until users update.

7. Staging (decided: lock down now, replace with a Terraform stack, then retire): flinapi.kumohq.in runs on a KumoHQ domain inside FLIN's prod account. Keep it up until the new staging exists and preview / preview-uat in apps/native/eas.json and the Trigger.dev staging environment point at it (deployment.md#staging-and-uat).

8. Expo: make a FLIN person Owner of flinmaybright, then record the signing, APNs and FCM credentials and where the Android upload keystore is backed up.

9. Kumo tracker: FLIN gets accounts now; export later, keeping the FLIN-nnn ids (decided 2026-10-12). Transfer the Figma files.

10. Remove KumoHQ access at PH launch (KumoHQ is FLIN's PH contractor until then): AWS IAM users and the Identity Center user, flin-prod-db-readers members, GitHub collaborators, Expo members, Trigger.dev members, Metabase users, Bugsink. Then rotate anything they could read.

11. Add FLIN's on-call address to both SNS alert topics and confirm the subscription.

Deadlines

Open threads with FLIN

⚠️ These come from the team's notes and ticket threads. Check the latest comments on each ticket in the Kumo tracker before acting.

• FLIN-211 (loan list redesign, shipped in PR #131): four decisions were asked on 2026-09-23: keep "Written off" / "Macet" on closed KOL 5 loans; how manual loans count in "Total Loan Amount"; Home's total outstanding versus the section totals; the year filter. There are also label and copy sign-offs ("Loan Amount" vs "Outstanding", Cash Loan replacing Pinjol/KTA, empty-state copy, Indonesian/Filipino copy review).
• FLIN-241…249 (feedback sheet, shipped in PR #135): six owner decisions that deviate from the tickets, each flagged on its ticket. Examples: "Cash Loan / Pinjaman Tunai" instead of "Pinjol"; "Overdue since" = the last missed due date.
• Bank logos (PR #122): FLIN still owes correct logos for several BPRs, a BSN logo and an unidentified file. Logos are cached as immutable, so a replacement needs a new S3 key.
• Legal copy: the Indonesian and Filipino Terms, Privacy and FAQ text are AI translations that have not had legal review. The FAQ also promises things the app does not do (product.md).
• Philippines inputs that block PH work (multi-country.md §8, product.md#12-pending-inputs-from-flin): CIBI sample response and access, AI prompts, eligibility rules, pricing (TODO(FLIN-174)), legal text, the KOL/DPD explainer, regulator references, nav-bar tabs.
• Onfido (PH KYC): the POC verdict was "go" (research/onfido-ph-poc.md). Still open before a contract: whether API orchestration (classic POST /checks) comes with a paid plan, PhilID/UMID coverage, and pricing against ASLI RI.
• Xendit checkout cancel: untested with real money ⚠️.

Known issues and recommended fixes

Consolidated from every doc in this set and from the live checks. Severity: High = live risk to users, data or deploys; Med = real gap, not urgent; Low = hygiene. Security items name the issue, the component and the fix only.

Security

Operations and deploys

App and product

Data and compliance

Code and tooling

Questions only KumoHQ or FLIN can answer

Collected from every doc. Each also sits next to the claim it affects.

Access and ownership

• Names for every owner still marked TODO(handover) in the accounts table (ownership and transfer actions were decided on 2026-10-12), and the PH launch date that ends KumoHQ's access.
• Who holds admin on each AWS account after the handover, how new people get access, and the break-glass procedure. Who should stay in flin-prod-db-readers.
• Who the third party in the PH AWS account is and how to contact them (decided: PH prod stays in the shared account).
• Who owns the Expo account flinmaybright, the Firebase project behind google-services.json, App Store Connect and Play Console admin, and the tunnelto flinapi subdomain.
• Who owns the Cloudflare account(s) for each zone, and the registrars.
• Who owns the Trigger.dev "Flin" org, its plan and TRIGGER_ACCESS_TOKEN, and which SERVER_URL prod and staging use.
• Bugsink retention and backups while KumoHQ hosts it, and which tool FLIN moves to with 1.2.0.
• Whether a local set-prod-secrets.sh (or other record of how secrets were set) exists and should be handed over through a secure channel.

Operations

• The agreed rollback method, and how many ECR images to keep.
• RPO and RTO targets per country.
• Who reads kumo@flin.co.id, who is on call, the escalation path to KumoHQ during the transition, and vendor support contacts.
• How flinapi.kumohq.in is deployed, from which branch and against which database (decided: lock it down, replace it with a Terraform staging stack, then retire it).
• Which vendors have the NAT egress IPs allowlisted, which webhook URLs are registered in the Xendit and GHL consoles, and who manages each vendor console.
• Who has Metabase accounts, who is admin, and which addresses go on the allowlist.

Release

• How 1.0.0 and 1.1.0 were uploaded (EAS has no submission records), and the signing and push credentials (eas credentials).
• Which Test-user numbers and instructions were given to Apple and Google review.
• The current App Store privacy labels and Play Data Safety answers.
• Whether Adjust's iOS SKAN app verification was completed.
• Target date for the first PH-capable store build, and whether it ships the en-PH overlay (PR #127).

Data, legal, product

• Retention required for KYC images, documents, raw bureau and biometric responses.
• Who handles deletion requests from support chat, and how the 7-business-day promise is met.
• Whether plain-text OTP storage is acceptable to compliance.
• Counsel sign-off on PH data residency.
• Legal review of the Indonesian Terms, Privacy, FAQ and consent text.
• What writes flin-uploads/ktp/ and bank-statement/.
• Who owns the Metabase Test-user exclusion and keeps it in sync with TEST_PHONE_NUMBERS.
• The AsliRI contract (quota/price per call) and where engineers get AsliRI tokens for local testing.
• Where specs and issues live from now on. Recommendation: write new specs to docs/specs/ and keep only scratch tickets local (docs/agents/issue-tracker.md still describes the local-only .scratch/ tracker).
• Whether FLIN's CRM team's GHL workflow creates and moves opportunities in the FLIN App pipeline and calls POST /webhooks/ghl (ID and PH).
• Who at FLIN owns each vendor contract (CLIK, Finfra, ASLI RI, CampaignHQ + WhatsApp sender numbers and Meta templates, GHL locations, Xendit, Adjust, CIBI, Onfido) and who can accept AWS Marketplace / Bedrock model agreements.
• Where CLIK's naming guide and the FTPS credential sheet go (both were only in a developer's Downloads folder).

Material that is not in git

KumoHQ worked with a local-only spec tracker (.scratch/) and design notes (docs/superpowers/); both are gitignored. This PR promotes into the repo every local file that committed code cites, scrubbed of personal data:

• specs/: Adjust integration, ASLI RI SDK integration, CLIK consent upload (with the APPL PDF prototype), GHL CRM sync, GHL pipeline status
• research/onfido-ph-poc.md
• reference/ghl-custom-fields.md
• runbooks/liveness-onboarding-smoke.md

Still local-only on the previous maintainer's machine, for KumoHQ to hand over through a secure channel:

• Every other .scratch/<feature>/spec.md and its issues: Debt Discipline (FLIN-70…79), notifications and the WhatsApp templates handoff, inbox, consultations, due-day picker, loan dedup (6 AFPI ids still unresolved), CLIK classification, portfolio insight. Their substance shipped and the code is the authority, but the specs record intent and open questions. One example: .scratch/debt-discipline/product-questions.md holds open product questions marked "Blocking Phase 2".
• Client documents that may exist nowhere else: the Portfolio Insight prompt PDF (the Google Doc link on the ticket returns 401), the CLIK loan-classification knowledge base, CLIK's naming guide. Also email drafts to CLIK, which contain contact names, so keep them private.
• docs/superpowers/plans|specs (May–July 2026 design history) and .superpowers/sdd/ (agent scratch, low value).
• Local .env files, the gitignored AFPI/CLIK response fixtures (real PII; do not hand these over in plain form) and google-services.json.

TODO(handover): decide where this archive goes, and check it for personal data first.