smoa/TODO.md

# SMOA – Remaining and Optional Tasks

Single list of **remaining** and **optional** work. References: [BACKEND-GAPS-AND-ROADMAP.md](backend/docs/BACKEND-GAPS-AND-ROADMAP.md), [REQUIREMENTS-ALIGNMENT.md](docs/reference/REQUIREMENTS-ALIGNMENT.md), [PLATFORM-REQUIREMENTS.md](docs/reference/PLATFORM-REQUIREMENTS.md), [IMPLEMENTATION_STATUS.md](docs/status/IMPLEMENTATION_STATUS.md).

---

## Backend

### Remaining
- [x] **Prod profile and DB** – Done: application-prod.yml, ddl-auto: validate, Flyway; document PostgreSQL in README.
- [x] **Unit/tenant scoping** – Done: TenantFilter when smoa.tenant.require-unit=true; X-Unit required for /api/v1.
- [x] **Migrations** – Done: Flyway, V1__baseline.sql, baseline-on-migrate.

### Optional
- [x] **Pagination** – Done: @Parameter on PullController for since/limit.
- [x] **ETag / If-None-Match** – Done: ShallowEtagHeaderFilter for /api/v1/*; GET list supports ETag and 304.
- [x] **Request ID** – Done: RequestIdFilter (X-Request-Id, MDC).
- [x] **API versioning** – Doc: backend/docs/API-VERSIONING.md (when to add v2, deprecation).
- [x] **Fix Gradle/Kotlin plugin** – Resolve “plugin already on classpath with unknown version” so `./gradlew :backend:test` runs (root vs backend plugin alignment).

---

## Android app

### Remaining
- [x] **SyncService serialization** – Done: Gson in core:common; serialize* produce JSON bytes.
- [x] **Pull on connect** – Done: PullAPI + BackendPullAPI; startSync() runs pull when online and emits to pullResults (merge by observing modules).
- [x] **API key in app** – Done: BuildConfig.SMOA_API_KEY, passed to BackendSyncAPI (build with -Psmoa.api.key=…).
- [x] **Android 16 doc** – Done: [docs/reference/ANDROID-16-TARGET.md](docs/reference/ANDROID-16-TARGET.md). Actual SDK bump when AGP 8.5+ is adopted.

### Optional
- [ ] **Knox integration** – If required, integrate Knox SDK (e.g. secure storage, VPN) for target devices; Knox API level 39 is supported on primary device.
- [ ] **WebRTC full integration** – Replace WebRTCManager TODOs with actual PeerConnection, audio/video capture, and track setup when library is fully integrated.
- [ ] **Connection quality from WebRTC** – Replace StubConnectionQualityMonitor with implementation that uses WebRTC `getStats()` (bandwidth, RTT, loss) and calls SmartRoutingService/AdaptiveCodecSelector.
- [x] **InfrastructureManager endpoints** – Done: BuildConfig SMOA_STUN_URLS, SMOA_SIGNALING_URLS; SMOAApplication configures STUN and signaling at startup; TURN set programmatically (see modules/communications/README.md).
- [ ] **Screen sharing / file transfer** – Implement TODOs in VideoTransport for screen sharing and file transfer in meetings.
- [ ] **SmartCardReader** – Implement actual card detection, connection, disconnection (or remove if not required).

---

## iOS (last 3 generations)

### Remaining
- [ ] **iOS app project** – Scaffold: [docs/ios/README.md](docs/ios/README.md). Create full app (Swift/SwiftUI) targeting iOS 15, 16, 17.
- [ ] **Keychain for API key** – To implement in iOS app.
- [ ] **Offline queue** – To implement in iOS app (queue sync when offline; retry when online).

### Optional
- [ ] **Face ID / Touch ID** – Optional app unlock or sensitive-action auth.
- [ ] **Certificate pinning** – Optional for API calls.

---

## Web Dapp (Desktop / Laptop + touch)

### Remaining
- [x] **Web scaffold expand** – Done: [docs/web-scaffold/index.html](docs/web-scaffold/index.html) – API info, health, **Pull directory** (GET /api/v1/directory, list display, 304 handling); vanilla JS, no build step. Full SPA (React/Vue/Svelte) remains optional.
- [ ] **Build and host** – Build pipeline and HTTPS hosting when SPA is ready.
- [ ] **CORS** – Configure backend `smoa.cors.allowed-origins` for web app origin(s) in production.

### Optional
- [ ] **Offline** – Service Worker + Cache API; queue sync in IndexedDB/localStorage and flush when online.
- [ ] **PWA** – Installable; optional offline shell.

---

## Infrastructure

### Optional
- [x] **Reverse proxy** – Done: [nginx-smoa.conf.example](docs/infrastructure/nginx-smoa.conf.example), [docker-compose.yml](docker-compose.yml).
- [ ] **TURN / signaling** – Host TURN and/or signaling for WebRTC if not using external services.
- [x] **k8s manifests** – Done: [docs/infrastructure/k8s/backend-deployment.yaml](docs/infrastructure/k8s/backend-deployment.yaml) (Deployment, Service, optional Secret/ConfigMap).

---

## Domain / compliance (optional, by priority)

### High (requires approvals / provider selection)
- [ ] **NCIC/III integration** – NCIC API (CJIS approval required).
- [ ] **ATF eTrace** – ATF eTrace API (federal approval required).
- [ ] **eIDAS QTSP** – Integrate with Qualified Trust Service Provider; qualified signatures, timestamps, EU Trust Lists.

### Medium
- [ ] **Digital signatures** – Full BouncyCastle (or similar) signature generation/verification; certificate chain validation.
- [ ] **XML security** – Apache Santuario; XMLDSig/XMLEnc for AS4 and compliance.
- [x] **CertificateManager.checkRevocationStatus** – Stub clarified: returns UNKNOWN; extend with OCSP/CRL for production.
- [ ] **AS4 full implementation** – Full AS4 message envelope, ebMS 3.0, WS-RM, receipts, CPA (see AS4Service TODOs).
- [x] **Report digital signature** – Done: ReportService.signReports + minimal SHA-256 content-hash signature; full signing via dedicated service when needed.
- [ ] **Electronic seal** – Actual seal verification (ElectronicSealService TODO).

### Lower / future
- [x] **ZeroTrustFramework** – Replaced TODO with “Minimal implementation; extend for production”.
- [x] **ThreatDetection** – Replaced TODOs with “Minimal implementation; extend for production”.
- [ ] **ATF form storage** – Add entities and storage for ATF forms (ATFFormDatabase TODO).
- [ ] **NCIC query storage** – Add entities for NCIC query storage (NCICQueryDatabase TODO).
- [ ] **Compliance gaps** – Address domain-specific gaps in [COMPLIANCE_EVALUATION.md](docs/reference/COMPLIANCE_EVALUATION.md) (eIDAS QES, credential formats, barcode, NIBRS/UCR, etc.) per deployment priorities.

---

## Testing

### Optional
- [ ] **Backend tests** – Fix Gradle plugin so `:backend:test` runs; add more integration tests as needed.
- [ ] **Android unit/integration** – More unit tests for remaining modules; integration tests; UI tests; target 80%+ coverage where practical.
- [ ] **E2E** – End-to-end tests for critical flows (sync, auth, meetings).

---

## Documentation

### Optional
- [x] **README/back-end** – Done: Backend README lists DELETE/GET, rate limit, audit, Docker, tenant (smoa.tenant.require-unit), Request ID, Flyway, PostgreSQL prod, CORS (smoa.cors.allowed-origins), ETag.
- [x] **Timeline** – Done: IMPLEMENTATION_STATUS.md “Next steps (short-term)” section added.

---

## Summary

| Area        | Remaining | Optional |
|------------|-----------|----------|
| Backend    | 0         | 2        |
| Android    | 0         | 6        |
| iOS        | 3         | 2        |
| Web Dapp   | 2         | 2        |
| Infra      | 0         | 2        |
| Domain     | 0         | 12+      |
| Testing    | 0         | 3        |
| Docs       | 0         | 0        |

Use this file as the single checklist for remaining and optional work; link to it from [docs/README.md](docs/README.md) or [IMPLEMENTATION_STATUS.md](docs/status/IMPLEMENTATION_STATUS.md) as needed.