Skip to main content

Cross-Repo Execution Rollup — Centralized Web Session

What this is. One coordination/sequencing view across the four per-repo task breakdowns for the Centralized Web Session initiative. It does not re-list implementation tasks — those live in the per-repo breakdowns (referenced by repo + task number below). It sequences the work, surfaces the shared upstream blockers, and exposes the critical path.

Parent RFC (cross-repo orchestration): ./cross-repo.md

Per-repo breakdowns (drill-down):

Reconciled 2026-07-02 (latest review). The real SDK is mekari-account-web-sdk v0.3.0 — a bundled git dependency (no CDN, no @mekari/sdk, no /sm/sdk.js), with iframe host sm.mekari.com/current and exactly 3 statuses (logged_in/logged_out/server_down — no switch_user). This changes two things portfolio-wide: (1) the SDK-distribution blocker (SB-1) and the canonical-path blocker (SB-3) are resolved, so tasks that were gated only on those now move to "startable"; (2) any task built specifically around a switch_user event or a consumer-owned msli/session.refresh() no longer corresponds to real SDK behavior and is removed from this rollup's totals where named below. This file's own numbers are corrected below; the four per-repo task-breakdown files linked above are being reconciled separately and may shift these figures again once that lands (flagged where relevant).

1. Portfolio effort summary​

RepoTotalFEBEQATasksRunnerConfidenceOne-line note
CRM9.55.52.02.06jest (yarn test)lowThree [critical] OQs remain (currentUser/SSO-id source, toggle code, current_company); SDK package distribution resolved (git dependency). An SSO account switch is handled via the normal logged_out sign-out flow — no dedicated switch_user task. Consumer-msli helper removed (SDK-owned, R7); switch_user autologin task removed (R5).
Launchpad FE9.56.50.52.55vitest (pnpm test)lowPilot repo (Rollout step 4); SDK distribution (was Q1) and iframe path resolved. BE reduced 2.0→0.5 (grounded): the Go backend (qontak-launchpad) already exposes sso_id+company_id+company_name on /users/me and live-syncs company from SSO — sync collapses to verification unless a new multi-company switch is required. switch_user task removed (R5); consumer server_down/msli task removed (R7).
Hub Chat v211.56.02.03.58vitest (pnpm test)mediumNuxt 4 legacy srcDir; well-anchored. SDK package name/version/entry (was Q2) resolved. Carries the single Chat-backend current-company BE (2.0) for both itself and Hub (hub-core/hub-service is shared). switch_user handling removed, event map reduced to 3 statuses (R5); _mekari_account/msli grace dropped (R7). Remaining mover: current-company ownership (Q4).
Hub7.05.002.05jest (npm run test)mediumAuth primitives all verified in-repo. BE = 0 (grounded): Hub and Hub Chat v2 are two FEs of the same hub-core/hub-service backend — the current-company BE is built once and counted under Hub Chat v2 (no double-count). SDK event-name contract (was OQ-4) resolved to the 3-status enum; switch_user task removed (R5), server_down fail-open (R7).
GRAND37.523.04.510.024——Recomputed after the latest review SDK reconciliation and BE grounding against the real backends (down from a pre-correction ~58.5). SDK pass removed every switch_user and consumer-msli/server_down task portfolio-wide. BE grounding cut the current-company sync from a naive 8.0 (2.0×4) to 4.5 across 3 distinct backends: CRM 2.0 (qontak.com Rails — genuinely missing, scaffolding exists), Chat 2.0 (hub-core/hub-service, serving both Hub + Hub Chat v2 — counted once), Launchpad 0.5 (qontak-launchpad Go — largely already exposed on /users/me). All per-repo totals reconcile exactly against their source files.

1a. Why "we just install the SDK" is still 37.5 md, not a one-liner​

The literal install is tiny — one git dependency plus a single new Session({ currentUser, interval }) call, roughly 0.5 md in one repo. The other ~37 md is everything the SDK deliberately does not do for you, multiplied across four heterogeneous products:

  • The SDK only reports; it never acts. It emits logged_in / logged_out / server_down and nothing else — no redirect, no token revoke, no company fetch, no UI. Each product must translate those three signals into its own session lifecycle, and that lifecycle differs per repo: CRM store/user.js userLogout → SSO sign_out redirect; Hub / Hub Chat v2 the Doorkeeper revoke chain (hub-core Interactors::Oauths::Revoke); Launchpad the OAuth2 re-auth flow. This event→action wiring is the bulk of the FE days.
  • Ship-dark + instant rollback. A per-product feature flag (centralized_session FE flag + the Kong centralized_web_session metadata) so it toggles per environment without a deploy — required by the rollout, not provided by the SDK.
  • SPA lifecycle integration. Route-guard/middleware await of the SDK's first resolution, plus singleton + destroy() teardown on the app shell so navigation isn't gated on stale state.
  • Current-company sync (the 4.5 BE days). The SDK exposes no company data at all, so keeping each product's company in step with SSO after login is separate product-BE↔SSO work (grounded per-backend in §2).
  • Observability. Per-product SDK-event metrics + alerts (adoption, server_down rate, singleton violations).
  • Tests. Each product needs specs for flag on/off, the three status branches, and the fail-open path.
  • Security / infra. CSP frame-src https://sm.mekari.com, infosec sign-off, and each product domain added to the Session-Manager-side frame-ancestors whitelist at pilot.
  • Four heterogeneous codebases. Two Nuxt 2 apps, one Nuxt 4 app, one Go backend and two Rails backends — each with its own auth model and its own staged, per-repo GA.

So the estimate is "integrate a session signal into four products end-to-end and roll it out safely," not "npm install." The install itself is ~0.5 md of the 37.5; the remaining ~37 is product-specific reaction logic, feature flags, BE company sync, tests, observability, CSP/infra, and per-repo rollout.

2. Shared blockers (the gating contracts)​

These are the upstream backend deliverables relevant to all four repos. They are owned by SSO/Account (BE) (with Platform/SSO on gateway routing and infosec on CSP), exactly as the cross-repo RFC's Cross-Service Responsibility Map states. Two of the three historical blockers below are now resolved by the real SDK (latest review); the third (SB-2, the live service) remains the program's single hard gate.

SB-1 — SDK distribution: RESOLVED (git dependency, no CDN)​

  • What it was thought to be: An unpublished @mekari/sdk package + a account.mekari.com/sm/sdk.js CDN script that SSO/Account needed to publish.
  • What it actually is (resolved by real SDK mekari-account-web-sdk v0.3.0, session.ts/README.md): an existing git dependency — npm install git+https://<user>:<pass>@bitbucket.org/mid-kelola-indonesia/mekari-account-web-sdk#<version>. There is no CDN, no /sm/sdk.js, no <script> tag, no publish step required — each repo adds it to package.json directly.
  • Owner: SSO/Account (BE) — maintains the SDK repo; no publish/CDN action needed from them for FE teams to consume it.
  • Effect on per-repo tasks (now startable, not blocked):
    • CRM → Task 5 (add dependency) is now actionable, not blocked — moved into the startable slice (§3).
    • Launchpad → Task 2 (loader plugin) can wire the real Session constructor now; only true end-to-end verification still waits on SB-2.
    • Hub Chat v2 → Tasks 2 & 4 (SDK boot) can use the real package/version/entry now.
    • Hub → Task 1 (real import) can un-mock now.
  • No longer gates the mocked→real swap the same way it used to — the swap is now a same-day dependency-install change, not a wait on an external publish/CDN pipeline.

SB-2 — Session Manager sm.mekari.com/current + Redis not live (the one remaining hard blocker)​

  • What: The Session Manager iframe page, its dedicated Redis, and the gateway routing to sm.mekari.com. Absent from all FE repos (no service to integration-test against).
  • Owner: SSO/Account (BE) + Platform/SSO (gateway/MAG).
  • Unblocks: the end-to-end integration / verification step in every repo — the point at which the (now real, no-longer-mocked) SDK's postMessage contract, checkTimeout/server_down behavior, and event flow can be exercised against a live session for real. No single per-repo task builds this, but it gates every repo's pilot enable (CRM ordering note 5; Launchpad ch.6; Hub Chat §4.D; Hub ordering note 5).
  • Until then: no repo can run a true end-to-end session test; all server_down/fail-open logic is unit-tested against synthetic events only.

SB-3 — Canonical iframe path: RESOLVED (sm.mekari.com/current)​

  • What it was thought to be: The parent RFC previously named two candidate iframe paths (/sm/current vs /sessionmanager/current), gating CSP frame-ancestors/frame-src and server_down timing.
  • Resolved by real SDK mekari-account-web-sdk v0.3.0 (session.ts default sessionUrl): the canonical host+path is sm.mekari.com/current — not account.mekari.com/sm/current, not /sessionmanager/current.
  • Effect: CSP frame-src/child-src rules for sm.mekari.com can now be finalized and merged (subject to infosec sign-off + each repo's domain being added to the SM-side frame-ancestors whitelist at pilot time) — Launchpad Task 2's CSP posture, Hub Chat v2 Task 8 (nginx-ingress CSP), and each repo's whitelist-add-at-pilot step can proceed on the known host.

Secondary cross-cutting contracts (important, not all-repo-blocking): the current-company endpoint (host/owner/shape — Launchpad Q3, Hub OQ-1, Hub Chat Q4, CRM Q4) blocks each repo's logged_in/company-sync task and carries the only BE days in the portfolio. Grounded against the real backends (latest review), this is 4.5 BE days across 3 distinct backends, not a naive 2.0×4=8.0: CRM 2.0 (qontak.com Rails — no per-session current-company today; SSO token/HTTP scaffolding exists so it's build-on-top, not from zero), Chat 2.0 (hub-core/hub-service — shared by Hub and Hub Chat v2, so counted once; SSO company services + login-time reconciliation already exist), and Launchpad 0.5 (qontak-launchpad Go — sso_id+company already exposed and live-synced on /users/me, so mostly verification). It remains a genuine BE/SSO dependency, independent of the SDK — the SDK exposes no company data at all (R10). The prior "session.refresh() throttle interval (parent OQ-6)" line item is now moot: there is no refresh() API — periodic re-validation is achieved by passing interval (recommended 5*60*1000ms per PRD constraint 6.9) to the Session constructor once, at boot. It is a one-time constructor argument, not a tunable gating acceptance assertions per repo.

3. What can start NOW in parallel (the mocked-or-real-SDK slice)​

Every repo can build its feature-flag + event-router composable/mixin, TDD red-first, today. With SB-1 and SB-3 resolved, this slice now includes adding the real mekari-account-web-sdk git dependency and wiring the real 3-status contract directly — mocking is only needed where a live Session Manager response is required (SB-2). Each repo's spine is independent; four engineers can run in parallel immediately.

RepoParallel-startable nowDay countThe actionable slice (see per-repo breakdown)
CRMTasks 1–5 (Task 6 blocked)6.0plugin shell + toggle gate, event handlers (3 statuses), logout→SSO redirect, RUM observability, add real mekari-account-web-sdk git dependency (SB-1 resolved)
Launchpad FETasks 1, 2*, 3, 5 (Task 6 blocked)7.0toggle composable, SDK loader (real dependency; *partial — live-SM verification still waits on SB-2), logged_out (covers account switch — R5), middleware await/timeout
HubTasks 1, 2, 4, 5 (Task 6 blocked)5.5toggle+boot plugin+mixin scaffold (real dependency now importable), logged_out, server_down fail-open, observability
Hub Chat v2Tasks 1–6, 8* (Task 7 blocked)8.5AppConfig flag, useCentralizedSession (lifecycle), event map (3 statuses), gated client plugin (real dependency now importable), RUM, docs, CSP frame-src at sm.mekari.com (*partial — infosec sign-off + whitelist add pending)
Parallel-startable total27.0of 37.5 grand — the remaining 10.5 days is the per-repo current-company sync contract (CRM Task 6 3.5 · Launchpad Task 6 2.5 · Hub Chat v2 Task 7 3.0 · Hub Task 6 1.5), which is BE-gated and includes the live-Session-Manager (SB-2) integration; no longer "SDK-gated", since SB-1/SB-3 are resolved. (BE portion grounded to 4.5 across 3 backends — §2.)

* Partial: the shell/wiring/tests build now against the real dependency where possible; only the live-Session-Manager integration test or infosec/whitelist sign-off waits on a shared blocker (SB-2).

No cross-repo coordination needed for any of the above. The four repos do not depend on each other — only on the shared upstream BE deps in §2.

All four per-repo task-breakdowns have completed their latest review SDK reconciliation and BE grounding; the day counts above reconcile exactly against their source files (CRM 9.5 · Launchpad 9.5 · Hub 7.0 · Hub Chat v2 11.5 = 37.5 grand).

4. Critical path​

SSO/Account stands up   ──►  each repo wires the real     ──►  each repo
staging SB-2             SDK integration end-to-end            flips flag
sm.mekari.com/current     (mutually INDEPENDENT —               for pilot
(SB-1 SDK + SB-3 path      all 4 in parallel)                   cohort
 already resolved)
  • The dependency chain is upstream-only, and shorter than before. SB-1 (SDK) and SB-3 (iframe path) are resolved. The single remaining hard gate is SSO/Account standing up a staging SB-2 (sm.mekari.com/current). The four repos remain mutually independent of one another — they share only the upstream BE dependency, never each other. The moment a staging Session Manager lands, all four repos can integrate in parallel (no repo waits on another's merge).
  • Critical path = the longest single-repo chain — Hub Chat v2 at 11.5 days (it also carries the shared Chat BE), with CRM and Launchpad FE tied at 9.5 and Hub at 7.0. This is a material change from the pre-correction estimate, where CRM alone was the 17.0-day longest pole driven by a blocked switch_user autologin task (3.5d) that no longer exists (R5) — an SSO account switch is now just the normal logged_out sign-out flow, with no dedicated FE task. With every switch_user and consumer-msli task removed portfolio-wide and the BE grounded, the pacing item across all repos converges on the same real dependency: the current-company sync contract (CRM Task 6, 3.5d; Launchpad Task 6, 2.5d; Hub Chat v2 Task 7, 3.0d; Hub Task 6, 1.5d) — grounded to 4.5 BE days across 3 distinct backends (§2 secondary contracts), not four independent problems.
  • Pilot ordering is set by the parent RFC, not by repo size: Launchpad pilots first (Rollout step 4 "Taking Off"); CRM/Hub/HubChat are step 5 "Next Chapter" (gated per-repo on adding their domain to the CSP frame-ancestors/frame-src whitelist for sm.mekari.com).

5. Per-repo blocked-task index​

Compact map of each repo's blocked / externally-gated task → the OQ/contract that unblocks it. (Full unblock conditions live in each per-repo breakdown's "Skipped stories" table.)

RepoBlocked taskUnblocked by
CRMTask 5 — add mekari-account-web-sdk depRESOLVED — SB-1: real package mekari-account-web-sdk v0.3.0, git dependency (npm install git+...); no CDN/publish needed. No longer blocked — moved to the startable slice (§3).
CRMTask 6 — current_company synccurrent-company contract (CRM Q4 + BE RFC) — still open
Launchpad FETask 2 — SDK loader (real dependency)RESOLVED (SB-1: git dependency mekari-account-web-sdk v0.3.0; SB-3: sm.mekari.com/current) — coding/unit tests unblocked now; full E2E still awaits SB-2 (live staging Session Manager) — partial
Launchpad FETask 6 — logged_in + current-company synccurrent-company endpoint host/owner (Q3) — still open
Hub Chat v2Tasks 2 & 4 — live SDK bootRESOLVED (SB-1: package name/registry/version/entry now known) — coding unblocked; final live-integration verification still awaits SB-2 — partial
Hub Chat v2Task 3 — server_down/msli grace branchMOOT per R7 — the SDK owns msli/server_down fallback internally; the correct behavior is fail-open with no _mekari_account read from hub-chat. (The per-repo file's Q1 framing predates this correction and is pending its own reconciliation.)
Hub Chat v2Task 7 — current-company sync (BE)Q4 (BE ownership; may drop to 0 if FE refetch suffices) — still open
Hub Chat v2Task 8 — CSP frame-src at nginx ingressSB-3 resolved (sm.mekari.com) — still needs infosec sign-off (Q8) + A&L frame-ancestors whitelist add — partial
HubTask 1 — real mekari-account-web-sdk importRESOLVED (SB-1) — coding unblocked now; mocked tests can be replaced with the real dependency
HubTask 6 — logged_in company syncOQ-1 (Hub BE current_company endpoint) + OQ-2 (org-payload flag) — still open
  1. Continue the real-SDK slice in all four repos now, in parallel — the §3 actionable work (27.0 days across the portfolio: CRM Tasks 1–5, Launchpad Tasks 1–3 + 5, Hub Tasks 1, 2, 4, 5, Hub Chat Tasks 1–6 + 8; each repo's current-company sync task is the blocked remainder). Each repo's flag + event-router composable/mixin builds TDD red-first against the real 3-status mekari-account-web-sdk contract where possible (mock only what a live Session Manager response would provide); no cross-repo coordination, no waiting on SB-1/SB-3 anymore.
  2. Push SSO/Account to stand up a staging SB-2 (sm.mekari.com/current + Redis + gateway routing). This is now the single upstream gate for the whole program — escalate it as the #1 cross-team dependency; SB-1 and SB-3 no longer need escalation.
  3. In parallel, close the secondary contract: the current-company endpoint host/owner/shape (Launchpad Q3 / Hub OQ-1 / Hub Chat Q4 / CRM Q4 — likely one shared SSO contract, not four). This is now the only remaining secondary blocker — the earlier switch_user autologin contract (CRM Q1) and the session.refresh() throttle interval (parent OQ-6) are both moot/removed (R5/R6).
  4. Once SB-2 lands, integrate all four repos in parallel — swap the remaining mocked pieces (only the live-SM response paths) for real, then run true end-to-end session tests against staging. No repo blocks another.
  5. Pilot Launchpad first (Rollout step 4 "Taking Off") — flip its flag for the pilot cohort, watch SDK event metrics + server_down rate against threshold.
  6. Then roll CRM / Hub / Hub Chat v2 (Rollout step 5 "Next Chapter"), each gated on adding its domain to the SDK-side CSP frame-ancestors/frame-src whitelist for sm.mekari.com
    • infosec sign-off. All three now sit at the same ~13-13.5-day envelope, paced by their respective current-company contracts rather than by a switch_user chain — start whichever repo's current-company contract resolves first.