# Overnight App Fix Plan — 2026-02-05

## Workflow
- **Kimi K2** = research, investigate, write code, build specs
- **Main session (Opus)** = coordinate, review, deploy, test
- All work targets: `/home/ccuser/rateright-v2/`

## Priority Tasks (ordered)

### P0 — BLOCKER (must fix before launch)

1. **ABR API Integration** — Replace mockCompanyResearch with real ABR lookup
   - Research ABR API (abr.business.gov.au/json/)
   - Build API route: /api/abn-lookup?abn=XXXXXXXXXXX
   - Returns: company name, status, location, type, GST status
   - Wire into contractor signup page

2. **ABN Validation** — Client-side ABN format validation
   - ABN is 11 digits with a specific checksum algorithm
   - Validate before API call
   - Show error if invalid format

3. **Remove ALL mock/fake data** — Audit entire codebase
   - Kill mockCompanyResearch() 
   - Update placeholder examples
   - Remove "built by AI from public records" messaging
   - Replace with "Verified via Australian Business Register"

### P1 — HIGH (security/trust)

4. **Company verification badge system**
   - ABN verified ✓ (checked against ABR)
   - Director match ✓ (future: ASIC check)
   - Unverified companies get flagged

5. **Signup flow hardening**
   - Email verification required before account active
   - Phone SMS verification  
   - Rate limit signups (prevent abuse)

### P2 — IMPORTANT (UX/credibility)

6. **Worker signup ABR integration**
   - Workers who are sole traders have ABNs too
   - Optional ABN field for workers
   - Verify if provided

7. **Error handling & edge cases**
   - ABR API down → graceful fallback
   - Company not found → manual entry allowed but flagged
   - Cancelled/inactive ABN → warn user

### P3 — NICE TO HAVE

8. **ASIC director cross-check** (research only tonight)
9. **NSW Fair Trading builder licence lookup** (research only)
10. **Google Places API for address verification** (research only)