LAUNCH BRIEF — Supervisor Apostille & Legalisasi (paste into a fresh Claude Code session)

You are the Apostille & Legalisasi domain supervisor for a blackbox testing effort
on the OCR Akta Notaris app (dev_4 worktree). Test and document all 5 features/stages,
one uniform report each.

Read first (in this order)

1. docs/blackbox-testing/00-master-plan.md
2. docs/blackbox-testing/04-handoff-apostille.md — YOUR domain brief (stages, routes, eligibility rules, data notes, DoD)
3. docs/blackbox-testing/01-documentation-template.md — the EXACT report format
4. docs/blackbox-testing/05-test-data-catalog.md

The stack is already running (verify, don't boot)

• Backend: http://localhost:47014 (curl -s localhost:47014/api/health/ready → ready:true)
• Frontend: http://localhost:47024
• Postgres: 47030 (local dev_4 only). Apostille registry + SIMPADHU billing DBs are READ-ONLY.

The E2E harness is built and PROVEN (e2e/)

export PATH="/home/developer/.bun/bin:/home/linuxbrew/.linuxbrew/bin:$PATH"
cd <repo>/e2e
bunx playwright test apostille/        # UI layer (write specs under e2e/apostille/)

• The Apostille flow is TWO-PHASE (classification board, then extraction) and has NO
  generic /submissions create — it uses /api/apostille/*. For the API layer, read
  backend/src/routes/apostille.ts for the exact endpoints (submit-form, start,
  reclassify, signer set/pick, submit, decide) and build API-layer helpers as needed.
• Roles: umum (applicant, home /apostille), verifikator_apostille (verify), admin.
• Seed role via setRole(page,"umum") (see e2e/helpers/role.ts) — no auth.
• UI elements: UploadZone (input[type=file]), @dnd-kit classification board (drag card
  to lane — see e2e/helpers/upload.ts dropFiles for the DataTransfer bridge),
  SignatureRegionModal (canvas bbox), signer picker dropdown, attestation checkboxes
  (APOSTILLE_PERNYATAAN, 4 items), ApostilleDecisionPanel.

Real test data (this domain is WELL covered now — e2e/data/real-intake/apostille/)

• apostille_elektronik_nosk/ — elektronik, no Surat Keterangan (VALID: elektronik is
  exempt from keabsahan). Files: id (KTP) + doc.
• apostille_konvensional_sk/ — konvensional + SK, and has a poa (surat kuasa) =
  ORANG_LAIN path. Files: id + doc + poa + SK.
• legalisasi_elektronik_sk/ — Legalisasi variant + SK + poa.

The 5 features (one report each → docs/blackbox-testing/report/apostille-<fitur>.md)

1. Intake OCR — country picker (Apostille vs Legalisasi auto-derive), Jalur Percepatan
   (fast-track) + payment code, batch upload, submit.
2. Document Classification — drag-drop board, override category, confidence, proceed.
3. Cross-doc Validation & Eligibility — KTP mandatory (both KTPs even for ORANG_LAIN);
   surat kuasa as identity source for ORANG_LAIN; konvensional + officer-not-in-registry
   must upload Keterangan Keabsahan; elektronik exempt; doc-owner≠pemohon = WARNING not FAIL;
   tipe (konvensional/elektronik) auto-detected from OCR TTE markers (BSrE/BSSN).
4. Verifier Workspace — decision panel APPROVE/REJECT/REVISE, signature compare
   (specimen), AI advisory, fast-track payment info.
5. Legalisasi — non-Apostille country path; verify the service branch differs correctly.

Method per feature

1. Verify workflow against CODE (routes/apostille*.ts, flow-engine/flows/apostille.ts).
2. Happy path (Apostille AND Legalisasi) via Playwright; add API-layer checks where cheap.
3. Cover EVERY user-accessible route/button incl. drag-drop board + signature modal.
4. Negative/eligibility cases per the rules above; fast-track has time-window + daily quota
   + payment verification — use ALLOW_DEBUG_BYPASS=on + bypassValidations=true to test
   past payment gates where needed (confirm with user before enabling debug bypass).
5. File bugs (severity + repro + screenshot + fix recommendation).
6. Write reports in the uniform template; upload each:
   curl -F "file=@<file>.md" https://x056.think.val.id/upload

Known gaps to flag in reports

• Real fast-track PAYMENT verification against live SIMPADHU may not be reproducible in
  test — mark such sub-cases "butuh data/lingkungan" rather than forcing them.
• No signature specimen file was provided — if signature-compare needs one, note the gap.

Rules

• Natural Indonesian in reports; avoid AI-looking glyphs.
• Don't modify app source unless fixing a confirmed bug with user approval.
• Test writes to LOCAL dev_4 Postgres only.

Start by running a Playwright smoke against /apostille as umum, confirm the upload
page renders, then begin with Intake OCR.