Q3 2026 Roadmap: Social Network, Payments Hardening, and Mobile App

01Q2 Recap: What We Built

Before looking ahead, here is where we stand after Q2.

In May, three services went to production: cdk-file-upload-app for avatar and document uploads, cdk-helpdesk for the admin backend, and cdk-achievement-engine for leaderboards and rankings. The frontend apps caught up — Cometbid Social got profile pages, security settings, and messaging enhancements. The Helpdesk Dashboard got admin user management.

In June, eight services deployed — the biggest month of the year. The full authentication stack (six auth services), user management, and the communication service all went live. The complete signup/signin flow is deployed and demo-ready — email verification, MFA with TOTP and backup codes, Google and GitHub OAuth, session management with device trust, and password reset flows. CloudFront distributions were separated per app, and Cometbid Social migrated to Netlify SSR.

The platform went from 6 services in production (April) to 17 (end of June). The foundation is solid. Now we build on it.

📊

Q2 results: 11 new services deployed, full auth stack live, user management operational, 17 services in production. The foundation is solid.

02July: The Social Network Goes Live

July is the month Cometbid Social becomes real. Three backend services deploy: cdk-social-network, cdk-activity-service, and cdk-member-app.

The social network service is the largest single deployment of the year. It powers profiles, connections, posts, reactions, comments, and shares. The data layer combines DynamoDB for primary storage, Amazon Neptune for graph queries (connections, network traversal, friend-of-friend lookups), and Amazon OpenSearch for full-text search with autocomplete.

The activity service handles notifications and the activity feed. Every engagement — a new follower, a comment on your post, a reaction, a mention — generates an activity event. The feed supports both algorithmic (relevance-based) and chronological views. Users control their notification preferences and can mute specific types of activity.

The frontend work in July is about wiring. The Cometbid Social app already has the UI components from the May catch-up. July connects them to the live backend — real profiles, real connections, real posts, real notifications. Privacy settings and profile visibility controls go live alongside the social features.

Templates for July include new-follower, connection-request, connection-accepted, comment and mention notifications, share notifications, profile view milestones, skill endorsements, and a weekly network activity digest.

🌐

July deploys the social network — profiles, connections, posts, reactions, activity feed, search. Cometbid Social goes from UI mockups to a live social platform.

03August: Payment System Hardening

August is about making the payment infrastructure rock-solid. cdk-billing deployed in July alongside the social network services. Now it needs to be hardened for production-grade financial operations before real money flows through the system.

Stripe integration hardening covers the edge cases that initial deployment did not address. Webhook idempotency ensures duplicate Stripe events do not create duplicate transactions. Payment retry logic handles transient failures with exponential backoff and dead-letter queues for manual review. Refund flows get comprehensive testing — partial refunds, full refunds, refunds on disputed charges, and refund timing relative to payout schedules.

Escrow edge cases are where the complexity lives. What happens when a milestone is disputed after partial delivery? When a project owner disappears mid-contract? When a contributor delivers but the approval window expires? Each scenario gets explicit handling with clear state machines, automated escalation paths, and admin intervention tools.

KYC and identity verification tightening ensures compliance before the platform handles real money at scale. Document verification retry flows, manual review queues for edge cases, and integration with fraud detection signals. The verification gate ensures no one can publish paid projects or withdraw funds without completing identity verification.

A full payment security audit rounds out August. Penetration testing focused on the billing API. Input validation on all monetary amounts. Currency handling edge cases. Race condition testing on concurrent escrow operations. The goal is confidence — when real money flows in Q1 2027, the system has been tested under adversarial conditions.

Canary deployments are introduced this month as part of the hardening effort. Payment services are the first to adopt progressive rollouts — new versions start at 10% traffic, CloudWatch alarms monitor for 5 minutes, green means promote to 100%, red means automatic rollback. If we cannot ship payment code safely, we cannot ship it at all.

Templates for August cover the full billing lifecycle: subscription confirmations, renewals, expirations, payment receipts, failures, refunds, escrow events, invoices, and contract notifications.

💰

August hardens the payment infrastructure — Stripe edge cases, escrow dispute flows, payment retry logic, KYC tightening, and a full security audit. Real money demands real confidence.

04September: Mobile App Development

September is dedicated to building the TCTF mobile app. The target market needs mobile-first access — notifications, messaging, and feed browsing happen on phones, not laptops.

The stack is React Native with Expo for cross-platform iOS and Android development. Expo provides the build infrastructure, over-the-air updates, and native module management without ejecting. The app shares TypeScript types and API contracts with the web frontend through the existing shared-data package.

Core features for the initial release: the social feed (posts, reactions, comments), messaging (real-time with the existing WebSocket infrastructure), notifications (activity feed with filtering), and profile management. These four features cover the daily use case — check what is happening, respond to messages, see who interacted with your content, update your profile.

Push notifications use Firebase Cloud Messaging for both platforms. The existing cdk-activity-service emits events that trigger push notifications through a new delivery channel. Users control which notification types generate pushes versus in-app-only alerts.

Deep linking connects the mobile app to the web experience. Tapping a notification opens the relevant screen. Sharing a profile or post generates a universal link that opens in the app if installed or falls back to the web. Navigation follows React Navigation with a tab-based structure — Feed, Messages, Notifications, Profile.

Testing spans physical devices and simulators. iOS TestFlight and Android internal testing tracks provide early access to the team for dogfooding. Performance profiling ensures the feed renders smoothly on mid-range Android devices, not just flagship iPhones.

Project management deployment (cdk-project-management, cdk-collaboration-service, cdk-user-roles-service) is pushed to Q4. These services require more integration work and the mobile app is a higher priority for the target market.

📱

September builds the mobile app — React Native with Expo, covering feed, messaging, notifications, and profiles. Push notifications via FCM. Deep linking. Testing across iOS and Android devices.

05Canary Deployments: Ship Safely

August introduces canary deployments during payment system hardening — and this is a big deal for production confidence.

Before canary, every deployment was all-or-nothing. A new version replaced the old version for 100% of traffic immediately. If the new version had a bug, 100% of users were affected until the rollback completed.

With canary deployments, a new version starts by serving 10% of traffic. CloudWatch alarms monitor error rates, latency, and business metrics. If the alarms stay green for 5 minutes, traffic shifts to 50%, then 100%. If any alarm triggers, the deployment automatically rolls back — the old version continues serving all traffic, and the team gets an alert.

We introduce canary in August — during payment hardening — because financial services demand the highest deployment confidence. If a billing bug reaches 100% of users, real money is at risk. By September, canary is standard across all services. By launch, the deployment process itself is battle-tested.

This is not optional. After August, all deployments use canary strategy. No exceptions.

🐤

Canary deployments: new versions start at 10% traffic. CloudWatch alarms monitor for 5 minutes. Green → promote to 100%. Red → automatic rollback. Introduced in August during payment hardening, mandatory for all services from September.

06Template Count: On Track for 116

Email templates ship alongside the features they support. Here is where we stand heading into Q3.

Done (Q1-Q2): 27 admin templates, 25 holiday campaigns, ~16 auth and account lifecycle templates, plus achievement templates. Roughly 70 templates in production.

Q3 additions: ~12 social engagement templates (July), ~16 billing and escrow templates (August), ~8 mobile onboarding and push notification templates (September). That is ~36 new templates across Q3.

Q4 adds the remaining templates: project and collaboration templates (October), onboarding drip series (November), launch announcement and feature highlights (December/January).

Total at launch: ~116 templates. Every template follows the design system established in v1.0.0 — 700px flat layout, circular illustrations, VML buttons for Outlook, dark footer with social icons. Every template is registered in the template registry with validation rules.

07Looking Ahead: Q4 Launch and Beyond

The public launch target is Q1 2027 — specifically January. Here is why, and here is what Q4 looks like.

The timeline shifted because two things became clear: payment infrastructure needs to be rock-solid before handling real money at scale, and the mobile app is essential for the target market. Rushing both into a compressed timeline creates exactly the kind of risk that canary deployments are designed to catch. Instead, we invest Q3 in depth — hardening payments and building mobile — and use Q4 for the final feature deployments and launch preparation.

October deploys cdk-project-management, cdk-collaboration-service, and cdk-user-roles-service. The project management system is the collaboration engine — open-source, paid, and internal projects with proposals, task management, and milestone tracking. This is the feature that connects the social network to real work.

November is launch hardening. Canary deployments become mandatory across all 22+ services. Load testing at production scale. Security audit and penetration testing across the full surface. Error handling audit. Monitoring and alerting verification. API documentation and user guides.

December is final QA. Accessibility pass (WCAG 2.1 AA). GDPR data export. Six-language i18n (English, French, Yoruba, Spanish, Igbo, Hausa). Unified notification and privacy preferences. AI features disabled with Coming Soon badges until usage controls are in place. Mobile app submitted to App Store and Play Store review.

January 2027 is the public launch. 25 services in production. Mobile app live. 116+ templates. Social networking, billing, escrow, projects, messaging — all battle-tested and monitored. The full Job Board follows in Q1 2027 post-launch, the academy in Q2.

We will share progress in the monthly newsletters and the Framework Deep Dives series. Subscribe to stay in the loop.

🚀

Q1 2027: Public launch. 25 services. Mobile app. 116+ templates. 6 languages. The timeline shifted to get payments and mobile right. October: projects. November: hardening. December: QA. January: launch.