# PILOT-005

## Guest Interaction Engine (RSVP + Wish)

You are implementing the fifth Pilot Launch feature for the INVEETAIRE platform.

Current Status

✅ Sprint 0 Complete

✅ Sprint 1 Complete

✅ Sprint 2 Complete

✅ Sprint 3 Complete

✅ PILOT-001 Invitation Engine

✅ PILOT-002 Guest Import

✅ PILOT-003 Public Guest Identity Layer

✅ PILOT-004 Public Invitation Rendering

Implement ONLY the Guest Interaction Engine.

Do NOT implement WhatsApp Distribution.

Do NOT implement QR Check-In.

Do NOT implement Attendance Dashboard.

---

# Goal

Allow invited guests to interact with their invitation.

Guests must be able to:

* RSVP
* Leave Wishes

without authentication.

Guest identity is resolved exclusively through guest_token.

---

# Mandatory Reading

Read:

* AI.md
* WORKFLOW.md
* IMPLEMENTATION_ROADMAP.md

Read implementation memories:

* PILOT-001
* PILOT-002
* PILOT-003
* PILOT-004

---

# Files Allowed

Create:

app/modules/Interaction/

```
InteractionController.php

InteractionService.php

InteractionModel.php

InteractionValidator.php

routes.php
```

Modify:

app/modules/PublicInvitation/

```
PublicInvitationController.php

PublicInvitationService.php

PublicInvitationModel.php
```

app/views/public/

```
identity.php
```

No other files.

---

# Functional Scope

Implement two interactions only.

---

## RSVP

Guest can choose:

* Attending
* Not Attending
* Undecided (optional if already supported by schema)

Guest can specify:

* Number of attendees (pax)

Validation:

Minimum 1

Maximum configurable

Save:

RSVP status

Pax

Responded timestamp

---

## Wishes

Guest may leave:

One wish message.

Automatically associated with:

guest_token

↓

guest_id

↓

workspace

Never request guest name.

Never request email.

Never require login.

---

# Interaction Rules

One guest

↓

One RSVP record

Guest may update RSVP.

Guest may edit wish.

Latest submission overwrites previous values.

No duplicate interaction records.

---

# Public Invitation Integration

If guest already responded:

Display:

Current RSVP status

Current Pax

Current Wish

Allow editing.

---

# Controller

Thin.

No SQL.

No business logic.

---

# Service

Owns:

Guest interaction workflow

Validation orchestration

Business rules

Response updates

---

# Model

Owns:

All PDO queries.

Prepared statements only.

Workspace isolation mandatory.

---

# Security

Verify:

guest_token lookup

Workspace isolation

Prepared statements

escape_html()

CSRF

No guest_id exposure

No workspace_id exposure

Invalid guest_token returns 404

---

# Constraints

Do NOT:

* implement WhatsApp
* implement Check-In
* implement Attendance Dashboard
* modify app/core/*
* modify Guest module schema
* modify Invitation module schema
* modify Workspace module
* perform git operations

---

# Verification

Verify:

Guest lookup.

RSVP create.

RSVP update.

Wish create.

Wish update.

Repeated submissions.

Invalid guest_token.

Workspace isolation.

PHP syntax.

---

# Acceptance Criteria

PASS only if:

* Interaction module created.
* RSVP implemented.
* Wish implemented.
* Guest identity reused.
* Update flow works.
* No duplicate records.
* Guest never types their name.
* No SQL outside Model.
* PHP syntax passes.
* Scope respected.

---

# Output

Provide:

1. Files created.
2. Files modified.
3. RSVP workflow.
4. Wish workflow.
5. Update workflow.
6. Security verification.
7. Acceptance checklist.
8. PHP syntax results.

Stop after implementation.

Wait for Human Approval.