UNPKG

oneie

Version:

Build apps, websites, and AI agents in English. Zero-interaction setup for AI agents (Claude Code, Cursor, Windsurf). Download to your computer, run in the cloud, deploy to the edge. Open source and free forever.

1,622 lines (1,291 loc) 47.7 kB
--- title: Todo Sequence dimension: things primary_dimension: things category: todo-sequence.md tags: ontology, testing related_dimensions: things, events, knowledge, groups, people scope: global created: 2025-11-03 updated: 2025-11-03 version: 1.0.0 ai_context: | This document is part of the things dimension in the todo-sequence.md category. Location: one/things/todo-sequence.md Purpose: Documents one platform: safe & smart build sequence v1.0.0 Related dimensions: events, knowledge For AI agents: Read this to understand todo sequence. --- # ONE Platform: Safe & Smart Build Sequence v1.0.0 **Purpose:** Define the safest, most intelligent way to build ONE so each code addition makes the system progressively smarter, stronger, and more reliable. **Philosophy:** Every feature compounds. Every test adds resilience. Every design decision reduces future errors. **Date:** 2025-10-30 **Version:** 1.0.0 **Status:** Foundation Framework for Safe Scaling --- ## EXECUTIVE SUMMARY: THE 4-PHASE STRATEGY ``` PHASE 1: FOUNDATION HARDENING (Cycle 1-100) ├─ Strengthen existing systems (auth, schema, error handling) ├─ Build shared infrastructure (logging, monitoring, testing) ├─ Lock down data model (validate 6-dimension ontology) └─ Result: Bulletproof base for all future features PHASE 2: INTELLIGENT LAYERING (Cycle 101-200) ├─ Add interconnected features (onboarding teams workspace) ├─ Build with continuous testing (80%+ coverage) ├─ Measure + optimize as you go (performance gates) └─ Result: Features that strengthen each other PHASE 3: SMART INTEGRATIONS (Cycle 201-300) ├─ Connect external systems safely (protocols, APIs, agents) ├─ Build adapter layers (minimize coupling) ├─ Comprehensive integration tests └─ Result: Extensible platform that doesn't break PHASE 4: INTELLIGENT OPERATIONS (Cycle 301-400) ├─ Monitoring + alerting that prevents fires ├─ Progressive rollout (canary blue-green) ├─ Knowledge capture + automation └─ Result: Self-improving operations ``` **Total Cycles:** 400 (not 900) **Why Fewer?** We're building smarter with: - Reusable patterns (don't repeat) - Shared infrastructure (single source of truth) - Continuous optimization (fast iteration) - Quality by design (test as you code) --- ## PHASE 1: FOUNDATION HARDENING (Cycle 1-100) **Goal:** Build unshakeable foundation that all other features depend on ### Why This Matters 80% of production issues come from: - Weak error handling - Inconsistent logging - Untested edge cases - Missing type safety - Unclear requirements Fix these FIRST, not last. --- ### Cycle 1-10: AUDIT EXISTING SYSTEMS **Purpose:** Understand current state before building on top #### Cycle 1: Audit Authentication System ``` DELIVERABLES: [ ] Review Better Auth setup in backend/convex/auth.ts [ ] Document all auth methods supported (email/OAuth/2FA) [ ] Check error handling completeness [ ] Review security headers and CORS config [ ] List any known vulnerabilities [ ] Document auth edge cases (session expiry, token refresh, revocation) SUCCESS CRITERIA: Complete auth specification document All error cases documented Security review completed Ready for auth additions (wallet, social verification) ``` #### Cycle 2: Audit Database Schema (6-Dimension Ontology) ``` DELIVERABLES: [ ] Review schema.ts groups table (check indexes, constraints) [ ] Review schema.ts things table (check properties flexibility) [ ] Review schema.ts connections table (check bidirectionality) [ ] Review schema.ts events table (check event types coverage) [ ] Review schema.ts knowledge table (check vector storage readiness) [ ] Identify missing indexes (performance) [ ] Identify constraint gaps (data integrity) [ ] Identify type issues (any: any patterns) SUCCESS CRITERIA: Schema audit report (300 lines) Performance recommendations (N+1 queries, missing indexes) Type safety improvements (eliminate any: any) Constraint improvements (unique, required fields) ``` #### Cycle 3: Audit Error Handling Strategy ``` DELIVERABLES: [ ] Scan codebase for error handling patterns [ ] Identify inconsistent error types [ ] Check Convex mutation error boundaries [ ] Review frontend error UI (loading, error, success states) [ ] Check async/await exception handling [ ] Document missing error cases SUCCESS CRITERIA: Error handling audit (catalog all patterns) Standardized error types (tagged unions with _tag) Error handling guide for new features Missing error cases identified ``` #### Cycle 4: Audit Logging & Observability ``` DELIVERABLES: [ ] Check existing logging (console.log usage, structure) [ ] Review Convex logs (are they captured?) [ ] Check frontend error tracking (Sentry, similar?) [ ] Identify untracked user actions [ ] Check database query logging [ ] Review performance metrics captured SUCCESS CRITERIA: Logging architecture documented Gaps identified (what's NOT logged) Logging standards defined (format, levels, context) Observability roadmap (monitoring, tracing) ``` #### Cycle 5: Audit Testing Coverage ``` DELIVERABLES: [ ] Run coverage report (web/ and backend/) [ ] Identify untested modules [ ] Review test quality (unit vs integration vs e2e) [ ] Check auth test coverage (all 6 methods) [ ] Check critical paths tested (payment flow, team creation) [ ] Document testing strategy gaps SUCCESS CRITERIA: Coverage report (current: __%) Testing strategy document (unit/integration/e2e) Critical path testing roadmap Mock data factory established ``` #### Cycle 6: Audit API Surface & Documentation ``` DELIVERABLES: [ ] List all Convex queries (public + internal) [ ] List all Convex mutations (public + internal) [ ] Check API documentation completeness [ ] Identify missing type definitions [ ] Review API consistency (naming, patterns) [ ] Check backward compatibility (can we add features without breaking?) SUCCESS CRITERIA: API inventory (all functions documented) API versioning strategy defined Breaking change policy established Type generation working (convex/_generated/) ``` #### Cycle 7: Audit Performance Baselines ``` DELIVERABLES: [ ] Measure page load times (Core Web Vitals) [ ] Measure API response times (p50, p95, p99) [ ] Measure database query times [ ] Check bundle size (web/) [ ] Identify performance bottlenecks [ ] Establish performance targets SUCCESS CRITERIA: Performance baseline report Performance targets (LCP < 2.5s, FID < 100ms, CLS < 0.1) Performance monitoring setup Critical path identified ``` #### Cycle 8: Audit Security Posture ``` DELIVERABLES: [ ] Check authentication security (HTTPS, secure cookies) [ ] Check authorization gaps (can user X access user Y's data?) [ ] Check injection vulnerabilities [ ] Check CSRF protection [ ] Check rate limiting [ ] Check secrets management (.env handling) [ ] Run OWASP Top 10 checklist SUCCESS CRITERIA: Security audit report Vulnerability list (prioritized) Security policy documented Secrets rotation plan ``` #### Cycle 9: Audit Frontend Architecture ``` DELIVERABLES: [ ] Review Astro + React islands architecture [ ] Check component organization (are there patterns?) [ ] Review state management (Convex hooks, context) [ ] Check styling consistency (Tailwind v4) [ ] Review accessibility (WCAG AA compliance) [ ] Document component patterns SUCCESS CRITERIA: Frontend architecture document Component library audit (what exists) Design system consistency check Accessibility audit (WCAG AA status) ``` #### Cycle 10: Audit Backend Architecture ``` DELIVERABLES: [ ] Review service layer organization [ ] Check type safety (TypeScript strict mode) [ ] Review mutation/query separation [ ] Check function composition (small, testable functions) [ ] Review dependency injection [ ] Document backend patterns SUCCESS CRITERIA: Backend architecture document Service layer audit Type safety improvements list Pattern library established ``` --- ### Cycle 11-30: BUILD SHARED INFRASTRUCTURE **Purpose:** Create the foundations all features will build on #### Cycle 11-15: Implement Structured Logging ``` DELIVERABLES: [ ] Create shared logging service: convex/services/logging.ts [ ] Define log levels (DEBUG, INFO, WARN, ERROR, CRITICAL) [ ] Define context structure (userId, groupId, requestId, timestamp) [ ] Implement frontend error tracking integration [ ] Create dashboard for log search (Datadog or similar) [ ] Add request tracing (correlate frontend backend logs) IMPLEMENTATION: // convex/services/logging.ts export type LogLevel = 'DEBUG' | 'INFO' | 'WARN' | 'ERROR' | 'CRITICAL' export async function log( level: LogLevel, message: string, context: { userId?: string groupId?: string requestId?: string action?: string duration?: number error?: Error metadata?: Record<string, unknown> } ) { // Store in DB + send to observability service const entry = { timestamp: Date.now(), level, message, ...context } // Log to Convex events table (for audit trail) // Send to Datadog/New Relic (for monitoring) } SUCCESS CRITERIA: All Convex functions use structured logging Frontend errors logged + tracked Request tracing working (frontend backend) Log search dashboard live 99th percentile query latency < 500ms ``` #### Cycle 16-20: Implement Error Handling Framework ``` DELIVERABLES: [ ] Create standardized error types (tagged unions with _tag) [ ] Implement error boundary components (React) [ ] Create error recovery strategies [ ] Implement retry logic with exponential backoff [ ] Create error reporting UI (user-friendly messages) [ ] Document all error cases for common operations IMPLEMENTATION: // convex/types/errors.ts export type Result<T, E> = | { _tag: 'Ok'; data: T } | { _tag: 'Error'; error: E } export type AppError = | { _tag: 'AuthError'; message: string } | { _tag: 'ValidationError'; field: string; message: string } | { _tag: 'NotFoundError'; resource: string; id: string } | { _tag: 'ForbiddenError'; message: string } | { _tag: 'RateLimitError'; retryAfter: number } | { _tag: 'NetworkError'; message: string } | { _tag: 'InternalError'; message: string } // Every mutation returns Result<Success, AppError> export const mutations = { createUser: mutation({ handler: async (ctx, args): Promise<Result<UserId, AppError>> => { // Implementation } }) } SUCCESS CRITERIA: All mutations return Result<T, AppError> Error UI components created (modal, toast, inline) Error recovery strategies documented No uncaught exceptions in logs (99.9%) ``` #### Cycle 21-25: Implement Validation Framework ``` DELIVERABLES: [ ] Create input validation layer (schema validation) [ ] Implement type-safe validators [ ] Create error messages that help users fix mistakes [ ] Implement sanitization (SQL injection, XSS prevention) [ ] Add file upload validation (size, type, content) [ ] Document validation rules for all inputs IMPLEMENTATION: // convex/services/validation.ts export function validateEmail(email: string): Result<string, AppError> { if (!email.includes('@')) { return { _tag: 'Error', error: { _tag: 'ValidationError', field: 'email', message: 'Invalid email format' }} } return { _tag: 'Ok', data: email.toLowerCase() } } // Apply to mutations export const signup = mutation({ args: { email: v.string(), password: v.string() }, handler: async (ctx, args) => { const emailResult = validateEmail(args.email) if (emailResult._tag === 'Error') return emailResult // Continue with validated email } }) SUCCESS CRITERIA: All inputs validated before processing Clear error messages guide users No injection vulnerabilities (code review) File uploads validated (size, type, content scan) ``` #### Cycle 26-30: Implement Testing Infrastructure ``` DELIVERABLES: [ ] Set up test database (isolated from production) [ ] Create mock data factory (fixtures for all entity types) [ ] Implement test helpers (createUser, createGroup, etc) [ ] Set up test environment (.env.test) [ ] Create test utilities (assert, expect, matchers) [ ] Document testing best practices IMPLEMENTATION: // test/fixtures.ts export async function createTestUser( ctx: TestContext, overrides?: Partial<User> ): Promise<User> { // Create user with sensible defaults } export async function createTestGroup( ctx: TestContext, overrides?: Partial<Group> ): Promise<Group> { // Create group with sensible defaults } // Usage in tests describe('User registration', () => { it('should create user with email', async () => { const user = await createTestUser(ctx) expect(user.email).toBe(defined) }) }) SUCCESS CRITERIA: Test database isolated from production Mock data factory for all entity types Test helpers reduce test code duplication 80%+ coverage of critical paths Test suite runs < 30 seconds ``` --- ### Cycle 31-50: HARDEN CORE DATA MODEL **Purpose:** Ensure 6-dimension ontology is bulletproof #### Cycle 31-35: Strengthen Schema Integrity ``` DELIVERABLES: [ ] Add NOT NULL constraints to required fields [ ] Add UNIQUE constraints where needed (email, username) [ ] Add CHECK constraints for enum values [ ] Add foreign key constraints (groupId must exist) [ ] Create database migrations script [ ] Write schema validation tests SUCCESS CRITERIA: Database constraints prevent invalid data Migrations tracked + reversible Schema change process documented No orphaned records possible ``` #### Cycle 36-40: Implement Type Safety ``` DELIVERABLES: [ ] Eliminate all 'any' types in backend [ ] Create strict types for all entity properties [ ] Implement discriminated unions for polymorphic types [ ] Enable TypeScript strict mode everywhere [ ] Run type checking in CI/CD [ ] Document type system architecture SUCCESS CRITERIA: Zero 'any' types in critical code TypeScript strict: true passes everywhere Type checking in CI/CD (fails build if types fail) Runtime type validation (zod or similar) ``` #### Cycle 41-45: Implement Data Consistency Rules ``` DELIVERABLES: [ ] Define data consistency rules (invariants) [ ] Implement guards before write operations [ ] Create consistency check mutations [ ] Implement eventual consistency handling [ ] Document conflict resolution strategies [ ] Test consistency under concurrent writes CONSISTENCY RULES: Every thing must belong to a group Every connection must have both parties Every event must have an actor (or system) Group hierarchy must be acyclic (no circular parents) Person role must be one of: platform_owner, org_owner, org_user, customer Status must be: draft, active, published, archived SUCCESS CRITERIA: Data consistency rules documented Guards prevent rule violations Consistency checks pass 99.9% of writes Recovery procedure for violations documented ``` #### Cycle 46-50: Implement Access Control (AuthZ) ``` DELIVERABLES: [ ] Define role-based access control (RBAC) [ ] Implement group scoping (users can only see own group data) [ ] Create permission checks for all mutations [ ] Implement hierarchical permissions (parent groups access child groups) [ ] Create audit log for access changes [ ] Test authorization thoroughly (permission matrix) AUTHORIZATION RULES: platform_owner can access all groups org_owner can access own organization + child groups org_user can access own group (with role restrictions) customer can access own account Can't modify other user's data without permission Can't access parent/child group data without explicit permission SUCCESS CRITERIA: All mutations check authorization first Permission matrix tested (40+ test cases) No privilege escalation vulnerabilities Audit log shows all access changes ``` --- ### Cycle 51-70: OPTIMIZE PERFORMANCE FOUNDATIONS **Purpose:** Ensure system performs well BEFORE adding features #### Cycle 51-55: Implement Query Optimization ``` DELIVERABLES: [ ] Add database indexes (analyze slow queries) [ ] Implement pagination (prevent N+1 queries) [ ] Add caching layer (Convex caching + frontend) [ ] Optimize API payloads (only send needed fields) [ ] Implement request deduplication [ ] Profile database queries (find bottlenecks) SUCCESS CRITERIA: P95 query latency < 100ms All lists paginated (limit results) Cache hit rate > 60% No N+1 queries in critical paths Bundle size < 200KB (compressed) ``` #### Cycle 56-60: Implement Frontend Performance ``` DELIVERABLES: [ ] Code split components (only load used code) [ ] Lazy load below-fold content [ ] Optimize images (WebP, responsive sizing) [ ] Minimize blocking scripts [ ] Implement service worker (offline support) [ ] Profile Core Web Vitals (LCP, FID, CLS) SUCCESS CRITERIA: Lighthouse score > 90 LCP < 2.5s (Core Web Vital) FID < 100ms (Core Web Vital) CLS < 0.1 (Core Web Vital) First Contentful Paint < 1.5s ``` #### Cycle 61-65: Implement Caching Strategy ``` DELIVERABLES: [ ] Define cache layers (CDN, server, browser) [ ] Implement cache invalidation (TTL-based, event-based) [ ] Create cache warm-up strategy [ ] Implement distributed caching (Redis if needed) [ ] Document cache-busting strategy [ ] Monitor cache effectiveness SUCCESS CRITERIA: CDN cache hit rate > 80% Browser cache covers > 90% of requests Cache invalidation < 5 seconds Staleness never exposed to users ``` #### Cycle 66-70: Implement Monitoring & Alerting ``` DELIVERABLES: [ ] Set up metrics collection (Prometheus, Datadog) [ ] Create dashboards (performance, errors, uptime) [ ] Implement alerting (page when bad things happen) [ ] Set up incident response process [ ] Create runbooks for common issues [ ] Track SLOs (99.9% uptime target) SUCCESS CRITERIA: Real-time dashboards monitoring system Alerts for: errors > 1%, latency > 1s, downtime On-call rotation defined Runbooks for top 5 incidents Uptime tracking (current: __%) ``` --- ### Cycle 71-90: BUILD DEVELOPMENT PRACTICES **Purpose:** Ensure team can build safely and quickly #### Cycle 71-75: Implement Testing Standards ``` DELIVERABLES: [ ] Create unit test guidelines (each function tested) [ ] Create integration test guidelines (services work together) [ ] Create e2e test guidelines (user workflows) [ ] Set minimum coverage thresholds (80% critical paths) [ ] Automate testing in CI/CD (blocks merge if tests fail) [ ] Create test documentation SUCCESS CRITERIA: All new code has tests before merge CI/CD runs full test suite (< 5 minutes) Coverage dashboard shows > 80% critical paths Test failures block production deployment ``` #### Cycle 76-80: Implement Code Review Process ``` DELIVERABLES: [ ] Create code review checklist [ ] Define review criteria (quality, security, performance) [ ] Set up GitHub branch protection (require 1+ review) [ ] Create automated checks (linting, type checking, tests) [ ] Document review SLA (reviews within 24 hours) [ ] Create knowledge capture from reviews SUCCESS CRITERIA: All PRs reviewed before merge Automated checks catch common issues Review comments documented (why this decision) No merges with failing checks ``` #### Cycle 81-85: Implement Documentation Standards ``` DELIVERABLES: [ ] Create API documentation template [ ] Create function documentation template [ ] Create architecture decision records (ADRs) [ ] Implement code comment standards [ ] Create README for each major module [ ] Link documentation to code (docstrings) SUCCESS CRITERIA: All public functions documented Complex logic has explanatory comments Architecture decisions recorded New team members can onboard via docs ``` #### Cycle 86-90: Implement Release Standards ``` DELIVERABLES: [ ] Create release checklist (automated where possible) [ ] Implement semantic versioning (major.minor.patch) [ ] Create changelog (auto-generate from commits) [ ] Implement deployment process (staging production) [ ] Create rollback procedure (for emergencies) [ ] Document release SLA (production deployment window) SUCCESS CRITERIA: Releases follow semantic versioning Changelog auto-generated from commit messages Deployment process documented + automated Rollback takes < 5 minutes Production deploys during business hours only ``` --- ### Cycle 91-100: DOCUMENT FOUNDATION **Purpose:** Capture what we've learned, so others can benefit #### Cycle 91-95: Create System Documentation ``` DELIVERABLES: [ ] Architecture overview (how components connect) [ ] Data model documentation (6-dimension ontology) [ ] API documentation (all endpoints with examples) [ ] Service layer documentation (Effect.ts patterns) [ ] Frontend architecture (Astro + React patterns) [ ] Deployment architecture (where runs, how scales) LOCATION: /one/knowledge/system-architecture.md (comprehensive) /one/things/architecture-diagram.md (visual) Backend code: JSDoc comments for all functions SUCCESS CRITERIA: New developer can understand system in 2 hours Architecture decisions explained (why this way) All key files have rundown Diagrams show component interactions ``` #### Cycle 96-100: Capture Lessons Learned ``` DELIVERABLES: [ ] Document what worked well (replicate this) [ ] Document what was hard (how to avoid) [ ] Document surprises (why did this happen?) [ ] Document future improvements (addressed later) [ ] Create decision journal (why we chose X over Y) [ ] Share with team (lessons drive future decisions) LOCATION: /one/events/foundation-hardening-lessons.md EXAMPLE ENTRIES: Structured logging pays off immediately (saves hours debugging production issues) Error handling framework prevents bugs (catch edge cases in code review, not production) ⚠️ Type safety takes discipline (need to push back on 'any' types) 💡 Performance testing early prevents rewrites (measure baselines, optimize with data) 💡 Test fixtures save time (good fixtures faster test writing) SUCCESS CRITERIA: Lessons document captures 20+ insights Team reviews + discusses lessons Lessons inform design of next phases Metrics show phase improved quality ``` --- ## PHASE 2: INTELLIGENT LAYERING (Cycle 101-200) **Goal:** Add interconnected features that strengthen each other **Philosophy:** Don't add isolated features. Build features that depend on strong foundations. --- ### Cycle 101-130: BUILD CREATOR ONBOARDING **Prerequisite:** Foundation phase complete (Cycle 1-100) #### Cycle 101-110: Define Onboarding Requirements ``` (Same as todo-onboard.md Cycle 1-10) Define personas, map to ontology, review auth, define flow stages ``` #### Cycle 111-120: Implement Backend (Schema + Services) ``` DELIVERABLES: [ ] Add person.role field (platform_owner, org_owner, org_user, customer) [ ] Add creator thing type with properties (bio, avatar, skills) [ ] Add onboarding_status (incomplete, in_progress, complete) [ ] Create mutateCompleteOnboarding (updates status, creates workspace) [ ] Create queryOnboardingProgress (for progress UI) [ ] Implement email verification flow (Resend integration) [ ] Implement wallet connection (viem/wagmi integration) REQUIREMENTS FROM FOUNDATION PHASE: Use structured logging for all operations Return Result<T, AppError> from all mutations Validate all inputs (email format, username uniqueness) Check authorization (user can only modify own data) Update audit log (track onboarding progress) Write tests for all functions (80%+ coverage) Profile query performance (optimize slow queries) SUCCESS CRITERIA: All onboarding mutations tested Email verification working Wallet connection working P95 query latency < 100ms ``` #### Cycle 121-130: Implement Frontend (Components + Pages) ``` DELIVERABLES: [ ] Create SignupForm component [ ] Create EmailVerificationPage [ ] Create ProfileCompletionForm [ ] Create WorkspaceSetupFlow [ ] Create WalletConnectionModal [ ] Create OnboardingProgressBar [ ] Create OnboardingCompletionPage REQUIREMENTS FROM FOUNDATION PHASE: Use error boundary components Show error UI for validation errors Implement retry logic (network errors) Implement loading states (show spinner) Add accessibility (WCAG AA labels, keyboard nav) Test all workflows Profile performance (optimize LCP, CLS) SUCCESS CRITERIA: All onboarding pages tested (e2e) Lighthouse score > 90 (before caching) Accessibility audit passes (WCAG AA) Mobile responsive (works on small screens) ``` --- ### Cycle 131-160: BUILD TEAM MANAGEMENT **Prerequisite:** Onboarding complete #### Cycle 131-140: Define Team Requirements ``` (Same as todo-onboard.md Cycle 5) Define workspace as group, roles, team features ``` #### Cycle 141-150: Implement Backend (Schema + Services) ``` DELIVERABLES: [ ] Add group_member connection type [ ] Add role field (owner, admin, editor, viewer) [ ] Create inviteTeamMember mutation [ ] Create acceptTeamInvitation mutation [ ] Create changeTeamMemberRole mutation [ ] Create removeTeamMember mutation [ ] Create queryTeamMembers [ ] Implement pending invitation tracking REQUIREMENTS FROM FOUNDATION PHASE: Check authorization (only owner can change roles) Validate email before inviting Prevent circular invitations Send invitation email via Resend Track invitations in audit log Write comprehensive tests Handle edge cases (invite existing member, revoke pending) SUCCESS CRITERIA: Team member operations tested Authorization checks prevent privilege escalation Email invitations sent reliably Pending invitations work smoothly ``` #### Cycle 151-160: Implement Frontend (Components + Pages) ``` DELIVERABLES: [ ] Create TeamMembersPage [ ] Create InviteTeamMemberForm [ ] Create TeamMemberCard (show role, actions) [ ] Create RoleChangeDialog [ ] Create RemoveTeamMemberDialog [ ] Create PendingInvitationsSection [ ] Create AcceptInvitationPage REQUIREMENTS FROM FOUNDATION PHASE: Show loading + error states Confirm dangerous actions (remove member) Show success feedback (member added) Implement retry on network error Test all workflows SUCCESS CRITERIA: Team management UI tested (e2e) All features working Mobile responsive ``` --- ### Cycle 161-200: BUILD ANALYTICS FOUNDATION **Prerequisite:** Onboarding + teams complete **Purpose:** Enable features to measure themselves #### Cycle 161-170: Implement Event Tracking ``` DELIVERABLES: [ ] Create analytics service that logs all events [ ] Track user actions (signup, login, create product, etc) [ ] Track system actions (payments processed, errors) [ ] Implement event batching (reduce API calls) [ ] Store events in Convex events table [ ] Create event query APIs REQUIREMENTS FROM FOUNDATION PHASE: Use structured logging (context, metadata) Track timing of operations Correlate events with user/group Implement data retention (delete old events) SUCCESS CRITERIA: All important events tracked Event data captured with proper context No personally identifiable info logged (privacy) Events queryable for analysis ``` #### Cycle 171-180: Implement Analytics Queries ``` DELIVERABLES: [ ] Create queryUserMetrics (signups, logins, activity) [ ] Create queryGroupMetrics (team size, activity) [ ] Create querySystemMetrics (errors, latency, uptime) [ ] Create queryConversionFunnel (signup create product sell) [ ] Create queryChurnRate (who stopped using platform) [ ] Implement time-series queries (graph over time) REQUIREMENTS FROM FOUNDATION PHASE: Cache analytics queries (expensive to compute) Return in format ready for charting Include 95% confidence intervals (for small samples) SUCCESS CRITERIA: Analytics queries perform < 500ms All important metrics tracked Queries return ready-to-chart data ``` #### Cycle 181-190: Implement Analytics UI ``` DELIVERABLES: [ ] Create creator analytics dashboard [ ] Show signup metrics [ ] Show team size + growth [ ] Show activity trends [ ] Create system analytics dashboard (admin only) [ ] Show platform health metrics [ ] Show error rates, uptime, performance REQUIREMENTS FROM FOUNDATION PHASE: Design for accessibility (color-blind friendly) Test with real data (not mock) Optimize chart rendering (many data points) SUCCESS CRITERIA: Analytics UI loads < 2s Charts render smoothly Mobile responsive ``` #### Cycle 191-200: Capture Learning & Metrics ``` DELIVERABLES: [ ] Document metrics we're tracking (why each one) [ ] Document how metrics inform product decisions [ ] Create insights from first users (what patterns?) [ ] Document unexpected findings [ ] Plan improvements based on metrics LOCATION: /one/events/phase2-analytics-insights.md EXAMPLE INSIGHTS: 📊 Onboarding completion rate: 85% (higher than expected, good UX) 📊 Team invitations: 40% accept rate (need to improve email, timing, or value prop) 📊 Wallet connections: 20% of creators (consider making more valuable) SUCCESS CRITERIA: Analytics dashboard running smoothly Metrics inform product decisions Insights documented for future reference ``` --- ## PHASE 3: SMART INTEGRATIONS (Cycle 201-300) **Goal:** Connect external systems safely without breaking core platform --- ### Cycle 201-230: BUILD PAYMENT INFRASTRUCTURE (X402) **Prerequisite:** Foundation + onboarding complete #### Cycle 201-210: Design Payment Flow ``` DELIVERABLES: [ ] Define payment sequence (on blockchain) [ ] Integrate viem for blockchain transactions [ ] Implement payment status tracking (pending confirmed finalized) [ ] Create error recovery (what if transaction fails?) [ ] Implement payment verification (confirm funds received) [ ] Create payment audit log SUCCESS CRITERIA: Payment flow documented Error cases identified + handled Blockchain integration tested Payment verification reliable (99.9%) ``` #### Cycle 211-220: Implement Payment Mutations ``` DELIVERABLES: [ ] Create initiatePayment mutation [ ] Create confirmPayment mutation [ ] Create refundPayment mutation [ ] Create queryPaymentStatus [ ] Implement webhook for blockchain events [ ] Create payment reconciliation service REQUIREMENTS FROM FOUNDATION PHASE: Return Result<PaymentId, AppError> Validate payment amount (not zero, reasonable) Check authorization (user can pay with own wallet) Log all payment attempts (audit trail) Write tests for payment flows (happy path + errors) Implement idempotency (don't double-charge) SUCCESS CRITERIA: Payment mutations reliable (no lost payments) Blockchain transactions verified Refunds working smoothly Audit log complete ``` #### Cycle 221-230: Implement Payment UI ``` DELIVERABLES: [ ] Create PaymentForm component [ ] Create PaymentStatusPage [ ] Create PaymentHistoryPage [ ] Create RefundRequestForm [ ] Implement payment retry (if failed) [ ] Show transaction details (blockchain explorer link) REQUIREMENTS FROM FOUNDATION PHASE: Show clear loading states Handle blockchain latency (payment takes time) Show user-friendly error messages Implement retry with exponential backoff SUCCESS CRITERIA: Payment UI tested (happy path + errors) Mobile responsive Users understand transaction status ``` --- ### Cycle 231-260: BUILD PRODUCT MANAGEMENT **Prerequisite:** Payment infrastructure complete #### Cycle 231-240: Design Product Schema ``` DELIVERABLES: [ ] Define product thing type [ ] Add properties: name, description, price, category [ ] Define product status: draft published archived [ ] Create connection types: creator→owns→product [ ] Define product categories (courses, templates, memberships) [ ] Create schema validation (all required fields present) SUCCESS CRITERIA: Product schema supports all product types Products scoped to creator's group Products queryable by category ``` #### Cycle 241-250: Implement Product Operations ``` DELIVERABLES: [ ] Create createProduct mutation [ ] Create updateProduct mutation [ ] Create publishProduct mutation [ ] Create deleteProduct mutation [ ] Create queryCreatorProducts [ ] Create queryPublishedProducts (public read) [ ] Implement product search (by name, category) REQUIREMENTS FROM FOUNDATION PHASE: Validate product data (name not empty, price > 0) Check authorization (only creator can modify own products) Implement soft delete (archive instead of delete) Log product changes (audit trail) Write comprehensive tests SUCCESS CRITERIA: Product CRUD operations tested Authorization prevents unauthorized changes Search performs < 500ms ``` #### Cycle 251-260: Implement Product UI ``` DELIVERABLES: [ ] Create ProductForm (create + edit) [ ] Create ProductCard (display) [ ] Create ProductPage (public view) [ ] Create CreatorProductsPage (dashboard) [ ] Create ProductSearchUI [ ] Create PublishProductDialog REQUIREMENTS FROM FOUNDATION PHASE: Form validation matches backend Show loading + error states Confirm destructive actions SUCCESS CRITERIA: Product UI tested Mobile responsive Users can create, edit, publish products ``` --- ### Cycle 261-290: BUILD CHECKOUT & ORDERS **Prerequisite:** Products + payments complete #### Cycle 261-270: Design Order Schema ``` DELIVERABLES: [ ] Define order thing type [ ] Add properties: product_id, customer, amount, status [ ] Define order status: pending paid fulfilled completed [ ] Create connection: customer→purchased→product [ ] Track timestamps: created, paid, fulfilled, completed [ ] Track fulfillment details (delivery, invoice) SUCCESS CRITERIA: Order schema supports all order types Orders can be filtered by status Orders can be searched by customer/product ``` #### Cycle 271-280: Implement Order Operations ``` DELIVERABLES: [ ] Create createOrder mutation [ ] Create processOrderPayment mutation [ ] Create fulfillOrder mutation [ ] Create queryCustomerOrders [ ] Create queryCreatorOrders [ ] Create orderReconciliation (verify payments match orders) [ ] Implement refund logic (reverse order + process refund) REQUIREMENTS FROM FOUNDATION PHASE: Validate order (product exists, customer valid) Check authorization (creator can fulfill own orders) Implement order confirmation email Track fulfillment (order can't complete without receipt) Write tests for order lifecycle SUCCESS CRITERIA: Orders created + paid correctly Fulfillment tracked Refunds processed smoothly Order reconciliation catches discrepancies ``` #### Cycle 281-290: Implement Checkout & Order UI ``` DELIVERABLES: [ ] Create ShoppingCartComponent [ ] Create CheckoutPage [ ] Create OrderConfirmationPage [ ] Create CreatorOrdersPage [ ] Create CustomerOrdersPage [ ] Create OrderTrackingUI (for physical orders) REQUIREMENTS FROM FOUNDATION PHASE: Secure checkout (HTTPS, validated input) Show order summary before payment Handle payment errors gracefully Send confirmation emails SUCCESS CRITERIA: Checkout tested end-to-end Orders created + tracked Mobile responsive Customers understand order status ``` --- ### Cycle 291-300: CAPTURE INTEGRATION LESSONS ``` DELIVERABLES: [ ] Document payment integration learnings [ ] Document product management patterns [ ] Document order processing patterns [ ] Document error recovery strategies [ ] Create runbooks for payment issues [ ] Plan improvements based on first orders LOCATION: /one/events/phase3-integration-lessons.md EXAMPLE INSIGHTS: 💡 Blockchain transactions slow (5-60s) Show clear status messages + polling 💡 Order reconciliation important Automatic checks catch payment bugs 💡 Refund requests need approval Prevent fraud, build trust 💡 Email confirmations reduce support Cheap way to reduce questions SUCCESS CRITERIA: Payment system handling real orders Products being created + sold Revenue flowing to creators Lessons inform Phase 4 design ``` --- ## PHASE 4: INTELLIGENT OPERATIONS (Cycle 301-400) **Goal:** Build systems that prevent problems + enable growth --- ### Cycle 301-320: MONITORING & INCIDENT MANAGEMENT #### Cycle 301-310: Build Comprehensive Monitoring ``` DELIVERABLES: [ ] Set up metrics collection (all key operations) [ ] Create system health dashboard [ ] Implement alerting (page on critical errors) [ ] Create incident tracking (log issues) [ ] Build runbooks (how to fix common problems) [ ] Implement SLO tracking (uptime, latency) ALERTS: 🚨 Error rate > 1% Page immediately 🚨 Payment failures > 5% Investigate 🚨 Blockchain gas prices > threshold Notify 🚨 Database latency > 1s Check queries 🚨 API latency p95 > 1s Investigate 🚨 Downtime > 5 minutes Manual intervention SUCCESS CRITERIA: Real-time dashboards Alerts accurate (no false positives) Incidents tracked with root cause SLOs monitored + reported ``` #### Cycle 311-320: Implement Incident Response ``` DELIVERABLES: [ ] Create incident response process [ ] Define severity levels (critical, high, medium, low) [ ] Set response time SLAs (critical: 5 min, high: 30 min) [ ] Create blameless postmortems (learn from incidents) [ ] Track incident metrics (frequency, resolution time) [ ] Plan improvements from incidents SUCCESS CRITERIA: Incidents resolved quickly Root causes identified + fixed Team learns from incidents (no repeat) System stability improves over time ``` --- ### Cycle 321-340: SECURITY HARDENING #### Cycle 321-330: Implement Security Best Practices ``` DELIVERABLES: [ ] Implement rate limiting (prevent abuse) [ ] Implement DDoS protection (Cloudflare) [ ] Implement secrets rotation (keys, tokens) [ ] Implement SQL injection prevention [ ] Implement XSS prevention (sanitize inputs) [ ] Implement CSRF protection SUCCESS CRITERIA: No security vulnerabilities (code review) Rate limiting prevents abuse Secrets never logged User data encrypted at rest ``` #### Cycle 331-340: Implement Security Audit ``` DELIVERABLES: [ ] Run OWASP Top 10 checklist [ ] Review authentication security [ ] Review authorization security [ ] Test for injection vulnerabilities [ ] Test for data leaks [ ] Create remediation plan for any issues SUCCESS CRITERIA: No critical vulnerabilities All audit findings documented Fixes tracked + prioritized ``` --- ### Cycle 341-360: SCALABILITY & PERFORMANCE #### Cycle 341-350: Optimize for Growth ``` DELIVERABLES: [ ] Analyze performance bottlenecks [ ] Optimize database queries (indexes, caching) [ ] Optimize API response times [ ] Implement CDN for static assets [ ] Load test the system (how many users can it handle?) [ ] Plan scaling strategy (when to add infrastructure) SUCCESS CRITERIA: System handles 10x current load Performance degrades gracefully Scaling plan documented Can add resources without code changes ``` #### Cycle 351-360: Build for Reliability ``` DELIVERABLES: [ ] Implement automated backups [ ] Implement database replication [ ] Implement failover strategy [ ] Create disaster recovery plan [ ] Test recovery procedures (annual) [ ] Document all critical infrastructure SUCCESS CRITERIA: Data backed up hourly Can recover from any failure < 1 hour No data loss possible Disaster recovery plan tested ``` --- ### Cycle 361-380: DEVELOPER EXPERIENCE #### Cycle 361-370: Build Developer Tools ``` DELIVERABLES: [ ] Create local development setup (docker-compose?) [ ] Create database seeding (test data) [ ] Create API testing tools (Postman, CLI) [ ] Create debugging tools (logs, traces) [ ] Create performance profiling tools [ ] Document development workflow SUCCESS CRITERIA: New developer can develop locally in < 30 min All tools open source Developer docs are current ``` #### Cycle 371-380: Build Deployment Tools ``` DELIVERABLES: [ ] Implement automated testing in CI/CD [ ] Implement automated deployment [ ] Implement blue-green deployments (zero downtime) [ ] Implement rollback capability [ ] Create deployment dashboard [ ] Document deployment process SUCCESS CRITERIA: Deployments happen multiple times daily Zero-downtime deployments Rollback takes < 5 minutes Deployment log shows what changed ``` --- ### Cycle 381-400: KNOWLEDGE & CONTINUOUS IMPROVEMENT #### Cycle 381-390: Capture System Knowledge ``` DELIVERABLES: [ ] Create architecture documentation (comprehensive) [ ] Create operational runbooks (how to fix things) [ ] Create troubleshooting guide (common issues) [ ] Create performance tuning guide [ ] Create security guide (for developers) [ ] Create decision log (why did we choose X?) LOCATION: /one/knowledge/ (comprehensive system docs) /one/things/ (specifications) /one/events/ (decisions + lessons learned) SUCCESS CRITERIA: All knowledge documented Knowledge is current (reviewed monthly) Team uses knowledge (not just stored) New developers learn from knowledge base ``` #### Cycle 391-400: Plan Continuous Improvement ``` DELIVERABLES: [ ] Review metrics (what's working, what's not) [ ] Identify top 5 performance bottlenecks [ ] Identify top 5 reliability issues [ ] Plan improvements for next phase [ ] Estimate effort (quick wins vs major rewrites) [ ] Prioritize (impact vs effort) OUTPUT: /one/things/todo-next-phase.md (plan for features, fixes, improvements) SUCCESS CRITERIA: System is stable + performant Improvement roadmap is clear Team has time to address technical debt Quality metrics are improving over time ``` --- ## SUCCESS METRICS: MEASURING WHAT MATTERS At the end of 400 cycles (the complete 4-phase build): ### System Quality Metrics | Metric | Target | Actual | | ------------------------------ | ---------- | ------ | | Test Coverage (critical paths) | 80%+ | \_\_\_ | | Type Safety (any: any count) | 0 in core | \_\_\_ | | Performance (p95 latency) | < 500ms | \_\_\_ | | Uptime | 99.9% | \_\_\_ | | Error Rate | < 0.1% | \_\_\_ | | Security Vulnerabilities | 0 critical | \_\_\_ | ### Development Metrics | Metric | Target | Actual | | ---------------------- | ---------------- | ------ | | Code Review Time | < 24 hours | \_\_\_ | | Deployment Frequency | Daily | \_\_\_ | | Mean Time to Recovery | < 15 min | \_\_\_ | | Time to Development | < 30 min (local) | \_\_\_ | | Documentation Coverage | 100% public API | \_\_\_ | ### Business Metrics | Metric | Target | Actual | | -------------------------- | -------- | ------ | | Onboarding Completion Rate | 80%+ | \_\_\_ | | Creator Retention (30d) | 70%+ | \_\_\_ | | Payment Success Rate | 99%+ | \_\_\_ | | Customer Satisfaction | 4.5+ / 5 | \_\_\_ | | Feature Adoption | 60%+ | \_\_\_ | --- ## COMPARISON: 900 CYCLEENCES vs 400 CYCLEENCES **Old Approach (900 cycles):** - 9 separate todo files (x402, onboard, agents, skills, sell, ecommerce, api, features, one-ie) - Limited reuse (each team member implements patterns separately) - Testing often deferred (Phase 6) - Quality issues discovered late - Performance optimizations at the end **New Approach (400 cycles):** - 4 phases (Foundation, Layering, Integration, Operations) - Strong shared foundations (all features benefit from Phase 1) - Testing integrated (Phase 1-2 = 80%+ coverage) - Quality issues prevented (good error handling, type safety) - Performance optimized throughout (monitoring from Phase 1) **Key Differences:** 1. **Reuse**: Foundation phase (100 infers) serves all subsequent features 2. **Quality**: Error handling framework prevents bugs in all features 3. **Testing**: Shared test infrastructure reduces per-feature testing 4. **Performance**: Monitoring + optimization happen early 5. **Knowledge**: Captured systematically (cycles 91-100, 191-200, etc) **Result**: ~55% fewer cycles to achieve same quality + reliability. --- ## HOW TO USE THIS DOCUMENT ### For Managers / Directors 1. **Use as roadmap:** 4 phases, 100 cycles each 2. **Track progress:** Mark cycles as complete 3. **Measure quality:** Track metrics in table above 4. **Plan team capacity:** ~100-112 cycles per person per day 5. **Identify blockers:** If one cycle blocked, skip to next ### For Engineers / Specialists 1. **Read phase overview:** Understand what's being built 2. **Read cycle details:** "DELIVERABLES" section tells you what to do 3. **Follow "SUCCESS CRITERIA":** These define "done" 4. **Use "REQUIREMENTS FROM FOUNDATION":** Don't skip these 5. **Capture lessons:** Document learnings (end of each phase) ### For New Team Members 1. **Start with Phase 1:** Read all 100 cycles 2. **Understand foundations:** Why error handling, logging, etc matter 3. **See patterns:** Same patterns used in Phases 2-4 4. **Know how to add features:** Follow the proven process --- ## CONCLUSION: BUILDING WISELY **The Goal:** Every code addition makes the system: - Smarter (captures learnings) - Stronger (more resilient) - More Reliable (fewer bugs) - Faster (performance built in) **The Method:** Foundation Smart Features Safe Integrations Intelligent Operations **The Outcome:** A platform trusted by creators, relied upon by developers, backed by solid engineering. **Let's build ONE wisely. 🚀** --- **Created:** 2025-10-30 **Reviewed:** [Your name] **Next Review:** After Phase 1 complete **Status:** READY FOR EXECUTION