oneie
Version:
Build apps, websites, and AI agents in English. Zero-interaction setup for AI agents (Claude Code, Cursor, Windsurf). Download to your computer, run in the cloud, deploy to the edge. Open source and free forever.
1,622 lines (1,291 loc) • 47.7 kB
Markdown
title: Todo Sequence
dimension: things
primary_dimension: things
category: todo-sequence.md
tags: ontology, testing
related_dimensions: things, events, knowledge, groups, people
scope: global
created: 2025-11-03
updated: 2025-11-03
version: 1.0.0
ai_context: |
This document is part of the things dimension in the todo-sequence.md category.
Location: one/things/todo-sequence.md
Purpose: Documents one platform: safe & smart build sequence v1.0.0
Related dimensions: events, knowledge
For AI agents: Read this to understand todo sequence.
# ONE Platform: Safe & Smart Build Sequence v1.0.0
**Purpose:** Define the safest, most intelligent way to build ONE so each code addition makes the system progressively smarter, stronger, and more reliable.
**Philosophy:** Every feature compounds. Every test adds resilience. Every design decision reduces future errors.
**Date:** 2025-10-30
**Version:** 1.0.0
**Status:** Foundation Framework for Safe Scaling
## EXECUTIVE SUMMARY: THE 4-PHASE STRATEGY
```
PHASE 1: FOUNDATION HARDENING (Cycle 1-100)
├─ Strengthen existing systems (auth, schema, error handling)
├─ Build shared infrastructure (logging, monitoring, testing)
├─ Lock down data model (validate 6-dimension ontology)
└─ Result: Bulletproof base for all future features
PHASE 2: INTELLIGENT LAYERING (Cycle 101-200)
├─ Add interconnected features (onboarding → teams → workspace)
├─ Build with continuous testing (80%+ coverage)
├─ Measure + optimize as you go (performance gates)
└─ Result: Features that strengthen each other
PHASE 3: SMART INTEGRATIONS (Cycle 201-300)
├─ Connect external systems safely (protocols, APIs, agents)
├─ Build adapter layers (minimize coupling)
├─ Comprehensive integration tests
└─ Result: Extensible platform that doesn't break
PHASE 4: INTELLIGENT OPERATIONS (Cycle 301-400)
├─ Monitoring + alerting that prevents fires
├─ Progressive rollout (canary → blue-green)
├─ Knowledge capture + automation
└─ Result: Self-improving operations
```
**Total Cycles:** 400 (not 900)
**Why Fewer?** We're building smarter with:
- Reusable patterns (don't repeat)
- Shared infrastructure (single source of truth)
- Continuous optimization (fast iteration)
- Quality by design (test as you code)
## PHASE 1: FOUNDATION HARDENING (Cycle 1-100)
**Goal:** Build unshakeable foundation that all other features depend on
### Why This Matters
80% of production issues come from:
- Weak error handling
- Inconsistent logging
- Untested edge cases
- Missing type safety
- Unclear requirements
Fix these FIRST, not last.
### Cycle 1-10: AUDIT EXISTING SYSTEMS
**Purpose:** Understand current state before building on top
#### Cycle 1: Audit Authentication System
```
DELIVERABLES:
[ ] Review Better Auth setup in backend/convex/auth.ts
[ ] Document all auth methods supported (email/OAuth/2FA)
[ ] Check error handling completeness
[ ] Review security headers and CORS config
[ ] List any known vulnerabilities
[ ] Document auth edge cases (session expiry, token refresh, revocation)
SUCCESS CRITERIA:
✅ Complete auth specification document
✅ All error cases documented
✅ Security review completed
✅ Ready for auth additions (wallet, social verification)
```
#### Cycle 2: Audit Database Schema (6-Dimension Ontology)
```
DELIVERABLES:
[ ] Review schema.ts groups table (check indexes, constraints)
[ ] Review schema.ts things table (check properties flexibility)
[ ] Review schema.ts connections table (check bidirectionality)
[ ] Review schema.ts events table (check event types coverage)
[ ] Review schema.ts knowledge table (check vector storage readiness)
[ ] Identify missing indexes (performance)
[ ] Identify constraint gaps (data integrity)
[ ] Identify type issues (any: any patterns)
SUCCESS CRITERIA:
✅ Schema audit report (300 lines)
✅ Performance recommendations (N+1 queries, missing indexes)
✅ Type safety improvements (eliminate any: any)
✅ Constraint improvements (unique, required fields)
```
#### Cycle 3: Audit Error Handling Strategy
```
DELIVERABLES:
[ ] Scan codebase for error handling patterns
[ ] Identify inconsistent error types
[ ] Check Convex mutation error boundaries
[ ] Review frontend error UI (loading, error, success states)
[ ] Check async/await exception handling
[ ] Document missing error cases
SUCCESS CRITERIA:
✅ Error handling audit (catalog all patterns)
✅ Standardized error types (tagged unions with _tag)
✅ Error handling guide for new features
✅ Missing error cases identified
```
#### Cycle 4: Audit Logging & Observability
```
DELIVERABLES:
[ ] Check existing logging (console.log usage, structure)
[ ] Review Convex logs (are they captured?)
[ ] Check frontend error tracking (Sentry, similar?)
[ ] Identify untracked user actions
[ ] Check database query logging
[ ] Review performance metrics captured
SUCCESS CRITERIA:
✅ Logging architecture documented
✅ Gaps identified (what's NOT logged)
✅ Logging standards defined (format, levels, context)
✅ Observability roadmap (monitoring, tracing)
```
#### Cycle 5: Audit Testing Coverage
```
DELIVERABLES:
[ ] Run coverage report (web/ and backend/)
[ ] Identify untested modules
[ ] Review test quality (unit vs integration vs e2e)
[ ] Check auth test coverage (all 6 methods)
[ ] Check critical paths tested (payment flow, team creation)
[ ] Document testing strategy gaps
SUCCESS CRITERIA:
✅ Coverage report (current: __%)
✅ Testing strategy document (unit/integration/e2e)
✅ Critical path testing roadmap
✅ Mock data factory established
```
#### Cycle 6: Audit API Surface & Documentation
```
DELIVERABLES:
[ ] List all Convex queries (public + internal)
[ ] List all Convex mutations (public + internal)
[ ] Check API documentation completeness
[ ] Identify missing type definitions
[ ] Review API consistency (naming, patterns)
[ ] Check backward compatibility (can we add features without breaking?)
SUCCESS CRITERIA:
✅ API inventory (all functions documented)
✅ API versioning strategy defined
✅ Breaking change policy established
✅ Type generation working (convex/_generated/)
```
#### Cycle 7: Audit Performance Baselines
```
DELIVERABLES:
[ ] Measure page load times (Core Web Vitals)
[ ] Measure API response times (p50, p95, p99)
[ ] Measure database query times
[ ] Check bundle size (web/)
[ ] Identify performance bottlenecks
[ ] Establish performance targets
SUCCESS CRITERIA:
✅ Performance baseline report
✅ Performance targets (LCP < 2.5s, FID < 100ms, CLS < 0.1)
✅ Performance monitoring setup
✅ Critical path identified
```
#### Cycle 8: Audit Security Posture
```
DELIVERABLES:
[ ] Check authentication security (HTTPS, secure cookies)
[ ] Check authorization gaps (can user X access user Y's data?)
[ ] Check injection vulnerabilities
[ ] Check CSRF protection
[ ] Check rate limiting
[ ] Check secrets management (.env handling)
[ ] Run OWASP Top 10 checklist
SUCCESS CRITERIA:
✅ Security audit report
✅ Vulnerability list (prioritized)
✅ Security policy documented
✅ Secrets rotation plan
```
#### Cycle 9: Audit Frontend Architecture
```
DELIVERABLES:
[ ] Review Astro + React islands architecture
[ ] Check component organization (are there patterns?)
[ ] Review state management (Convex hooks, context)
[ ] Check styling consistency (Tailwind v4)
[ ] Review accessibility (WCAG AA compliance)
[ ] Document component patterns
SUCCESS CRITERIA:
✅ Frontend architecture document
✅ Component library audit (what exists)
✅ Design system consistency check
✅ Accessibility audit (WCAG AA status)
```
#### Cycle 10: Audit Backend Architecture
```
DELIVERABLES:
[ ] Review service layer organization
[ ] Check type safety (TypeScript strict mode)
[ ] Review mutation/query separation
[ ] Check function composition (small, testable functions)
[ ] Review dependency injection
[ ] Document backend patterns
SUCCESS CRITERIA:
✅ Backend architecture document
✅ Service layer audit
✅ Type safety improvements list
✅ Pattern library established
```
### Cycle 11-30: BUILD SHARED INFRASTRUCTURE
**Purpose:** Create the foundations all features will build on
#### Cycle 11-15: Implement Structured Logging
```
DELIVERABLES:
[ ] Create shared logging service: convex/services/logging.ts
[ ] Define log levels (DEBUG, INFO, WARN, ERROR, CRITICAL)
[ ] Define context structure (userId, groupId, requestId, timestamp)
[ ] Implement frontend error tracking integration
[ ] Create dashboard for log search (Datadog or similar)
[ ] Add request tracing (correlate frontend → backend logs)
IMPLEMENTATION:
// convex/services/logging.ts
export type LogLevel = 'DEBUG' | 'INFO' | 'WARN' | 'ERROR' | 'CRITICAL'
export async function log(
level: LogLevel,
message: string,
context: {
userId?: string
groupId?: string
requestId?: string
action?: string
duration?: number
error?: Error
metadata?: Record<string, unknown>
}
) {
// Store in DB + send to observability service
const entry = {
timestamp: Date.now(),
level,
message,
...context
}
// Log to Convex events table (for audit trail)
// Send to Datadog/New Relic (for monitoring)
}
SUCCESS CRITERIA:
✅ All Convex functions use structured logging
✅ Frontend errors logged + tracked
✅ Request tracing working (frontend → backend)
✅ Log search dashboard live
✅ 99th percentile query latency < 500ms
```
#### Cycle 16-20: Implement Error Handling Framework
```
DELIVERABLES:
[ ] Create standardized error types (tagged unions with _tag)
[ ] Implement error boundary components (React)
[ ] Create error recovery strategies
[ ] Implement retry logic with exponential backoff
[ ] Create error reporting UI (user-friendly messages)
[ ] Document all error cases for common operations
IMPLEMENTATION:
// convex/types/errors.ts
export type Result<T, E> =
| { _tag: 'Ok'; data: T }
| { _tag: 'Error'; error: E }
export type AppError =
| { _tag: 'AuthError'; message: string }
| { _tag: 'ValidationError'; field: string; message: string }
| { _tag: 'NotFoundError'; resource: string; id: string }
| { _tag: 'ForbiddenError'; message: string }
| { _tag: 'RateLimitError'; retryAfter: number }
| { _tag: 'NetworkError'; message: string }
| { _tag: 'InternalError'; message: string }
// Every mutation returns Result<Success, AppError>
export const mutations = {
createUser: mutation({
handler: async (ctx, args): Promise<Result<UserId, AppError>> => {
// Implementation
}
})
}
SUCCESS CRITERIA:
✅ All mutations return Result<T, AppError>
✅ Error UI components created (modal, toast, inline)
✅ Error recovery strategies documented
✅ No uncaught exceptions in logs (99.9%)
```
#### Cycle 21-25: Implement Validation Framework
```
DELIVERABLES:
[ ] Create input validation layer (schema validation)
[ ] Implement type-safe validators
[ ] Create error messages that help users fix mistakes
[ ] Implement sanitization (SQL injection, XSS prevention)
[ ] Add file upload validation (size, type, content)
[ ] Document validation rules for all inputs
IMPLEMENTATION:
// convex/services/validation.ts
export function validateEmail(email: string): Result<string, AppError> {
if (!email.includes('@')) {
return { _tag: 'Error', error: {
_tag: 'ValidationError',
field: 'email',
message: 'Invalid email format'
}}
}
return { _tag: 'Ok', data: email.toLowerCase() }
}
// Apply to mutations
export const signup = mutation({
args: { email: v.string(), password: v.string() },
handler: async (ctx, args) => {
const emailResult = validateEmail(args.email)
if (emailResult._tag === 'Error') return emailResult
// Continue with validated email
}
})
SUCCESS CRITERIA:
✅ All inputs validated before processing
✅ Clear error messages guide users
✅ No injection vulnerabilities (code review)
✅ File uploads validated (size, type, content scan)
```
#### Cycle 26-30: Implement Testing Infrastructure
```
DELIVERABLES:
[ ] Set up test database (isolated from production)
[ ] Create mock data factory (fixtures for all entity types)
[ ] Implement test helpers (createUser, createGroup, etc)
[ ] Set up test environment (.env.test)
[ ] Create test utilities (assert, expect, matchers)
[ ] Document testing best practices
IMPLEMENTATION:
// test/fixtures.ts
export async function createTestUser(
ctx: TestContext,
overrides?: Partial<User>
): Promise<User> {
// Create user with sensible defaults
}
export async function createTestGroup(
ctx: TestContext,
overrides?: Partial<Group>
): Promise<Group> {
// Create group with sensible defaults
}
// Usage in tests
describe('User registration', () => {
it('should create user with email', async () => {
const user = await createTestUser(ctx)
expect(user.email).toBe(defined)
})
})
SUCCESS CRITERIA:
✅ Test database isolated from production
✅ Mock data factory for all entity types
✅ Test helpers reduce test code duplication
✅ 80%+ coverage of critical paths
✅ Test suite runs < 30 seconds
```
### Cycle 31-50: HARDEN CORE DATA MODEL
**Purpose:** Ensure 6-dimension ontology is bulletproof
#### Cycle 31-35: Strengthen Schema Integrity
```
DELIVERABLES:
[ ] Add NOT NULL constraints to required fields
[ ] Add UNIQUE constraints where needed (email, username)
[ ] Add CHECK constraints for enum values
[ ] Add foreign key constraints (groupId must exist)
[ ] Create database migrations script
[ ] Write schema validation tests
SUCCESS CRITERIA:
✅ Database constraints prevent invalid data
✅ Migrations tracked + reversible
✅ Schema change process documented
✅ No orphaned records possible
```
#### Cycle 36-40: Implement Type Safety
```
DELIVERABLES:
[ ] Eliminate all 'any' types in backend
[ ] Create strict types for all entity properties
[ ] Implement discriminated unions for polymorphic types
[ ] Enable TypeScript strict mode everywhere
[ ] Run type checking in CI/CD
[ ] Document type system architecture
SUCCESS CRITERIA:
✅ Zero 'any' types in critical code
✅ TypeScript strict: true passes everywhere
✅ Type checking in CI/CD (fails build if types fail)
✅ Runtime type validation (zod or similar)
```
#### Cycle 41-45: Implement Data Consistency Rules
```
DELIVERABLES:
[ ] Define data consistency rules (invariants)
[ ] Implement guards before write operations
[ ] Create consistency check mutations
[ ] Implement eventual consistency handling
[ ] Document conflict resolution strategies
[ ] Test consistency under concurrent writes
CONSISTENCY RULES:
• Every thing must belong to a group
• Every connection must have both parties
• Every event must have an actor (or system)
• Group hierarchy must be acyclic (no circular parents)
• Person role must be one of: platform_owner, org_owner, org_user, customer
• Status must be: draft, active, published, archived
SUCCESS CRITERIA:
✅ Data consistency rules documented
✅ Guards prevent rule violations
✅ Consistency checks pass 99.9% of writes
✅ Recovery procedure for violations documented
```
#### Cycle 46-50: Implement Access Control (AuthZ)
```
DELIVERABLES:
[ ] Define role-based access control (RBAC)
[ ] Implement group scoping (users can only see own group data)
[ ] Create permission checks for all mutations
[ ] Implement hierarchical permissions (parent groups access child groups)
[ ] Create audit log for access changes
[ ] Test authorization thoroughly (permission matrix)
AUTHORIZATION RULES:
• platform_owner can access all groups
• org_owner can access own organization + child groups
• org_user can access own group (with role restrictions)
• customer can access own account
• Can't modify other user's data without permission
• Can't access parent/child group data without explicit permission
SUCCESS CRITERIA:
✅ All mutations check authorization first
✅ Permission matrix tested (40+ test cases)
✅ No privilege escalation vulnerabilities
✅ Audit log shows all access changes
```
### Cycle 51-70: OPTIMIZE PERFORMANCE FOUNDATIONS
**Purpose:** Ensure system performs well BEFORE adding features
#### Cycle 51-55: Implement Query Optimization
```
DELIVERABLES:
[ ] Add database indexes (analyze slow queries)
[ ] Implement pagination (prevent N+1 queries)
[ ] Add caching layer (Convex caching + frontend)
[ ] Optimize API payloads (only send needed fields)
[ ] Implement request deduplication
[ ] Profile database queries (find bottlenecks)
SUCCESS CRITERIA:
✅ P95 query latency < 100ms
✅ All lists paginated (limit results)
✅ Cache hit rate > 60%
✅ No N+1 queries in critical paths
✅ Bundle size < 200KB (compressed)
```
#### Cycle 56-60: Implement Frontend Performance
```
DELIVERABLES:
[ ] Code split components (only load used code)
[ ] Lazy load below-fold content
[ ] Optimize images (WebP, responsive sizing)
[ ] Minimize blocking scripts
[ ] Implement service worker (offline support)
[ ] Profile Core Web Vitals (LCP, FID, CLS)
SUCCESS CRITERIA:
✅ Lighthouse score > 90
✅ LCP < 2.5s (Core Web Vital)
✅ FID < 100ms (Core Web Vital)
✅ CLS < 0.1 (Core Web Vital)
✅ First Contentful Paint < 1.5s
```
#### Cycle 61-65: Implement Caching Strategy
```
DELIVERABLES:
[ ] Define cache layers (CDN, server, browser)
[ ] Implement cache invalidation (TTL-based, event-based)
[ ] Create cache warm-up strategy
[ ] Implement distributed caching (Redis if needed)
[ ] Document cache-busting strategy
[ ] Monitor cache effectiveness
SUCCESS CRITERIA:
✅ CDN cache hit rate > 80%
✅ Browser cache covers > 90% of requests
✅ Cache invalidation < 5 seconds
✅ Staleness never exposed to users
```
#### Cycle 66-70: Implement Monitoring & Alerting
```
DELIVERABLES:
[ ] Set up metrics collection (Prometheus, Datadog)
[ ] Create dashboards (performance, errors, uptime)
[ ] Implement alerting (page when bad things happen)
[ ] Set up incident response process
[ ] Create runbooks for common issues
[ ] Track SLOs (99.9% uptime target)
SUCCESS CRITERIA:
✅ Real-time dashboards monitoring system
✅ Alerts for: errors > 1%, latency > 1s, downtime
✅ On-call rotation defined
✅ Runbooks for top 5 incidents
✅ Uptime tracking (current: __%)
```
### Cycle 71-90: BUILD DEVELOPMENT PRACTICES
**Purpose:** Ensure team can build safely and quickly
#### Cycle 71-75: Implement Testing Standards
```
DELIVERABLES:
[ ] Create unit test guidelines (each function tested)
[ ] Create integration test guidelines (services work together)
[ ] Create e2e test guidelines (user workflows)
[ ] Set minimum coverage thresholds (80% critical paths)
[ ] Automate testing in CI/CD (blocks merge if tests fail)
[ ] Create test documentation
SUCCESS CRITERIA:
✅ All new code has tests before merge
✅ CI/CD runs full test suite (< 5 minutes)
✅ Coverage dashboard shows > 80% critical paths
✅ Test failures block production deployment
```
#### Cycle 76-80: Implement Code Review Process
```
DELIVERABLES:
[ ] Create code review checklist
[ ] Define review criteria (quality, security, performance)
[ ] Set up GitHub branch protection (require 1+ review)
[ ] Create automated checks (linting, type checking, tests)
[ ] Document review SLA (reviews within 24 hours)
[ ] Create knowledge capture from reviews
SUCCESS CRITERIA:
✅ All PRs reviewed before merge
✅ Automated checks catch common issues
✅ Review comments documented (why this decision)
✅ No merges with failing checks
```
#### Cycle 81-85: Implement Documentation Standards
```
DELIVERABLES:
[ ] Create API documentation template
[ ] Create function documentation template
[ ] Create architecture decision records (ADRs)
[ ] Implement code comment standards
[ ] Create README for each major module
[ ] Link documentation to code (docstrings)
SUCCESS CRITERIA:
✅ All public functions documented
✅ Complex logic has explanatory comments
✅ Architecture decisions recorded
✅ New team members can onboard via docs
```
#### Cycle 86-90: Implement Release Standards
```
DELIVERABLES:
[ ] Create release checklist (automated where possible)
[ ] Implement semantic versioning (major.minor.patch)
[ ] Create changelog (auto-generate from commits)
[ ] Implement deployment process (staging → production)
[ ] Create rollback procedure (for emergencies)
[ ] Document release SLA (production deployment window)
SUCCESS CRITERIA:
✅ Releases follow semantic versioning
✅ Changelog auto-generated from commit messages
✅ Deployment process documented + automated
✅ Rollback takes < 5 minutes
✅ Production deploys during business hours only
```
### Cycle 91-100: DOCUMENT FOUNDATION
**Purpose:** Capture what we've learned, so others can benefit
#### Cycle 91-95: Create System Documentation
```
DELIVERABLES:
[ ] Architecture overview (how components connect)
[ ] Data model documentation (6-dimension ontology)
[ ] API documentation (all endpoints with examples)
[ ] Service layer documentation (Effect.ts patterns)
[ ] Frontend architecture (Astro + React patterns)
[ ] Deployment architecture (where runs, how scales)
LOCATION:
/one/knowledge/system-architecture.md (comprehensive)
/one/things/architecture-diagram.md (visual)
Backend code: JSDoc comments for all functions
SUCCESS CRITERIA:
✅ New developer can understand system in 2 hours
✅ Architecture decisions explained (why this way)
✅ All key files have rundown
✅ Diagrams show component interactions
```
#### Cycle 96-100: Capture Lessons Learned
```
DELIVERABLES:
[ ] Document what worked well (replicate this)
[ ] Document what was hard (how to avoid)
[ ] Document surprises (why did this happen?)
[ ] Document future improvements (addressed later)
[ ] Create decision journal (why we chose X over Y)
[ ] Share with team (lessons drive future decisions)
LOCATION:
/one/events/foundation-hardening-lessons.md
EXAMPLE ENTRIES:
✅ Structured logging pays off immediately
(saves hours debugging production issues)
✅ Error handling framework prevents bugs
(catch edge cases in code review, not production)
⚠️ Type safety takes discipline
(need to push back on 'any' types)
💡 Performance testing early prevents rewrites
(measure baselines, optimize with data)
💡 Test fixtures save time
(good fixtures → faster test writing)
SUCCESS CRITERIA:
✅ Lessons document captures 20+ insights
✅ Team reviews + discusses lessons
✅ Lessons inform design of next phases
✅ Metrics show phase improved quality
```
## PHASE 2: INTELLIGENT LAYERING (Cycle 101-200)
**Goal:** Add interconnected features that strengthen each other
**Philosophy:** Don't add isolated features. Build features that depend on strong foundations.
### Cycle 101-130: BUILD CREATOR ONBOARDING
**Prerequisite:** Foundation phase complete (Cycle 1-100)
#### Cycle 101-110: Define Onboarding Requirements
```
(Same as todo-onboard.md Cycle 1-10)
Define personas, map to ontology, review auth, define flow stages
```
#### Cycle 111-120: Implement Backend (Schema + Services)
```
DELIVERABLES:
[ ] Add person.role field (platform_owner, org_owner, org_user, customer)
[ ] Add creator thing type with properties (bio, avatar, skills)
[ ] Add onboarding_status (incomplete, in_progress, complete)
[ ] Create mutateCompleteOnboarding (updates status, creates workspace)
[ ] Create queryOnboardingProgress (for progress UI)
[ ] Implement email verification flow (Resend integration)
[ ] Implement wallet connection (viem/wagmi integration)
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Use structured logging for all operations
✅ Return Result<T, AppError> from all mutations
✅ Validate all inputs (email format, username uniqueness)
✅ Check authorization (user can only modify own data)
✅ Update audit log (track onboarding progress)
✅ Write tests for all functions (80%+ coverage)
✅ Profile query performance (optimize slow queries)
SUCCESS CRITERIA:
✅ All onboarding mutations tested
✅ Email verification working
✅ Wallet connection working
✅ P95 query latency < 100ms
```
#### Cycle 121-130: Implement Frontend (Components + Pages)
```
DELIVERABLES:
[ ] Create SignupForm component
[ ] Create EmailVerificationPage
[ ] Create ProfileCompletionForm
[ ] Create WorkspaceSetupFlow
[ ] Create WalletConnectionModal
[ ] Create OnboardingProgressBar
[ ] Create OnboardingCompletionPage
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Use error boundary components
✅ Show error UI for validation errors
✅ Implement retry logic (network errors)
✅ Implement loading states (show spinner)
✅ Add accessibility (WCAG AA labels, keyboard nav)
✅ Test all workflows
✅ Profile performance (optimize LCP, CLS)
SUCCESS CRITERIA:
✅ All onboarding pages tested (e2e)
✅ Lighthouse score > 90 (before caching)
✅ Accessibility audit passes (WCAG AA)
✅ Mobile responsive (works on small screens)
```
### Cycle 131-160: BUILD TEAM MANAGEMENT
**Prerequisite:** Onboarding complete
#### Cycle 131-140: Define Team Requirements
```
(Same as todo-onboard.md Cycle 5)
Define workspace as group, roles, team features
```
#### Cycle 141-150: Implement Backend (Schema + Services)
```
DELIVERABLES:
[ ] Add group_member connection type
[ ] Add role field (owner, admin, editor, viewer)
[ ] Create inviteTeamMember mutation
[ ] Create acceptTeamInvitation mutation
[ ] Create changeTeamMemberRole mutation
[ ] Create removeTeamMember mutation
[ ] Create queryTeamMembers
[ ] Implement pending invitation tracking
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Check authorization (only owner can change roles)
✅ Validate email before inviting
✅ Prevent circular invitations
✅ Send invitation email via Resend
✅ Track invitations in audit log
✅ Write comprehensive tests
✅ Handle edge cases (invite existing member, revoke pending)
SUCCESS CRITERIA:
✅ Team member operations tested
✅ Authorization checks prevent privilege escalation
✅ Email invitations sent reliably
✅ Pending invitations work smoothly
```
#### Cycle 151-160: Implement Frontend (Components + Pages)
```
DELIVERABLES:
[ ] Create TeamMembersPage
[ ] Create InviteTeamMemberForm
[ ] Create TeamMemberCard (show role, actions)
[ ] Create RoleChangeDialog
[ ] Create RemoveTeamMemberDialog
[ ] Create PendingInvitationsSection
[ ] Create AcceptInvitationPage
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Show loading + error states
✅ Confirm dangerous actions (remove member)
✅ Show success feedback (member added)
✅ Implement retry on network error
✅ Test all workflows
SUCCESS CRITERIA:
✅ Team management UI tested (e2e)
✅ All features working
✅ Mobile responsive
```
### Cycle 161-200: BUILD ANALYTICS FOUNDATION
**Prerequisite:** Onboarding + teams complete
**Purpose:** Enable features to measure themselves
#### Cycle 161-170: Implement Event Tracking
```
DELIVERABLES:
[ ] Create analytics service that logs all events
[ ] Track user actions (signup, login, create product, etc)
[ ] Track system actions (payments processed, errors)
[ ] Implement event batching (reduce API calls)
[ ] Store events in Convex events table
[ ] Create event query APIs
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Use structured logging (context, metadata)
✅ Track timing of operations
✅ Correlate events with user/group
✅ Implement data retention (delete old events)
SUCCESS CRITERIA:
✅ All important events tracked
✅ Event data captured with proper context
✅ No personally identifiable info logged (privacy)
✅ Events queryable for analysis
```
#### Cycle 171-180: Implement Analytics Queries
```
DELIVERABLES:
[ ] Create queryUserMetrics (signups, logins, activity)
[ ] Create queryGroupMetrics (team size, activity)
[ ] Create querySystemMetrics (errors, latency, uptime)
[ ] Create queryConversionFunnel (signup → create product → sell)
[ ] Create queryChurnRate (who stopped using platform)
[ ] Implement time-series queries (graph over time)
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Cache analytics queries (expensive to compute)
✅ Return in format ready for charting
✅ Include 95% confidence intervals (for small samples)
SUCCESS CRITERIA:
✅ Analytics queries perform < 500ms
✅ All important metrics tracked
✅ Queries return ready-to-chart data
```
#### Cycle 181-190: Implement Analytics UI
```
DELIVERABLES:
[ ] Create creator analytics dashboard
[ ] Show signup metrics
[ ] Show team size + growth
[ ] Show activity trends
[ ] Create system analytics dashboard (admin only)
[ ] Show platform health metrics
[ ] Show error rates, uptime, performance
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Design for accessibility (color-blind friendly)
✅ Test with real data (not mock)
✅ Optimize chart rendering (many data points)
SUCCESS CRITERIA:
✅ Analytics UI loads < 2s
✅ Charts render smoothly
✅ Mobile responsive
```
#### Cycle 191-200: Capture Learning & Metrics
```
DELIVERABLES:
[ ] Document metrics we're tracking (why each one)
[ ] Document how metrics inform product decisions
[ ] Create insights from first users (what patterns?)
[ ] Document unexpected findings
[ ] Plan improvements based on metrics
LOCATION:
/one/events/phase2-analytics-insights.md
EXAMPLE INSIGHTS:
📊 Onboarding completion rate: 85%
(higher than expected, good UX)
📊 Team invitations: 40% accept rate
(need to improve email, timing, or value prop)
📊 Wallet connections: 20% of creators
(consider making more valuable)
SUCCESS CRITERIA:
✅ Analytics dashboard running smoothly
✅ Metrics inform product decisions
✅ Insights documented for future reference
```
## PHASE 3: SMART INTEGRATIONS (Cycle 201-300)
**Goal:** Connect external systems safely without breaking core platform
### Cycle 201-230: BUILD PAYMENT INFRASTRUCTURE (X402)
**Prerequisite:** Foundation + onboarding complete
#### Cycle 201-210: Design Payment Flow
```
DELIVERABLES:
[ ] Define payment sequence (on blockchain)
[ ] Integrate viem for blockchain transactions
[ ] Implement payment status tracking (pending → confirmed → finalized)
[ ] Create error recovery (what if transaction fails?)
[ ] Implement payment verification (confirm funds received)
[ ] Create payment audit log
SUCCESS CRITERIA:
✅ Payment flow documented
✅ Error cases identified + handled
✅ Blockchain integration tested
✅ Payment verification reliable (99.9%)
```
#### Cycle 211-220: Implement Payment Mutations
```
DELIVERABLES:
[ ] Create initiatePayment mutation
[ ] Create confirmPayment mutation
[ ] Create refundPayment mutation
[ ] Create queryPaymentStatus
[ ] Implement webhook for blockchain events
[ ] Create payment reconciliation service
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Return Result<PaymentId, AppError>
✅ Validate payment amount (not zero, reasonable)
✅ Check authorization (user can pay with own wallet)
✅ Log all payment attempts (audit trail)
✅ Write tests for payment flows (happy path + errors)
✅ Implement idempotency (don't double-charge)
SUCCESS CRITERIA:
✅ Payment mutations reliable (no lost payments)
✅ Blockchain transactions verified
✅ Refunds working smoothly
✅ Audit log complete
```
#### Cycle 221-230: Implement Payment UI
```
DELIVERABLES:
[ ] Create PaymentForm component
[ ] Create PaymentStatusPage
[ ] Create PaymentHistoryPage
[ ] Create RefundRequestForm
[ ] Implement payment retry (if failed)
[ ] Show transaction details (blockchain explorer link)
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Show clear loading states
✅ Handle blockchain latency (payment takes time)
✅ Show user-friendly error messages
✅ Implement retry with exponential backoff
SUCCESS CRITERIA:
✅ Payment UI tested (happy path + errors)
✅ Mobile responsive
✅ Users understand transaction status
```
### Cycle 231-260: BUILD PRODUCT MANAGEMENT
**Prerequisite:** Payment infrastructure complete
#### Cycle 231-240: Design Product Schema
```
DELIVERABLES:
[ ] Define product thing type
[ ] Add properties: name, description, price, category
[ ] Define product status: draft → published → archived
[ ] Create connection types: creator→owns→product
[ ] Define product categories (courses, templates, memberships)
[ ] Create schema validation (all required fields present)
SUCCESS CRITERIA:
✅ Product schema supports all product types
✅ Products scoped to creator's group
✅ Products queryable by category
```
#### Cycle 241-250: Implement Product Operations
```
DELIVERABLES:
[ ] Create createProduct mutation
[ ] Create updateProduct mutation
[ ] Create publishProduct mutation
[ ] Create deleteProduct mutation
[ ] Create queryCreatorProducts
[ ] Create queryPublishedProducts (public read)
[ ] Implement product search (by name, category)
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Validate product data (name not empty, price > 0)
✅ Check authorization (only creator can modify own products)
✅ Implement soft delete (archive instead of delete)
✅ Log product changes (audit trail)
✅ Write comprehensive tests
SUCCESS CRITERIA:
✅ Product CRUD operations tested
✅ Authorization prevents unauthorized changes
✅ Search performs < 500ms
```
#### Cycle 251-260: Implement Product UI
```
DELIVERABLES:
[ ] Create ProductForm (create + edit)
[ ] Create ProductCard (display)
[ ] Create ProductPage (public view)
[ ] Create CreatorProductsPage (dashboard)
[ ] Create ProductSearchUI
[ ] Create PublishProductDialog
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Form validation matches backend
✅ Show loading + error states
✅ Confirm destructive actions
SUCCESS CRITERIA:
✅ Product UI tested
✅ Mobile responsive
✅ Users can create, edit, publish products
```
### Cycle 261-290: BUILD CHECKOUT & ORDERS
**Prerequisite:** Products + payments complete
#### Cycle 261-270: Design Order Schema
```
DELIVERABLES:
[ ] Define order thing type
[ ] Add properties: product_id, customer, amount, status
[ ] Define order status: pending → paid → fulfilled → completed
[ ] Create connection: customer→purchased→product
[ ] Track timestamps: created, paid, fulfilled, completed
[ ] Track fulfillment details (delivery, invoice)
SUCCESS CRITERIA:
✅ Order schema supports all order types
✅ Orders can be filtered by status
✅ Orders can be searched by customer/product
```
#### Cycle 271-280: Implement Order Operations
```
DELIVERABLES:
[ ] Create createOrder mutation
[ ] Create processOrderPayment mutation
[ ] Create fulfillOrder mutation
[ ] Create queryCustomerOrders
[ ] Create queryCreatorOrders
[ ] Create orderReconciliation (verify payments match orders)
[ ] Implement refund logic (reverse order + process refund)
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Validate order (product exists, customer valid)
✅ Check authorization (creator can fulfill own orders)
✅ Implement order confirmation email
✅ Track fulfillment (order can't complete without receipt)
✅ Write tests for order lifecycle
SUCCESS CRITERIA:
✅ Orders created + paid correctly
✅ Fulfillment tracked
✅ Refunds processed smoothly
✅ Order reconciliation catches discrepancies
```
#### Cycle 281-290: Implement Checkout & Order UI
```
DELIVERABLES:
[ ] Create ShoppingCartComponent
[ ] Create CheckoutPage
[ ] Create OrderConfirmationPage
[ ] Create CreatorOrdersPage
[ ] Create CustomerOrdersPage
[ ] Create OrderTrackingUI (for physical orders)
REQUIREMENTS FROM FOUNDATION PHASE:
✅ Secure checkout (HTTPS, validated input)
✅ Show order summary before payment
✅ Handle payment errors gracefully
✅ Send confirmation emails
SUCCESS CRITERIA:
✅ Checkout tested end-to-end
✅ Orders created + tracked
✅ Mobile responsive
✅ Customers understand order status
```
### Cycle 291-300: CAPTURE INTEGRATION LESSONS
```
DELIVERABLES:
[ ] Document payment integration learnings
[ ] Document product management patterns
[ ] Document order processing patterns
[ ] Document error recovery strategies
[ ] Create runbooks for payment issues
[ ] Plan improvements based on first orders
LOCATION:
/one/events/phase3-integration-lessons.md
EXAMPLE INSIGHTS:
💡 Blockchain transactions slow (5-60s)
→ Show clear status messages + polling
💡 Order reconciliation important
→ Automatic checks catch payment bugs
💡 Refund requests need approval
→ Prevent fraud, build trust
💡 Email confirmations reduce support
→ Cheap way to reduce questions
SUCCESS CRITERIA:
✅ Payment system handling real orders
✅ Products being created + sold
✅ Revenue flowing to creators
✅ Lessons inform Phase 4 design
```
## PHASE 4: INTELLIGENT OPERATIONS (Cycle 301-400)
**Goal:** Build systems that prevent problems + enable growth
### Cycle 301-320: MONITORING & INCIDENT MANAGEMENT
#### Cycle 301-310: Build Comprehensive Monitoring
```
DELIVERABLES:
[ ] Set up metrics collection (all key operations)
[ ] Create system health dashboard
[ ] Implement alerting (page on critical errors)
[ ] Create incident tracking (log issues)
[ ] Build runbooks (how to fix common problems)
[ ] Implement SLO tracking (uptime, latency)
ALERTS:
🚨 Error rate > 1% → Page immediately
🚨 Payment failures > 5% → Investigate
🚨 Blockchain gas prices > threshold → Notify
🚨 Database latency > 1s → Check queries
🚨 API latency p95 > 1s → Investigate
🚨 Downtime > 5 minutes → Manual intervention
SUCCESS CRITERIA:
✅ Real-time dashboards
✅ Alerts accurate (no false positives)
✅ Incidents tracked with root cause
✅ SLOs monitored + reported
```
#### Cycle 311-320: Implement Incident Response
```
DELIVERABLES:
[ ] Create incident response process
[ ] Define severity levels (critical, high, medium, low)
[ ] Set response time SLAs (critical: 5 min, high: 30 min)
[ ] Create blameless postmortems (learn from incidents)
[ ] Track incident metrics (frequency, resolution time)
[ ] Plan improvements from incidents
SUCCESS CRITERIA:
✅ Incidents resolved quickly
✅ Root causes identified + fixed
✅ Team learns from incidents (no repeat)
✅ System stability improves over time
```
### Cycle 321-340: SECURITY HARDENING
#### Cycle 321-330: Implement Security Best Practices
```
DELIVERABLES:
[ ] Implement rate limiting (prevent abuse)
[ ] Implement DDoS protection (Cloudflare)
[ ] Implement secrets rotation (keys, tokens)
[ ] Implement SQL injection prevention
[ ] Implement XSS prevention (sanitize inputs)
[ ] Implement CSRF protection
SUCCESS CRITERIA:
✅ No security vulnerabilities (code review)
✅ Rate limiting prevents abuse
✅ Secrets never logged
✅ User data encrypted at rest
```
#### Cycle 331-340: Implement Security Audit
```
DELIVERABLES:
[ ] Run OWASP Top 10 checklist
[ ] Review authentication security
[ ] Review authorization security
[ ] Test for injection vulnerabilities
[ ] Test for data leaks
[ ] Create remediation plan for any issues
SUCCESS CRITERIA:
✅ No critical vulnerabilities
✅ All audit findings documented
✅ Fixes tracked + prioritized
```
### Cycle 341-360: SCALABILITY & PERFORMANCE
#### Cycle 341-350: Optimize for Growth
```
DELIVERABLES:
[ ] Analyze performance bottlenecks
[ ] Optimize database queries (indexes, caching)
[ ] Optimize API response times
[ ] Implement CDN for static assets
[ ] Load test the system (how many users can it handle?)
[ ] Plan scaling strategy (when to add infrastructure)
SUCCESS CRITERIA:
✅ System handles 10x current load
✅ Performance degrades gracefully
✅ Scaling plan documented
✅ Can add resources without code changes
```
#### Cycle 351-360: Build for Reliability
```
DELIVERABLES:
[ ] Implement automated backups
[ ] Implement database replication
[ ] Implement failover strategy
[ ] Create disaster recovery plan
[ ] Test recovery procedures (annual)
[ ] Document all critical infrastructure
SUCCESS CRITERIA:
✅ Data backed up hourly
✅ Can recover from any failure < 1 hour
✅ No data loss possible
✅ Disaster recovery plan tested
```
### Cycle 361-380: DEVELOPER EXPERIENCE
#### Cycle 361-370: Build Developer Tools
```
DELIVERABLES:
[ ] Create local development setup (docker-compose?)
[ ] Create database seeding (test data)
[ ] Create API testing tools (Postman, CLI)
[ ] Create debugging tools (logs, traces)
[ ] Create performance profiling tools
[ ] Document development workflow
SUCCESS CRITERIA:
✅ New developer can develop locally in < 30 min
✅ All tools open source
✅ Developer docs are current
```
#### Cycle 371-380: Build Deployment Tools
```
DELIVERABLES:
[ ] Implement automated testing in CI/CD
[ ] Implement automated deployment
[ ] Implement blue-green deployments (zero downtime)
[ ] Implement rollback capability
[ ] Create deployment dashboard
[ ] Document deployment process
SUCCESS CRITERIA:
✅ Deployments happen multiple times daily
✅ Zero-downtime deployments
✅ Rollback takes < 5 minutes
✅ Deployment log shows what changed
```
### Cycle 381-400: KNOWLEDGE & CONTINUOUS IMPROVEMENT
#### Cycle 381-390: Capture System Knowledge
```
DELIVERABLES:
[ ] Create architecture documentation (comprehensive)
[ ] Create operational runbooks (how to fix things)
[ ] Create troubleshooting guide (common issues)
[ ] Create performance tuning guide
[ ] Create security guide (for developers)
[ ] Create decision log (why did we choose X?)
LOCATION:
/one/knowledge/ (comprehensive system docs)
/one/things/ (specifications)
/one/events/ (decisions + lessons learned)
SUCCESS CRITERIA:
✅ All knowledge documented
✅ Knowledge is current (reviewed monthly)
✅ Team uses knowledge (not just stored)
✅ New developers learn from knowledge base
```
#### Cycle 391-400: Plan Continuous Improvement
```
DELIVERABLES:
[ ] Review metrics (what's working, what's not)
[ ] Identify top 5 performance bottlenecks
[ ] Identify top 5 reliability issues
[ ] Plan improvements for next phase
[ ] Estimate effort (quick wins vs major rewrites)
[ ] Prioritize (impact vs effort)
OUTPUT:
/one/things/todo-next-phase.md
(plan for features, fixes, improvements)
SUCCESS CRITERIA:
✅ System is stable + performant
✅ Improvement roadmap is clear
✅ Team has time to address technical debt
✅ Quality metrics are improving over time
```
## SUCCESS METRICS: MEASURING WHAT MATTERS
At the end of 400 cycles (the complete 4-phase build):
### System Quality Metrics
| Metric | Target | Actual |
| ------------------------------ | ---------- | ------ |
| Test Coverage (critical paths) | 80%+ | \_\_\_ |
| Type Safety (any: any count) | 0 in core | \_\_\_ |
| Performance (p95 latency) | < 500ms | \_\_\_ |
| Uptime | 99.9% | \_\_\_ |
| Error Rate | < 0.1% | \_\_\_ |
| Security Vulnerabilities | 0 critical | \_\_\_ |
### Development Metrics
| Metric | Target | Actual |
| ---------------------- | ---------------- | ------ |
| Code Review Time | < 24 hours | \_\_\_ |
| Deployment Frequency | Daily | \_\_\_ |
| Mean Time to Recovery | < 15 min | \_\_\_ |
| Time to Development | < 30 min (local) | \_\_\_ |
| Documentation Coverage | 100% public API | \_\_\_ |
### Business Metrics
| Metric | Target | Actual |
| -------------------------- | -------- | ------ |
| Onboarding Completion Rate | 80%+ | \_\_\_ |
| Creator Retention (30d) | 70%+ | \_\_\_ |
| Payment Success Rate | 99%+ | \_\_\_ |
| Customer Satisfaction | 4.5+ / 5 | \_\_\_ |
| Feature Adoption | 60%+ | \_\_\_ |
## COMPARISON: 900 CYCLEENCES vs 400 CYCLEENCES
**Old Approach (900 cycles):**
- 9 separate todo files (x402, onboard, agents, skills, sell, ecommerce, api, features, one-ie)
- Limited reuse (each team member implements patterns separately)
- Testing often deferred (Phase 6)
- Quality issues discovered late
- Performance optimizations at the end
**New Approach (400 cycles):**
- 4 phases (Foundation, Layering, Integration, Operations)
- Strong shared foundations (all features benefit from Phase 1)
- Testing integrated (Phase 1-2 = 80%+ coverage)
- Quality issues prevented (good error handling, type safety)
- Performance optimized throughout (monitoring from Phase 1)
**Key Differences:**
1. **Reuse**: Foundation phase (100 infers) serves all subsequent features
2. **Quality**: Error handling framework prevents bugs in all features
3. **Testing**: Shared test infrastructure reduces per-feature testing
4. **Performance**: Monitoring + optimization happen early
5. **Knowledge**: Captured systematically (cycles 91-100, 191-200, etc)
**Result**: ~55% fewer cycles to achieve same quality + reliability.
## HOW TO USE THIS DOCUMENT
### For Managers / Directors
1. **Use as roadmap:** 4 phases, 100 cycles each
2. **Track progress:** Mark cycles as complete
3. **Measure quality:** Track metrics in table above
4. **Plan team capacity:** ~100-112 cycles per person per day
5. **Identify blockers:** If one cycle blocked, skip to next
### For Engineers / Specialists
1. **Read phase overview:** Understand what's being built
2. **Read cycle details:** "DELIVERABLES" section tells you what to do
3. **Follow "SUCCESS CRITERIA":** These define "done"
4. **Use "REQUIREMENTS FROM FOUNDATION":** Don't skip these
5. **Capture lessons:** Document learnings (end of each phase)
### For New Team Members
1. **Start with Phase 1:** Read all 100 cycles
2. **Understand foundations:** Why error handling, logging, etc matter
3. **See patterns:** Same patterns used in Phases 2-4
4. **Know how to add features:** Follow the proven process
## CONCLUSION: BUILDING WISELY
**The Goal:** Every code addition makes the system:
- ✅ Smarter (captures learnings)
- ✅ Stronger (more resilient)
- ✅ More Reliable (fewer bugs)
- ✅ Faster (performance built in)
**The Method:** Foundation → Smart Features → Safe Integrations → Intelligent Operations
**The Outcome:** A platform trusted by creators, relied upon by developers, backed by solid engineering.
**Let's build ONE wisely. 🚀**
**Created:** 2025-10-30
**Reviewed:** [Your name]
**Next Review:** After Phase 1 complete
**Status:** READY FOR EXECUTION