section

Project: an app

Turn a learner-chosen app idea into one secure, authenticated, tested, and deployed vertical slice.

You choose the app. The course supplies the sequence and the review gates:

PRD → pinned baseline → plan → data → auth → vertical slice → differentiator → evidence → release

A two-row app workflow moves from a PRD through human-reviewed planning and a baseline commit, then loops through bounded builds, optional data and sign-in, testing, diff review, and commits.

The project references KRSHH/standard-saas-starter at tested commit e887b0c. It does not define your user, feature, or schema for you.

Step	Lesson	Evidence
1	Write the PRD	One user, job, object, flow, and acceptance set
2	Start from the tested template	Licensed, pinned, passing baseline
3	Map and strip the starter	Honest shell and approved system map
4	Connect Supabase	Secret-safe backend and inspected baseline schema
5	Design and migrate core data	Reviewed migration and ownership tests
6	Add Google sign-in	Real OAuth session and protected route
7	Build one vertical slice	Protected create/view/update/delete workflow
8	Add the differentiator	Product-specific value with failure checks
9	Test against the PRD	Repeatable and human evidence
10	Deploy and verify production	Live auth, data, health, and boundary checks
11	Add optional layers deliberately	One named need, fully configured—or no addition

Instructors should use the milestone guide.

Write the PRD

Define one learner-chosen user, job, data object, complete workflow, differentiator, and observable acceptance set.

Start from the tested template

Create a learner-owned repository from the audited KRSHH starter commit while preserving its MIT licence and baseline evidence.

Map and strip the starter

Decide which starter systems serve the PRD and remove or disable misleading optional surfaces in reviewable batches.

Connect Supabase

Configure Supabase locally without tracking secrets, review the starter migrations, and prove auth/database plumbing before product schema work.

Design and migrate the core data

Translate the learner's PRD into an owned data model, review generated SQL and RLS, and test both user and privileged query boundaries.

Add Google sign-in

Configure Google through Supabase and implement the OAuth entry point missing from the tested starter's sign-in form.

Build one vertical slice

Complete one protected create, view, update, and delete workflow from the interface through validated, owner-scoped data access.

Add the differentiator

Add the learner's product-specific value after the protected core workflow works, with explicit inputs, failures, and evaluation.

Test against the PRD

Convert the approved PRD into repeatable static, unit, browser, authentication, permission, and human acceptance evidence.

Deploy and verify production

Deploy the tested app with reviewed environments and migrations, then prove production auth, health, data ownership, and rollback.

Add optional production layers deliberately

Add one optional production system only when a named product need justifies its full data, security, cost, failure, and maintenance surface.