App build todos

PRD version/commit:

Rules

• Work one milestone at a time.
• Do not start an item with a missing input or unresolved human decision.
• End each milestone with evidence and a commit.
• Record discovered work; do not silently expand scope.

Milestone 0 — Approved baseline

• ☐ Pinned starter checked out
• ☐ Upstream MIT licence preserved
• ☐ Dependencies installed
• ☐ Baseline checks pass
• Evidence:
• Commit:

Milestone 1 — Honest shell

• ☐ Keep/change/defer map approved
• ☐ Starter identity and claims removed
• ☐ Deferred systems cleanly disabled or removed
• Evidence:
• Commit:

Milestone 2 — Backend

• ☐ Supabase environment configured without tracked secrets
• ☐ Existing migrations reviewed and applied
• ☐ Health and profile creation checked
• Evidence:
• Commit:

Milestone 3 — Core data

• ☐ Ownership and constraints approved
• ☐ Generated migration reviewed before apply
• ☐ RLS policy behavior tested as two users
• Evidence:
• Commit:

Milestone 4 — Authentication

• ☐ Google provider and redirects configured
• ☐ Missing Google sign-in control implemented
• ☐ Callback, session, profile, protected route, and sign-out tested
• Evidence:
• Commit:

Milestone 5 — Vertical slice

• ☐ Create
• ☐ View
• ☐ Update
• ☐ Delete/archive
• ☐ Validation and ownership checks
• Evidence:
• Commit:

Milestone 6 — Differentiator

• ☐ Project-specific feature approved
• ☐ Failure and evaluation cases implemented
• Evidence:
• Commit:

Milestone 7 — Release

• ☐ PRD acceptance checks pass
• ☐ Production environment and migration reviewed
• ☐ Production auth, data, health, and unauthorized access tested
• Evidence:
• Commit/deployment:

Discovered work