# MindLyst — Beta Launch Readiness Checklist

> **Purpose:** A single place to track what’s left before we can call this “beta launch ready”.
> **Last updated:** 2026-02-14

---

## What “Beta” Means (Pick One)

### Option A: Web Beta (Next.js app)

Goal: a hosted web beta testers can use without local setup.

### Option B: Native Beta (iOS TestFlight + Android Internal Testing)

Goal: mobile builds distributed to testers (plus a hosted backend or a reliable local mode).

---

## Current Repo Health (Verified)

- [x] Secrets scan (tracked files): `bash scripts/secret-scan-repo.sh` passes
- [x] Web lint/build: `cd mindlyst-native/web && npm run lint && npm run build` passes
- [ ] KMP build (Gradle): not verified here (agent sandbox can’t write to `~/.gradle`)
- [ ] iOS TestFlight: `mindlyst-native/MindLyst.xcodeproj` is not present (release script expects manual Xcode project setup)
- [ ] Android build: depends on local Android SDK + `local.properties` (not verified here)

---

## Security & Secrets (Staging)

- [x] Plaintext secrets removed from docs: `docs/WINDSURF/AZURE_PORTAL_SETUP.md`
- [x] MindLyst secrets centralized in Key Vault: `kv-mywisprai` (`mindlyst-*`)
- [ ] Key rotation still required (deferred): see `docs/WINDSURF/AZURE_KEY_VAULT_AND_SECRETS_ROTATION.md`
- [ ] Git history contains past secret values (we are not rewriting history right now). Treat as compromised and rotate keys.

---

## Go / No-Go (Beta)

### Web Beta Go Criteria

- [ ] Choose hosting target (App Service vs Container Apps vs Vercel, etc.)
- [ ] Add authentication (current model uses `x-user-id` / `MINDLYST_USER_ID` and is not “beta safe”)
- [x] Add basic abuse controls (rate limiting + request size limits for `/api/triage`, `/api/brain-chat`): `docs/WINDSURF/WEB_ABUSE_CONTROLS.md`
- [ ] Integrate Key Vault with the hosting runtime (Managed Identity + Key Vault refs, or deployment-time injection)
- [ ] Monitoring: App Insights connected + alerts (error rate, latency, OpenAI failures)
- [ ] Backups / retention policy confirmed for Cosmos + Blob (and deletion semantics)

### Native Beta Go Criteria (iOS/Android)

- [ ] iOS: create/commit the Xcode project setup instructions (and/or the `.xcodeproj` if you want it in repo)
- [ ] Android: stable local build instructions + SDK prerequisites (and CI once runners are available)
- [ ] Backend connectivity strategy:
  - [ ] Either ship with a hosted backend, or
  - [ ] Ship with an offline/local-only mode that provides real value
- [ ] Crash reporting (Crashlytics or equivalent)
- [ ] Push notifications plan: APNs + FCM configured (or explicitly deferred for beta)

---

## Fast Wins We Can Do Next (No Azure Changes)

- [ ] Update `docs/IMPLEMENTATION_PLAN_v2.md` Cloud Infra section to reflect current staging resource names (`rg-mywisprai`) and mark completed items
- [ ] Add a lightweight auth layer for web (e.g. `BETA_API_TOKEN` header) so API isn’t publicly writable when hosted
- [ ] Add “smoke test” scripts for web API routes (triage, brains, memory) that run against staging with Key Vault-fetched env
