Skip to main content

Resume checkpoint — 2026-07-14

Point-in-time snapshot so any session (or person) can resume without re-deriving state. Supersedes 2026-07-03-remaining-work-checkpoint.md for current status. Branch: feat/mvp1-personas-authz (acts as main). HEAD at write time: a0c35f8. Suites: app 555 / SDK 1076, analyze clean. Durable execution ledger (gitignored, richer detail): .superpowers/sdd/progress.md.

What is DONE and LIVE​

Invite feature (adults) — complete end-to-end (2026-07-11)​

  • Layer 1: accept_invite SECURITY DEFINER RPC (email-bound, hash-stored token, typed jsonb reasons, single-use, expiry) + invite_events trail + join-with-code
    • co-parent code surface. Live on Supabase bgedvvmihygwxhjxlvfu, security- hardened (capability guard vs. privilege-escalation takeover), live-verified.
  • Layer 2: send-invite Edge Fn (deployed + wired — email fires on invite) + app deep-link handler (/invite?token=…, cold+warm) + AndroidManifest App Links + marketsite /invite landing + assetlinks.json (SSR endpoint; fingerprints empty until first Play upload).
  • Marketsite deployed at rewhaven.com (CF Worker).

Child self-signup + household consent gate (COPPA) — Layer 1 complete (2026-07-12/13)​

Spec: docs/superpowers/specs/2026-07-12-child-self-signup-consent-gate-design.md. Plan (12 L1 tasks + 4 L2): docs/superpowers/plans/2026-07-12-child-self-signup-consent-gate.md.

  • Full loop LIVE: parent issues a code (per-child attach code from the member editor OR rotatable household join code in Household settings) → child self-signs-up with username+password (child-auth Edge Fn mints a pre-confirmed synthetic-email auth user) → child lands FROZEN in pendingConsent (triple gate: waiting-screen route guard + assertChildDataAllowed + the RLS freeze) → parent approves (VPC via captureConsent → active) or declines (member + auth deleted). 13+ at approval converts to the adult path (ChildSignupService.convertPendingChildToAdult).
  • Migrations live (in order): 20260712000100 (pendingConsent status) / 000200 (link_child RPC + household join-code column) / 000300 (the RLS freeze: member_household_ids() excludes an unconsented child + own-row self-read policy) / 000400 (decline_child RPC) / 000500 (hardening: attach compare-and-swap, new-path ON CONFLICT, partial unique (household_id,auth_user_id) index, decline NOT EXISTS).
  • Edge Fns live: child-auth v2 (create/delete child auth users; generic errors) and expire-pending-children v1 (see Layer 2 below).
  • Verified live: the load-bearing SQL smoke (simulated JWTs — freeze / self-read only / activation via the consents flow / decline / wrong-code / not_a_child) + an RLS sweep proving every household-scoped table routes through the freeze helper and a frozen child cannot self-activate.
  • Final whole-branch review (2 reviewers): no new Critical; all fixes landed (bd57ccf, ed3d5fb), including: child credentials excluded from the debug bloc stream, 13+ conversion moved into the SDK service (one-data-path), freeze guard on /chore-editor /member/:memberId /account.

Layer 2 (child self-signup) — partial​

  • L2-T2 DONE (dormant): expire-pending-children Edge Fn — Sweep A deletes pendingConsent children past the 7-day COPPA window (+ auth users); Sweep B reconciles orphaned child-metadata auth users (fixes the known signIn-rollback orphan). Deployed verify_jwt=false behind a fail-closed x-cron-secret. Partial index 20260713000100 applied. Not yet scheduled — see owner actions.
  • L2-T1 (household "a child is waiting" notification) + L2-T4 (decline-UX) — held for owner self-testing findings. L2-T3 (VPC method tiers) — deferred with legal.

Deployed for solo self-testing (2026-07-13)​

OWNER-GATED actions (blockers only the owner can clear)​

  1. Supabase Auth URL config (fixes the localhost invite redirect — diagnosed 2026-07-13): the project Site URL is still the default http://localhost:3000 and the deploy domains are not in the redirect allow-list, so GoTrue drops the redirectTo on ALL auth emails (invite, signup-confirm, password-reset). Dashboard → Auth → URL Configuration: Site URL https://rewhaven.com; Redirect URLs https://rewhaven.com/** + https://home.eldr-labs.duckdns.org/**. No MCP tool exists for this. OPEN CHOICE: optionally point send-invite's redirect at the duckdns web app for in-browser UAT acceptance (small code change + redeploy) — owner had not yet chosen at write time.
  2. Schedule the expiry sweep: set the CRON_SECRET function secret, enable pg_cron + pg_net, cron.schedule a daily net.http_post to /functions/v1/expire-pending-children with the x-cron-secret header. Until then the reaper is safely dormant (401s everything).
  3. COPPA VPC legal review — DEFERRED (2026-07-13) while the product is single-user (owner self-testing). HARD gate before any public launch / real child users. See memory rewhaven-coppa-legal-gate-deferred.
  4. Android release chain (Play upload → prod signing SHA-256 → fill assetlinks.json fingerprints) — unblocks App Links verification.

Known deferred/minor debt (not blocking)​

  • link_child / child-auth create rate-limiting (join codes are rotatable; worst case is approval-queue spam) — Layer 2 fast-follow.
  • Send-invite email fires on initial invite only, not resend.
  • Invite Minors: accept_invite check-order (email-bind before already_linked); co-parent Regenerate spinner flag; Dev-1 G8 acting-member gating + event actorAuthUserId threading (RLS-backstopped).
  • Flutter two-identity HTTP live test not CI-runnable (publishable key doesn't attach JWT headless) — SQL smokes are the executed proof; self-skipping tests document this (accept_invite_live_test, child_freeze_live_test).

Next work (owner-directed)​

  • Owner is self-testing the child-signup loop on the UAT deploy; findings feed L2-T1 (notification) + L2-T4 (decline-UX).
  • Competitive analysis (2026-07-14, in progress): rewhaven vs the FULL competitive space — engagement benchmarks (Finch, Habitica), mainstream chore/allowance apps, hardware family displays, and neurodivergent-focused apps (Joon, Goally, …) — child-mode engagement gap ("is our child version too bland/watered-down?"). Builds on docs/market-analysis-2026-06.md + docs/decisions/2026-06-22-skylight-competitor-and-calendar.md.
  • Backlog after that: C1.3/C1.4 cache-first slices, private activities/rewards (#208), remaining P1/P2 consolidated backlog items.