You are building Sync, a couple's shared chat MVP. Your task is to implement the product step-by-step, milestone by milestone.
- Shared couple chat with AI reflection β clarification β optional micro-actions
- Strict safety boundaries, EU resources only, delete-only retention
- Turn-taking enforcement (no simultaneous typing)
- Mobile-first with optional web demo
- Production-ready with proper security, testing, and deployment
- Mobile App: React Native (Expo)
- Website: Next.js (App Router)
- API: Node.js + TypeScript (Fastify) + PostgreSQL
- AI: OpenAI with custom orchestrator
- Security: JWT, CORS, RLS, AES-GCM encryption
/app-mobile/ # React Native (Expo)
/website/ # Next.js site + /demo trial chat
/services/api/ # Fastify API + OpenAPI YAML
/services/ai/ # Orchestrator, prompts, evals
/packages/ui/ # Shared UI tokens/components
/packages/types/ # Shared TS types + generated client
/infra/ # DB migrations, env templates, KMS helpers
/docs/ # RFCs, runbooks, openapi.yaml
- PostgreSQL setup with RLS
- JWT authentication
- Basic message CRUD
- Simple AI integration
- Deliverable: Working API with auth
- Session state machine
- Real-time message sync
- Turn-taking enforcement
- Deliverable: Two-device chat flow
- Custom AI prompt engineering
- Safety boundary detection
- Response validation
- Deliverable: AI-powered conversation flow
- Tier-1 content filtering
- Safety templates
- EU support resources
- Frontend safety locks
- Deliverable: Production-ready safety system
- 3-emoji feedback system
- Hard delete functionality
- Survey analytics
- Deliverable: User feedback and data deletion
- Demo chat interface
- Staging gates
- Theme system
- Deliverable: Web demo with staging protection
- Accessibility (WCAG AA)
- Rate limiting
- Copy review
- Comprehensive testing
- Deliverable: Production-ready application
- Encryption at rest: AES-GCM on sensitive columns
- EU-only resources: All data processing in EU region
- Delete-only retention: No data export, only deletion
- Safety boundaries: AI content filtering and boundary detection
- Turn-taking enforcement: No simultaneous typing
- Backend: Node.js, TypeScript, Fastify, PostgreSQL
- Frontend: React Native (Expo), Next.js
- AI: OpenAI GPT-4 with custom orchestrator
- Security: JWT, CORS, RLS, AES-GCM
- Deployment: Vercel (web), Expo (mobile)
- Milestone-by-milestone: Never skip or merge milestones
- Explicit approval: Ask for approval before proceeding
- Comprehensive deliverables: Code, tests, docs, demos
- Production-ready: Each milestone must be deployable
- Security-first: All features must meet security requirements
- Functional: Complete couple chat with AI assistance
- Secure: Production-ready security and privacy
- Scalable: Proper architecture for growth
- Maintainable: Clean code with comprehensive tests
- Accessible: WCAG AA compliance
- Deployable: Ready for production deployment
Remember: Always ask for explicit approval before starting the next milestone. Never skip or merge milestones.