Prototype

Now, releasing December 2026. Code name Pilot Light. Audience is internal developers and designers only.

The Prototype release means the product is feature-complete and deliberately attacked and verified. It does not mean production or legal clearance: the cutover, the counsel-facing legal work, and everything downstream of them belong to Alpha, because 100% production readiness by December is not realistic and legal only becomes a blocker once outsiders arrive (operator, 2026-08-31).

P0 here means blocks the December release.

Phases are sequential. See Phases.

Phase 1: Environment

Task	Category	Priority	Description	Why	Status	Issues
Onboarding path	Eng, Ops	🔴 P0	One onboarding page, a doctor command that names the next step, POC-side access granting	A newcomer productive in ten minutes without hand-holding	✅ Built	#825, #829
Personal context sync	Eng	🔴 P0	Adopt the context repo on every machine, keep it current, dated volatile files, generated index	Context stranded per machine loses work and starts sessions blind	🚧 In progress	#834, #861, #862
Local service stacks	Eng	🟠 P1	One command to bring up a preset of services with port-collision guards	Standing up a stack by hand is where an afternoon goes	⬜ Not started	#855
Doctor learns more	Eng	🟠 P1	Worktree health, port status, the stale-server hint	The single best diagnostic should cover the things that actually break	✅ Built	#857
Local admin and merchant login	Eng	🟠 P1	ADC cannot mint custom tokens, so local portal login is impossible	Forces portal work onto deployed dev	⬜ Not started	#819
Prebuilt Codespace	Eng	🟡 P2	One-click environment with the agent tooling preinstalled	Only worth it if someone joins who cannot use the local path	⬜ Not started	#801

Phase 2: Build

The product works end to end.

Task	Category	Priority	Description	Why	Status	Issues
Chat	Eng	🔴 P0	End-to-end encrypted 1:1 messaging inside a connection	Two people who waved need somewhere to arrange the actual meet	✅ Built	#166
Frens	Eng	🔴 P0	Keep a connection after a successful meet	Turns a one-off into retention, the second thing Alpha measures	✅ Built	#159, #131
Invite-gated signup	Eng	🔴 P0	Account creation requires a single-use invite link, consumed server-side	Alpha is invite-only, and this is the mechanism that enforces it	✅ Built	#375
Light a lantern	Eng	🔴 P0	Pick a venue, signal availability, expire on the 2-hour lifetime	It is the product	✅ Built	#177, #28
Phone and PIN sign-in	Eng	🔴 P0	Phone plus PIN, external OTP behind a flag and a hard spend ceiling	The door to the product	✅ Built	#289, #699
User profiles	Eng	🔴 P0	Anonymous profile with interests, client-side encrypted	Interests are what strangers match on	✅ Built	#132, #147
Venue data	Eng	🔴 P0	Real venues with hours and age rules from OpenStreetMap plus enrichment	A lantern with nowhere to be lit is not a test	✅ Built	#222, #250
Wave to meet	Eng	🔴 P0	Send and accept a meeting request between two lit lanterns	The mechanic Alpha exists to validate	✅ Built	#177, #740
Push notifications	Eng	🟠 P1	Real OS push for waves and accepts, Android and desktop Chrome	A wave nobody sees is a meet that does not happen	✅ Built	#161
Block	Eng, Safety	🔴 P0	Severs visibility both directions	Nobody meets strangers without an exit	✅ Built	#144
Report	Eng, Safety	🔴 P0	In-chat report that opens a moderation case	The channel for the thing we hope does not happen	✅ Built	#662, #678
Moderation pipeline	Eng, Safety	🔴 P0	Report to case to notice, with appeals	A report nobody reads is theater	✅ Built	#145, #677
Location proximity gating	Eng, Safety	🔴 P0	The server validates you are at the venue before a lantern lights	A lantern lit from home is a stranger who is not where they say they are	✅ Built	#155, #210
Merchant provisioning seam	Eng	🔴 P0	Application to approved to provisioned without an admin bridging it by hand	Alpha-gating per the 2026-08-03 gap map	✅ Built	#790, #793
Merchant signup and approval	Eng	🔴 P0	Application, review, approval into a merchant account	No offers exist until merchants can get in	✅ Built	#136, #138
Offers	Eng	🔴 P0	Create, publish, and expire an offer against a venue	What a partner merchant runs during Alpha	✅ Built	#357
Offer moderation gate	Eng, Safety	🔴 P0	Publish holds at pending review; only an admin approval makes an offer live	Nothing unreviewed reaches a user during Alpha	✅ Built	#796
Redemption and claims	Eng	🔴 P0	A user claims an offer, the merchant sees it happened	Without this there is no attribution	✅ Built	#704
Moderation surfaces	Eng, Safety	🔴 P0	Cases, claim, escalate, priority, sealed ban, appeals	Someone has to act on a report during Alpha	✅ Built	#621, #678
Venue creation from admin	Eng	🔴 P0	Create and edit a net-new venue in the portal	Venues otherwise only arrive by OSM import	✅ Built	#786
Event pipeline	Eng, Analytics	🔴 P0	App events into BigQuery, modeled for reporting	Everything downstream reads from it	✅ Built	#64, #272
Ad delivery telemetry	Analytics, Eng	🟠 P1	Impressions, fills and claim attribution behind a k-anonymity gate	What a merchant is shown has to come from somewhere	✅ Built	#694, #696
Account deletion and retention	Eng, Legal	🔴 P0	Full deletion cascade, enforced retention, BigQuery pseudonymization	The privacy policy will promise exactly this, and it is already true	✅ Built	#151, #749
Attribution, no-POS path	Analytics, Business	🔴 P0	Lit lantern redeems in-app with an animated confirmation shown at the counter	Pilot venues can test this with no merchant systems integration	❓ Needs operator input	#965, #704
Merchant-side dashboards	Analytics, Design	🟠 P1	What a partner merchant sees about their own offers and foot traffic	The partnership promises them data	🚧 In progress	#320
Venue and activity dashboards	Analytics, Design	🟠 P1	Period activity, wave accept rates, offer delivery	How we watch the experiment while it runs	🚧 In progress	#320
Polish and refinement	Design, Eng	🔴 P0	A deliberate pass over the app, merchant surfaces and admin portal	Real users meet strangers through this; unfinished edges read as untrustworthy	🚧 In progress	#293
Splash page refinement	Design, Growth	🟠 P1	Copy, layout and visual polish across the public site	Invited people land here before they can open the app	⬜ Not started	#848, #593
Embers, minimal set	Eng, Design	🟠 P1	Three badges tied to what Alpha proves: showed up, lit a lantern, met someone	Badges shape behavior, so the starting set is itself a hypothesis	⬜ Not started	#579, #160
Google Places integration	Eng, Business	🟠 P1	Google Places alongside OpenStreetMap, with cost established	Venue coverage is the supply side, and OSM alone does not reliably give it	⬜ Not started	#866
Performance optimization	Eng	🟠 P1	Load and responsiveness under real usage	First impressions, even at invite scale	⬜ Not started	#153
Ad Network as a first-class surface	Eng, Design	🟠 P1	Its own page and section under Platform in the admin site	It is a product area now, and burying it makes it unmanageable	⬜ Not started
Venues search and filters	Eng, Design	🟠 P1	The venues list has neither	Unusable once there is more than a handful	⬜ Not started
Interest-based venue filtering	Eng	🟡 P2	Filter venues by interest	Makes a small venue list feel chosen rather than sparse	⬜ Not started	#319
Privacy architecture in place	Eng, Legal	🔴 P0	Sealed identity stages landed before real phone numbers scale	Plaintext phones in production are hard to walk back	🚧 In progress	#523, #875, #874
Credential and identity colocation	Eng, Safety	🔴 P0	Credentials and sealed-identity material out of documents admin clients read wholesale	Firestore has no field-level read control, so a routine admin read shipped hashes to the browser	🚧 In progress	#875
Data classification and egress	Eng, Safety	🔴 P0	One policy for what each consumer may emit and where	Answered ad hoc four times already; search and the apps platform would each invent a fifth	⬜ Not started	#874
Admin portal mobile layout	Design, Eng	🟠 P1	The sidebar never collapses; content renders off-screen on a phone	Moderation may need answering away from a desk	⬜ Not started	#826
Lantern naming	Eng, Design	🟡 P2	Unique generation with display-time disambiguation, expanded word lists, user-chosen names	A permanent numeric suffix is a small identity leak in an anonymous product	⬜ Not started	#251, #578
Offer review layout	Design	🟠 P1	The last screen before publishing reads as broken	Reviewers use it every day of Alpha	✅ Built	#818
Profile completion metric	Eng, Analytics	🟡 P2	Counts plaintext fields that encryption deliberately deletes, so it is structurally near-zero	The operator reads that number as truth	⬜ Not started	#881
System Health false DOWN	Eng	🟡 P2	Browser CORS probes report services down that are up	Operational confidence during a live event	⬜ Not started	#797

Phase 3: Gates

Task	Category	Priority	Description	Why	Status	Issues
Contrast enforced for real	Eng, Design	🔴 P0	axe is blind three ways (unparseable colour, exactly 1:1, layered backgrounds); the palette converges so it can see	A user's own lantern name shipped invisible behind a green 347/347 suite	🚧 In progress	#895, #878
Story coverage and a11y gate	Eng	🔴 P0	Every component has a story; axe gates at error	Catches what a human sweep does not	✅ Built	#814
Admin zone lint gate	Eng	🟠 P1	Ratchet on eslint errors in the admin zones	A core alpha surface accumulated 55 errors while ungated	✅ Built	#806
Shared UI primitives	Eng	🟡 P2	Extract the repeated CloseButton, PasswordReveal, ViewModeToggle	Divergence is where inconsistency enters	⬜ Not started	#822
Admin vitest alignment	Eng	🟡 P2	Build-versus-test transform split under vite 8	Blocks the admin suite from moving forward	⬜ Not started	#804

Phase 4: Prove

Deliberately attacked, and verified by running rather than by reading.

Evidence: break-it walkthrough.

Task	Category	Priority	Description	Why	Status	Issues
Live two-account E2E	Eng	🔴 P0	Actually run the loop with two accounts, including the offer round-trip	Both halves run on deployed dev 2026-08-16: two accounts wave, accept and chat; and a merchant publish held at pending review, invisible to a user at the venue, admin approved, then discovered and claimed	✅ Verified	#817
Intentional break-it walkthrough	Eng, Design	🔴 P0	Deliberately try to break things, then fix what gives	Finds the edges a happy-path demo never touches	🚧 In progress	#193
Full manual code review	Eng	🔴 P0	Read the codebase piece by piece: understand it, optimize, confirm no vulnerabilities	Automated checks catch classes of problems; a human reading everything catches what nobody thought to test for	⬜ Not started	#523
Penetration testing	Eng, Safety	🔴 P0	An outside-our-infrastructure system that emulates breaking in	Our own tests share our own blind spots	⬜ Not started	#865
Android and iOS device testing	Eng	🔴 P0	Install, push and offline behavior across real devices	The PWA is the product	⬜ Not started	#963
iOS PWA push verification	Eng	🟠 P1	Install to home screen and verify push on a real iPhone	If Alpha users carry iPhones, push is part of the experiment	⬜ Not started	#722
Untested API functions on alpha paths	Eng	🔴 P0	109 exported functions across the six API services are imported by no test in their own service (auth 49, venues 18, lanterns 11, analytics 13, merchants 6, assistant 12). Ranked subset is DONE except the half on another lane's territory. Run npm run count:untested-api	Tracked on IMPORTED-by-a-test, not mentioned: the mention floor counted a guard as covered on the strength of a prose comment. It reads 76, and the 33 in between are reached by nothing	🚧 In progress	#962, #942

Phase 5: Internal tools

Not a gate on the December release; it rides alongside and finishes when it finishes.

Task	Category	Priority	Description	Why	Status	Issues
Doc site taxonomy	Eng, Ops	🟠 P1	Four subdomains, three audiences, one internal-only and needing a real gate	"Internal" with nothing enforcing it is a label, not a boundary	⬜ Not started	#883
Intranet search	Eng	🟠 P1	Search across docs, worklogs, plans and issues	Finding where something was written down	⬜ Not started	#800
Go links	Eng	🟡 P2	Speakable short URLs for internal resources	Cheap once search exists	⬜ Not started	#811
Ranked next-task list	Eng	🟡 P2	Print the board, live plans and scored issues in the terminal	Answers "what now" without a person deciding	⬜ Not started	#856, #859
Team-built apps platform	Eng, Business	🟡 P2	Let a non-engineer build on Lantern infrastructure. Needs a spec first	The least defined thing on this page, and the privacy boundary questions live here	⬜ Not started	#827, #849

Runs throughout

Task	Category	Description	Status	Issues
Funding and grants outreach	Business	Non-dilutive grants (woman, veteran, LGBTQ+ founder) and the outreach cadence behind them. Grants only: no shareholders, no venture capital (operator, 2026-08-31)	⬜ Not started	#629
Broken doc links	Docs	Roughly 500 links point at moved or absent files	🚧 In progress	#833
Guide consolidation	Docs	Overlapping and duplicated guides under docs/engineering/guides	⬜ Not started	#840
Dependency currency	Eng	vitest 3 to 4, lucide-react 0.x to 1.x, the Cloud Functions Node pin	⬜ Not started	#771, #770, #838
Agent guidance	Ops	Skills, rules and coordination discipline, kept current as lessons land	🚧 In progress

Bugs

Bug	Surface	Priority	Description	Status	Issues
Lantern lifetime copy	App	🔴 P0	The UI said 48 hours in three places while the server expired lanterns at 2	✅ Fixed	#789
Invisible lantern names	App	🔴 P0	Six of 31 adjectives rendered unreadable on the dark app; Onyx measured 1.01:1	✅ Fixed	#878
Anthropic spend missing from billing	Analytics	🟡 P2	Absent from some reports	⬜ Not started
Reporting-period layout	Analytics	🟡 P2	Spans the full page width instead of fitting its content	⬜ Not started