diff --git a/.bmad/bmm-workflow-status.yaml b/.bmad/bmm-workflow-status.yaml index 1350a5e..c6e8560 100644 --- a/.bmad/bmm-workflow-status.yaml +++ b/.bmad/bmm-workflow-status.yaml @@ -12,8 +12,107 @@ project: completed_points: 431 # All V1 completed active_track: prod # V2 retired into prod series +# Release Phases (active) — overlay on top of the 28-epic prod roadmap +# Pilot v1 → MENA-10 → Public Launch +# Manifests: epics/phase-1-pilot-v1.md, phase-2-mena10.md, phase-3-launch.md +release_phases: + phase_1_pilot_v1: + sprints: [P1, P2, P3] + weeks: 7 + points: 296 + target_date: 2026-07-12 + status: not-started + pilot_tenant: "King Fahad Schools (Sudan)" + manifest: epics/phase-1-pilot-v1.md + success_criteria: + - "King Fahad converts to paid in Jun/Jul 2026 conversation" + - "Play Internal Testing track live with admin + parent test cohort" + - "Crash-free user rate >= 99% on internal track" + - "Arabic translation audit rated >= 95% natural by native-speaker review" + + phase_2_mena10: + sprints: [P4, P5, P6, P7, P8] + weeks: 10 + points: 411 + target_date: 2026-09-15 + status: not-started + manifest: epics/phase-2-mena10.md + success_criteria: + - "10 pilot schools onboarded" + - ">= 1 paid conversion" + - "Admission flow used by >= 3 schools for Sep 2026 intake" + - "Crash-free user rate >= 99%" + - "Unit test coverage >= 35%" + + phase_3_launch: + sprints: [P9, P10, P11, P12, P13, P14, P15, P16] + weeks: 16 + points: 408 + target_date: 2026-12-20 + status: not-started + manifest: epics/phase-3-launch.md + success_criteria: + - "v1.0.0 in Play Store production (staged rollout to 100%)" + - "Unit test coverage >= 80%; crash-free users >= 99.5%" + - "TalkBack + WCAG AA audit clean" + +# Per-story release-phase mapping (Phase 1 enumerated; Phase 2/3 see manifests). +# Pick next work from phase_1_story_ids in dependency order — full AC in epics/epic-prod-NN-*.md. +phase_1_story_ids: + E01: [S01, S02, S03, S04, S05, S06, S07] + E02: [S01, S02, S06, S08, S09] + E03: [S01, S04, S05, S06, S08] + E04: [S01, S02, S05, S06] + E05: [S01, S02, S04, S05] + E06: [S01, S02, S03, S05, S07, S10] + E07: [S01, S02, S03] + E08: [S01, S02, S03, S04, S05, S06, S07, S11, S12, S14, S16, S17, S20] # S20 admission portion only + E09: [S06, S07] + E10: [S01, S05, S08, S09] + E11: [S01, S03, S07] + E19: [S01, S02, S03, S04, S05, S06] + E25: [S01, S08] + E26: [S01, S02, S03, S04] + E27: [S01, S03, S04] +# Total: 71 stories ~296 points + +# Epics whose pilot/MENA-10/launch work concentration drives staffing focus. +# (A single epic can contribute to multiple phases; this lists where the *bulk* lives.) +release_phase_concentration: + primarily_phase_1_pilot: + - epic-prod-01 # foundation: 26/42 pts in P1 + - epic-prod-07 # locale formatting: 13/18 pts in P1 + primarily_phase_2_mena10: + - epic-prod-02 # tenancy RBAC + - epic-prod-03 # auth hardening + - epic-prod-04 # UI i18n + - epic-prod-06 # DB translation + - epic-prod-08 # API contract + - epic-prod-09 # real-time layer + - epic-prod-10 # auth/profile UI + - epic-prod-13 # attendance behaviour + - epic-prod-14 # grading exams + - epic-prod-16 # fees finance + - epic-prod-18 # communications + - epic-prod-19 # admission (P1) + library/idcard/wallet (P3) — mixed + - epic-prod-22 # test infra + - epic-prod-25 # security hardening + - epic-prod-26 # observability + - epic-prod-27 # release pipeline + primarily_phase_3_launch: + - epic-prod-05 # RTL — most polish in P3 + - epic-prod-11 # dashboard + - epic-prod-12 # SIS + - epic-prod-15 # timetable curriculum + - epic-prod-17 # LMS + - epic-prod-20 # role portals + - epic-prod-21 # settings + - epic-prod-23 # performance + - epic-prod-24 # accessibility + - epic-prod-28 # Play Store launch + # Production-Readiness Roadmap (active) -# Source plan: ~/.claude/plans/typed-wobbling-giraffe.md +# Source plan: ~/.claude/plans/take-web-app-as-precious-turtle.md (refresh of typed-wobbling-giraffe.md) # Overview: epics/epic-prod-overview.md prod_epics: total_epics: 28 diff --git a/.bmad/epics/README.md b/.bmad/epics/README.md new file mode 100644 index 0000000..22f6b12 --- /dev/null +++ b/.bmad/epics/README.md @@ -0,0 +1,46 @@ +# Hogwarts Android — Production Roadmap + +This directory holds the **active** production roadmap for `databayt/android-app`. Two coordinate axes describe each story: a **build phase** (dependency order) and a **release phase** (ship order). + +## Two-axis model + +| Axis | Phases | What it tells you | +|---|---|---| +| **Build phase** (existing) | A Foundation · B i18n · C Backend · D Features · E Quality · F Production | Which work must complete before which other work | +| **Release phase** (new overlay) | 1 Pilot v1 · 2 MENA-10 · 3 Public Launch | Which customer milestone the work serves | + +A story like `E13.S04` (mark attendance bulk) lives in **build phase D** (it depends on backend endpoints from C) and **release phase 2** (it ships to support the 10 pilot schools, not the first one). The two phases are orthogonal — read each story's header for both. + +## Start here + +| File | Purpose | +|---|---| +| [`epic-prod-overview.md`](./epic-prod-overview.md) | Master roadmap. 28 epics, 1115 points, 16 sprints, both axes summarised. | +| [`phase-1-pilot-v1.md`](./phase-1-pilot-v1.md) | **The next ~7 weeks.** King Fahad Schools (Sudan) pilot conversion target. | +| [`phase-2-mena10.md`](./phase-2-mena10.md) | MENA-10 program — scale from 1 to 10 schools. | +| [`phase-3-launch.md`](./phase-3-launch.md) | Public Play Store launch (v1.0.0). | + +## Individual epic files + +`epic-prod-01-*.md` through `epic-prod-28-*.md` — one file per epic, ~10 stories each, with acceptance criteria + file refs + estimates. Each story's header marks both its build phase and its release phase. + +## Status + +`../bmm-workflow-status.yaml` is the canonical source of "what's done / in progress / not started" per story and per epic. Update it as work lands. + +## Archive + +`./archive/` holds: + +- `epic-01..17-*.md` — V1 epics (the completed UI shell; 431 points; superseded). +- `epic-v2-01-backend-api.md` — V2 backend API draft (folded into `epic-prod-08`). +- `docs-epics/epic-1..7-*.md` — Earlier `docs/epics/` mirrors (stale). + +These remain readable for historical reference; do not pick up stories from them. + +## How to use this directory + +- **Picking next work:** read the active phase manifest (`phase-1-pilot-v1.md` today). Find the next story whose dependencies are merged. Follow [`.claude/rules/github-workflow.md`](../../.claude/rules/github-workflow.md). +- **Adding a story:** add it to the relevant `epic-prod-NN-*.md` file. Tag it with `**Phase: **` and a sprint. Update `bmm-workflow-status.yaml`. +- **Shifting a story between release phases:** edit its header marker, move it in the relevant phase manifest, update `bmm-workflow-status.yaml`. Don't renumber. +- **Closing an epic:** mark all stories `completed` in the YAML; tick the epic's DoD; leave the epic file in place. diff --git a/docs/epics/epic-1-auth.md b/.bmad/epics/archive/docs-epics/epic-1-auth.md similarity index 100% rename from docs/epics/epic-1-auth.md rename to .bmad/epics/archive/docs-epics/epic-1-auth.md diff --git a/docs/epics/epic-2-dashboard.md b/.bmad/epics/archive/docs-epics/epic-2-dashboard.md similarity index 100% rename from docs/epics/epic-2-dashboard.md rename to .bmad/epics/archive/docs-epics/epic-2-dashboard.md diff --git a/docs/epics/epic-3-student.md b/.bmad/epics/archive/docs-epics/epic-3-student.md similarity index 100% rename from docs/epics/epic-3-student.md rename to .bmad/epics/archive/docs-epics/epic-3-student.md diff --git a/docs/epics/epic-4-teacher.md b/.bmad/epics/archive/docs-epics/epic-4-teacher.md similarity index 100% rename from docs/epics/epic-4-teacher.md rename to .bmad/epics/archive/docs-epics/epic-4-teacher.md diff --git a/docs/epics/epic-5-guardian.md b/.bmad/epics/archive/docs-epics/epic-5-guardian.md similarity index 100% rename from docs/epics/epic-5-guardian.md rename to .bmad/epics/archive/docs-epics/epic-5-guardian.md diff --git a/docs/epics/epic-6-messaging.md b/.bmad/epics/archive/docs-epics/epic-6-messaging.md similarity index 100% rename from docs/epics/epic-6-messaging.md rename to .bmad/epics/archive/docs-epics/epic-6-messaging.md diff --git a/docs/epics/epic-7-offline.md b/.bmad/epics/archive/docs-epics/epic-7-offline.md similarity index 100% rename from docs/epics/epic-7-offline.md rename to .bmad/epics/archive/docs-epics/epic-7-offline.md diff --git a/.bmad/epics/epic-01-authentication.md b/.bmad/epics/archive/epic-01-authentication.md similarity index 100% rename from .bmad/epics/epic-01-authentication.md rename to .bmad/epics/archive/epic-01-authentication.md diff --git a/.bmad/epics/epic-02-dashboard.md b/.bmad/epics/archive/epic-02-dashboard.md similarity index 100% rename from .bmad/epics/epic-02-dashboard.md rename to .bmad/epics/archive/epic-02-dashboard.md diff --git a/.bmad/epics/epic-03-student.md b/.bmad/epics/archive/epic-03-student.md similarity index 100% rename from .bmad/epics/epic-03-student.md rename to .bmad/epics/archive/epic-03-student.md diff --git a/.bmad/epics/epic-04-teacher.md b/.bmad/epics/archive/epic-04-teacher.md similarity index 100% rename from .bmad/epics/epic-04-teacher.md rename to .bmad/epics/archive/epic-04-teacher.md diff --git a/.bmad/epics/epic-05-guardian.md b/.bmad/epics/archive/epic-05-guardian.md similarity index 100% rename from .bmad/epics/epic-05-guardian.md rename to .bmad/epics/archive/epic-05-guardian.md diff --git a/.bmad/epics/epic-06-messaging.md b/.bmad/epics/archive/epic-06-messaging.md similarity index 100% rename from .bmad/epics/epic-06-messaging.md rename to .bmad/epics/archive/epic-06-messaging.md diff --git a/.bmad/epics/epic-07-offline.md b/.bmad/epics/archive/epic-07-offline.md similarity index 100% rename from .bmad/epics/epic-07-offline.md rename to .bmad/epics/archive/epic-07-offline.md diff --git a/.bmad/epics/epic-08-fees.md b/.bmad/epics/archive/epic-08-fees.md similarity index 100% rename from .bmad/epics/epic-08-fees.md rename to .bmad/epics/archive/epic-08-fees.md diff --git a/.bmad/epics/epic-09-exams.md b/.bmad/epics/archive/epic-09-exams.md similarity index 100% rename from .bmad/epics/epic-09-exams.md rename to .bmad/epics/archive/epic-09-exams.md diff --git a/.bmad/epics/epic-10-profile.md b/.bmad/epics/archive/epic-10-profile.md similarity index 100% rename from .bmad/epics/epic-10-profile.md rename to .bmad/epics/archive/epic-10-profile.md diff --git a/.bmad/epics/epic-11-notifications.md b/.bmad/epics/archive/epic-11-notifications.md similarity index 100% rename from .bmad/epics/epic-11-notifications.md rename to .bmad/epics/archive/epic-11-notifications.md diff --git a/.bmad/epics/epic-12-attendance.md b/.bmad/epics/archive/epic-12-attendance.md similarity index 100% rename from .bmad/epics/epic-12-attendance.md rename to .bmad/epics/archive/epic-12-attendance.md diff --git a/.bmad/epics/epic-13-grades.md b/.bmad/epics/archive/epic-13-grades.md similarity index 100% rename from .bmad/epics/epic-13-grades.md rename to .bmad/epics/archive/epic-13-grades.md diff --git a/.bmad/epics/epic-14-timetable.md b/.bmad/epics/archive/epic-14-timetable.md similarity index 100% rename from .bmad/epics/epic-14-timetable.md rename to .bmad/epics/archive/epic-14-timetable.md diff --git a/.bmad/epics/epic-15-design-system.md b/.bmad/epics/archive/epic-15-design-system.md similarity index 100% rename from .bmad/epics/epic-15-design-system.md rename to .bmad/epics/archive/epic-15-design-system.md diff --git a/.bmad/epics/epic-16-production.md b/.bmad/epics/archive/epic-16-production.md similarity index 100% rename from .bmad/epics/epic-16-production.md rename to .bmad/epics/archive/epic-16-production.md diff --git a/.bmad/epics/epic-17-critical-stubs.md b/.bmad/epics/archive/epic-17-critical-stubs.md similarity index 100% rename from .bmad/epics/epic-17-critical-stubs.md rename to .bmad/epics/archive/epic-17-critical-stubs.md diff --git a/.bmad/epics/epic-v2-01-backend-api.md b/.bmad/epics/archive/epic-v2-01-backend-api.md similarity index 100% rename from .bmad/epics/epic-v2-01-backend-api.md rename to .bmad/epics/archive/epic-v2-01-backend-api.md diff --git a/.bmad/epics/epic-prod-01-foundation-hardening.md b/.bmad/epics/epic-prod-01-foundation-hardening.md index 450fb1a..1b14f5b 100644 --- a/.bmad/epics/epic-prod-01-foundation-hardening.md +++ b/.bmad/epics/epic-prod-01-foundation-hardening.md @@ -33,7 +33,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop ## 2. Stories -### Story E01.S01: Commit `google-services.json` for debug + staging + release [2 pts] +### Story E01.S01: Commit `google-services.json` for debug + staging + release [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** new contributor, **I want** the Firebase plugin to find its config, **So that** a fresh checkout builds without manual setup. @@ -48,7 +48,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop --- -### Story E01.S02: Replace `fallbackToDestructiveMigration()` with explicit migrations [8 pts] +### Story E01.S02: Replace `fallbackToDestructiveMigration()` with explicit migrations [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** user upgrading the app, **I want** my offline data to survive schema bumps, **So that** I don't lose attendance, messages, or grades on every release. @@ -68,7 +68,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop --- -### Story E01.S03: Wire mutation queue to actually transmit [8 pts] +### Story E01.S03: Wire mutation queue to actually transmit [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** teacher marking attendance offline, **I want** the marks to reach the server when I'm back online, **So that** my work isn't lost. @@ -89,7 +89,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop --- -### Story E01.S04: Upload FCM token to backend [3 pts] +### Story E01.S04: Upload FCM token to backend [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** server operator, **I want** every device's FCM token registered, **So that** push notifications can reach the right device. @@ -106,7 +106,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop --- -### Story E01.S05: Reconcile `BuildConfigHelper` drift with compiled `BuildConfig` [2 pts] +### Story E01.S05: Reconcile `BuildConfigHelper` drift with compiled `BuildConfig` [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** future reader of `BuildConfigHelper`, **I want** one source of truth for the API base URL, **So that** I don't have to chase down two divergent constants. @@ -121,7 +121,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop --- -### Story E01.S06: Reconcile `app/strings.xml` parity drift [1 pt] +### Story E01.S06: Reconcile `app/strings.xml` parity drift [1 pt] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** CI runner, **I want** `:app:checkStringParity` to be green, **So that** the build doesn't fail on a single missing translation. @@ -134,7 +134,7 @@ The MVP shell ships with several silent stubs that would corrupt user data, drop --- -### Story E01.S07: Wire `AppStartupInitializer` into `HogwartsApplication.onCreate` [2 pts] +### Story E01.S07: Wire `AppStartupInitializer` into `HogwartsApplication.onCreate` [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** developer triaging startup issues, **I want** the existing initializer skeleton actually invoked, **So that** I have one place to add startup hooks. diff --git a/.bmad/epics/epic-prod-02-multi-tenancy-rbac.md b/.bmad/epics/epic-prod-02-multi-tenancy-rbac.md index 033c5eb..07890b9 100644 --- a/.bmad/epics/epic-prod-02-multi-tenancy-rbac.md +++ b/.bmad/epics/epic-prod-02-multi-tenancy-rbac.md @@ -30,7 +30,7 @@ Production-grade tenant isolation and 8-role permission enforcement. Every Room ## 2. Stories -### Story E02.S01: Expand `UserRole` enum to 8 roles [2 pts] +### Story E02.S01: Expand `UserRole` enum to 8 roles [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** mobile user with the ACCOUNTANT role on the web, **I want** my role to be honored on mobile, **So that** I can do my job from the field. @@ -48,7 +48,7 @@ Production-grade tenant isolation and 8-role permission enforcement. Every Room --- -### Story E02.S02: Move `SessionManagerImpl` from `app/.../di/repository-module.kt` into `core/security` [3 pts] +### Story E02.S02: Move `SessionManagerImpl` from `app/.../di/repository-module.kt` into `core/security` [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 1 **As a** developer auditing security primitives, **I want** session storage in `core/security`, **So that** the auditable surface is one module. @@ -115,7 +115,7 @@ Production-grade tenant isolation and 8-role permission enforcement. Every Room --- -### Story E02.S06: Rewrite `TenantContext` to surface tenant + role + scoping helpers [5 pts] +### Story E02.S06: Rewrite `TenantContext` to surface tenant + role + scoping helpers [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 2 **As a** repository, **I want** a single source of truth for the active tenant + user scope, **So that** I never have to manually thread `schoolId`, `userId`, `classIds`, etc. through method parameters. @@ -149,7 +149,7 @@ Production-grade tenant isolation and 8-role permission enforcement. Every Room --- -### Story E02.S08: `TenantInterceptor` reads from flow-backed `TenantContext` [2 pts] +### Story E02.S08: `TenantInterceptor` reads from flow-backed `TenantContext` [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** UI, **I want** network requests to reflect the current tenant within 1 frame of switch, **So that** stale-tenant requests don't fly after logout. @@ -163,7 +163,7 @@ Production-grade tenant isolation and 8-role permission enforcement. Every Room --- -### Story E02.S09: Logout fully clears tenant + ability + DataStore + secure prefs + Room [3 pts] +### Story E02.S09: Logout fully clears tenant + ability + DataStore + secure prefs + Room [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** shared-device user, **I want** logout to leave no trace of my data, **So that** the next user starts clean. diff --git a/.bmad/epics/epic-prod-03-auth-session-hardening.md b/.bmad/epics/epic-prod-03-auth-session-hardening.md index 87ea04c..49ea08f 100644 --- a/.bmad/epics/epic-prod-03-auth-session-hardening.md +++ b/.bmad/epics/epic-prod-03-auth-session-hardening.md @@ -32,7 +32,7 @@ Production-grade auth that mirrors hogwarts' Auth.js v5 patterns: cross-subdomai ## 2. Stories -### Story E03.S01: Migrate to Credential Manager API for password autofill [5 pts] +### Story E03.S01: Migrate to Credential Manager API for password autofill [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 2 **As a** returning user, **I want** my saved password to autofill on the login screen, **So that** I sign in with one tap. @@ -83,7 +83,7 @@ Production-grade auth that mirrors hogwarts' Auth.js v5 patterns: cross-subdomai --- -### Story E03.S04: Implement `whoami` post-login + post-onboarding refresh [5 pts] +### Story E03.S04: Implement `whoami` post-login + post-onboarding refresh [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 2 **As a** newly-onboarded school admin, **I want** my session to immediately reflect my new schoolId, **So that** I don't need to log out and back in. @@ -101,7 +101,7 @@ Production-grade auth that mirrors hogwarts' Auth.js v5 patterns: cross-subdomai --- -### Story E03.S05: Biometric re-login [5 pts] +### Story E03.S05: Biometric re-login [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** returning user on a trusted device, **I want** to log back in with my fingerprint / face, **So that** I skip typing my password. @@ -120,7 +120,7 @@ Production-grade auth that mirrors hogwarts' Auth.js v5 patterns: cross-subdomai --- -### Story E03.S06: Forgot-password OTP flow end-to-end [5 pts] +### Story E03.S06: Forgot-password OTP flow end-to-end [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** user who forgot their password, **I want** to reset it via email OTP, **So that** I can regain access without contacting support. @@ -156,7 +156,7 @@ Production-grade auth that mirrors hogwarts' Auth.js v5 patterns: cross-subdomai --- -### Story E03.S08: Tenant selector before login (multi-school users) [3 pts] +### Story E03.S08: Tenant selector before login (multi-school users) [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** parent with kids in two schools, **I want** to choose which school to sign into, **So that** the right tenant context loads. diff --git a/.bmad/epics/epic-prod-04-ui-internationalization.md b/.bmad/epics/epic-prod-04-ui-internationalization.md index 26841b0..857a23c 100644 --- a/.bmad/epics/epic-prod-04-ui-internationalization.md +++ b/.bmad/epics/epic-prod-04-ui-internationalization.md @@ -30,7 +30,7 @@ Every UI string in every Composable, dialog, notification, and snackbar is keyed ## 2. Stories -### Story E04.S01: Audit existing 1,820 EN / 1,819 AR strings for translation quality [8 pts] +### Story E04.S01: Audit existing 1,820 EN / 1,819 AR strings for translation quality [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** native Arabic-speaking user, **I want** strings that read naturally, **So that** I trust the app for my school's daily work. @@ -47,7 +47,7 @@ Every UI string in every Composable, dialog, notification, and snackbar is keyed --- -### Story E04.S02: Fix all `Text("literal")` violations after Detekt rule lands [8 pts] +### Story E04.S02: Fix all `Text("literal")` violations after Detekt rule lands [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** non-English user, **I want** every UI string available in my language, **So that** I'm not surprised by random English text. @@ -101,7 +101,7 @@ Every UI string in every Composable, dialog, notification, and snackbar is keyed --- -### Story E04.S05: Locale switch without app restart [5 pts] +### Story E04.S05: Locale switch without app restart [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** user, **I want** to switch language and see immediate effect, **So that** I don't have to kill the app. @@ -117,7 +117,7 @@ Every UI string in every Composable, dialog, notification, and snackbar is keyed --- -### Story E04.S06: Plurals audit and fix for Arabic six-form rule [3 pts] +### Story E04.S06: Plurals audit and fix for Arabic six-form rule [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** native Arabic speaker, **I want** counts rendered with grammatical plurals, **So that** "1 student" / "2 students" / "11 students" all read correctly in Arabic. diff --git a/.bmad/epics/epic-prod-05-rtl-layout-typography.md b/.bmad/epics/epic-prod-05-rtl-layout-typography.md index 3ac4ffd..7511052 100644 --- a/.bmad/epics/epic-prod-05-rtl-layout-typography.md +++ b/.bmad/epics/epic-prod-05-rtl-layout-typography.md @@ -30,7 +30,7 @@ Pixel-perfect mirror layouts in Arabic. Every padding, alignment, icon, and anim ## 2. Stories -### Story E05.S01: Audit and fix 100% of `Modifier.padding(start|end)` correctness [8 pts] +### Story E05.S01: Audit and fix 100% of `Modifier.padding(start|end)` correctness [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** developer, **I want** zero `left`/`right` padding violations, **So that** RTL just works. @@ -46,7 +46,7 @@ Pixel-perfect mirror layouts in Arabic. Every padding, alignment, icon, and anim --- -### Story E05.S02: Auto-mirroring icons via `autoMirrored = true` [3 pts] +### Story E05.S02: Auto-mirroring icons via `autoMirrored = true` [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 3 **As a** Arabic user, **I want** the back arrow to point right (toward where I came from), **So that** navigation icons feel native. @@ -81,7 +81,7 @@ Pixel-perfect mirror layouts in Arabic. Every padding, alignment, icon, and anim --- -### Story E05.S04: Font-swap correctness audit [3 pts] +### Story E05.S04: Font-swap correctness audit [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** Arabic user, **I want** Arabic text rendered with the proper Arabic font, **So that** ligatures and diacritics look right. @@ -96,7 +96,7 @@ Pixel-perfect mirror layouts in Arabic. Every padding, alignment, icon, and anim --- -### Story E05.S05: Bidi-safe number rendering [2 pts] +### Story E05.S05: Bidi-safe number rendering [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** Arabic user reading a phone number or invoice number, **I want** the digits in their original order (not mirrored), **So that** I can read and dial correctly. diff --git a/.bmad/epics/epic-prod-06-database-content-translation.md b/.bmad/epics/epic-prod-06-database-content-translation.md index 23700ea..f8d82d9 100644 --- a/.bmad/epics/epic-prod-06-database-content-translation.md +++ b/.bmad/epics/epic-prod-06-database-content-translation.md @@ -45,7 +45,7 @@ Without this, an Arabic announcement created by a teacher is invisible (or appea ## 2. Stories -### Story E06.S01: Add `lang: String` column to all translatable entities [8 pts] +### Story E06.S01: Add `lang: String` column to all translatable entities [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** server, **I want** the client to track each row's source language, **So that** display-side translation can be triggered correctly. @@ -63,7 +63,7 @@ Without this, an Arabic announcement created by a teacher is invisible (or appea --- -### Story E06.S02: `TranslationCacheEntity` + DAO [3 pts] +### Story E06.S02: `TranslationCacheEntity` + DAO [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** client, **I want** a local mirror of the server's translation cache, **So that** previously-seen translations don't require a network round-trip. @@ -97,7 +97,7 @@ Without this, an Arabic announcement created by a teacher is invisible (or appea --- -### Story E06.S03: `TranslationRepository` with `getDisplayText` + `getDisplayFields` [8 pts] +### Story E06.S03: `TranslationRepository` with `getDisplayText` + `getDisplayFields` [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** UI layer, **I want** one helper to call at every display site, **So that** I never render untranslated content. @@ -138,7 +138,7 @@ Without this, an Arabic announcement created by a teacher is invisible (or appea --- -### Story E06.S05: `Tenant.nameEn` exception (pre-translated school name) [2 pts] +### Story E06.S05: `Tenant.nameEn` exception (pre-translated school name) [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** every-screen renderer, **I want** the school name pre-translated, **So that** I don't pay translation cache cost on every render. @@ -172,7 +172,7 @@ Without this, an Arabic announcement created by a teacher is invisible (or appea --- -### Story E06.S07: Pre-seed canonical reference translations on tenant onboarding [5 pts] +### Story E06.S07: Pre-seed canonical reference translations on tenant onboarding [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 5 **As a** new tenant, **I want** common labels (grade levels, terms, subjects) pre-translated, **So that** display works without round-tripping the API for high-frequency labels. @@ -221,7 +221,7 @@ Without this, an Arabic announcement created by a teacher is invisible (or appea --- -### Story E06.S10: Compose `LocalizedText` Composable [3 pts] +### Story E06.S10: Compose `LocalizedText` Composable [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 5 **As a** UI developer, **I want** one Composable to drop in for translatable content, **So that** I don't write 5 lines per call site. diff --git a/.bmad/epics/epic-prod-07-locale-aware-formatting.md b/.bmad/epics/epic-prod-07-locale-aware-formatting.md index b645d05..a13b9f8 100644 --- a/.bmad/epics/epic-prod-07-locale-aware-formatting.md +++ b/.bmad/epics/epic-prod-07-locale-aware-formatting.md @@ -31,7 +31,7 @@ Numbers, dates, currency, file sizes, and durations render correctly in both loc ## 2. Stories -### Story E07.S01: `LocaleAwareFormatter` API [5 pts] +### Story E07.S01: `LocaleAwareFormatter` API [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** UI layer, **I want** one set of formatters for all locale-aware rendering, **So that** every screen consistently follows locale rules. @@ -54,7 +54,7 @@ Numbers, dates, currency, file sizes, and durations render correctly in both loc --- -### Story E07.S02: Tenant-currency injection [3 pts] +### Story E07.S02: Tenant-currency injection [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** parent paying fees in SAR, **I want** prices displayed in SAR, **So that** I'm not confused by USD or EUR. @@ -71,7 +71,7 @@ Numbers, dates, currency, file sizes, and durations render correctly in both loc --- -### Story E07.S03: Refactor existing formatter usages [5 pts] +### Story E07.S03: Refactor existing formatter usages [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** developer, **I want** one formatter API across the app, **So that** I don't have 3 different number-formatting patterns. diff --git a/.bmad/epics/epic-prod-08-api-contract-endpoints.md b/.bmad/epics/epic-prod-08-api-contract-endpoints.md index e5f51b9..cd82f7b 100644 --- a/.bmad/epics/epic-prod-08-api-contract-endpoints.md +++ b/.bmad/epics/epic-prod-08-api-contract-endpoints.md @@ -32,7 +32,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod ## 2. Stories -### Story E08.S01: Define OpenAPI 3.1 spec [8 pts] +### Story E08.S01: Define OpenAPI 3.1 spec [8 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** mobile + web team, **I want** one source of truth for the mobile API, **So that** drift between client and server is impossible. @@ -48,7 +48,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S02: Codegen Retrofit interfaces from OpenAPI [5 pts] +### Story E08.S02: Codegen Retrofit interfaces from OpenAPI [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 4 **As a** Android developer, **I want** Retrofit interfaces auto-generated, **So that** I don't hand-maintain 25+ API files. @@ -64,7 +64,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S03: Implement `/api/mobile/auth/*` (8 endpoints) [8 pts] *(server-side)* +### Story E08.S03: Implement `/api/mobile/auth/*` (8 endpoints) [8 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 4 **As a** mobile user, **I want** registration, password reset, OAuth exchange, biometric, and school listing, **So that** I can authenticate any way the platform supports. @@ -86,7 +86,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S04: Implement `/api/mobile/auth/whoami` [3 pts] *(server-side)* +### Story E08.S04: Implement `/api/mobile/auth/whoami` [3 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 4 **As a** mobile client, **I want** to refresh my session context after login or onboarding, **So that** I always have current `schoolId`, `role`, `enabledModules`, and `userScope`. @@ -98,7 +98,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S05: Implement `/api/mobile/devices/*` (FCM tokens) [3 pts] *(server-side)* +### Story E08.S05: Implement `/api/mobile/devices/*` (FCM tokens) [3 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 4 **As a** mobile push system, **I want** tokens registered + unregistered + tracked per device, **So that** notifications reach the right device. @@ -111,7 +111,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S06: Implement `/api/mobile/dashboard` [3 pts] *(server-side)* +### Story E08.S06: Implement `/api/mobile/dashboard` [3 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 4 **As a** mobile dashboard, **I want** role-specific summary tiles, **So that** I render correct numbers without 10 separate calls. @@ -126,7 +126,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S07: Implement `/api/mobile/profile` (GET + PUT) [3 pts] *(server-side)* +### Story E08.S07: Implement `/api/mobile/profile` (GET + PUT) [3 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 4 **As a** mobile user, **I want** to view + edit my profile, **So that** I can update contact info from the field. @@ -181,7 +181,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S11: Implement `/api/mobile/attendance/*` (~12 endpoints) [8 pts] *(server-side)* +### Story E08.S11: Implement `/api/mobile/attendance/*` (~12 endpoints) [8 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 5 **As a** mobile attendance feature, **I want** complete read+write+QR+excuse+intervention endpoints, **So that** the largest module (E13) works end-to-end. @@ -198,7 +198,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S12: Implement `/api/mobile/grades/*` (~6 endpoints) [5 pts] *(server-side)* +### Story E08.S12: Implement `/api/mobile/grades/*` (~6 endpoints) [5 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 5 **Acceptance Criteria:** @@ -223,7 +223,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S14: Implement `/api/mobile/timetable/*` (~3 endpoints) [3 pts] *(server-side)* +### Story E08.S14: Implement `/api/mobile/timetable/*` (~3 endpoints) [3 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 5 **Acceptance Criteria:** @@ -246,7 +246,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S16: Implement `/api/mobile/{fees,invoices,payments,scholarships,fines}` (~10 endpoints) [5 pts] *(server-side)* +### Story E08.S16: Implement `/api/mobile/{fees,invoices,payments,scholarships,fines}` (~10 endpoints) [5 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 6 **Acceptance Criteria:** @@ -259,7 +259,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S17: Implement `/api/mobile/{announcements,notifications}` (~5 endpoints) [5 pts] *(server-side)* +### Story E08.S17: Implement `/api/mobile/{announcements,notifications}` (~5 endpoints) [5 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 6 **Acceptance Criteria:** @@ -293,7 +293,7 @@ Land the ~90 missing backend mobile endpoints. Specify each via OpenAPI 3.1; cod --- -### Story E08.S20: Implement `/api/mobile/{admission,events,library,id-card,quiz}` (~8 endpoints) [5 pts] *(server-side)* +### Story E08.S20: Implement `/api/mobile/{admission,events,library,id-card,quiz}` (~8 endpoints) [5 pts] · **Phase: Pilot v1** *(server-side)* **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** diff --git a/.bmad/epics/epic-prod-09-real-time-layer.md b/.bmad/epics/epic-prod-09-real-time-layer.md index 05d6012..610ab6a 100644 --- a/.bmad/epics/epic-prod-09-real-time-layer.md +++ b/.bmad/epics/epic-prod-09-real-time-layer.md @@ -101,7 +101,7 @@ End-to-end real-time messaging, presence, typing, attendance live updates, and n --- -### Story E09.S06: FCM data + notification dual-channel [3 pts] +### Story E09.S06: FCM data + notification dual-channel [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** @@ -111,7 +111,7 @@ End-to-end real-time messaging, presence, typing, attendance live updates, and n --- -### Story E09.S07: Background message sync via FCM data payload [3 pts] +### Story E09.S07: Background message sync via FCM data payload [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** diff --git a/.bmad/epics/epic-prod-10-auth-onboarding-profile.md b/.bmad/epics/epic-prod-10-auth-onboarding-profile.md index 2d28d8c..235ec90 100644 --- a/.bmad/epics/epic-prod-10-auth-onboarding-profile.md +++ b/.bmad/epics/epic-prod-10-auth-onboarding-profile.md @@ -24,7 +24,7 @@ Complete the auth + first-run + profile UI surfaces, building on the auth backen ## 2. Stories -### Story E10.S01: Welcome / login / signup flow polish [5 pts] +### Story E10.S01: Welcome / login / signup flow polish [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** @@ -72,7 +72,7 @@ Complete the auth + first-run + profile UI surfaces, building on the auth backen --- -### Story E10.S05: Profile view + edit [5 pts] +### Story E10.S05: Profile view + edit [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** @@ -109,7 +109,7 @@ Complete the auth + first-run + profile UI surfaces, building on the auth backen --- -### Story E10.S08: Account deletion (Play Store policy) [5 pts] +### Story E10.S08: Account deletion (Play Store policy) [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **As a** user, **I want** to delete my account from within the app, **So that** the app meets Google Play 2026 self-service deletion policy. @@ -123,7 +123,7 @@ Complete the auth + first-run + profile UI surfaces, building on the auth backen --- -### Story E10.S09: Privacy + ToS in-app viewer [2 pts] +### Story E10.S09: Privacy + ToS in-app viewer [2 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** diff --git a/.bmad/epics/epic-prod-11-dashboard-navigation.md b/.bmad/epics/epic-prod-11-dashboard-navigation.md index 6d206d3..c30f67a 100644 --- a/.bmad/epics/epic-prod-11-dashboard-navigation.md +++ b/.bmad/epics/epic-prod-11-dashboard-navigation.md @@ -25,7 +25,7 @@ Role-aware dashboard with all 19 tiles routed and polished. Search, dock, deep-l ## 2. Stories -### Story E11.S01: Wire 6 dashboard TODO tiles [5 pts] +### Story E11.S01: Wire 6 dashboard TODO tiles [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** @@ -48,7 +48,7 @@ Role-aware dashboard with all 19 tiles routed and polished. Search, dock, deep-l --- -### Story E11.S03: Role-specific tile filtering [5 pts] +### Story E11.S03: Role-specific tile filtering [5 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 7 **Acceptance Criteria:** @@ -96,7 +96,7 @@ Role-aware dashboard with all 19 tiles routed and polished. Search, dock, deep-l --- -### Story E11.S07: Deep-link audit for cold-start [3 pts] +### Story E11.S07: Deep-link audit for cold-start [3 pts] · **Phase: Pilot v1** **Status:** Not Started · **Sprint:** 8 **Acceptance Criteria:** diff --git a/.bmad/epics/epic-prod-19-admissions-events-library-idcard-quiz.md b/.bmad/epics/epic-prod-19-admissions-events-library-idcard-quiz.md index 2a404b7..000067e 100644 --- a/.bmad/epics/epic-prod-19-admissions-events-library-idcard-quiz.md +++ b/.bmad/epics/epic-prod-19-admissions-events-library-idcard-quiz.md @@ -25,12 +25,12 @@ Round out the remaining 5 domain modules. Each is a smaller surface area than th | ID | Title | Pts | Sprint | Notes | |---|---|---:|---|---| -| E19.S01 | Admission application list (admin) | 3 | 12 | | -| E19.S02 | Admission application form (multi-step) | 8 | 12 | | -| E19.S03 | Admission status check (public, OTP-gated) | 3 | 12 | | -| E19.S04 | Tour booking (public) | 3 | 12 | | -| E19.S05 | Events list + calendar | 3 | 12 | | -| E19.S06 | Event detail + RSVP | 3 | 12 | | +| E19.S01 | Admission application list (admin) **(Phase: Pilot v1)** | 3 | 12 | | +| E19.S02 | Admission application form (multi-step) **(Phase: Pilot v1)** | 8 | 12 | | +| E19.S03 | Admission status check (public, OTP-gated) **(Phase: Pilot v1)** | 3 | 12 | | +| E19.S04 | Tour booking (public) **(Phase: Pilot v1)** | 3 | 12 | | +| E19.S05 | Events list + calendar **(Phase: Pilot v1)** | 3 | 12 | | +| E19.S06 | Event detail + RSVP **(Phase: Pilot v1)** | 3 | 12 | | | E19.S07 | Library catalog with search | 3 | 13 | | | E19.S08 | Book detail + borrow flow | 3 | 13 | | | E19.S09 | My borrowings + due-date alerts | 3 | 13 | | diff --git a/.bmad/epics/epic-prod-25-security-hardening.md b/.bmad/epics/epic-prod-25-security-hardening.md index a8f19f7..b14e6b6 100644 --- a/.bmad/epics/epic-prod-25-security-hardening.md +++ b/.bmad/epics/epic-prod-25-security-hardening.md @@ -27,14 +27,14 @@ Production-grade security. Pin certs to real values. Detect rooted/jailbroken de | ID | Title | Pts | Sprint | Notes | |---|---|---:|---|---| -| E25.S01 | Real cert pin values in `SecurityConfig` | 3 | 14 | | +| E25.S01 | Real cert pin values in `SecurityConfig` **(Phase: Pilot v1)** | 3 | 14 | | | E25.S02 | `network_security_config.xml` `` block uncommented | 2 | 14 | | | E25.S03 | Play Integrity API integration | 5 | 14 | Server validation | | E25.S04 | Root/Jailbreak detection (RootBeer) — warn but not block | 3 | 14 | | | E25.S05 | Rate limiting on auth endpoints | 3 | 14 | Server-side | | E25.S06 | OWASP Mobile Top 10 audit + gap tracking | 5 | 15 | | | E25.S07 | Audit log emit (client-side actions) | 3 | 15 | | -| E25.S08 | Sensitive data redaction in logs (custom Timber tree) | 2 | 15 | | +| E25.S08 | Sensitive data redaction in logs (custom Timber tree) **(Phase: Pilot v1)** | 2 | 15 | | | E25.S09 | Disable debugger in release build (verify) | 1 | 15 | | | E25.S10 | DataStore encryption for sensitive prefs | 3 | 15 | | diff --git a/.bmad/epics/epic-prod-26-observability-crash-reporting.md b/.bmad/epics/epic-prod-26-observability-crash-reporting.md index dcfe25d..6fbcd45 100644 --- a/.bmad/epics/epic-prod-26-observability-crash-reporting.md +++ b/.bmad/epics/epic-prod-26-observability-crash-reporting.md @@ -28,10 +28,10 @@ Every release is observable. Crash-free rate, ANR rate, Core Vitals, business me | ID | Title | Pts | Sprint | |---|---|---:|---| -| E26.S01 | Verify Crashlytics integration end-to-end (test crash) | 3 | 15 | -| E26.S02 | Firebase Performance — screen render + network traces | 3 | 15 | -| E26.S03 | Firebase Analytics — business events | 3 | 15 | -| E26.S04 | User attribution (userId, schoolId, role) on Crashlytics | 2 | 15 | +| E26.S01 | Verify Crashlytics integration end-to-end (test crash) **(Phase: Pilot v1)** | 3 | 15 | +| E26.S02 | Firebase Performance — screen render + network traces **(Phase: Pilot v1)** | 3 | 15 | +| E26.S03 | Firebase Analytics — business events **(Phase: Pilot v1)** | 3 | 15 | +| E26.S04 | User attribution (userId, schoolId, role) on Crashlytics **(Phase: Pilot v1)** | 2 | 15 | | E26.S05 | ANR rate tracking + alerting | 2 | 15 | | E26.S06 | Crash-free user rate dashboard | 2 | 15 | | E26.S07 | Sentry for non-fatal exceptions (parallel to Crashlytics, optional) | 3 | 16 | diff --git a/.bmad/epics/epic-prod-27-release-pipeline-distribution.md b/.bmad/epics/epic-prod-27-release-pipeline-distribution.md index dccf3a9..4e63708 100644 --- a/.bmad/epics/epic-prod-27-release-pipeline-distribution.md +++ b/.bmad/epics/epic-prod-27-release-pipeline-distribution.md @@ -27,10 +27,10 @@ One-button release. Signed bundles. Multi-track distribution (internal, alpha, b | ID | Title | Pts | Sprint | |---|---|---:|---| -| E27.S01 | GitHub Actions: PR build + tests + lint + Detekt | 5 | 15 | +| E27.S01 | GitHub Actions: PR build + tests + lint + Detekt **(Phase: Pilot v1)** | 5 | 15 | | E27.S02 | GitHub Actions: nightly staging build → Firebase App Distribution | 3 | 15 | -| E27.S03 | GitHub Actions: tagged release → Play Internal Testing | 5 | 15 | -| E27.S04 | Signing key in GitHub Secrets + rotation procedure | 2 | 15 | +| E27.S03 | GitHub Actions: tagged release → Play Internal Testing **(Phase: Pilot v1)** | 5 | 15 | +| E27.S04 | Signing key in GitHub Secrets + rotation procedure **(Phase: Pilot v1)** | 2 | 15 | | E27.S05 | Play Console API integration via `gradle-play-publisher` | 3 | 16 | | E27.S06 | Dependency vulnerability scanning (Dependabot + OWASP dependency-check) | 2 | 16 | | E27.S07 | Renovate for dependency updates | 2 | 16 | diff --git a/.bmad/epics/epic-prod-overview.md b/.bmad/epics/epic-prod-overview.md index 47101d8..ed9e5e7 100644 --- a/.bmad/epics/epic-prod-overview.md +++ b/.bmad/epics/epic-prod-overview.md @@ -4,13 +4,15 @@ **Generated:** 2026-04-26 **Owner:** Captain (handover via `/sprint-plan`) -This series supersedes the V2 plan (`epic-v2-01..09`). It reorganizes ~352 V2 points into ~1115 points across 28 epics in 6 dependency-ordered phases. The V2 epic files remain as historical drafts; their stories have been folded into the new epics with explicit cross-reference (see "Mapping" section below). +This series supersedes the V2 plan (`epic-v2-01..09`) and the legacy V1 series (`epic-01..17`). It reorganizes ~352 V2 points into ~1115 points across 28 epics in 6 dependency-ordered phases. The V1 and V2 epic files have been moved to [`archive/`](./archive/) for historical reference; their stories have been folded into the new epics with explicit cross-reference (see "Mapping" section below). + +A **release-phase overlay** (Phase 1 Pilot v1 · Phase 2 MENA-10 · Phase 3 Public Launch) is layered on top of the existing build-phase structure — see "Release Phases" below and [`README.md`](./README.md) for the two-axis model. --- ## Why a New Roadmap -The MVP shell is in place (35 modules, 533 feature Kotlin files, 1820+ EN strings, encrypted token storage, periodic sync, 24 nav graphs, Material 3 theme with RTL font swap). But the visible polish hides ten silent stubs that block any production claim: +The MVP shell is in place (35 modules, 533 feature Kotlin files, 1820+ EN strings, encrypted token storage, periodic sync, 24 nav graphs, Material 3 theme with RTL font swap) — and as of May 2026, **King Fahad Schools (Sudan)** is live on the free pilot tier with a conversion conversation scheduled for Jun 2026, anchoring the new release-phase plan below. The visible polish hides ten silent stubs that block any production claim: 1. Backend is largely fictional — only 2 of ~92 endpoints actually exist 2. `fallbackToDestructiveMigration()` will wipe user data on every schema bump @@ -63,6 +65,28 @@ The new roadmap fixes all of these and adds the user-requested DB-content transl --- +## Release Phases (Pilot v1 / MENA-10 / Launch) + +The 28 epics above are ordered by **dependency** (A Foundation must land before B i18n, which must land before C Backend, etc.). That order is a build sequence, not a release sequence. Layered on top, three **release phases** describe what ships to which customer cohort and when: + +| Phase | Sprints | Weeks | Pts | Target | Pilot cohort | +|---|---|---:|---:|---|---| +| **1 — Pilot v1** | P1, P2, P3 | 7 | ~296 | 2026-07-12 | King Fahad Schools (Sudan) — 1 school, conversion conversation | +| **2 — MENA-10** | P4–P8 | 10 | ~411 | 2026-09-15 | 10 MENA schools onboarded; ≥1 paid conversion | +| **3 — Public Launch** | P9–P16 | 16 | ~408 | 2026-12-20 | Public Play Store, v1.0.0, staged rollout to 100% | + +Each story in `epic-prod-NN-*.md` carries both axes in its header: a build phase (A–F via the table above) and a release phase (1, 2, or 3). The two are orthogonal: a story can sit in build phase D (Features) but ship in release phase 1 (because it's pilot-critical) or release phase 3 (because it's launch-only polish). + +**Active phase manifests:** + +- [`phase-1-pilot-v1.md`](./phase-1-pilot-v1.md) — Pilot v1 story selection, sprint cadence, DoD. +- [`phase-2-mena10.md`](./phase-2-mena10.md) — MENA-10 polish. +- [`phase-3-launch.md`](./phase-3-launch.md) — Public launch / v1.0.0 gate. + +Pick up work by reading the active phase manifest; the per-epic file (`epic-prod-NN-*.md`) has the full AC and file refs for the selected story. + +--- + ## Architecture Decisions (locked) See full plan §"Architecture Decisions". Key load-bearing choices: diff --git a/.bmad/epics/phase-1-pilot-v1.md b/.bmad/epics/phase-1-pilot-v1.md new file mode 100644 index 0000000..3184696 --- /dev/null +++ b/.bmad/epics/phase-1-pilot-v1.md @@ -0,0 +1,299 @@ +# Phase 1 — Pilot v1 (King Fahad Schools) + +**Release phase:** 1 of 3 +**Sprints:** P1, P2, P3 (~7 weeks) +**Target points:** ~296 +**Target date:** 2026-07-12 +**Pilot tenant:** King Fahad Schools (Sudan, K-12) — free pilot active since Apr 2026; conversion conversation Jun 2026. +**Status:** Not Started +**Owner:** Captain (kun) + Samia (R&D) +**Sibling phases:** [phase-2-mena10.md](./phase-2-mena10.md) · [phase-3-launch.md](./phase-3-launch.md) +**Source plan:** [`~/.claude/plans/take-web-app-as-precious-turtle.md`](../../../.claude/plans/take-web-app-as-precious-turtle.md) + +--- + +## Intent + +The slimmest mobile companion that makes parents and students at King Fahad happy enough to recommend conversion to paid, and gives the sales conversation an admission demo for the next intake season. + +**What ships:** auth (incl. biometric), read-only views of grades / attendance / fees / timetable, announcements + notifications (FCM data-channel), Arabic-complete UI, full admission flow, signed APK on Play Internal Testing track, Crashlytics + Performance + Analytics. + +**What does NOT ship in Phase 1** (moved to Phase 2 or 3): teacher write flows, Socket.IO real-time messaging, fee payment / Stripe, OAuth (Google/Facebook), LMS / Stream / Lessons, Library, ID Card / Wallet, Quiz, exam interactions, public Play Store track. + +--- + +## Story selection by epic + +Each entry links to the source story in the epic file. Stories are listed in dependency order within each epic. + +### E01 — Foundation Hardening (~26 pts) + +Source: [`epic-prod-01-foundation-hardening.md`](./epic-prod-01-foundation-hardening.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E01.S01 | 2 | P1 | `google-services.json` committed — FCM cannot init without it; pilot demo fails on fresh checkout | +| E01.S02 | 8 | P1 | Replace `fallbackToDestructiveMigration()` — pilot users upgrade across schema bumps; wiping their cache kills trust | +| E01.S03 | 8 | P1 | Mutation queue actually transmits — required so FCM token upload + read receipts don't drop | +| E01.S04 | 3 | P1 | Upload FCM token on first auth — without it, push notifications never arrive | +| E01.S05 | 2 | P1 | One source of truth for API base URL — avoids prod-vs-staging debug regression | +| E01.S06 | 1 | P1 | Fix EN/AR parity drift — Arabic is primary; missing one string fails `:app:checkStringParity` | +| E01.S07 | 2 | P1 | Wire `AppStartupInitializer` — needed for Crashlytics + StrictMode initialisation | + +**Deferred to Phase 2:** S08 Detekt `NoHardcodedComposeText`, S09 Detekt `RequireTenantScope`, S10 Spotless, S11 Kover, S12 lint promotion. These are CI hygiene; not pilot-gating. + +### E02 — Multi-Tenancy & RBAC (~15 pts) + +Source: [`epic-prod-02-multi-tenancy-rbac.md`](./epic-prod-02-multi-tenancy-rbac.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E02.S01 | 2 | P1 | 8-role enum — server returns 8 roles (DEVELOPER, ADMIN, TEACHER, STUDENT, GUARDIAN, ACCOUNTANT, STAFF, USER); local mismatch deserialises wrong | +| E02.S02 | 3 | P1 | Move `SessionManagerImpl` to `core/security` — unblocks S06 | +| E02.S06 | 5 | P1 | `TenantContext` with `userScope` — needed so dashboard knows which child a guardian is viewing | +| E02.S08 | 2 | P2 | `TenantInterceptor` reads flow — logout doesn't fire stale tenant requests | +| E02.S09 | 3 | P2 | Logout orchestrator — King Fahad is a shared-device family scenario | + +**Deferred to Phase 2:** S03–S05 (Action/Subject taxonomy, full predicate ability layer, `@SessionScoped`), S07 (Detekt sweep), S10 (cross-tenant integration test). Phase 1 is read-only — inline `role in allowedRoles` checks suffice. + +### E03 — Auth & Session Hardening (~23 pts) + +Source: [`epic-prod-03-auth-session-hardening.md`](./epic-prod-03-auth-session-hardening.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E03.S01 | 5 | P2 | Credential Manager autofill — single-tap return is daily-use feature | +| E03.S04 | 5 | P2 | `whoami` post-login — dashboard renders correct tenant + role on first launch | +| E03.S05 | 5 | P2 | Biometric re-login — King Fahad parents asked for this in pilot feedback | +| E03.S06 | 5 | P2 | Forgot-password OTP — locked-out parents must self-recover | +| E03.S08 | 3 | P2 | School selector — King Fahad parents with kids on multiple campuses hit this | + +**Deferred to Phase 2:** S02 Google OAuth, S03 Facebook OAuth, S07 sign-up. Pilot users are pre-provisioned by the school; self-signup not needed. + +### E04 — UI Internationalization (~24 pts) + +Source: [`epic-prod-04-ui-internationalization.md`](./epic-prod-04-ui-internationalization.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E04.S01 | 8 | P1 | Native-speaker translation audit — Arabic primary; awkward translations fail trust | +| E04.S02 | 8 | P2 | Sweep `Text("literal")` violations — depends on audit list, not the Detekt rule (deferred) | +| E04.S05 | 5 | P2 | Locale switch without restart — power users will toggle to verify | +| E04.S06 | 3 | P2 | Arabic six-form plurals — counts read wrong otherwise | + +**Deferred to Phase 2:** S03 server dictionary loader, S04 per-module string-parity build task, S07 docs. + +### E05 — RTL Layout & Typography (~16 pts) + +Source: [`epic-prod-05-rtl-layout-typography.md`](./epic-prod-05-rtl-layout-typography.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E05.S01 | 8 | P1 | RTL padding correctness sweep — visible mirroring bugs would tank pilot | +| E05.S02 | 3 | P2 | Auto-mirroring icons — wrong-direction back arrows signal "broken" | +| E05.S04 | 3 | P2 | Font-swap audit — Arabic must use SF Arabic / Noto Arabic, not Latin | +| E05.S05 | 2 | P2 | Bidi-safe number rendering — phone numbers, OTPs, fee amounts | + +**Deferred to Phase 3:** S03 RTL snapshot tests. Manual visual audit acceptable for 1 pilot school. + +### E06 — Database Content Translation (~29 pts) + +Source: [`epic-prod-06-database-content-translation.md`](./epic-prod-06-database-content-translation.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E06.S01 | 8 | P2 | Add `lang: String` column to translatable entities — schema must absorb this before Phase 2 writes | +| E06.S02 | 3 | P2 | `TranslationCacheEntity` + DAO | +| E06.S03 | 8 | P3 | `TranslationRepository.getDisplayText` — minimal path: same-lang short-circuit + script-mismatch guard + cache lookup | +| E06.S05 | 2 | P3 | `Tenant.nameEn` pre-translated — King Fahad's English name fixed | +| E06.S07 | 5 | P3 | Pre-seed canonical translations (grade levels, subjects, terms, role names). Phase 1 ships without `POST /api/mobile/translate` because King Fahad's announcement labels hit only canonical seeds | +| E06.S10 | 3 | P3 | `LocalizedText` Composable — drop-in for all display sites | + +**Deferred to Phase 2:** S04 API endpoint, S06 value class, S08 LRU eviction, S09 Detekt enforcement, S11 full migration of 40–60 display sites, S12 observability dashboard. + +### E07 — Locale-Aware Formatting (~13 pts) + +Source: [`epic-prod-07-locale-aware-formatting.md`](./epic-prod-07-locale-aware-formatting.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E07.S01 | 5 | P1 | `LocaleAwareFormatter` API — needed for fee amounts + dates | +| E07.S02 | 3 | P2 | Tenant currency — King Fahad is SDG; defaulting USD is wrong | +| E07.S03 | 5 | P2 | Refactor existing formatter usages — sweep the ~30 `String.format` callsites | + +**Deferred to Phase 3:** S04 Hijri toggle (Sudan uses Gregorian for school year), S05 doc. + +### E08 — API Contract & Endpoints (~62 pts) + +Source: [`epic-prod-08-api-contract-endpoints.md`](./epic-prod-08-api-contract-endpoints.md) + +⚠ **Roughly half of E08 is server-side work in the hogwarts repo, not android-app.** Track each server story as a hogwarts issue with explicit Jun 1, 2026 deadline. + +| Story | Pts | Sprint | Side | Why pilot-critical | +|---|---:|---|---|---| +| E08.S01 | 8 | P1 | both | OpenAPI 3.1 spec — single source of truth for the pilot subset | +| E08.S02 | 5 | P1 | mobile | Codegen Retrofit interfaces from OpenAPI | +| E08.S03 | 8 | P1 | server | Auth endpoints (register/reset/OTP/biometric/schools) | +| E08.S04 | 3 | P1 | server | `whoami` | +| E08.S05 | 3 | P1 | server | `/devices/*` FCM tokens | +| E08.S06 | 3 | P2 | server | `/dashboard` | +| E08.S07 | 3 | P2 | server | `/profile` GET + PUT + delete | +| E08.S11 | 8 | P2 | server | Attendance endpoints — **read subset only**: `GET /student/{id}`, `GET /analytics`. Mark endpoints deferred | +| E08.S12 | 5 | P2 | server | Grades endpoints — **read subset**: `GET /student/{id}`, `GET /summary/{id}`, `GET /report-cards/{id}`. Submit deferred | +| E08.S14 | 3 | P2 | server | Timetable endpoints — full read | +| E08.S16 | 5 | P3 | server | Fees endpoints — **read subset**: `GET /fees`, `GET /fees/summary/{id}`. Payment deferred | +| E08.S17 | 5 | P2 | server | Announcements + notifications endpoints — full read + mark-read | +| E08.S20 | 3 | P2 | server | Admission endpoints (admission portion only — events/library/idcard/quiz deferred) | + +**Deferred to Phase 2:** S08 dictionary, S15 translate, S18 messaging, S21 MockWebServer contract tests. +**Deferred to Phase 3:** S09–S10 SIS CRUD, S13 exams, S19 LMS, S22 Pact, S20 remaining portions (events/library/idcard/quiz). + +### E09 — Real-Time Layer (~6 pts) + +Source: [`epic-prod-09-real-time-layer.md`](./epic-prod-09-real-time-layer.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E09.S06 | 3 | P3 | FCM data + notification dual-channel — pilot uses FCM-only | +| E09.S07 | 3 | P3 | Background message sync via FCM data payload — guardian gets attendance alerts | + +**Deferred entirely to Phase 2:** S01–S05, S08, S09 (full Socket.IO server + auth + presence + typing + reconnection + real-time attendance + test harness). One school, small user count — FCM latency is fine. + +### E10 — Auth, Onboarding & Profile UI (~17 pts) + +Source: [`epic-prod-10-auth-onboarding-profile.md`](./epic-prod-10-auth-onboarding-profile.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E10.S01 | 5 | P3 | Welcome / login / signup flow polish — edge cases will be hit | +| E10.S05 | 5 | P3 | Profile view + edit — basic identity surface | +| E10.S08 | 5 | P3 | Account deletion — **Google Play 2026 policy gate**. Submit listing draft in P1 week 1 | +| E10.S09 | 2 | P3 | Privacy + ToS in-app viewer — Play Store policy gate | + +**Deferred to Phase 2:** S02 OTP SMS auto-fill (covered functionally by E03.S06), S03 forgot-password nav, S04 school selector UI (covered by E03.S08), S06 avatar upload, S07 change password. + +### E11 — Dashboard & Navigation (~13 pts) + +Source: [`epic-prod-11-dashboard-navigation.md`](./epic-prod-11-dashboard-navigation.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E11.S01 | 5 | P3 | Wire 6 dashboard TODO tiles — `onClick` lambdas that currently do nothing | +| E11.S03 | 5 | P3 | Role-specific tile filtering — students don't see admin tiles | +| E11.S07 | 3 | P3 | Deep-link audit for cold-start — notifications deep-link to feature screens | + +**Deferred to Phase 3:** S02 search, S04 long-press quick actions, S05 bottom nav polish, S06 sidebar drawer, S08 app shortcuts. All polish. + +### E19 — Admissions (~23 pts; events/library/idcard/quiz deferred) + +Source: [`epic-prod-19-admissions-events-library-idcard-quiz.md`](./epic-prod-19-admissions-events-library-idcard-quiz.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E19.S01 | 3 | P2 | Admission application list (admin) — sales demo | +| E19.S02 | 8 | P2 | Admission application form (multi-step) — sales demo | +| E19.S03 | 3 | P3 | Admission status check (public, OTP-gated) — applicants can check without account | +| E19.S04 | 3 | P3 | Tour booking (public) — sales-funnel hook | +| E19.S05 | 3 | P3 | Events list + calendar | +| E19.S06 | 3 | P3 | Event detail + RSVP | + +**Deferred to Phase 2:** none (admission fully in P1 per user lock). +**Deferred to Phase 3:** S07–S14 library catalog, book detail, borrowings, digital ID card, Apple/Google Wallet passes, quiz hub, timed challenge, tests. + +### E25 — Security Hardening (~5 pts) + +Source: [`epic-prod-25-security-hardening.md`](./epic-prod-25-security-hardening.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E25.S01 | 3 | P3 | Real cert pins — staging already configured; pilot uses production cert | +| E25.S08 | 2 | P3 | Sensitive-data redaction in Crashlytics breadcrumbs — tokens must not leak | + +**Deferred to Phase 2:** S02 `network_security_config.xml` (done with S01), S03 Play Integrity, S04 RootBeer, S05 server rate-limiting, S07 audit log. +**Deferred to Phase 3:** S06 OWASP audit, S09 debugger disable, S10 DataStore encryption. + +### E26 — Observability & Crash Reporting (~11 pts) + +Source: [`epic-prod-26-observability-crash-reporting.md`](./epic-prod-26-observability-crash-reporting.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E26.S01 | 3 | P3 | Verify Crashlytics e2e (test crash) — required to debug pilot crashes | +| E26.S02 | 3 | P3 | Firebase Performance traces — cold-start baseline | +| E26.S03 | 3 | P3 | Business analytics events — captain needs DAU/funnel data | +| E26.S04 | 2 | P3 | User attribution on Crashlytics — identify which pilot user crashed | + +**Deferred to Phase 2:** S05 ANR tracking, S09 shake-to-report. +**Deferred to Phase 3:** S06 dashboard, S07 Sentry, S08 logcat capture, S10 custom dashboards. + +### E27 — Release Pipeline & Distribution (~12 pts) + +Source: [`epic-prod-27-release-pipeline-distribution.md`](./epic-prod-27-release-pipeline-distribution.md) + +| Story | Pts | Sprint | Why pilot-critical | +|---|---:|---|---| +| E27.S01 | 5 | P3 | PR build + tests + lint workflow — basic CI | +| E27.S03 | 5 | P3 | Tagged release → Play Internal Testing track | +| E27.S04 | 2 | P3 | Signing key in GitHub Secrets — required to ship signed APK | + +**Deferred to Phase 2:** S02 nightly staging to App Distribution, S05 Play Console API. +**Deferred to Phase 3:** S06 Dependabot, S07 Renovate, S08 release notes, S09 build cache, S10 reproducible builds. + +--- + +## Sprint cadence + +| Sprint | Weeks | Theme | Key stories | Pts | +|---|---|---|---|---:| +| **P1** | 1–2 | Foundation + tenancy + i18n start + OpenAPI kickoff | E01.S01–S07, E02.S01–S02, E02.S06, E04.S01, E05.S01, E07.S01, E08.S01–S05 (incl. server-side auth + whoami + devices) | ~88 | +| **P2** | 3–5 | Auth UI + read endpoints + RTL/i18n sweep + DB translation foundation + admission UI start | E02.S08–S09, E03.S01/S04/S05/S06/S08, E04.S02/S05/S06, E05.S02/S04/S05, E07.S02/S03, E06.S01–S02, E08.S06/S07/S11/S12/S14/S17 (server), E08.S20 admission portion (server), E19.S01–S02 | ~110 | +| **P3** | 6–7 | Translation finish + dashboard + fees read + FCM + admission finish + Play Internal release | E06.S03/S05/S07/S10, E08.S16, E10.S01/S05/S08/S09, E11.S01/S03/S07, E09.S06–S07, E19.S03–S06, E26.S01–S04, E27.S01/S03/S04, E25.S01/S08 | ~98 | +| | | | **Phase 1 total** | **~296** | + +**Velocity:** 88/110/98 vs the existing-plan target of 50–80. Hot. Mitigation: roughly half of P1+P2 stories are server-side hogwarts-repo work that runs in parallel; mobile-side weekly load stays manageable. + +--- + +## Definition of Done + +- [ ] All ~70 Phase 1 stories merged via the `IDEA → ISSUE → BRANCH → PR` workflow (`.claude/rules/github-workflow.md`). +- [ ] Conventional commits with `Closes #N`; co-author trailer present. +- [ ] Signed APK uploaded to **Play Internal Testing** track. Crashlytics, Performance, Analytics events visible in Firebase console. +- [ ] King Fahad principals + a sample parent cohort (5–10 accounts) have install + login + Arabic UI screenshot review. +- [ ] `MigrationTest` green; `:app:checkStringParity` green; `detekt` + `spotlessCheck` green on every PR. +- [ ] One Maestro flow recorded: login → dashboard → announcement detail → fee balance → log out. +- [ ] One admission demo recording: multi-step form → submit → status check via OTP link. +- [ ] Captain (kun) + Ali (QA) sign off on the build going to King Fahad. + +--- + +## Risks (see source plan for mitigations) + +1. **Server endpoint slippage** (highest impact) — hogwarts-repo work owned by web team. Mitigation: per-endpoint owners; MockWebServer fallback. +2. **Arabic translation audit (E04.S01)** depends on native-speaker review (Crowdin/Lokalise vendor). +3. **Conversion conversation timing** — pitch from a P2-end build (week 5) before P3 fully ships. +4. **Velocity is hot** — bail-out is dropping E04.S01 audit and accepting canonical-seed Arabic. +5. **Account deletion review** can take 2–4 weeks; submit listing draft in P1 week 1. + +--- + +## How to pick up a story + +1. Read this manifest; pick the next available story whose dependencies are merged. +2. Open the source epic file (linked above) and read the full AC + file refs. +3. Create the GitHub issue per `.claude/rules/github-workflow.md`: + ```bash + gh issue create --repo databayt/android-app \ + --title ": (E0X.S0Y)" \ + --body "" \ + --label "type:,P0,phase:pilot-v1" + ``` +4. Branch: `feat/E0X-S0Y-{kebab-case}` from `main`. +5. Implement; run `./gradlew :app:lintRelease detekt spotlessCheck`. +6. PR with `Closes #N`. + +--- + +## Phase boundary + +When Phase 1 ships, the next manifest is [`phase-2-mena10.md`](./phase-2-mena10.md). Phase 2 picks up the deferred items listed above plus the broader teacher / messaging / payment surfaces. diff --git a/.bmad/epics/phase-2-mena10.md b/.bmad/epics/phase-2-mena10.md new file mode 100644 index 0000000..a41910a --- /dev/null +++ b/.bmad/epics/phase-2-mena10.md @@ -0,0 +1,121 @@ +# Phase 2 — MENA-10 Polish + +**Release phase:** 2 of 3 +**Sprints:** P4, P5, P6, P7, P8 (~10 weeks) +**Target points:** ~411 +**Target date:** 2026-09-15 +**Status:** Not Started (begins after Phase 1 DoD) +**Owner:** Captain (kun) + Samia (R&D) +**Sibling phases:** [phase-1-pilot-v1.md](./phase-1-pilot-v1.md) · [phase-3-launch.md](./phase-3-launch.md) +**Source plan:** [`~/.claude/plans/take-web-app-as-precious-turtle.md`](../../../.claude/plans/take-web-app-as-precious-turtle.md) + +--- + +## Intent + +Scale from 1 pilot to 10 schools. Open the write half of the app (teacher attendance + grading), turn on real-time messaging, ship Stripe fee payment, complete OAuth, and start the test-coverage climb. Admission shipped in Phase 1; remaining E19 surfaces (library, ID card, wallet, quiz) stay deferred to Phase 3. + +**MENA-10 success metrics** (from team memory): + +- 10 pilot schools onboarded by Aug 31, 2026. +- ≥ 1 paid conversion (King Fahad if not already converted in Phase 1) by Oct 31. +- ≥ 3 schools use the admission flow for Sep 2026 intake. +- Crash-free user rate ≥ 99%. + +--- + +## Story selection by theme + +### Foundation cleanup (~25 pts) + +Sources: [E01](./epic-prod-01-foundation-hardening.md), [E02](./epic-prod-02-multi-tenancy-rbac.md), [E04](./epic-prod-04-ui-internationalization.md), [E06](./epic-prod-06-database-content-translation.md). + +| Story | Pts | Why | +|---|---:|---| +| E01.S08–S12 | ~13 | Detekt `NoHardcodedComposeText` + `RequireTenantScope`, Spotless, Kover, lint promotion | +| E02.S03–S05, S07, S10 | ~17 | Full RBAC ability layer for writes (Action/Subject taxonomy, predicate layer, `@SessionScoped`, Detekt sweep, cross-tenant integration test) | +| E04.S03 / S04 / S07 | ~10 | Server-driven dictionary + per-module string-parity build task + docs | +| E06.S04 / S08 / S09 / S11 / S12 | ~15 | Live translate API endpoint + LRU eviction + Detekt enforcement + full migration of 40–60 display sites + observability dashboard | + +### Teacher write surfaces (~80 pts) + +Sources: [E12](./epic-prod-12-sis-students-staff-subjects-classes.md), [E13](./epic-prod-13-attendance-behaviour.md), [E14](./epic-prod-14-grading-exams-report-cards.md). + +| Story | Pts | Why | +|---|---:|---| +| E13.S01, S02, S04, S05, S10, S11, S12 | ~32 | Single + bulk attendance marking, QR code attendance, excuse workflow, interventions, settings, real-time, tests | +| E14.S01, S02, S03, S07, S10, S11, S12 | ~19 | **Grade entry — fixes the fake `submit-grade-use-case.kt:20` stub**; view, summary, results, report-card view, charts, tests | +| E12.S01, S02, S05, S06, S07, S09, S10, S12, S13 | ~29 | Students + staff + subjects + classes (list, detail, translation sweep, tests) | + +### Real-time messaging (~80 pts) + +Sources: [E09](./epic-prod-09-real-time-layer.md), [E08](./epic-prod-08-api-contract-endpoints.md), [E18](./epic-prod-18-communications.md). + +| Story | Pts | Why | +|---|---:|---| +| E09.S01–S05, S08, S09 | ~36 | Socket.IO server + auth + presence + reconnection + real-time attendance + test harness | +| E08.S18 | 3 | Messaging REST baseline | +| E18.S01–S08, S10, S11, S15–S17 | ~38 | Conversations + chat + typing + presence + attachments + delivery + pin/star + tests | + +### Fee payment (~33 pts) + +Source: [E16](./epic-prod-16-fees-payments-finance.md). + +| Story | Pts | Why | +|---|---:|---| +| E16.S01–S06, S09, S11 | ~33 | Balance, invoice list/detail, **Stripe flow**, receipt PDF, transactions, multi-currency, tests | + +### Auth completion (~30 pts) + +Sources: [E03](./epic-prod-03-auth-session-hardening.md), [E10](./epic-prod-10-auth-onboarding-profile.md). + +| Story | Pts | Why | +|---|---:|---| +| E03.S02, S03, S07 | ~11 | Google OAuth, Facebook OAuth, sign-up flow | +| E10.S02, S03, S04, S06, S07 | ~19 | OTP SMS auto-fill, forgot-password nav, school selector UI, avatar upload, change password | + +### Guardian polish (~11 pts) + +Source: [E20](./epic-prod-20-role-specific-portals.md). + +| Story | Pts | Why | +|---|---:|---| +| E20.S01, S02 | ~11 | Children switcher + per-child views | + +### Security + observability + release (~25 pts) + +Sources: [E25](./epic-prod-25-security-hardening.md), [E26](./epic-prod-26-observability-crash-reporting.md), [E27](./epic-prod-27-release-pipeline-distribution.md), [E08](./epic-prod-08-api-contract-endpoints.md). + +| Story | Pts | Why | +|---|---:|---| +| E25.S03, S04, S05, S07 | ~14 | Play Integrity, RootBeer, server rate-limiting, audit log | +| E26.S05, S09 | ~5 | ANR tracking, shake-to-report | +| E27.S02, S05 | ~6 | Nightly staging build to App Distribution, Play Console API | +| E08.S21 | 5 | MockWebServer contract tests | + +### Test infra start (~25 pts) + +Source: [E22](./epic-prod-22-test-infrastructure-coverage.md). + +| Story | Pts | Why | +|---|---:|---| +| E22.S02, S03, S05 | ~25 | Test harness + 110 unit tests for untested modules + migration tests | + +--- + +## Definition of Done + +- [ ] 10 pilot schools onboarded. +- [ ] ≥ 1 paid conversion (King Fahad if not earlier). +- [ ] Teacher attendance + grade-entry verified end-to-end against staging by Ali (QA). +- [ ] Stripe payment in test mode for ≥ 1 school's fee structure. +- [ ] Socket.IO messaging stable; reconnection under flaky network verified. +- [ ] Crash-free user rate ≥ 99%. +- [ ] Test coverage rises from < 5% → ≥ 35% (target for Phase 2 exit). +- [ ] Admission flow used by ≥ 3 schools for Sep 2026 intake. + +--- + +## Phase boundary + +When Phase 2 ships, the next manifest is [`phase-3-launch.md`](./phase-3-launch.md). Phase 3 is the public Play Store launch and v1.0.0 gate. diff --git a/.bmad/epics/phase-3-launch.md b/.bmad/epics/phase-3-launch.md new file mode 100644 index 0000000..7cfd149 --- /dev/null +++ b/.bmad/epics/phase-3-launch.md @@ -0,0 +1,101 @@ +# Phase 3 — Public Launch (v1.0.0) + +**Release phase:** 3 of 3 +**Sprints:** P9, P10, P11, P12, P13, P14, P15, P16 (~16 weeks) +**Target points:** ~408 +**Target date:** 2026-12-20 +**Status:** Not Started (begins after Phase 2 DoD) +**Owner:** Captain (kun) + Samia (R&D) +**Sibling phases:** [phase-1-pilot-v1.md](./phase-1-pilot-v1.md) · [phase-2-mena10.md](./phase-2-mena10.md) +**Source plan:** [`~/.claude/plans/take-web-app-as-precious-turtle.md`](../../../.claude/plans/take-web-app-as-precious-turtle.md) + +--- + +## Intent + +Public Play Store launch. v1.0.0 staged rollout to 100%. Feature breadth complete (LMS, library, ID card with Wallet passes, full settings + accessibility + performance audits), 80% unit test coverage, ≥ 99.5% crash-free user rate, WCAG AA accessibility audit clean. + +Phase 3 is **everything not in Phase 1 or Phase 2**, plus the explicit Play Store launch gate. + +--- + +## Story selection by epic + +### E11 — Dashboard polish + +[Source](./epic-prod-11-dashboard-navigation.md). S02 search, S04 long-press quick actions, S05 bottom nav polish, S06 sidebar drawer, S08 app shortcuts. — needed for public, not pilot. + +### E15 — Timetable & Curriculum (full) + +[Source](./epic-prod-15-timetable-curriculum.md). S01–S08 — lesson plans + curriculum map + home widget. Public expects this completeness. + +### E17 — LMS Stream / Lessons / Courses (full) + +[Source](./epic-prod-17-lms-stream-lessons-courses.md). S01–S11 — Media3 video player, offline downloads, Stripe-gated courses, certificates. Major surface area; deferred entirely because King Fahad isn't using LMS. + +### E18 — Communications polish + +[Source](./epic-prod-18-communications.md). S09 search, S12 voice messages, S13 link previews, S14 wallpaper SVG. Power-user polish. + +### E19 — Library + ID Card + Wallet + Quiz + +[Source](./epic-prod-19-admissions-events-library-idcard-quiz.md). S07–S14 — library catalog + book detail + borrowings + digital ID card + Apple Wallet + Google Wallet passes + quiz hub + timed challenge + tests. Entire wallet pass story is launch-marketing-worthy but not pilot-critical. + +### E20 — Role-Specific Portals (remaining) + +[Source](./epic-prod-20-role-specific-portals.md). S03–S14 — meetings, consent, trips, prefs, teacher portals, admin portals. Secondary role surfaces. + +### E21 — Settings & Personalization (full) + +[Source](./epic-prod-21-settings-personalization.md). S01–S08 — wallpaper, notification channels per-type, cache management, diagnostics. + +### E22 — Test Infrastructure (finish) + +[Source](./epic-prod-22-test-infrastructure-coverage.md). S04 Compose UI tests for top 30 screens, S06 Maestro E2E for top 8 flows, S07–S09 (contract + snapshot + perf regression). **Target: 80% coverage gate.** + +### E23 — Performance & Resource Optimization (full) + +[Source](./epic-prod-23-performance-optimization.md). S01–S09 — Macrobenchmark, baseline profiles, dynamic features, leak audit. + +### E24 — Accessibility (full) + +[Source](./epic-prod-24-accessibility.md). S01–S07 — TalkBack audit, WCAG AA, reduced motion, keyboard nav. + +### E25 — Security (remaining) + +[Source](./epic-prod-25-security-hardening.md). S02 `network_security_config.xml`, S06 full OWASP audit, S09 debugger disable, S10 DataStore encryption. + +### E26 — Observability (remaining) + +[Source](./epic-prod-26-observability-crash-reporting.md). S06 dashboard, S07 Sentry, S08 logcat, S10 custom dashboards. + +### E27 — Release Pipeline (remaining) + +[Source](./epic-prod-27-release-pipeline-distribution.md). S06 Dependabot, S07 Renovate, S08 release notes automation, S09 build cache, S10 reproducible builds. + +### E28 — Play Store Launch (full) + +[Source](./epic-prod-28-play-store-launch.md). S01–S08 — listings, screenshots, video, Privacy Policy, Data Safety form, soft-launch, staged rollout. **This is the v1.0.0 ship gate.** + +--- + +## Definition of Done + +- [ ] v1.0.0 tagged and in Play Store **production** track. +- [ ] Staged rollout reaches 100% with no rollback. +- [ ] Crash-free user rate ≥ 99.5%. +- [ ] Unit test coverage ≥ 80% (Kover report). +- [ ] TalkBack walkthrough of every Phase-1 + Phase-2 surface passes. +- [ ] WCAG AA audit clean (manual + axe-android). +- [ ] All 28 production epics either shipped, archived as obsolete, or explicitly carried to v1.1+ roadmap. + +--- + +## Post-launch + +After Phase 3 ships, the production roadmap (`epic-prod-01..28`) is complete. The next planning artifact is the v1.1+ roadmap, sourced from: + +- King Fahad + MENA-10 cumulative pilot feedback. +- Play Store user reviews + ANR/crash signals. +- Sentry + Crashlytics + Firebase Performance dashboards. +- A formal Phase 4 captain's review with Samia (R&D). diff --git a/docs/prd.md b/docs/prd.md index 9ff0903..e6ac4bc 100644 --- a/docs/prd.md +++ b/docs/prd.md @@ -26,67 +26,42 @@ A native Android app that provides students, teachers, guardians, and administra --- -## MVP Features (P0) - -### Epic 1: Authentication -- [ ] Email/password login -- [ ] JWT token management -- [ ] Biometric authentication (fingerprint/face) -- [ ] Session persistence -- [ ] Offline auth (cached credentials) - -### Epic 2: Dashboard -- [ ] Role-specific dashboard layout -- [ ] Quick action cards -- [ ] Notification summary -- [ ] Offline indicator - -### Epic 3: Student Features -- [ ] View grades by subject/term -- [ ] View attendance history -- [ ] View timetable/schedule -- [ ] View fee statements - -### Epic 4: Teacher Features -- [ ] Class list view -- [ ] Mark attendance (manual) -- [ ] Mark attendance (QR scan) -- [ ] Submit grades - -### Epic 5: Guardian Features -- [ ] Children list -- [ ] Child progress overview -- [ ] Attendance alerts - -### Epic 6: Notifications -- [ ] Push notifications (FCM) -- [ ] In-app notification center -- [ ] Notification preferences - -### Epic 7: Offline Support -- [ ] Cached data display -- [ ] Offline mutation queue -- [ ] Background sync +## Milestones ---- +Three release phases stage delivery against the active pilot timeline. Story-level detail lives in `.bmad/epics/phase-{1,2,3}-*.md`; this section is the customer-facing summary. + +### Phase 1 — Pilot v1 (King Fahad Schools, target 2026-07-12) + +3 sprints, ~7 weeks, ~296 story points. Slimmest companion that supports the Jun 2026 conversion conversation with Pilot Seat 1. + +- Authentication: email/password, JWT, biometric, session persistence, school selector +- Read-only views: grades, attendance, timetable, fee statement, announcements +- Notifications: FCM data + notification dual-channel, in-app center, deep links +- Admission flow: applicant multi-step form, status check (OTP-gated), tour booking, events list +- Arabic-complete UI: native-speaker translation audit, RTL correctness sweep, locale-aware formatting (SDG default) +- Foundation: explicit Room migrations, mutation queue actually transmits, FCM token upload, 8-role enum aligned, OpenAPI 3.1 contract + codegen +- Release: signed APK, Play Internal Testing track, Crashlytics + Performance + Analytics live + +### Phase 2 — MENA-10 (target 2026-09-15) + +5 sprints, ~10 weeks, ~411 story points. Scale from 1 pilot to 10 schools. -## Post-MVP Features (P1) +- Teacher write surfaces: mark attendance (single, bulk, QR), grade entry (replacing the fake `SubmitGradeUseCase`), report cards +- Real-time messaging: Socket.IO server + client, presence, typing, attachments, delivery receipts +- Payment: Stripe fee flow, receipt PDF, multi-currency +- OAuth: Google + Facebook sign-in +- Foundation cleanup: Detekt rules enforced, full RBAC ability layer, live translate API endpoint +- Quality climb: test coverage rising from < 5% to ≥ 35% -### Messaging -- [ ] Direct messaging -- [ ] Group announcements -- [ ] Real-time chat (Socket.IO) +### Phase 3 — Public Launch v1.0.0 (target 2026-12-20) -### Payments -- [ ] Fee payment integration -- [ ] Payment history -- [ ] Receipt download +8 sprints, ~16 weeks, ~408 story points. Public Play Store release with staged rollout. -### Advanced Features -- [ ] Dark mode -- [ ] Widget support -- [ ] Calendar integration -- [ ] Document viewing +- LMS, library, ID card with Apple/Google Wallet passes, quiz +- Full accessibility audit (TalkBack, WCAG AA) +- Performance: Macrobenchmark, baseline profiles +- Test coverage ≥ 80% +- v1.0.0 staged rollout to 100% in Play Store production track --- @@ -139,7 +114,7 @@ A native Android app that provides students, teachers, guardians, and administra 1. **API**: Use existing Hogwarts backend APIs (no new endpoints) 2. **Auth**: JWT tokens from existing NextAuth system 3. **Data**: Prisma models define data schema -4. **Timeline**: MVP in 4 sprints +4. **Timeline**: Phase 1 (Pilot v1) in 3 sprints / ~7 weeks. Subsequent phases per `.bmad/epics/phase-{2,3}-*.md`. --- @@ -173,5 +148,8 @@ A native Android app that provides students, teachers, guardians, and administra ### Related Documents - [Architecture](./architecture.md) -- [Epics](./epics/) -- [Stories](./stories/) +- [Production Roadmap Overview](../.bmad/epics/epic-prod-overview.md) +- [Phase 1 — Pilot v1](../.bmad/epics/phase-1-pilot-v1.md) +- [Phase 2 — MENA-10](../.bmad/epics/phase-2-mena10.md) +- [Phase 3 — Public Launch](../.bmad/epics/phase-3-launch.md) +- Legacy `docs/epics/` and V1 epic files archived to `../.bmad/epics/archive/`