arah2/.planning/phases/07-hardening-private-launch/07-CONTEXT.md

Phase 7: Hardening + Private Launch - Context

Gathered: 2025-10-25 Status: Ready for planning

## Phase Boundary

The final phase hardens everything phases 1–6 shipped and closes with a checklist-signed private launch: one consolidated privacy-audit tool (zero-telemetry v1, PRIV-02/GEO-03 re-verified end-to-end), PX-04 fullscreen + landscape QA across the full device matrix with a measured battery-drain record (<10%/hr), a consolidated budget record (CPU/subrequests/bundles/KV), all parked review debts paid (the 3 deferred INFOs; /cari re-arm attempt + honest documentation), the known-limitations doc shipped and linked from /help — and the private beta launched to the user's first KL drivers when the checklist signs.

No new product features. This phase hardens outcomes; its empty/error states ARE the polish surface.

## Implementation Decisions

Privacy audit (SC3)

• D-01: A consolidated automated audit script (npm run privacy-audit, repo tool): grep gates over ALL src trees (no storage-API writes outside the platform allowlist — the phase-3 gate's law extended repo-wide; no coordinate/payload logging — the category-only vocabulary verified by schema scan), a KV listing probe (only TTL-keyed namespaces), a bundle scan (zero telemetry: no analytics, no beacons — the ONLY runtime fetches are OpenFreeMap tiles, the Telegram API, and the app's own Worker endpoints), plus a signed written audit record citing the evidence (PRIV-02/GEO-03 re-verified end-to-end). Reusable by forks (GPL audit tool).
• D-02: Zero telemetry in v1 — opt-in telemetry stays an IDEAS.md aspiration post-validation; nothing to opt into yet, nothing to audit but absence.

Device matrix + battery (SC1, PX-04)

• D-03: Fullscreen on guidance start via requestFullscreen() behind the 8.0 capability guard (phase-6 guard precedent), with orientation-lock used where available; landscape usability per device in the QA pass; landscape layout fixes are CSS-only media queries (tokens binding; the cockpit/banner/card geometry adapts, the map stays Rams-constant).
• D-04: The battery target is a RECORDED real measurement: one Android guidance run ≥30 min screen-on, battery % read at start/end (method + caveats written into the gate file); the D-15 distance-throttle is the software half. The <10%/hr target is recorded as measured, never synthesized (no bench harness — over-engineering for one phone).
• D-05: The QA pass is one consolidated walk: Android + iOS + Desktop + browser × (boot, search→route, guidance, minimize/resume, trip-end, theme flip, landscape/fullscreen) — a single checklist in the phase gate file; user walks once; NOT-RUN legs recorded honestly (the phase 3/4 protocol; iOS legs if the device is available — Phase 4 verified iOS present).

Budgets + deferred debt (SC4)

• D-06: A consolidated budget record (npm run budget-audit output + written record checked into verification): Worker CPU/subrequests (06-04's measured ladder re-run against the live graph), bundle sizes (BA9 et al.), KV write counts per request class (cron = 0 writes — the free-plan law), asset cache headers. Current numbers vs free-tier limits, in one document.
• D-07: Debts paid here: (1) 02-REVIEW's 3 deferred INFOs — IN-01 (dead ParsedInitData export + unreachable branch + read-helper intent comments), IN-02 (stale wrangler.jsonc comment), IN-03 (exact-900s boundary test — the security-critical comparator pin); (2) the /cari menu: re-run register-commands.mjs (scopes were re-armed in phase 4) + record the Telegram non-default-scope defect honestly in the limitations doc; (3) phase 3's stale-fix assumption notes (A1/A3) reviewed and closed or re-pointed. NOT here: ALT landmarks (c2) — committed to the v1.x milestone, not this phase.

Known-limitations doc (SC4)

• D-08: docs/KNOWN-LIMITATIONS.md in-repo, written for drivers AND forks: OSM data gaps (no traffic confidence, no lane guidance, speed limits where mapped), cross-metro CPU degradation (the c3 class), the /cari menu defect + its workaround, beta quality statement, and the roadmap pointers (WASM-router track, ALT, engine B). Surfaced from the bot: /help gains one line pointing at the doc (strings-module copy).

Launch definition

• D-09: Private launch = checklist-signed private beta: the user's chosen first drivers (friends/family/testers in KL) receive the bot link; word-of-mouth distribution. No app store, no marketing, no landing page (post-v1 idea). The launch checklist: known-limitations shipped · privacy audit signed · budget record green · full device matrix walked · /help + /privacy accurate · repo pushed public under GPL-3.0. The milestone completes when the checklist is signed — the launch act itself is the user's, not the workflow's.

OpenCode's Discretion

• Audit script file layout (scripts/ + test/ split), gate vocabulary, exit codes
• Battery recording method details; landscape media-query breakpoints within tokens
• INFO-fix mechanics; the boundary test's fixture form
• Known-limitations doc structure/tone; the /help one-liner copy (en/ms)

## Specific Ideas

• The audit tool doubles as the fork's own onboarding check — a fork runs npm run privacy-audit before their first driver.
• The limitations doc is honest engineering prose, not a legal page — the clinical tone extends to it.
• The launch checklist lives in the phase gate file and is signed there; STATE.md records the milestone completion.

<canonical_refs>

Canonical References

Downstream agents MUST read these before planning or implementing.

Phase scope + decisions

• .planning/ROADMAP.md §Phase 7 — goal, 4 success criteria, launch framing
• .planning/REQUIREMENTS.md §PX-04 (+ PRIV-02/GEO-03 re-verification; the v1.x deferred table)
• .planning/phases/02-bot-skeleton-initdata-security/02-REVIEW.md — the 3 INFO findings (IN-01/02/03)
• .planning/phases/03-mini-app-shell-geolocation/03-CONTEXT.md — the privacy law's origin (D-07) + storage-gate precedent
• .planning/phases/06-turn-by-turn-guidance-live-driving/06-CONTEXT.md — c3 class + A1 escalation + cron laws being audited

Codebase

• bot/src/kv/ — the TTL-only surfaces the audit probes
• bot/src/webhook.ts — the log vocabulary + route table the audit scans
• web/test/no-storage.test.mjs + bot/test/route-privacy.test.mjs — the gate lineage the audit script consolidates
• routing/scripts/measure-route-cpu.mjs — the CPU measurement the budget record re-runs
• bot/scripts/register-commands.mjs — the /cari re-arm tool
• docs/CONFIGURATION.md — the docs dir the limitations doc joins

</canonical_refs>

<code_context>

Existing Code Insights

Reusable Assets

• Storage/privacy gates (no-storage.test.mjs, route-privacy.test.mjs, PG1/PG2) — consolidated into the audit tool
• measure-route-cpu.mjs — the budget record's engine half
• Device-gate files (03/04/06) — the consolidated QA walk inherits their checklist shapes
• register-commands.mjs — the /cari re-arm

Established Patterns

• Gate suites as data (named vectors); hand-rolled runners; device-gate honesty protocol
• TTL-only KV; category-only logs; zero-telemetry posture
• Docs dir (docs/CONFIGURATION.md precedent)

Integration Points

• requestFullscreen/orientation lock → capability-guarded webapp wrapper (homescreen.ts precedent)
• /help strings → the limitations pointer line
• STATE.md → the milestone completion record

</code_context>

## Deferred Ideas

• ALT landmark preprocessing (c2) — v1.x milestone lever (measured decision, phase 6)
• Engine B (fully client-side webview router) — the static-hosted endgame track
• WASM-router OSS project — backend #2's standalone evolution
• Opt-in telemetry — post-validation (IDEAS.md)
• Voice guidance, live trip share, toll toggle, speed-limit display, traffic ETA — v1.x table
• Bitmap map snapshots in turn-cards — v1.x
• Public launch (landing page, marketing, app-store presence) — post-v1

---

Phase: 07-hardening-private-launch Context gathered: 2025-10-25