| Blocker | Set `EOOD_REGISTERED_ADDRESS` in Vercel env — every transactional email currently shows a placeholder. CAN-SPAM Act §316.4(a)(5) requires valid postal address. LB1 · hintly · Compliance & legal | PR #66 audit pass 2 / `_emailLayout.js` |
| blocked | Counsel sign-off on VPC method — checkbox-only consent may not satisfy COPPA "reasonably calculated" verification rule for a service that collects ongoing learning records. May need stronger blocked LB2 · hintly · Compliance & legal | PR #57 ANTHROPIC-COMPLIANCE-REVIEW + memory obs #13 |
| blocked | Counsel sign-off on Google OAuth signup path — currently bypasses the COPPA consent checkboxes. Open question: are existing OAuth-signed-up parents validly consented? blocked LB3 · hintly · Compliance & legal | Memory obs #20 + PR #57 |
| blocked | Privacy policy sub-processor table update — currently lists 6 of 9 actual sub-processors; missing Sentry, Upstash, Cloudflare. COPPA §312.4(d) violation if shipped as-is. blocked LB4 · hintly · Compliance & legal | PR #58 SUBPROCESSOR-DPA-MATRIX + PR #65 audit F6 |
| blocked | Stripe dual-role disclosure — Stripe is both processor AND independent controller (fraud detection). Privacy policy doesn't capture this; counsel should confirm wording. blocked LB5 · hintly · Compliance & legal | PR #58 / PR #65 audit |
| blocked | Read the Supabase DPA PDF — binary PDF I couldn't extract; supabase holds 100% of user data including child profiles. blocked LB6 · hintly · Compliance & legal | PR #58 |
| blocked | Texas HB18 + state children's privacy laws review — partially enjoined but parts apply. Plus California CAADCA, NY Stop Addictive Feeds Act, etc. Founder + counsel decide which states are open. blocked LB7 · hintly · Compliance & legal | Memory obs #4 / PR #57 |
| blocked | DPA execution status check with each sub-processor — confirm executed DPA on file is the latest published version for: Anthropic, Supabase, Stripe, Vercel, Resend, Sentry, PostHog, Upstash, Cloudflare blocked LB8 · hintly · Compliance & legal | PR #58 |
| Blocker | EOOD formation finalized LB9 · hintly · Operational launch-blockers | Memory `project_launch_plan_2026_05.md` B-list |
| Blocker | Liability insurance LB10 · hintly · Operational launch-blockers | Memory B-list |
| Blocker | Counsel retention LB11 · hintly · Operational launch-blockers | Memory B-list |
| Blocker | Verify Vercel env vars all set — full list below in 🟠 section. `ANTHROPIC_API_KEY`, `SUPABASE_*`, `STRIPE_*`, `RESEND_API_KEY`, `EOOD_REGISTERED_ADDRESS`, etc. LB12 · hintly · Operational launch-blockers | PR #66 + .env.example |
| Blocker | Common Sense Privacy submission LB13 · hintly · Operational launch-blockers | Memory B-list / `docs/compliance/common-sense-privacy-submission.md` |
| blocked | `EOOD_REGISTERED_ADDRESS` blocked EV7 · hintly · Vercel environment variables | **🔴 Launch-blocker** — CAN-SPAM postal address |
| High | Confirm `support@hintlyapp.com` routes to founder inbox EM1 · hintly · Email forwarders + DNS | always |
| High | Confirm `team@hintlyapp.com` routes (referenced in /careers) EM2 · hintly · Email forwarders + DNS | PR #65 audit S6 |
| High | Confirm `privacy@hintlyapp.com` routes (referenced in privacy + KB) EM3 · hintly · Email forwarders + DNS | PR #65 audit S6 |
| High | SPF / DKIM / DMARC for hintlyapp.com → Resend (deliverability) EM4 · hintly · Email forwarders + DNS | always |
| High | Test welcome email lands in Gmail / Outlook / iCloud inbox (not spam) EM5 · hintly · Email forwarders + DNS | implicit |
| High | Claim `@hintlyapp` on X (or remove footer icon) SO1 · hintly · Social handles | PR #65 audit S7 |
| High | Claim `@hintlyapp` on Instagram (or remove icon) SO2 · hintly · Social handles | PR #65 audit S7 |
| High | Claim `@hintlyapp` on LinkedIn company page (or remove icon) SO3 · hintly · Social handles | PR #65 audit S7 |
| High | First eval-suite run against launch baseline → commit `eval/quality-suite/results/baseline-2026-05.md` OP1 · hintly · Beta / launch operations | PR #59 STRESS-TEST-PLAN + PR #63 LEARNING-LOOP |
| High | First k6 stress-test run against a Vercel preview → commit `docs/STRESS-TEST-RESULTS.md` OP2 · hintly · Beta / launch operations | PR #59 |
| High | Lighthouse-CI baseline numbers committed (after Lighthouse runs in PR #47) OP3 · hintly · Beta / launch operations | PR #47 |
| High | Healthchecks.io account → set `HEALTHCHECKS_PING_URL` env var OP4 · hintly · Beta / launch operations | Memory B-list / Agent playbook 5.10 |
| High | Slack workspace incoming webhook → set `SLACK_ALERT_WEBHOOK_URL` env var OP5 · hintly · Beta / launch operations | Agent playbook Phase 1 |
| High | PostHog read-only API key → set `POSTHOG_API_KEY` for daily founder digest agent OP6 · hintly · Beta / launch operations | Agent playbook 9.2 |
| High | PostHog feature-flag config (`signup-trial-variant`, etc.) reviewed and shipped OP7 · hintly · Beta / launch operations | Memory B-list |
| High | Decide founder-digest email destination + send time (default 7am EST to founder) OP8 · hintly · Beta / launch operations | Agent playbook 9.2 |
| High | GSC (Google Search Console) validate-fix on any pre-launch crawl errors OP9 · hintly · Beta / launch operations | Memory B-list |
| High | Verify Supabase `pgcron` jobs scheduled correctly (not skipping) OP10 · hintly · Beta / launch operations | implicit |
| High | Test the full signup → onboarding → first session → weekly summary flow end-to-end with a clean test account OP11 · hintly · Beta / launch operations | implicit |
| High | Send a test welcome email + weekly digest to yourself; confirm no placeholder text OP12 · hintly · Beta / launch operations | PR #66 / this PR |
| Medium | Real testimonials collection → replace placeholder spots with quotes M1.1 · hintly · 🟡 Post-launch month 1 | Memory `project_overhaul_plan.md` |
| Medium | Wire 8 Phase-1 agents from agent playbook (incident response, daily digest, error budget, COPPA audit, dunning, MRR snapshot, cache health, weekly retro) M1.2 · hintly · 🟡 Post-launch month 1 | Agent playbook |
| Medium | Build `/api/admin-quality-trend` endpoint M1.3 · hintly · 🟡 Post-launch month 1 | Learning-loop roadmap Phase 1 |
| Medium | Stripe webhook handler audit — confirm dunning fires on `invoice.payment_failed` M1.4 · hintly · 🟡 Post-launch month 1 | implicit |
| Medium | Run eval suite monthly going forward (cron) M1.5 · hintly · 🟡 Post-launch month 1 | PR #63 |
| Medium | Watch first 30 days of Anthropic spend vs. cache hit rate (PR #56 instrumentation now real) M1.6 · hintly · 🟡 Post-launch month 1 | PR #56 |
| Low | Cache health dashboard (visual) M2.1 · hintly · 🟢 Post-launch month 2-3 | PR #56 follow-up |
| Low | First prompt iteration based on real production data → MAIN_HINT_PROMPT_VERSION = 2 M2.2 · hintly · 🟢 Post-launch month 2-3 | Learning-loop Phase 2 |
| Low | Personalization layer (misconceptions injected into system prompt) M2.3 · hintly · 🟢 Post-launch month 2-3 | Learning-loop Phase 2 |
| Low | RAG layer (recent session summaries injected) M2.4 · hintly · 🟢 Post-launch month 2-3 | Learning-loop Phase 2 |
| Low | Active-learning review queue UI M2.5 · hintly · 🟢 Post-launch month 2-3 | Learning-loop Phase 2 |
| Low | Decide /faq vs /help consolidation strategy M2.6 · hintly · 🟢 Post-launch month 2-3 | PR #65 audit S3 |
| Low | Public roadmap page (`/roadmap`) M2.7 · hintly · 🟢 Post-launch month 2-3 | Strengthen audit 10.1 |
| Low | Public changelog page (`/changelog`) M2.8 · hintly · 🟢 Post-launch month 2-3 | Strengthen audit 10.1 |
| Low | Trust center (`/trust` consolidating /privacy + /cookies + /child-safety + /sub-processors + security) ST1 · hintly · ⚫ Strategic / discretionary | Strengthen audit 9.3 |
| Low | A/B prompt testing in production via PostHog flags ST2 · hintly · ⚫ Strategic / discretionary | Learning-loop Phase 3 |
| Low | Per-grade-band prompt specialization ST3 · hintly · ⚫ Strategic / discretionary | Learning-loop Phase 3 |
| Low | DMCA agent registration + `/dmca` page ST4 · hintly · ⚫ Strategic / discretionary | PR #65 audit N3 |
| Low | Public sub-processor list page ST5 · hintly · ⚫ Strategic / discretionary | PR #65 audit N3 |
| Low | First hire (recruiting → onboarding → perf review) ST6 · hintly · ⚫ Strategic / discretionary | Agent playbook 8.x |
| Low | Brand voice canon evolution after first 100 copy decisions ST7 · hintly · ⚫ Strategic / discretionary | Strengthen audit 10.3 |
| Low | Hintly Adults / Skill Coach spinoff ST8 · hintly · ⚫ Strategic / discretionary | `Hintly_Secondary_Products_Roadmap.md` |
| Blocker | Complete EOOD incorporation LB1 · mdm-engine · 🔴 Launch-blockers | Cannot accept payment without legal entity |
| Blocker | Switch Stripe to live mode LB2 · mdm-engine · 🔴 Launch-blockers | Needed for actual revenue |
| Blocker | Fill `[BRACKETS]` in legal pages — entity name, address, governing law LB3 · mdm-engine · 🔴 Launch-blockers | Privacy/Terms/DPA reference placeholder values today (verified `webapp/src/lib/l |
| Blocker | ~~Verify RLS isolates tenants end-to-end~~ LB4 · mdm-engine · 🔴 Launch-blockers | ~~A bug here = cross-tenant data leak~~ |
| Blocker | ~~Verify `/api/account/delete` purges blobs + Stripe customer~~ LB5 · mdm-engine · 🔴 Launch-blockers | ~~GDPR Art. 17 risk~~ |
| Blocker | ~~Add `.github/workflows/ci.yml` (typecheck + vitest)~~ LB6 · mdm-engine · 🔴 Launch-blockers | ~~Regressions in engine ship undetected today~~ |
| Blocker | Penetration test or independent security review LB7 · mdm-engine · 🔴 Launch-blockers | Cheap insurance before money flows |
| High | Define ICP in 2-3 sentences and rewrite landing hero PL1 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Today: "distributors / retailers / brand owners" too broad for outboun |
| High | Create `docs/BRAND-VOICE.md` PL2 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Voice drifts across landing/emails/pricing pages today |
| High | Create `.env.example` documenting all 12 env vars PL3 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Currently nothing documents required env (verified by grep) |
| High | Add Sentry (error tracking) PL4 · mdm-engine · 🟠 Pre-launch (before public marketing push) | `error.tsx:18` literally says "we'd ship this to Sentry... for now con |
| High | Add status page (UptimeRobot or Better Stack free tier) PL5 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Trust signal in sales pitch |
| High | Wire Healthchecks.io pings to both crons PL6 · mdm-engine · 🟠 Pre-launch (before public marketing push) | `/api/cron/purge-blobs` + `/api/cron/send-emails` are currently silent |
| High | Record 2-minute Loom of upload→clean→download PL7 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Embed on landing above fold |
| High | Send first 5 cold outreach messages from `marketing/sales-pitch.md` PL8 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Lowest-CAC distribution test |
| High | Send first 3 partnership outreach (SAP migration consultancies) PL9 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Highest-leverage channel |
| High | Pricing tiers redesign (Free / Pro / Team / Enterprise with row caps) PL10 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Today $149 flat undermonetizes large customers |
| High | Cookie consent banner PL11 · mdm-engine · 🟠 Pre-launch (before public marketing push) | EU regulatory hygiene |
| High | Resend account + verify sending domain PL12 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Onboarding emails are coded but inert until this is set up — see `webapp/docs/on |
| High | Configure Clerk webhook with signing secret + set `CLERK_WEBHOOK_SECRET` PL13 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Triggers the welcome email |
| High | Set `CRON_SECRET` env var for hourly cron auth PL14 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Prevents external abuse of `/api/cron/send-emails` |
| High | Audit `npm audit` findings — 7 vulnerabilities (6 moderate, 1 high) PL15 · mdm-engine · 🟠 Pre-launch (before public marketing push) | Surfaced when CI first ran. Some may need force-fixes that break versions; needs |
| Medium | PostHog event instrumentation — funnel events (signup, first run, first download, upgrade) M1.1 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Medium | Add Playwright smoke suite with render-error assertions (per playbook Part 7) M1.2 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Medium | Add Lighthouse-CI to CI workflow M1.3 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Medium | Knowledge base / FAQ page on landing M1.4 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Medium | Onboarding email sequence verified working end-to-end (after PL12-14) M1.5 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Medium | Customer-success motion: NPS survey at run 5; 30-day check-in template M1.6 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Medium | First case study + reference customer permission M1.7 · mdm-engine · 🟡 Month 1 (after customer #1 lands) | Pending |
| Low | Team / multi-user accounts (Clerk Organizations) M23.1 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Build when first customer asks |
| Low | Public REST API + API keys M23.2 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Build when first automation customer asks |
| Low | Persistent connectors (S3, SFTP, vendor email inbox) M23.3 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Per-request |
| Low | Run comparison view (diff two runs of the same vendor) M23.4 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Pending |
| Low | Tier 2 custom output (full YAML profile upload) M23.5 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Build when 3+ customers ask |
| Low | DPP JSON-LD output writer (currently emits CSV; ESPR submission needs JSON-LD) M23.6 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Pending |
| Low | Audit log of admin actions M23.7 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Build when first regulated-industry customer surfaces |
| Low | SSO (Clerk Enterprise tier) M23.8 · mdm-engine · 🟢 Month 2-3 (post initial product-market signal) | Build when first enterprise prospect blocks on it |
| Low | Channel partnerships — pick 3 SAP migration consultancies, formal partner program S1 · mdm-engine · ⚫ Strategic / wedge bets | Per E2E audit: highest-leverage distribution lever, not yet attempted |
| Low | Pricing redesign with usage-based + per-user tiers S2 · mdm-engine · ⚫ Strategic / wedge bets | Per E2E audit: today's flat $149 leaves 30-60% on the table |
| Low | DPP regulatory deep-dive — full ESPR field set, JSON-LD output, SCIP integration S3 · mdm-engine · ⚫ Strategic / wedge bets | Wedge bet: regulatory tailwind 2026-2027 |
| Low | SAP-deeper — more SAP profiles (CC1, MDG/IDOC/iDoc, S/4HANA Migration Cockpit XML) S4 · mdm-engine · ⚫ Strategic / wedge bets | Wedge bet: 2027 S/4HANA migration deadline |
| Low | Schema-broader — let customers define their own schemas via UI S5 · mdm-engine · ⚫ Strategic / wedge bets | Wedge bet: opens horizontal markets (medical devices, food, chemicals) |
| Low | SOC 2 / ISO 27001 S6 · mdm-engine · ⚫ Strategic / wedge bets | 6-12 month process; only worth starting when 1+ enterprise prospect blocks |