Skip to content

Angel — Phased Build Plan (v0.2, multi-tenant)

Each phase ends with something real. The scaffold is multi-tenant from the first migration — retrofitting tenancy is how products die. Amanda is the first user of the real product, not a special build.

Phase 0 — Foundation (weeks 1–2)

  • Repo last1enterprises/angel (README §Repo setup — confirm exact GitHub org slug), monorepo scaffold, CI (lint, typecheck, test, SECURITY.md §8 checklist, IDOR test suite stub)
  • Infra setup (ARCHITECTURE.md §7): Cloudflare Workers API (api.angel.report), Pages web (angel.report), Neon Postgres via Hyperdrive, R2 ciphertext blobs, Bitwarden → wrangler secrets; Queues + Cron for jobs; docker-compose for optional local Postgres/Redis; no-store, private cache headers + repeat-hit cache test in CI from the first deploy. apps/infra/ Terraform (AWS path) is parked, not deployed.
  • packages/crypto: per-user key hierarchy, envelope encryption, recovery phrase — test vectors + unit tests before anything uses it
  • Start now (long poles): Anthropic zero-data-retention setup. (Apple enrollment: already covered — Angel ships under the existing Last 1 Enterprises team, shared with LastVet; D-U-N-S 14-388-1862.)
  • Dev memory: install MemPalace + its Cursor hooks on the Mac laptop (uv tool install mempalace, hooks per mempalaceofficial.com/guide/cursor-hooks) — this is separate from the MemPalace repo already on the PC, which serves the local lane later (ARCHITECTURE.md §6b)
  • PC link: cloudflared Tunnel on the PC exposing Ollama at a private hostname behind Cloudflare Access (service token); OLLAMA_BASE_URL + Access credentials in .env; pull Gemma/Mistral variants onto SOV (replacing legacy qwen per the no-Chinese-LLM policy) and benchmark (5 sample docs) through the Tunnel, results into router config
  • Exit: crypto round-trip green in CI; deployed hello-world behind TLS.

Phase 1 — Multi-tenant vault MVP (weeks 3–6)

  • Auth: Sign in with Apple (web flow) + passkey/email; invite codes; passphrase + recovery ceremony
  • Condition catalog v1 + onboarding picker + consent screens (vault-only vs research_profile split)
  • Upload → client-encrypt → store; viewer; tags; on-device/WASM OCR + extraction (PDF text layer); skeleton timeline (Records + Signals per docs/UX-TIMELINE.md); symptom journal + meds list; passkey list/revoke; vault delete with search reindex
  • Per-user encrypted search index; full export; in-app account deletion (web)
  • Two test users + Amanda-fixture: prove isolation (IDOR suite green, DB inspection shows ciphertext only)
  • Exit: two real users can't see each other's anything; operator demo: can't read either vault.
  • Status (2026-07-15): Exit gate met. CI integration IDOR green; skeleton timeline, vault CRUD, passkey management, PDF OCR, journal/meds shipped on web. Polish shipped: recovery-phrase unlock UI, vault-only onboarding path, onboarding gate before vault/chat.

Phase 2 — Ask Angel (weeks 7–9)

  • Router (on-device / Claude surfaces), scrubber, RAG per AI-STRATEGY.md; per-user budgets + tier gating stubs
  • packages/memory: palace-pattern encrypted memory (AI-STRATEGY.md §2c) — every chat turn stored verbatim+encrypted, scoped retrieval by condition wing
  • Chat UI with citations; lab-trend charts; eval harness golden set in CI
  • Council mode v1 (AI-STRATEGY.md §2b): fan-out to 2–3 models + home-LLM synthesis with disagreement flagging; panel config-driven
  • Exit: 10 real questions per test user; ≥8 grounded+cited; zero uncited claims; budget caps enforced; council disagreements render visibly.
  • Status (2026-07-15): Exit gate met. Fixture live eval 10/10 grounded+cited (artifacts/phase2-qa-fixture-2026-07-15T19-40-35-219Z.json); eval harness 20 cases in CI; Ask Angel + council + budget caps shipped; manual browser QA completed on real vaults (auth/unlock fixes + chat UI polish deployed).

Phase 3 — Research engine + digest (weeks 10–12)

  • condition_catalog-driven source queries (INTEGRATIONS.md): PubMed, Europe PMC, ClinicalTrials.gov, openFDA first; shared-corpus fetch/embed/rank on local lane; per-user digest synthesis
  • Digest reader; 👍/👎 relevance feedback; weekly free-tier version
  • Exit: 7 consecutive daily digests for 3 test profiles; acceptable signal/noise.
  • Status (2026-07-15): Complete. Exit gate passed (scripts/phase3-digest-qa.ts: 7 consecutive daily issues × 3 test profiles). Shipped: 8 source adapters, shared corpus + coarse/Ollama rank, PMID/DOI verification, feedback ranking, sources transparency UI, timeline research dots, digest backfill tooling.

Phase 3 backlog (ordered)

  1. ~~Remaining source adapters~~ (done 2026-07-15)
  2. ~~Corpus embed/rank on local lane~~ (done 2026-07-15): config-weight + recency coarse rank; optional Ollama embedding rerank when OLLAMA_BASE_URL is reachable.
  3. ~~PMID/DOI verification~~ (done 2026-07-15): filterVerifiedPapers() gate in digest build.
  4. ~~Phase 3 exit QA~~ (done 2026-07-15): 7 consecutive daily digests × 3 test profiles; scripts/backfill-phase3-digest.ts for gap-fill.
  5. ~~Research sources transparency UI~~ (done 2026-07-15): five family chips on /digest, source badges, settings watch toggles, timeline research dots. Spec: docs/UX-RESEARCH-SOURCES.md.
  6. ~~Feedback-driven ranking~~ (done 2026-07-15): 👍/👎 scores reorder corpus candidates before synthesis.

Phase 4 — Imports + Google + billing (weeks 13–15)

  • ChatGPT export importer, Claude export, generic paste; Google OAuth (Drive bulk import, Gmail watch with per-item confirm)
  • Stripe (web) + entitlements module; free/paid gating live
  • Exit: a test user's ChatGPT ZIP + Drive folder fully imported, searchable; tier upgrade/downgrade works.
  • Status (2026-07-15): Complete. Exit gate met for imports: ChatGPT fixture import (fixtures/qa/chatgpt-conversations.json) searchable in vault; Google Drive OAuth + bulk import verified on production (anthropic chat doc because paste doesnt work!.txt, #drive-import). Stripe checkout/webhook QA deferred (tier sync validated via scripts/phase4-simulate-billing.ts); Gmail watch still deferred.

Phase 4 backlog (ordered)

  1. ~~Transcript schema + importers package~~ (done 2026-07-15): packages/importers/ — ChatGPT conversations.json, Claude export, generic paste; client-side parse only.
  2. ~~Import staging UI~~ (done 2026-07-15): /vault tray for ZIP/JSON/paste preview → encrypt as ai_import → manifest + search index; timeline occurredAt from conversation date.
  3. ~~Entitlements module~~ (done 2026-07-15): packages/entitlements/ — feature flags by tier (digest cadence, Ask Angel budget already in @angel/ai).
  4. ~~Stripe billing (web)~~ (done 2026-07-15): checkout session, webhook tier sync, customer portal; users.stripe_* columns + migration 0012.
  5. ~~Google Drive OAuth~~ (done 2026-07-15): drive.readonly bulk-import wizard on /vault; per-batch confirm before vault write. Gmail deferred.
  6. ~~Phase 4 exit QA~~ (done 2026-07-15): scripts/phase4-import-qa.ts infra checks green; manual ChatGPT + Drive import passed on curryrg@gmail.com. Stripe live checkout parked for Phase 7 hardening.

Phase 5 — iOS + App Store (weeks 16–20)

  • SwiftUI app: Sign in with Apple, passphrase unlock, onboarding picker, VisionKit capture → encrypt → upload, chat, digest, offline pinned cache, StoreKit 2 IAP, in-app deletion, APNs
  • fastlane/Xcode Cloud → TestFlight (internal QA only) → App Store submission
  • Review prep: medical disclaimers, privacy nutrition label, demo account for reviewers, 17+ rating; budget 2–4 weeks + one rejection cycle. Follow docs/APP-STORE-COMPLIANCE.md (Health & Fitness category, regulated-device declaration, AI consent, copy gate in CI).
  • Exit: app live on the App Store, installable by invite.
  • Status (2026-07-19): In progress. Native onboarding flow shipped on iOS (invite registration, passphrase + recovery + crypto setup, condition picker, research profile consent / vault-only). VisionKit upload and App Store compliance items next. POST /auth/apple/native still needs API worker redeploy (404 on production as of 2026-07-19).

Phase 5 backlog (ordered)

  1. ~~Native Apple auth API~~ (done 2026-07-15): POST /auth/apple/native exchanges iOS identity token (audience report.angel.app) for session cookie + user JSON. Deploy to production pending.
  2. ~~Swift-Sodium crypto~~ (done 2026-07-15): client passphrase unlock matching @angel/crypto wire formats (Argon2id + XChaCha20-Poly1305).
  3. ~~Onboarding + passphrase~~ (done 2026-07-19 on iOS): invite registration, passphrase setup, BIP39 recovery phrase, POST /auth/crypto/setup, condition catalog picker, research profile consent / vault-only path. Web onboarding unchanged.
  4. ~~VisionKit + vault upload~~ (done 2026-07-20 on iOS): document camera scan → PDF → client encrypt → POST /vault/items + manifest update. OCR/lab extraction and search index still web-only for now.
  5. Vault / chat / digest screens — parity with web; offline pinned cache; decrypt item content for Ask Angel context.
  6. StoreKit 2 IAP — paid tier; no external checkout links in-app.
  7. Deletion + push — in-app account deletion, digest-ready APNs.
  8. TestFlight → App Store — fastlane, reviewer demo account, copy gate green.

Phase 6 — Amanda onboarding (week 20 — the actual point of all this)

  • Seed package built from her conditions list: pre-selected picker draft, curated sources, ChatGPT/Drive import queue attached to her invite code (ARCHITECTURE.md §5 seeding flow — drafts to her client, never operator-side vault writes)
  • She installs from the App Store, signs in, reviews/consents, imports — everything waiting for her
  • Exit: Amanda daily-driving it, managing nothing technical; her feedback becomes the v1.1 backlog.

Phase 7 — Hardening → open registration (ongoing)

  • Security review vs SECURITY.md; restore drill; recovery-phrase fire drill; dependency audit; cost review vs tier pricing
  • Invite cohort grows → open registration when support burden + unit costs are proven
  • v2: HealthKit, Android/PWA, share links, "request a condition" catalog growth

Standing rules

  1. SECURITY.md is binding; more private wins.
  2. No merges without tests for crypto- or isolation-adjacent paths.
  3. Every phase exits with a demo; Phase 6 exits with Amanda smiling.