Implementation status

Honest, per-item state. Done means built, used end to end in the browser or covered by tests. Partial means it works but a named part is missing. Not started items are not visible in the product.

Last updated: 2026-10-19 (Phases A to J complete, including the nonce-based CSP and the React Compiler lint clean-up; all twelve acceptance scenarios pass (docs/acceptance/REPORT.md); the Docker image and the backup scripts are written but were not run on this development machine, which has no Docker; Stripe and the real email providers are written against their APIs but not yet run against real accounts (the Anthropic API ran on 2026-10-19); platform invoices are collected by hand).

Verified this session

• Test server on Railway (2026-10-19, docs/acceptance/TEST_SERVER.md): the Dockerfile built and ran, 17 migrations on an empty PostgreSQL 18, rampline.patricdaccache.com and a customer domain with valid certificates, installation check 0 to fix, smoke test over public HTTPS, customer domain verified by TXT, backup and restore of database and files with the app running on the restored database.

• Security follow-up (2026-10-19): the CSP now allows scripts only with a nonce per request; in the dev server and the production build every script tag carried it, the 404 page included (it now renders per request). npm run perf against the production build: no console errors and no CSP violations. The 28 React Compiler readiness findings are fixed and the four rules are errors again: lint 0 errors, 0 warnings. In the editor on the production build an evergreen countdown counted down each second and kept its stored deadline when switched to a fixed date and back. npx tsc --noEmit, npm test (21 files, 170 tests) and the production build pass; npm run acceptance against the dev server: 12 of 12 passed.
• Phase J acceptance: npm run acceptance drove headless Chrome through the twelve scenarios of the brief against the dev server: sign-up, template, headline edited on the canvas and published, domain added with its TXT record; a visitor's form submission created one contact in the right workspace and the worker ran its workflow; a sales member moved the deal to Won on the board and the revenue report counted it; a test-card purchase granted course access and queued a receipt; an agency created two clients through the console and their data stayed apart; an operator set product name, app domain, email sender, plans and a customer, and its domain's sign-in page showed its brand; a fresh database installed as the independent edition with a signed license passed the smoke test; the revenue report showed measured, attributed and estimated figures and contribution margin; an A/B test kept every visitor on one version and named no winner on little data; a failing webhook was retried and then shown as failed with Retry; the workspace export contained only its own rows and no secrets; the release package installed from scratch with npm ci and passed the clean-installation test. 12 of 12 passed; scenarios 1 to 11 also passed against the production build.
• Found and fixed by these runs: the storage driver (src/lib/storage) had never been committed because .gitignore ignored every folder named storage; the home page was frozen at build time so / redirected to sign-in in production; favicon requests answered 404.
• Production build in Chrome: 16 pages without console errors or CSP violations; load figures in docs/acceptance/PERFORMANCE.md.
• Account security walked through in the browser: two-factor setup with QR code, sign-in with password then a recovery code, wrong code refused, two-factor turned off with the password; password reset link from the log, new password, signed in; other sessions signed out.
• npm test: 21 files, 170 tests; npm audit --omit=dev: 0 vulnerabilities; lint: 0 errors (28 React Compiler warnings at the time; fixed 2026-10-19).

• Phase I: the demo seed builds "Northwind Yoga (demo)" through the real services (form submissions, test checkout with the published test card, access grants, commissions, an A/B test with a published version B, deals, a workflow, spend) and spreads it over 30 days; --local adds sign-in accounts, a demo agency with three clients and an example license. In the browser: /demo opened the workspace without a password; all 25 navigation pages loaded for the demo account without errors; creating a funnel as the demo account was refused (first with a crash page, fixed: write buttons are hidden for the demo account, refused actions show a demo message, the editor works as an unsaved sandbox); signing out worked.
• npm run screenshots took 21 views (workspace, editor, CRM, automations, revenue, lab, rescue, course, affiliates, public page and checkout, agency console, branding, licensing, installation, setup wizard preview, phone view) into public/screenshots; reviewed by eye, template placeholders on the demo pages were found and replaced with example copy.
• Sales website: all 30 routes answered 200 (an unknown feature page and an unknown document answered 404), no horizontal scroll at 390 px on the checked pages, the contact form stored an enquiry, notified the platform administrator and showed under Platform → Enquiries. Claims checked against the code while writing (for example: there is no API with keys, so the integrations page says so; the AI architect asks nine questions).
• npm run build (production, separate output folder): compiles; every website route renders at request time so SALES_SITE is read at runtime.
• npm test: 18 files, 150 tests, all passing, including 5 for Phase I (demo account cannot write through row-level security even as admin, enquiries, documentation escaping and allow-list).

• Phase H walk-through in the browser: a course built in the editor (module, two lessons, YouTube video, markdown text, free preview, published), a product set to unlock it, a test purchase through the public checkout; the worker made the buyer a member, gave access and recorded the sign-in email; the receipt's "Open my member area" signed the buyer in; the portal showed "Start here", the lesson with video embed (the in-app browser loads no external frames, the embed address was checked), "Mark as done and continue" and "You finished the course"; the phone layout has no horizontal scroll. A community created by the team, published for all members; the member posted with markdown, commented and liked. The affiliate program opened with terms; the member joined from the portal, got the link ?ref=ines; a visit through that link and a second test purchase were counted: 1 visit, 1 sale, a commission of 20% of the order before tax waiting for the 30-day hold, the same in the team view. A template saved from a funnel and a course, published, approved by a platform administrator, listed in the marketplace and installed again from there.
• Found while testing and fixed: a Rampline dev server started in the morning (Phase A code, port 3351) was still running with its worker and took jobs from the same database. It explains the dead "No handler" order jobs since Phase C; the process tree was ended and the four lost jobs were put back in the queue and done.
• npm test: 17 files, 145 tests, all passing, including 34 for Phase H.

• Phase G: a clean installation into an empty database (migrations, first-run setup, setup refused a second time, schema, service role and storage checks, smoke test with published funnel, form, test checkout, cleanup) passes as npm run install:check -- --fresh and as a test. The smoke test also passed against the running dev server over HTTP, including the worker. The setup wizard was walked through in the browser on a second instance with an empty database: link from the log, step validation, a wrong license shown at the field with all entries kept, sign-in and the installation page afterwards. The demo workspace was exported from the dev installation and imported into that second installation: 366 rows, its live pages answered 200 and its uploaded image was served from the new storage; the operator downloaded the same export from the customer page, a foreign id got 403.
• npm run build with no database reachable: compiles (the Docker build stage has no database).
• npm test: 13 files, 111 tests, all passing, including 4 for Phase G.

• Phase F walk-through: workspace branding saved and the tab title followed the new product name; plan and usage page for a workspace; example plans created as operator; a customer put on Growth with a 14-day trial; customer list with plan; platform owner view with margins (estimates); a self-hosted license signed and issued in the browser; signed revocation list served at /api/license/revocations.
• npm test: 12 files, 107 tests, all passing, including 15 for Phase F (CSS filter, branding inheritance, plan limits at creation, invoice with usage lines, overdue and paid, agency client creation within the plan, owner invitation accepted with a new account, staff assignment, time-boxed support access with audit entry, funnel rollout, workspace duplication without contacts, owner-only approvals, suspension, operator customer without operator membership, invitation bound to the invited address, license signing, tampering, grace, domain, version, revocation, independent edition refusing new workspaces).
• Bugs found by these tests and fixed: storage usage read a table that does not exist (media instead of media_assets), and an approval request was silently discarded because a failed notification insert aborted its transaction.

• Phase E walk-through: revenue report with test orders, Lead Rescue flagged a form lead without owner and reply and drafted a follow-up, Conversion Lab created an A/B test (version B opens in the editor), personalization rule editor with block picker, health checks found a downsell without price and three historic dead jobs, AI architect shows that no API key is set.
• Phase D walk-through (log email provider, nothing delivered): CSV import with semicolons, automatic column mapping, invalid row reported, existing contact only tagged; workflow from the hot-lead template switched on, tagging a contact ran it (stage, owner rotation, task, notification, run on the timeline); deal created, moved between stages, marked lost with a reason; campaign to a tag segment counted 2 of 4 contacts (consent rule), preview, send, personalised subjects in Sent messages marked as recorded, not delivered.
• npm run build, npm run lint, npx tsc --noEmit: clean.
• npm test: 11 files, 92 tests, all passing (16 commerce, 19 CRM/email/automations, 20 intelligence) (schema safety, document operations, tenant isolation through RLS, publish and form lifecycle, media, global sections, popups, funnel transfer, websites, blog scheduling, redirects, sitemaps).
• Phase B second walk-through: starter website created, image uploaded and placed through the media picker, alt-text check cleared, popup created and seen opening after its delay on the live site, blog post written and published, blog index and post page live with the shared header and footer.
• Browser walk-through on localhost: sign-up creates a workspace, template picker, funnel map, editor (inline edit, autosave, mobile preview), publish, live page, form submission redirects along the funnel edge, contact appears in the right workspace with consent, funnel table shows measured visitors and submissions, worker processed the job.

Phase A: Foundations

Phase B: Funnels and pages

Phase C: Commerce

Phase D: CRM, pipelines, automations, email

Phase E: Intelligence

Phase F: Agency and white label

Phase G: Independent distribution

Phase H: Courses, communities, affiliates, marketplace

Phase I: Sales website, demo, screenshots, acquisition package

Phase J: Security, reliability and production verification

Other modules

Known gaps to close next

1. An external penetration test, then encrypted backups.
2. Run the Stripe path against a Stripe test account (needs your sk_test key and a webhook secret).
3. Connect a real email provider (SMTP, Resend or Postmark) and send a first test of invitations, password reset and receipts.
4. Run docker compose with the Caddy profile on a plain Linux server (on-demand certificates, backup.sh, restore.sh, upgrade.sh), and push the repository to a remote so the CI workflow runs; then add the acceptance suite to CI against a throwaway database. (Image, domain, certificates and a backup and restore drill are done on Railway.)
5. Decide how platform invoices are collected (Stripe Billing or by hand) and whether they need tax lines; have the license agreements, terms and privacy notice drafted by a lawyer.
6. Image resizing (responsive sizes) for uploaded images; S3 driver verification against a real bucket.
7. A setting to require two-factor sign-in for administrators; single sign-on if enterprise buyers ask.
8. Email notifications for community replies, affiliate events, incidents and limits; commissions on subscription renewals; payment collection for paid marketplace templates.