mem.jbnx.io · Project tracker

CipherDeck App

Internal label only — the public product is CipherDeck. See GA-6.

Working now

0 agents

No agent has touched this project in the last 3 hours.

90 / 119
Done
76%
15
Waiting on you
open the list →
10
Blocked
0
In review
PRs and checks
Done In progress In review Blocked Not started

Lanes

Tap a lane to see its tasks.

Launch readiness — take money from strangers84% 16 / 193 blocked
LR-7 Decide the raffle before it meets the public Blocked Nov 11, 4:50 PM
LR-8 First-run experience audit with fresh eyes Done Jul 26, 12:22 AM
LR-0 Launch-readiness audit Done Jul 25, 6:59 PM
LR-1 Link the legal pages from the marketing site and name the governing state Done Jul 26, 2:41 AM
LR-3 Lock down price_points — any signed-in user can forge market prices Done Jul 26, 12:22 AM
LR-6 Revoke EXECUTE on trigger functions exposed as RPCs Done Jul 25, 7:41 PM
LR-4 Stop the slabs bucket from listing every uploaded file Done Jul 25, 7:41 PM
LR-5 Turn on leaked-password protection Done Jul 31, 11:55 AM
LR-2 Verify the live tier page matches what is built Done Jul 26, 3:15 AM
LR-9 Collections are public by DEFAULT — flip to opt-in Done Jul 25, 8:00 PM
LR-13 Draft Terms, Privacy Policy and Refund/Cancellation policy Done Jul 25, 7:31 PM
LR-11 No age gate exists anywhere, and Pokemon skews young Done Jul 26, 12:22 AM
LR-12 Raffle winners hand over a real name and home address Blocked Nov 11, 4:50 PM
LR-10 The raffle can take paid entries — that structure is a private lottery Blocked Nov 11, 4:50 PM
CD-16 Move price_points writes server-side and drop client INSERT Done Jul 26, 12:22 AM
LR-16 "Shuffling the deck…" is not stuck — finding withdrawn Done Jul 25, 11:43 PM
LR-15 Add a support contact for paying subscribers Done Jul 26, 12:22 AM
LR-14 Enforce the 18+ limit the Privacy Policy already promises Done Jul 26, 12:22 AM
LR-17 Explain TCGplayer, PSA, CGC, BGS and SGC on first contact Done Jul 26, 12:22 AM
Product taste cleanup100% 1 / 1
CD-1 Replace 72 alert() and 14 confirm() calls with miniToast Done Jul 26, 12:22 AM
Priced but not built50% 1 / 2
CD-3 Build price alerts (Premium) Done Jul 26, 12:11 PM
CD-4 Build vendor storefront (Premium) Not started Jul 25, 6:55 PM
Japanese card data100% 2 / 2
CD-5 Investigate free Japanese prices via TCGCSV Done Jul 26, 8:55 AM
CD-6 Japanese set art: the ticket's premise was wrong, and the data said so Done Jul 26, 7:46 AM
Alerts and News data sources0% 0 / 2
CD-7 Build release_calendar table fed from ICv2 Not started Jul 25, 6:55 PM
CD-8 Find a partner for restock alerts Not started Nov 11, 4:48 PM
Waiting on Joey0% 0 / 55 blocked
CD-14 Google Business Profile video verification Blocked Nov 11, 4:48 PM
CD-13 Lawyer review of raffle rules Blocked Nov 11, 4:48 PM
CD-11 Live $5 checkout self-test Blocked Nov 11, 4:48 PM
CD-15 Print the eBay promo stickers Blocked Nov 11, 4:48 PM
CD-12 Real-device Google sign-in test Blocked Nov 11, 4:48 PM
Paid acquisition33% 3 / 9
GA-2 Channel plan and test design Not started Jul 25, 6:59 PM
GA-1 Establish the unit economics before buying any traffic Not started Jul 25, 6:59 PM
GA-4 Instrument the funnel before spending Not started Jul 25, 6:59 PM
GA-5 Set the ad budget cap and the escalation trigger Not started Nov 11, 4:48 PM
GA-3 Write ad copy that only claims what ships Not started Jul 25, 6:59 PM
GA-6 Do NOT ship "Pokemon" in the product name, domain or handles Done Jul 26, 12:16 AM
GA-7 Paid acquisition strategy and IP constraint research Done Jul 25, 7:31 PM
GA-8 Run the $128 card show test before any ad spend Not started Nov 11, 4:48 PM
GA-9 Redo the CAC arithmetic against the REAL price of $5/mo Done Jul 26, 2:42 AM
General85% 67 / 792 blocked
CD-2 Admin users list not loading Done Jul 26, 12:22 AM
CD-10 Correct handoff section 2 to stop pointing at .claude-secrets Done Jul 26, 12:22 AM
CD-9 Refresh cipherdeck-status.md Done Jul 31, 12:08 PM
CD-0 Verify the paywall is actually enforced in the database Done Jul 25, 6:55 PM
CD-18 Prove the initplan rewrite changed performance only, not access Done Jul 25, 8:07 PM
CD-17 Scale prep: rewrite 11 RLS policies to initplan form and index every foreign key Done Jul 25, 8:07 PM
CD-20 Grep the frontend for any price_points write path now that the grant is gone Done Jul 26, 2:03 AM
CD-19 Remove 74 write grants that no RLS policy ever allowed Done Jul 26, 12:22 AM
CD-21 Stop the public API answering "does this person pay you?" Done Jul 26, 12:22 AM
CD-22 Any unmatched /api/ GET answered with the app shell and a 200 Done Jul 26, 12:22 AM
CD-23 A transient 401 silently raised the founding price from $25/yr to $39/yr Done Jul 26, 3:16 AM
CD-24 I clobbered my own working copy, and the file bridge served a stale snapshot on top of it Done Jul 26, 12:16 AM
MK-2 "Export your collection — always free" is paywalled Done Jul 26, 1:26 AM
CD-25 The Stripe webhook could not report its own failure Done Jul 26, 1:26 AM
MK-1 The app advertises photo capture it does not have Done Jul 26, 1:26 AM
GA-4b Funnel instrumentation is half-built: the server records events, the browser never sends any Done Jul 31, 11:55 AM
OPS-1 The CEO is the deployment pipeline, and that is the wrong shape Blocked Jul 26, 2:03 AM
CD-27 The slabs bucket is public — and it has to be. Photos outliving the card was the real defect. Done Jul 26, 3:16 AM
CD-26 Users could upload slab photos but never delete them, and the bucket had no size or type limit Done Jul 26, 3:16 AM
CD-28 Three trigger functions were callable as RPC by anon Done Jul 26, 3:16 AM
CD-29 The highest-intent button in the product was 38px on a phone Done Jul 26, 3:25 AM
CD-30 Price history collection was dead for seven hours and nothing anywhere said so Done Jul 26, 4:00 AM
CD-31 Price history only started when someone opened a card, which is not what the pricing card promises Done Jul 26, 4:00 AM
CD-32 A wrong card could still become a set tile — the fix in the comment did not work Done Jul 26, 5:24 AM
CD-33 Stored XSS: one account could run script in every visitor to their public page Done Jul 31, 11:55 AM
CD-34 A single card could be imported as a sealed box — same hyphen flaw, third location Done Jul 26, 5:59 AM
CD-35 A trailing space was enough to split a card's price history in two, silently Done Jul 26, 6:16 AM
CD-36 cipherdeck_support was an available username on a public namespace Done Jul 26, 6:35 AM
CD-37 A failed renewal cut a paying customer off instantly, while Stripe was still trying to charge them Done Jul 26, 6:53 AM
CD-38 Base Set and Base Set 2 produced the same SKU — one custom label, two different cards Done Jul 26, 7:12 AM
CD-39 eBay titles were cut mid-word, throwing away the keywords buyers search on Done Jul 26, 7:29 AM
CD-40 A European-formatted price import would export a $1,234 card at $1.23 Done Jul 26, 7:35 AM
CD-41 The card-image matcher had no way to say "none of these" Done Jul 26, 7:43 AM
CD-42 "Is my fix actually live?" has been a guess all night — now it is one request Done Jul 26, 8:03 AM
CD-43 A 2024 and a 2025 Elite Trainer Box merged into one inventory row Done Jul 26, 8:21 AM
CD-44 The tool I have been verifying deploys with serves stale data, and the runbook told me to trust it Done Jul 26, 8:27 AM
CD-45 The deployment now records what it is serving into the database Done Jul 26, 8:36 AM
CD-46 The build check cried wolf on its first real use — git line endings Done Jul 26, 8:51 AM
CD-55 Set-alias table: 140 raw cards have no catalogue match and no price at all Done Jul 26, 4:24 PM
CD-57 Priced-nothing has become priced-nowhere: 84 cards now find their product but the catalogue holds no market price Done Jul 26, 4:30 PM
CD-58 The honest remainder after CD-55: 27 unmapped set names and 22 keys that resolve to more than one product Not started Jul 26, 4:30 PM
CD-60 Holdings numbered "75/144" never match a catalogue that stores "075/144" Done Jul 31, 12:00 PM
CD-59 Price fetcher was blind to every aliased set: 113 card keys could never be priced Done Jul 26, 4:24 PM
CD-61 tcg_fire_prices cannot use the normalised number comparison until the key is precomputed - the naive version times out the whole ingest pipeline Done Jul 31, 12:00 PM
LPC-5 The free-month announcement repeats on every visit, and the mailbox shows a red count with no unread mail Done Jul 31, 12:00 PM
CD-PAY-1 The live app self-reports that annual checkout will fail: "pay readiness: Checkout WILL fail - annual: resource_missing" Done Jul 31, 11:55 AM
CD-62 BLOCKED BY CD-72, DO NOT WORK THIS FIRST - Stripe TEST mode is not why checkout fails; the pinned API version is (see CD-72) Done Jul 31, 12:06 PM
CD-63 BLOCKED BY CD-72, DO NOT WORK THIS FIRST - refuted live: source=configured, so checkout is NOT sending a different price id (see CD-72) Done Jul 31, 12:06 PM
CD-70 Checkout failed silently: the error dialog opened UNDERNEATH the plan chooser Done Jul 31, 12:06 PM
CD-71 The annual price a customer is charged was never probed by the readiness check Done Jul 31, 12:06 PM
CD-72 THE REAL REASON CipherDeck cannot take money: the Stripe API version is pinned to 2024-12-18.acacia and Managed Payments needs 2025-03-31.basil Done Jul 28, 11:30 AM
CD-73 EBAY promo could be redeemed repeatedly - 60 days each time, up to 300 Done Jul 31, 11:55 AM
MK-16 Emit the four funnel steps the view already reads — the cheapest measurement win in the company Done Jul 31, 12:08 PM
CD-74 EBAY existed in the app but not in Stripe, and the buyer had no way to know which Done Jul 31, 11:55 AM
CD-75 The silent outage the paywall commit predicted actually shipped: /api/tcgproduct 401s every call for a signed-in user on the live build Done Jul 31, 12:06 PM
CD-80 Adding a card is one tile among six, and add-friction is what kills collection apps Not started Jul 28, 5:13 PM
CD-78 Collect / Vend / App are internal words, and "Chase binder" has to be taught Done Jul 31, 12:05 PM
CD-79 Set completion is the strongest loop in collecting and the app does not have it Not started Jul 28, 12:32 AM
CD-77 Six tiles, six identical green dots that mean nothing Done Jul 31, 12:00 PM
CD-76 The home screen of a card app shows no cards and not one number Done Jul 31, 11:55 AM
CD-81 Three competing controls in the header, none of them the main job Done Jul 31, 12:05 PM
CD-82 20 checkouts started, 0 of anything after: the funnel cannot tell an abandoned cart from a broken redirect Done Jul 31, 11:55 AM
CD-83 CipherDeck's funnel has no terminal step, so CD-72's own acceptance criterion cannot be met by any code path Done Jul 31, 11:55 AM
CD-84 Entitlement has two sources of truth and they contradict each other on 4 of the 8 accounts that exist Done Jul 31, 12:04 PM
CD-85 /api/admin/promo/provision writes the Stripe mirror field, so a comp is indistinguishable from a paid subscription Done Jul 31, 12:05 PM
CD-86 Merge the Cursor QC/CI branch — two real defects, a one-command runner, and the first CI this repo has had Done Jul 31, 12:20 PM
CD-87 Port the cipherdeck.com design language into the app — settle the accent collision before writing a line Blocked Nov 11, 4:48 PM
CD-88 The first real subscriber has a NULL renewal date: customer.subscription.created overwrites the good value with nothing Done Jul 31, 11:55 AM
CD-89 The owner paid $25 while holding a 60-day EBAY code, because Stripe's page offered a code box our codes cannot use Not started Nov 11, 4:48 PM
CD-91 A [?] on every control that explains what it is and why it is useful — for people who have never collected Done Jul 31, 12:00 PM
CD-90 One code box, and it is Stripe's: retire the app's parallel promo system and make EBAY 2 months Done Jul 28, 6:51 PM
CD-92 Stripe-only codes mean a card on file and auto-renewal, which reverses the "let it end" instruction Not started Nov 11, 4:48 PM
CD-93 app.cipherdeck.com answered GET /.git/config with HTTP 200 - either the repository is being served publicly or the catch-all route masks every 404, and both are defects Done Jul 31, 12:00 PM
OPS-73 A non-Railway process is overwriting catalog_cache app:build every ~60s with an empty commit, which blinds the release watchdog and means something outside Railway is writing production cache Done Jul 31, 12:04 PM
CD-94 The app:build watchdog anchor guard tests for an absent commit SHA instead of an empty one, so a deployment with no git metadata blanks it Not started Jul 31, 8:22 PM
CD-95 Every cipherdeck-web container boots into a window where every Supabase call 401s with PGRST303 "JWT issued at future" — the app mints a token from the container clock and PostgREST rejects it until the skew closes Not started Jul 31, 11:21 PM
REQ-4 Portfolio landing: Robinhood-style collection value chart (CEO spec, priority over Sell Center UI) Not started Aug 2, 6:55 AM
REQ-5 Google One Tap sign-in (Continue as <you> modal, Shopify-style) Not started Aug 2, 7:57 AM
INS-CDAPP-1 app.cipherdeck.com has no /insights: route returns the SPA shell, /collect 405, /go/call 200 (no redirect) Not started Nov 11, 4:48 PM

Source of truth: mem (Supabase mem_entities / mem_facts / mem_relations), aggregated by brain.tracker_projects() at request time. Data as of Nov 12, 8:44 AM ET.
Canonical project page: mem.jbnx.io/project/brain · Public mirror: jbnx.io/p · The 3D memory map stays owner-only at mem.jbnx.io.