Development plan

Delivery principles

Build vertical, testable slices. Do not implement all future domains at once. Security and backup foundations precede production health-data use. Each phase includes documentation, migrations, automated tests, and a runnable Compose deployment.

Phase 0 - Repository foundation

Establish server/, web/, companion/, docs/, compose.yaml, and build tooling.
Pin Go, Flutter, PocketBase, Alpine, and CI tool versions.
Add formatting, lint, unit test, secret scan, dependency/image scan, SBOM, and multi-arch build skeleton.
Create OpenAPI baseline and ADR process.

Acceptance: clean checkout builds/tests without external proprietary services; containers run non-root; PocketBase is demonstrably unreachable from host/public network.

Phase 1 - Secure instance foundation

First-run setup and atomic first-admin creation.
Master-key generation/storage/download and startup validation.
Go facade, private PocketBase, migrations, settings, audit framework.
Password+TOTP, passkeys, invitations, recovery, session rotation.
User-owned device pairing/management and authorization test matrix.
Basic Flutter Web shell and Android secure local storage.

Acceptance: cross-user tests pass; setup closes after completion; token replay is detected; no sensitive log output; loss/invalid key fails safely.

Phase 2 - Offline data and manual measurements

Encrypted Companion local database, outbox/inbox sync, conflict handling.
Measurement-session CRUD, metric/imperial conversion, French/English UI.
Silhouette measurement map and per-metric charts.
Correction, deletion, tombstones, personal CSV export baseline.
Consistency guidance.

Acceptance: airplane-mode CRUD survives restart and syncs idempotently; changing locale/units preserves canonical data; user A cannot infer B's sessions.

Phase 3 - Photos and media

Android/Web preprocess, EXIF removal, server validation/re-encode.
Encrypted media format/storage, avatars, timeline and comparison.
Admin future-photo policy and user choices.
JPEG export and quotas.

Acceptance: malicious/oversized fixtures fail within resource bounds; stored files are not recognizable plaintext; no public media URL; policy changes do not alter existing photos.

Phase 4 - Health Connect

Permission UX, background/history support, change-token import.
Heart-rate series, sleep, activities, workouts, weight/body composition.
Stable IDs/versions for data EvolioHealth writes.
Kinomap workout and Pixel/Fitbit heart-rate association.

Acceptance: repeated import/write produces no duplicates; updates/deletions propagate; provider source remains traceable; background work obeys user network/frequency settings.

Phase 5 - Xiaomi scale

Verified BLE protocol and fixtures for Mi Body Composition Scale 2.
Stable/final reading detection and duplicate suppression.
Weight/impedance storage, versioned estimates, optional Health Connect write.

Acceptance: incomplete readings never become final records; reconnect/rebroadcast does not duplicate; outputs distinguish measured from estimated.

Phase 6 - Operations

Password-encrypted .hbackup, restore and automated restore tests.
Voluntary crash-safe master-key replacement.
Reference DB signed update/rollback.
Admin operational UI, audit retention, health diagnostics.
Reverse-proxy/NAS documentation and benchmarks.

Acceptance: restore to a fresh instance with a different master key preserves authorized user data; interrupted key change recovers deterministically; tampered backups/reference DBs are rejected.

Phase 7 - Future domains

Add strength-training and nutrition only after reference licensing, schemas, update provenance, UX, and resource benchmarks are explicitly specified. Do not copy wger or nutrition datasets without verifying compatible licenses and attribution obligations.

Required test layers

Go and Dart/Kotlin unit tests for domain, crypto wrappers, conversion, deduplication.
Integration tests with real PocketBase and SQLite migrations.
API contract and malformed-input tests.
Authorization matrix and IDOR regression tests.
Mobile offline/sync and WorkManager tests.
Health Connect fake/provider integration tests.
BLE packet fixture and state-machine tests.
Image corpus and resource-exhaustion tests.
End-to-end setup, invite, login, pairing, measurement, photo, export, delete, backup/restore.
Multi-architecture image smoke tests.

Release gate

No production tag until migrations/rollback notes, threat-model delta, dependency and image scans, SBOM/signature, backup restore test, authorization suite, French/English checks, and operator upgrade instructions pass.

4.6 KiB Raw Permalink Blame History