Block broad image and video read permissions in Expo config and the checked-in Android manifest. Keep picker access scoped to user-selected media and gallery saves write-only. Add regression coverage and document the release-manifest invariant.
Route Android uploads to an internal draft and bind iOS submissions to the verified App Store Connect app. Document explicit-path local artifact submission and preserve separate release authorization.
Add a conditional Home cue for partner-answered questions and route both the card and catch-up reminders into the pending answer flow. Track prompt engagement and cover hidden, visible, CTA, and notification behavior.
Add a guarded mobile release skill that synchronizes public versions, writes on-brand notes, verifies signed iOS and Android artifacts, and tags the verified release commit.
Measure untouched mobile source, add regression coverage for native media paths and account operations, and enforce ratcheting API and mobile thresholds in required CI checks.
Share one configured PostgreSQL pool across worker repositories and make API and worker connection budgets explicit.
Add privacy-safe aggregate request, query, pool, sync, and outbox telemetry, a loopback-only representative load fixture, bounded worker shutdown, and focused regression and integration coverage.
Document the database-wide budget formula and defer pg_stat_statements activation to a reviewed migration and planned restart.
Share bounded database pools across API repositories, consolidate sync and chat queries, and make mobile refreshes cache-aware and foreground-aware.
Add focused regression coverage, client freshness documentation, and repository agent role configuration.
Add a repository-owned Codex skill and helper for bounded Claude Code execution, model and effort selection, resumable follow-ups, and independent acceptance checks.
Combine the Android API 36 release, dares loop, RevenueCat documentation correction, and daily engagement features. Resolve migration ordering and preserve both dares expiry and streak reminder operations.
Use reported user timezones for daily response limits, expose couple streak state and reminders, and improve swipe and live-drawing synchronization with focused tests and documentation.
Completes the half-built dares feature: send a dare, respond, report done,
confirm, and get a push notification on every transition.
Backend (apps/api):
- New `dares` domain with couple-shared premium entitlement, a free weekly
send allowance, and server-enforced actor/state rules on every transition.
- `submitted` status so the recipient reports completion and the sender
confirms, rather than the sender guessing.
- Notifications ride the existing operations outbox via a trigger on
`sent_dares`. Push copy is generic; store compliance forbids dare text in a
preview and a test asserts no payload leaks it.
- Worker expiry sweep now covers `pending` as well as `active`/`submitted`;
an invitation nobody opened previously stayed open forever.
Fixes two latent defects:
- Deleting any dare that had been sent aborted with a check violation, because
`dare_id` is ON DELETE SET NULL while `sent_dares_dare_or_custom_check`
required it. Dare text is now snapshotted at send time, which also keeps a
couple's history stable across catalogue edits.
- The free send allowance was raceable: concurrent requests all read the same
count and every one succeeded. The count and insert are now serialized on
the sender's profile row.
Also ports `content_status` review metadata to the API catalogue, which had no
store-safety gating at all, and mirrors the review decision already enforced on
the legacy catalogue.
Mobile: dares screen (active/send/history), send sheet with duration presets,
home tile badging incoming dares, paywall on both proactive and 402 paths.
Verified: lint, typecheck, 379 unit tests, build, 71 integration tests against
local PostgreSQL.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
jjbrunton
