> Latest authentication update: native Supabase recovery, email-confirmation UI, branded templates, and guest claim/retention are implemented. Seven unit/handler tests, 22 application browser scenarios, and three recovery UI contract scenarios pass. Live Supabase/email verification remains pending configuration. See SUPABASE_AUTH.md and FRONTEND_FLOWS.md. Supabase Auth does not imply that the wall database/storage has moved from SQLite to Supabase.
MVP Implementation Checklist
This checklist separates front-end product experience from real backend, persistence, auth, and security wiring. A feature can feel present in the prototype while still being marked unwired for the production MVP.
Status Legend
[x]Implemented and usable in the current prototype.[~]Partially implemented or prototype-only.[ ]Not implemented yet.
Outcome Contracts
These are the user-level outcomes the MVP should satisfy. Use them to decide what to build next when implementation details are underspecified.
Core Creation Journey
[x]A new user can open the app and immediately see the wall as the primary experience.[x]A new user can customize the room atmosphere before understanding the full app.[x]A new user can add visual, written, folder, decor, and music objects without signing in.[x]A new user can make the wall feel personally meaningful in one session.[x]A returning same-browser user can revisit locally saved work.[~]A user can create and switch between multiple boards.- Current state: multiple local-only boards can be created and switched in the browser.
- Not yet: account-backed multi-board ownership across devices.
[~]A new user understands whether saving is local-only or account-backed.- Current state: save status exists, but does not explain local-only persistence.
- Not yet: clear local/prototype save messaging.
[ ]A user can sign in after building a wall without losing their local work.[ ]A signed-in user can save the wall remotely.[ ]A signed-in user can revisit the same wall from another browser/device.
Sharing And Visiting Journey
[x]A user can switch from Edit Mode to Visit Mode.[x]Visit Mode removes editing affordances.[x]A visitor can click wall objects for focused viewing.[x]A visitor can open folders in read-only mode.[x]A visitor can open music playback without autoplay.[ ]A user can create a public share link.[ ]A public share link opens directly in Visit Mode.[ ]A user can copy a stable wall link suitable for an NFC sticker.[ ]A visitor can view a public wall without seeing owner-only controls.[ ]A private wall is unavailable to users who are not authorized.[ ]A shared wall is available only to explicitly shared users.
Trust And Truthfulness
[ ]Any auth, save, share, privacy, or NFC control that is front-end-only is clearly labeled as prototype/local-only/not backend-secured.[ ]The UI never implies that a wall is actually private, shared, public, or account-saved unless backend enforcement exists.[ ]Prototype-only controls identify what future backend wiring they require.[ ]Backend/security checklist items are marked complete only after Supabase/RLS/storage behavior is verified.
Product Quality Bar
Use this bar when deciding whether a front-end slice is truly complete enough for the MVP demo.
[~]The wall remains the first visual priority on desktop.- Current state: wall-first layout exists.
- Not yet: final responsive polish pass.
[~]Mobile and narrow layouts remain usable without incoherent overlap.- Current state: responsive styling exists.
- Not yet: Playwright/mobile screenshot coverage.
[~]UI chrome is minimal and does not turn the product into a dashboard.- Current state: palette and inspector support the wall without becoming the main event.
- Not yet: final pass after share/sign-in controls are added.
[~]Pixel-art objects feel cohesive across frames, notes, folders, decor, music, sprites, and scenes.- Current state: cohesive custom object language exists.
- Not yet: enough variety and final art direction review.
[ ]At least several high-quality options exist in each major visual category: frames, notes/text, folders, plants, lamps, shelves, music, sprites, wall materials, window/outside scenes.[ ]Ambient motion is subtle, calm, and never blocks reading or editing.[ ]Focused object views feel intentionally separate from the room, not like generic browser dialogs.
Testing Contracts
Every user-visible checklist slice should either add a test, update an existing test, or explicitly explain why automated testing is not practical for that slice yet.
Current Automated Coverage
[x]Wall creation, editing, local save, and same-browser revisit.[x]Spatial edit controls and Visit Mode no-edit behavior.[x]Wall setup persistence.[x]Multiple local boards can be created, switched, and kept separate.[x]Light studio wall background can be selected and persisted.[x]Folder pages and read-only folder behavior in Visit Mode.[x]Playlist visitor embed opens without autoplay.[x]Catalog object-family coverage.[x]JSON export/import round trip.[x]Uploaded artwork rendering and reload persistence.
Needed Front-End Tests
[ ]Prototype-only auth/share/privacy/NFC controls are visibly labeled as not backend-secured.[ ]Outside scene presets or prompt field change the wall visually and persist locally.[ ]Focused object presentation has a stronger separated state in Visit Mode.[ ]Responsive smoke test for desktop and narrow/mobile viewport.[ ]Dialog accessibility smoke test for setup, detail, and folder dialogs.[ ]Visitor cannot trigger edit-only controls through click, keyboard, or visible buttons.
Needed Backend/Security Tests
[ ]Signed-in user can save a wall remotely and reload it from the backend.[ ]Signed-in user can create and revisit multiple backend-backed boards.[ ]Anonymous/local wall can be claimed after sign-in without losing state.[ ]Public wall link opens read-only in Visit Mode.[ ]Private wall cannot be fetched by another user.[ ]Private wall assets cannot be fetched by another user.[ ]Shared-user wall can be fetched by shared users and blocked for non-shared users.[ ]RLS policies enforce owner/shared/public access without relying on hidden UI.[ ]Upload validation rejects unsupported file types and oversized files.
Front-End Experience
[x]One customizable digital wall as the primary experience.[x]Wall material selection.[x]Light studio wall background.[x]Wall color/atmosphere through material and lighting presets.[x]Window placement selection.[~]Outside scene experience.- Current state: static/preset visual window treatment exists.
- Not yet: selectable outside scenes or prompt-based scene input.
[x]Time-of-day or lighting selection.[x]Image upload into framed artwork.[x]Multiple frame styles.[x]Add and edit quotes.[x]Add and edit text notes.[x]Decorative plants.[x]Decorative lamps.[x]Shelves.[x]Text-holder style objects through quote/note variants.[x]Drag objects while editing.[x]Snap or align objects to a grid.[x]Resize objects.[x]Layer objects forward/backward.[x]Reposition objects while editing.[x]Separate Edit Mode and Visit Mode.[x]Visit Mode prevents accidental editing.[x]Clicking an item in Visit Mode opens a focused detail view.[~]Focused objects visually separate from the room.- Current state: detail dialog exists.
- Not yet: richer transitions and stronger cinematic separation.
[x]Folder/project object.[x]Folder pages with notes, links, reminders, image references, and mood.[~]Folder/project object containing multiple images.- Current state: multiple pages can each hold a visual reference.
- Not yet: robust multi-image page/gallery handling.
[x]One song or small playlist on a wall.[x]Visitor playback through YouTube embeds when a supported URL is used.[~]Visitor playback controls.- Current state: embed/provider controls exist.
- Not yet: custom wall-level play/pause/mute controls for all providers.
[x]Music does not autoplay.[x]Local autosave.[x]JSON export/import.[~]Desktop-first responsive experience.- Current state: responsive views exist and screenshots have been captured.
- Not yet: final cross-device polish pass.
[~]Seeded high-quality pixel-art objects, frames, wall styles, and scenes.- Current state: custom object language and generated assets exist.
- Not yet: enough production-grade variety to call the library complete.
[~]Subtle ambient animation.- Current state: lighting/glow/window styling exists.
- Not yet: deliberate ambient motion pass for lamps, window, plants, etc.
[x]Minimal UI chrome with wall as focus.
Account, Saving, Sharing, And Privacy
[ ]Build a wall without signing in, then require account creation to save remotely.[ ]Google sign-in.[~]Multiple boards.- Current state: local-only board selector and new-board flow.
- Not yet: backend-backed board list per signed-in user.
[~]Saved walls persist across sessions.- Current state: localStorage persistence works on the same browser/device.
- Not yet: account-backed persistence.
[ ]Database-backed saved walls.[ ]Wall privacy control: Private.[ ]Wall privacy control: Shared with specific users.[ ]Wall privacy control: Public.[ ]Share links that open the wall in Visit Mode.[ ]Shared-user invite/access experience.[ ]Public wall viewing experience backed by real access policy.[ ]Stable NFC-ready visit links.
Technical Stack
[ ]Next.js.[ ]TypeScript.[ ]Supabase Postgres.[ ]Supabase Google Auth.[ ]Supabase Storage.[ ]Supabase Row Level Security.[~]Hosted static prototype.- Current state: ChatGPT/Sites hosting metadata exists and points at
dist. - Not yet: production app stack or backend integration.
Security And Data Protection
[ ]Unguessable wall IDs from backend records.[ ]Protected storage for private uploads.[ ]Signed/private asset access.[ ]Backend authorization checks for wall access.[ ]Backend authorization checks for asset access.[ ]RLS policies for owner access.[ ]RLS policies for shared-user access.[ ]RLS policies for public access.[ ]Validation for uploaded content.[ ]Sanitization for user-generated text and URLs.[ ]Private wall cannot be accessed by changing or guessing a URL.[ ]Private assets cannot be accessed by changing or guessing a URL.
Data Model Readiness
[~]Local wall state maps to backend wall records.- Current state: data model plan exists in
docs/DATA_MODEL.md. - Not yet: migration code or Supabase schema.
[x]Wall items have stable local IDs and serializable fields.[x]Wall configuration is serializable.[x]Folder pages are serializable.[x]Playlist tracks are serializable.[~]Uploaded images can round-trip locally as data URLs.- Current state: works for localStorage/export/import.
- Not yet: storage-backed asset records.
[ ]Local data URL images have a migration path to Supabase Storage assets.[ ]External media URLs have validation and provider parsing before backend save.[ ]Backend schema supports wall settings, wall items, folders, folder pages, playlists, tracks, assets, share links, and NFC links.
Definition Of Done Progress
[x]Create a wall.[x]Decorate the wall.[x]Add meaningful content.[ ]Sign in.[~]Save.- Current state: local save works.
- Not yet: account-backed save.
[~]Revisit.- Current state: same-browser revisit works.
- Not yet: cross-device/account revisit.
[ ]Share the wall.[ ]Control privacy.[x]Enjoy the wall in Visit Mode.
Recommended Next Front-End Prototype Slices
1. Add visible privacy/share/NFC controls as non-functional or local-only prototype UI, clearly labeled as not backend-secured. 2. Add outside-window scene presets and prompt field as front-end state. 3. Improve focused object presentation in Visit Mode. 4. Landscape visit mode enhancements (framing, chrome, focus on narrow landscape viewports). 5. Catalogue browsing: categories, sectioning, and mobile-friendly catalog navigation. 4. Add richer folder page media handling. 5. Add ambient animation polish. 6. Add a sign-in/save/share flow shell that documents exactly where Supabase wiring will attach later.
Recommended Backend Wiring Order
1. Migrate to Next.js and TypeScript. 2. Add Supabase project configuration. 3. Implement Google sign-in. 4. Create users, walls, and wall_items. 5. Persist wall state to Supabase after sign-in. 6. Move uploaded assets to Supabase Storage. 7. Add privacy states and RLS. 8. Add public/share links. 9. Add shared-user access. 10. Add signed/private asset access and final security review.
Autonomous Build Rules
Use these rules when continuing implementation without new product guidance.
1. Prefer the next checklist item that unlocks a complete user outcome, not just a decorative subtask. 2. For front-end-only work, clearly label backend-dependent states as prototype/local-only/not secured. 3. Do not mark auth, saving, sharing, privacy, or security items complete unless real backend behavior exists. 4. Add or update Playwright tests for every meaningful user-visible outcome. 5. Keep docs/MVP_IMPLEMENTATION_CHECKLIST.md current when feature status changes. 6. Preserve the wall-first product feel; avoid turning the interface into a generic dashboard. 7. Keep changes scoped to the active outcome and avoid unrelated rewrites. 8. If a change affects dist for the hosted static prototype, keep source and dist behavior aligned until a build pipeline replaces manual sync. 9. If a test exposes a mismatch between checklist intent and current behavior, either fix the behavior or update the checklist with an explicit known gap. 10. When uncertain between multiple next steps, choose the one that improves trust, clarity, or end-to-end demo value first.