Building the MVP

                        ┌───────────────────────────────┐
  browser ─── HTTPS ───►│  ONE APP (single repo/deploy) │
  (responsive web)      │  Next.js  or  Vite + Hono     │
                        │  ├─ pages / UI                │
                        │  ├─ API routes / actions      │
                        │  ├─ modules: accounts, core,  │
                        │  │   billing, notifications   │
                        │  ├─ track() → events table    │
                        │  └─ /healthz                  │
                        └──────┬──────────┬─────────────┘
                               │          │
              ┌────────────────┘          └──────────────────┐
              ▼                                              ▼
   ┌─────────────────────┐        managed services (HTTPS APIs)
   │ ONE POSTGRES        │        ├─ auth provider / library
   │ tables + events     │        ├─ payments (webhooks → app)
   │ daily backups       │        ├─ email API
   │ (PITR if offered)   │        ├─ object storage (files)
   └─────────────────────┘        ├─ error tracking
                                  └─ product analytics
 
 CI: push to main → typecheck + smoke tests → migrate → deploy
 Monitoring: uptime check on /healthz, error alerts to phone

THE DAILY LOOP (solo founder, build phase)
 
09:00  Read yesterday's note. Pick ONE story from the MVP slice.
09:15  Write the acceptance check (what will I click to prove it?)
09:30  Build the thinnest vertical slice of it.
12:30  Deploy what works (behind a flag if incomplete).
13:30  Continue / fix / cut (2× rule).
16:30  Deploy. Tick the story on the map. Update the cut list.
16:45  Write tomorrow's first step. Reply to any user messages.
17:00  Stop.
 
Weekly: Friday scope check · show it to 1 target user · review
error tracker · update launch list.

PRE-LAUNCH CHECKLIST
 
DOMAIN & DELIVERY
[ ] Custom domain; apex and www redirect to one canonical URL
[ ] HTTPS everywhere (valid certificate, HSTS)
[ ] Email: SPF, DKIM, DMARC on sending domain; magic links and
    receipts land in inbox, not spam (test Gmail and Outlook)
 
LEGAL & TRUST
[ ] Privacy policy that matches what you actually collect
[ ] Terms of service
[ ] Cookie/consent banner if your analytics or region needs one
[ ] Contact method visible (email address, not only a form)
[ ] Company/legal name where payment or law requires it
 
PRODUCT
[ ] Onboarding: new account reaches first value without help;
    empty states explain the next action
[ ] Core loop works end to end for a fresh account (not yours)
[ ] Account deletion or a documented way to request it
[ ] Mobile check: core loop usable on a real phone
[ ] Performance: key pages load fast on a mid-range phone on 4G;
    no obvious slow queries on the core loop
[ ] 404 and error pages exist and link home
 
PAYMENTS
[ ] Test-mode purchase, cancellation and failed payment work
[ ] Webhook signature verified; handler idempotent
[ ] One real live-mode purchase (yours), refunded
[ ] Receipts/invoices sent
 
OPERATIONS
[ ] Analytics: all planned events arriving, with properties
[ ] Error tracking live on client + server; alerts reach phone
[ ] Uptime monitor on /healthz
[ ] Backups automated AND one restore rehearsed
[ ] Secrets only in the host's secret store; .env not in git
[ ] Rate limits on sign-up, login, email-sending endpoints
 
SEO & SHARING BASICS
[ ] <title> and meta description per public page
[ ] Open Graph image and tags (link previews look right)
[ ] sitemap.xml and robots.txt; favicon
 
FEEDBACK
[ ] Feedback widget or "Reply to this email" on key emails
[ ] A way to book a call with you (calendar link)

PHASE 3 EXIT CHECKLIST (handoff to Phase 4: Launch)
 
[ ] MVP deployed at a public URL on your own domain
[ ] A brand-new user completes the core loop end to end in
    under N minutes (N = the first-value target in the spec,
    typically 5-10), without help, on desktop and phone
[ ] Analytics live: every event in the plan arrives with its
    properties; activation query written and returns numbers
[ ] Error tracking and uptime monitoring live, alerting you
[ ] Payments work in live mode (if charging from day one)
[ ] Feedback channel in the product (widget, email, call link)
[ ] Backups automated and one restore rehearsed
[ ] Pre-launch checklist complete
[ ] Launch list of the first 20-50 named people to invite:
    interviewees, prototype testers, waitlist, warm intros
    (name, how you know them, channel, date to contact)
[ ] "Not now" list updated: everything cut during the build,
    ready to become the iteration backlog

import { sql } from "drizzle-orm";
import {
  boolean, index, jsonb, pgTable, text, timestamp, uuid,
} from "drizzle-orm/pg-core";
 
const createdAt = () =>
  timestamp({ withTimezone: true }).notNull().defaultNow();
 
export const accounts = pgTable("accounts", {
  id: uuid().primaryKey().defaultRandom(),
  name: text().notNull(),
  createdAt: createdAt(),
});
 
export const users = pgTable("users", {
  id: uuid().primaryKey().defaultRandom(),
  accountId: uuid()
    .notNull()
    .references(() => accounts.id, { onDelete: "cascade" }),
  email: text().notNull().unique(),
  createdAt: createdAt(),
});
 
export const events = pgTable(
  "events",
  {
    id: uuid().primaryKey().defaultRandom(),
    accountId: uuid().references(() => accounts.id, {
      onDelete: "set null",
    }),
    userId: uuid().references(() => users.id, {
      onDelete: "set null",
    }),
    name: text().notNull(),
    props: jsonb().$type<Record<string, unknown>>()
      .notNull()
      .default({}),
    at: createdAt(),
  },
  (t) => [
    index("events_name_at_idx").on(t.name, t.at),
    index("events_user_at_idx").on(t.userId, t.at),
  ],
);
 
export const flags = pgTable("feature_flags", {
  name: text().primaryKey(),
  enabled: boolean().notNull().default(false),
  accountIds: uuid().array().notNull().default(sql`'{}'`),
});

import { db } from "../db";
import { events } from "../db/schema";
 
export type EventName =
  | "account_created"
  | "first_value_reached"
  | "core_action_completed"
  | "checkout_started"
  | "subscription_activated"
  | "feedback_submitted";
 
type Actor = { accountId?: string; userId?: string };
 
export async function track(
  name: EventName,
  actor: Actor,
  props: Record<string, unknown> = {},
) {
  try {
    await db.insert(events)
      .values({ name, ...actor, props });
  } catch (err) {
    console.error("track failed", name, err);
  }
}
 
// await track("account_created", { accountId, userId },
//   { source: "show_hn" });

select date_trunc('week', a.at) as week,
       count(*) as signups,
       count(v.account_id) as activated,
       round(100.0 * count(v.account_id) / count(*), 1)
         as pct
from events a
left join lateral (
  select e.account_id from events e
  where e.account_id = a.account_id
    and e.name = 'first_value_reached'
    and e.at < a.at + interval '7 days'
  limit 1
) v on true
where a.name = 'account_created'
group by 1 order by 1;

import { eq } from "drizzle-orm";
import { db } from "../db";
import { flags } from "../db/schema";
 
const fromEnv = new Set(
  (process.env.FLAGS ?? "")
    .split(",")
    .map((s) => s.trim())
    .filter(Boolean),
);
 
export async function isOn(
  name: string,
  accountId?: string,
) {
  if (fromEnv.has(name)) return true;
  const [row] = await db
    .select()
    .from(flags)
    .where(eq(flags.name, name))
    .limit(1);
  if (!row) return false;
  if (row.enabled) return true;
  return !!accountId && row.accountIds.includes(accountId);
}
 
// enable for one pilot customer:
// update feature_flags
//   set account_ids = array_append(account_ids, '<uuid>')
//   where name = 'bulk_import';

import { Hono } from "hono";
import { sql } from "drizzle-orm";
import { db } from "../db";
 
export const health = new Hono();
 
health.get("/healthz", async (c) => {
  const version = process.env.GIT_SHA ?? "dev";
  try {
    await db.execute(sql`select 1`);
    return c.json({ ok: true, db: "up", version });
  } catch {
    return c.json({ ok: false, db: "down", version }, 503);
  }
});
 
// app.route("/", health);

import { Hono } from "hono";
import { zValidator } from "@hono/zod-validator";
import { z } from "zod";
import {
  pgTable, text, timestamp,
} from "drizzle-orm/pg-core";
import { db } from "../db";
 
export const waitlist = pgTable("waitlist", {
  email: text().primaryKey(),
  source: text(),
  at: timestamp({ withTimezone: true }).defaultNow(),
});
 
const Form = z.object({
  email: z.string().trim().toLowerCase().email(),
  source: z.string().max(64).optional(),
  website: z.string().max(0).optional(), // honeypot
});
 
export const waitlistRoutes = new Hono().post(
  "/waitlist",
  zValidator("form", Form),
  async (c) => {
    const { email, source } = c.req.valid("form");
    await db
      .insert(waitlist)
      .values({ email, source })
      .onConflictDoNothing();
    return c.redirect("/thanks", 303);
  },
);

<form method="post" action="/waitlist">
  <label>Email <input name="email" type="email"
    autocomplete="email" required></label>
  <input name="website" tabindex="-1" autocomplete="off"
    style="position:absolute;left:-9999px"
    aria-hidden="true">
  <input type="hidden" name="source" value="landing">
  <button>Join the waitlist</button>
</form>

name: deploy
on:
  push:
    branches: [main]
concurrency: deploy-production
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: oven-sh/setup-bun@v2
      - run: bun install --frozen-lockfile
      - run: bunx tsc --noEmit
      - run: bun test
      - run: bunx drizzle-kit migrate
        env:
          DATABASE_URL: ${{ secrets.DATABASE_URL }}
      - uses: superfly/flyctl-actions/setup-flyctl@master
      - run: flyctl deploy --remote-only
        env:
          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}

#!/usr/bin/env bash
set -euo pipefail
dir="$HOME/backups/pg"
file="$dir/app-$(date -u +%Y%m%dT%H%MZ).dump"
mkdir -p "$dir"
 
pg_dump --format=custom --no-owner \
  --dbname="$DATABASE_URL" --file="$file"
pg_restore --list "$file" > /dev/null   # readable?
 
# copy off the machine, e.g. to object storage:
# aws s3 cp "$file" "s3://my-backups/pg/"
find "$dir" -name 'app-*.dump' -mtime +14 -delete

# 03:15 UTC daily; the script's env needs DATABASE_URL
15 3 * * * ~/bin/pg-backup >> ~/pg-backup.log 2>&1

createdb app_restore_test
pg_restore --no-owner --dbname=app_restore_test \
  ~/backups/pg/app-20260926T0315Z.dump
psql app_restore_test -c "select count(*) from users;"