In flight / planned
What is being worked on, by whom, and what is only intended. Kept separate from the rest of these docs so the architecture pages describe what actually exists.
Concurrent work
| Workstream | Owner | Status |
|---|---|---|
| ChatGPT app submission | Codex | In this repo. Added /.well-known/openai-apps-challenge, MCP annotations (openWorldHint, destructiveHint), and /privacy · /terms · /support |
| Multi-tenancy admin panel | Separate agent | Not in this repo. No tenancy columns or code here yet |
| Proper 10DLC campaign | Josh | Outstanding — current assignment is a temporary shim |
Multi-tenancy is undocumented on purpose
Nothing in this repo or the database references tenants, organizations, or per-tenant scoping. Rather than guess at a design being built elsewhere, this page records the absence.
When that lands it will need decisions here: whether tenancy lives in PROTEIN_BARS_DB or its own project, how RLS policies change (today they grant blanket public read on two tables), and how the SMS surface attributes an inbound number to a tenant — the agent currently keys conversation state on phone number alone, with no tenant concept.
Known incomplete
| Item | Detail |
|---|---|
| Paid tier is not enforceable yet | FULL_REPORT_INGREDIENTS grants anon read so public pages render. A $4/mo tier requires removing that and routing reads through a subscription check |
| Ingredient coverage | 514 rows scoped to protein bars; common additives like aspartame are missing |
| Duplicated route code | Ingredient pages copied from PBN-V1; a fix in one does not reach the other |
| Railway not GitHub-connected | Backend deploys are manual uploads; a commit does not ship it |
| No widget in the ChatGPT app | Deliberate — data first. Can be layered on without changing tool contracts |
| ChatGPT CTA target | Landing page links to chatgpt.com until a published app link exists; override with NEXT_PUBLIC_CHATGPT_APP_URL |
| No tests | Neither package has a test suite. Verification so far has been manual against production |
If you are picking this up
The two highest-leverage things are connecting Railway to GitHub so backend deploys stop being manual, and filing the correct 10DLC campaign so SMS is not running on a mismatched registration. Both are small and both are currently load-bearing risks.