All 65 epics/stories — sortable table. Source CSV: docs/backlog.csv
| Epic | ID | Story | Priority | Estimate | Acceptance Criteria | Dependencies |
|---|---|---|---|---|---|---|
| A. Cloud foundation & secure landing zone | A1 | AWS Organization with dev/staging/prod/security accounts | P0 | M | Accounts isolated; SCP guardrails deny public S3 and non-EU/CH regions; billing alerts on | |
| A. Cloud foundation & secure landing zone | A2 | VPC public/private subnets in eu-central-2 Zurich; NAT egress; no public DB | P0 | L | Data stores only in private subnets; least-privilege SGs; flow logs enabled | A1 |
| A. Cloud foundation & secure landing zone | A3 | Secure data zone for Aurora + S3 PII/health with KMS CMK rotation | P0 | M | All PII/health encrypted at rest with CMK; access only from API SG; key access audited | A2 |
| A. Cloud foundation & secure landing zone | A4 | Cloudflare front: DNS/CDN/WAF/DDoS/rate-limit/bot | P0 | S | Origin locked to Cloudflare; OWASP ruleset on; TLS 1.2+ end to end | A2 |
| A. Cloud foundation & secure landing zone | A5 | Secrets via AWS Secrets Manager; CI via OIDC | P0 | S | App reads secrets at runtime; rotation on; no static keys in CI | A1 |
| A. Cloud foundation & secure landing zone | A6 | Terraform IaC for all infra with remote state | P1 | M | terraform plan clean; environments reproducible | A1-A5 |
| A. Cloud foundation & secure landing zone | A7 | Cost guardrails and tagging policy | P1 | S | Per-env cost dashboards; anomaly alerts | A1 |
| B. CI/CD GitHub to production | B1 | GitHub mono-repo with branch protection and CODEOWNERS | P0 | S | No direct pushes to main; PRs need green CI + 1 review | |
| B. CI/CD GitHub to production | B2 | CI: lint/typecheck/test/build/SBOM/image scan/secret scan | P0 | M | Pipeline fails on critical vulns or leaked secrets; artifacts versioned | B1 |
| B. CI/CD GitHub to production | B3 | Container build/push to ECR with immutable tags + cosign signing | P0 | M | Only signed images deploy to prod | B2 |
| B. CI/CD GitHub to production | B4 | CD: dev on merge / staging on tag / prod on approval; blue-green | P0 | L | Zero-downtime deploys; one-click rollback; deploy events logged | B3;C1 |
| B. CI/CD GitHub to production | B5 | DB migrations as gated pipeline step (expand/contract) | P0 | S | Migrations reversible; prod migration requires approval | B4;C2 |
| B. CI/CD GitHub to production | B6 | Ephemeral preview environments per PR | P1 | S | Each PR gets a URL; torn down on merge/close | B4 |
| B. CI/CD GitHub to production | B7 | Dependabot/Renovate + license checks | P1 | S | Weekly dependency PRs; blocked licenses fail CI | B2 |
| C. Scalable containerized backend | C1 | API service on ECS Fargate behind ALB with autoscaling | P0 | L | Scales horizontally; survives instance loss; p95 latency target under load | A2 |
| C. Scalable containerized backend | C2 | Aurora PostgreSQL Multi-AZ in secure zone with pooling | P0 | M | Failover < 60s; encrypted backups + PITR | A3 |
| C. Scalable containerized backend | C3 | Encrypted S3 for media/exports; signed URLs only | P0 | M | No public objects; access logged | A3 |
| C. Scalable containerized backend | C4 | Async layer SQS + workers for syncs/recompute/notifications | P1 | M | Retries + DLQ; idempotent consumers | C1 |
| C. Scalable containerized backend | C5 | Redis cache for phase content/sessions/rate limits | P1 | M | Cache hit ratio target; safe invalidation | C1 |
| C. Scalable containerized backend | C6 | Recommendation service behind /recommendations (rules to ML/Apertus) | P2 | L | Engine swappable without client changes; IO logged de-identified | C1;C4 |
| C. Scalable containerized backend | C7 | Multi-region/read-replica readiness for US expansion | P2 | L | Documented failover + residency plan | C2 |
| D. Data protection consent & compliance | D1 | Consent service with versioned scopes + immutable audit | P0 | M | Every scope stored with timestamp + policy version; queryable per user | C2 |
| D. Data protection consent & compliance | D2 | Consent in onboarding: granular unbundled opt-ins before health data | P0 | M | No health row persists without matching consent; optional refusals still allow core use | D1 |
| D. Data protection consent & compliance | D3 | Consent at point of capture (just-in-time for wearables/sensitive data) | P0 | M | Connector cannot sync until scope granted; revocation stops sync immediately | D1 |
| D. Data protection consent & compliance | D4 | DSAR endpoints: export + erasure incl downstream connectors | P0 | M | Export within SLA; erasure purges PII across stores; backup schedule documented | D1 |
| D. Data protection consent & compliance | D5 | Row-Level Security / per-user isolation; org sees aggregates only | P0 | S | Cross-user access impossible; verified by tests | C2 |
| D. Data protection consent & compliance | D6 | Data classification + retention + minimization | P0 | S | Each field tagged; retention enforced by jobs | C2 |
| D. Data protection consent & compliance | D7 | DPIA + Records of Processing + DPA templates | P1 | M | DPIA signed before launch; sub-processor list published | D1 |
| D. Data protection consent & compliance | D8 | Cookie/consent banner privacy-first on web entry | P1 | S | Non-essential off by default; choices logged | F1 |
| D. Data protection consent & compliance | D9 | Your-data-is-yours trust surface in-app | P1 | S | Users can view/manage/revoke all consents in Profile | D1 |
| E. Health & wearable connectors | E1 | Apple Health (HealthKit) connector | P1 | L | Read selected types with grant; background delivery; revoke handled | EP1;D3 |
| E. Health & wearable connectors | E2 | Google Health Connect / Android connector | P1 | L | Health Connect permissions; graceful when app absent | EP1;D3 |
| E. Health & wearable connectors | E3 | Samsung Health connector | P1 | L | SDK integration; scoped read | EP1;D3 |
| E. Health & wearable connectors | E4 | Garmin Connect connector | P1 | L | OAuth + webhook pull; backfill window | EP1;D3 |
| E. Health & wearable connectors | E5 | Fitbit connector | P1 | M | OAuth2; rate-limit aware | EP1;D3 |
| E. Health & wearable connectors | E6 | Strava connector | P1 | M | OAuth2 + webhooks; dedup vs phone data | EP1;D3 |
| E. Health & wearable connectors | E7 | Oura connector (sleep/readiness/HRV/temp) | P2 | M | OAuth2; temperature mapped to cycle model | EP1;D3 |
| E. Health & wearable connectors | E8 | WHOOP connector | P2 | M | OAuth2 + webhooks | EP1;D3 |
| E. Health & wearable connectors | E9 | Polar/Suunto/Withings connector (by demand) | P2 | M | At least one integrated; documented | EP1;D3 |
| E. Health & wearable connectors | E10 | Apple Watch / Wear OS phase surfacing | P2 | M | Complication/tile reads today phase + focus | E1;E2 |
| E. Health & wearable connectors | EP1 | Connector framework: normalized schema + adapters + token vault + sync/backfill/dedup | P1 | L | Adding provider = new adapter only; conflicts resolved by priority | C4 |
| E. Health & wearable connectors | EP2 | Sync orchestration SQS + webhooks + per-provider observability | P1 | M | Failed syncs alert; per-user sync status visible | EP1;C4 |
| E. Health & wearable connectors | EP3 | Consent + revoke wiring; disconnect purges tokens | P1 | S | Revoke stops sync < 1 min; tokens deleted | D3;EP1 |
| F. Unified web entry point | F1 | Single web app: public marketing + authenticated /app | P0 | M | One codebase/deploy/domain; SEO-friendly marketing | C1 |
| F. Unified web entry point | F2 | Smart entry point routing anon to marketing logged-in to app | P0 | S | Session-aware routing; deep links preserved | F1;F3 |
| F. Unified web entry point | F3 | Shared auth/session (SSO) across marketing and app | P0 | M | Single sign-in; waitlist to account upgrade path | C2 |
| F. Unified web entry point | F4 | Shared design tokens across marketing/web/RN (Figma-aligned) | P0 | S | One token source; consistent brand | |
| F. Unified web entry point | F5 | Waitlist to onboarding handoff | P1 | S | Waitlisted emails convert without re-entry | F3 |
| F. Unified web entry point | F6 | Funnel analytics + A/B (EU) | P1 | S | Signup funnel measured end-to-end | F1 |
| G. Web admin app (MIS/KPIs) | G1 | Admin shell with RBAC behind Cloudflare Access + MFA | P1 | M | No public access; roles enforced server-side; actions audited | F3;A4 |
| G. Web admin app (MIS/KPIs) | G2 | MIS KPI dashboard: access/signups/retention/subscriptions/MRR/churn/CAC/LTV/ARPU | P1 | M | Metrics match source-of-truth; date filters; export | G1;F6 |
| G. Web admin app (MIS/KPIs) | G3 | Business-case/financial tracker vs plan | P1 | M | Editable assumptions; variance vs plan shown | G1 |
| G. Web admin app (MIS/KPIs) | G4 | Subscription & user admin (no raw cycle data) | P1 | S | PII access role-gated + logged; cycle data never shown individually | G1;D5 |
| G. Web admin app (MIS/KPIs) | G5 | Connector/ops health panel | P1 | S | Surfaces per-provider sync metrics | G1;EP2 |
| G. Web admin app (MIS/KPIs) | G6 | Content/clinical review queue | P2 | S | Publish workflow with clinical sign-off | G1 |
| H. Protected business-case site | H1 | Business-case microsite from pitch deck | P1 | M | All deck sections represented; responsive; on-brand | |
| H. Protected business-case site | H2 | Access protection via Cloudflare Access (SSO/allowlist) | P1 | S | Only invited emails view; access logged; revocable | A4;F3 |
| H. Protected business-case site | H3 | Document vault with gated downloads | P1 | S | Gated downloads; per-file access tracked | H2 |
| H. Protected business-case site | H4 | Embed live Canva presentation + export | P2 | S | Deck viewable inline once Canva link/export provided | H1 |
| H. Protected business-case site | H5 | Per-visitor view analytics | P2 | S | Per-email engagement visible in admin | H2;G1 |
| I. Observability security & DR | I1 | Central logging/metrics/tracing + dashboards + alerts | P1 | M | p95 latency/error/sync-failure alerts to on-call | C1 |
| I. Observability security & DR | I2 | Error tracking (Sentry) across web/RN/API | P1 | S | Releases tracked; alerts routed | |
| I. Observability security & DR | I3 | Security: WAF + scanning + pen-test + incident runbook | P1 | M | Criticals block release; runbook rehearsed | A4;B2 |
| I. Observability security & DR | I4 | Backups + DR drill with RPO/RTO | P1 | S | Restore tested; RPO/RTO documented | C2 |
| I. Observability security & DR | I5 | Status page + uptime monitoring | P2 | S | Public status; SLO dashboards | I1 |