Bootspring
HomeGet Started

Release Quality Plan

Current quality gates and next-wave engineering priorities for Bootspring.

Bootspring's release quality model has four layers:

  1. Correctness - route tests, workflow E2E, typecheck, Prisma schema/client freshness, and contract checks.
  2. Trust - auth, authorization, dependency hygiene, audit logs, data retention, and AI safety checks.
  3. Reliability - read-only builds, explicit database jobs, observability, SLOs, incident response, and rollback paths.
  4. Product intelligence - launch readiness scoring, quality graph signals, support/chat feedback loops, and agent benchmarks.

Current Release Gates

Every release should pass:

  • npm run db:generate
  • npx tsc --noEmit
  • npm run lint
  • npm test
  • npm audit --audit-level=high
  • npm run build with no database writes during build
  • Authenticated Playwright workflow tests for auth, projects, keys, devices, support, subscription, settings, and account lifecycle

Current Priority

The immediate quality reset restored the core engineering gates after the chat/live-support work:

  • Chat Prisma schema models exist and fresh client generation typechecks.
  • Chat lint and React Compiler findings are cleared.
  • Chat index writes are removed from prebuild and exposed as explicit chat:index scripts.
  • Initial /api/chat route tests and RAG prompt-boundary safety tests are in place.
  • Live-support handoff, owner cancel, admin join, live-message, and resolve routes have ownership and workflow guardrail tests.
  • AI chat rejects oversized prompts before provider/rate-limit/database work, first-party WebSocket private-channel auth is covered, and chat-to-ticket creation validates admin access, ticket priority, anonymous conversations, and transcript sanitization.
  • Chat-to-ticket creation is idempotent by source chat conversation so repeated admin clicks return the existing ticket instead of creating duplicates.
  • Chat rate limiting supports database-backed buckets for multi-instance production, with memory mode reserved for local/test operation.
  • Expired chat rate-limit buckets are removed by the admin chat cleanup job so distributed abuse-control state does not grow forever.
  • Chat transcript and alert-event retention now have admin-configurable anonymous, archived-conversation, and resolved-alert cleanup windows; active conversations and unresolved alerts are preserved.
  • Chat token budgets now run before model calls for anonymous, free, and paid usage tiers, with admin-configurable Light, Balanced, Deep Research, and Enterprise Guarded profiles.
  • Runtime compatibility tracking now covers MCP clients, hooks, Claude Code, Codex-style workflows, and IDE agent surfaces.
  • The admin chat command center now exposes conversation volume, token burn, estimated spend, helpfulness, escalation rate, support workflow health, stale handoffs, live queue health, conversation mix, budget projections, and persisted operational alerts with acknowledgement/resolution actions.
  • Alert acknowledgement/resolution routes now have admin-only, invalid-status, missing-alert, status-update, and audit-log regression coverage.
  • Active chat alerts now sync into an in-app admin notifications inbox with unread count, header badge, deduped alert items, and mark-read actions.
  • Active chat alerts now queue durable external notification deliveries for webhook, Slack, and email targets, with retry/backoff processing, self-hosted runner support, ADMIN_JOB_SECRET HTTP job auth, and super-admin processor API coverage.
  • Admin chat settings now expose operator delivery controls for channel routing, minimum severity, email recipients, and batch size while keeping webhook secrets in env.
  • The admin command center now shows delivery runner health and raises persisted alerts for missing outbox schema, stuck due rows, and repeated delivery failures.
  • npm run chat:rollout:smoke -- --target=staging --base-url=... provides a guarded staging/prod rollout check for DB schema, chat index inputs, delivery outbox health, optional delivery processing, endpoint smoke, and host scheduler setup.
  • Chat database rollout has an operator runbook and npm run db:verify:chat live DB verification gate covering chat tickets, rate-limit buckets, persisted alert events, admin notifications, and notification delivery outbox rows.
  • Dashboard chat prompts do not include the user's email address.
  • Marketing and dashboard chat widgets are mounted in the app shell.
  • The first mocked Playwright chat workflow covers the public marketing widget.
  • Dependency audit reports zero vulnerabilities.
  • Production build passes with the known Turbopack dynamic trace warning still tracked.

The next priority is making chat/live-support client-ready: broader AI safety evals, tenant/project/IP budget policy, production host scheduler configuration for npm run notifications:deliver -- --limit=50, observability, executing the database rollout, and workflow E2E coverage.

Next-Wave Product Bets

The product direction is to become the operating system for AI-assisted product development:

  • Quality Graph across projects, tasks, tests, docs, usage, audit logs, support, and chat.
  • Launch Readiness Score with evidence-backed recommendations.
  • Agent Benchmark dashboard for regression testing agent quality.
  • AI Support Brain that converts user questions into docs fixes, tickets, roadmap signals, and onboarding improvements.
  • Adaptive Bootspring Profiles so users can choose Light, Balanced, Deep Research, or Enterprise Guarded modes with different cost, retrieval, memory, and tool policies.
  • Provider-neutral MCP runtime work so Bootspring profiles, hooks, tools, memory, and budgets stay portable across MCP-compatible agent clients.
  • Governed Action System where agents can act only through typed tools, policy checks, approvals, audit trails, and rollback paths.

The full internal execution plan lives in planning/QUALITY_AND_MARKET_LEADERSHIP_PLAN_2026-05-13.md.