Appendix B — Rollout plan

A five-phase path to take a project from “everything in my head” to “ready for a collaborator and paying customers”. Each phase fits in one or two iterations and doesn’t depend on paid tools.

B.1 Phase 0 — Right away

• Move every secret into a password manager, in a project vault.
• Check whether any secret has ever been committed; if so, change it.
• Turn on 2FA, secret scanning, and push protection on GitHub.
• Move changing binaries (presentations, videos) out of the repository and into the drive.

B.2 Phase 1 — Organize the work

• Create the GitHub Project with Status, Priority, Area, Estimate, and Iteration (Chapter 3).
• Create the labels and the Backlog, Current iteration, and Roadmap views.
• Move TODO.md into issues and drafts; archive the file.
• Create the current epics as issues of type Epic.
• Run the first iteration with planning and review (Chapter 4).

B.3 Phase 2 — Code flow and CI

• Write HOW-WE-WORK.md and the root README.md (Chapter 5).
• Create .github/ with PR and issue templates and dependabot.yml.
• Create the minimal CI: lint, tests, and migration check (Chapter 9).
• Turn on branch protection for main (Chapter 7).
• Adopt Conventional Commits and start a CHANGELOG.md.

B.4 Phase 3 — Operations

• Set up error tracking on the backend and the frontend (Chapter 11).
• Set up an external uptime monitor, with alerts.
• Define RPO and RTO; do the first test restore (Chapter 12).
• Write the deploy, rollback, and secret-rotation runbooks.
• Create docs/postmortems/ and the template (Chapter 13).
• Have a staging environment with fictional data.

B.5 Phase 4 — Ready for a collaborator and paying customers

• A README with “run it in 10 minutes” and seed data (Chapter 6).
• CONTRIBUTING.md and three good first issue issues.
• Onboarding and offboarding checklists for collaborators.
• Audit log and masking of sensitive data (Chapter 14).
• Privacy and data retention policy.
• Automated deploy from main, with feature flags (Chapter 10).
• Status page.