Alpha plan

Status: Accepted · Version: 0.1

Alpha is the first time backend behaviour is real. It is still not a public launch. Stages 2 through 5 land here, in order. Do not start stage 4 because the demo went well if stage 2’s audit trail is missing.

Sensitive modules stay inside backend unless a boundary in ADR-001 is revisited.

Stage 2 — Functional MVP

Build

• Authentication: email, OTP, optional passkey, revocable sessions
• Trusted contacts: invite, accept, verify channel, remove, replace
• Vault: categories, text instructions, recipient mapping, encrypted values
• Life check: scheduler, email confirmation, reminder, response tracking
• Audit on every critical mutation (TITIP-010)

Exit

• A real user can create an account, create a vault, assign a recipient, receive a life check, confirm they are present, and see that confirmation in the audit trail
• Confirming during reminder or grace returns the cycle to ACTIVE
• Instruction plaintext is absent from the database and from audit payloads

Stage 3 — Escalation MVP

This is the first build that is actually Titip rather than a notes app with a timer.

Build the state machine in TITIP-007:

ACTIVE, CHECK_DUE, REMINDER_1, REMINDER_2, ALTERNATE_CHANNEL, GRACE_PERIOD, TRUSTED_CONTACT_VERIFY, REVIEW, ELIGIBLE_FOR_RELEASE, plus HELD and CANCELLED.

Rules are versioned. Changing a monthly check archives policy v3 and activates v4. The open cycle keeps v3.

Exit

• A missed check walks the default policy to a CANDIDATE release case and stops
• Provider failure does not start grace
• Insufficient trusted-contact confirmations do not produce eligibility

Stage 4 — Controlled recipient delivery

High-risk. Implement TITIP-009.

Recipient receives notice
  → opens secure portal
  → verifies email or phone
  → identity step-up
  → accepts disclosure
  → vault-specific access
  → access expires

Do not send vault contents in email or WhatsApp. Do not enable this stage until step-up is a real control, not a TODO, and until manual review (ADR-005) is enforced. Global hold must work before the first non-simulated approval.

Exit

• Recipient A cannot open recipient B’s vault
• A held age-gated vault stays held
• Revocation kills unused tokens
• Access writes release.recipient.accessed

Stage 5 — AI preparedness assistant

Only after stages 2 and 3 are stable. Delivery (stage 4) may proceed in parallel only if AI cannot call it.

Flow

Owner describes what matters (“I have a wife, two kids, a house, insurance and a business”). The assistant returns a checklist: family, property, insurance, business. It may draft “instructions for my wife about insurance.” The owner reviews before anything is saved.

Exit

• No AI dependency in lifecheck, escalation, or releases
• Secret offers are refused and not logged
• Output is labelled a draft, not legal advice

Not in alpha

Public launch, death-registry integration, blockchain, a password vault, or a fully automatic release. Those are either out of product or they wait for production-readiness.md.