# Greenfield fullstack MVP bootstrap

Use when the user hands over an empty repository and asks for a real first productive version, not a design mockup.

## Durable workflow

1. Treat the request as product + engineering scope, not UI-only scaffolding.
2. Clone/initialize the target repo and verify auth/branch state before edits.
3. Create a task plan that separates repo bootstrap, backend, frontend, devops, docs, verification, and commit/push.
4. Start with a thin RED test set for the most important backend invariants before implementing:
   - health endpoint;
   - security/redaction helpers;
   - one core import or upload workflow;
   - one read/update/review workflow.
5. Implement real backend primitives before polish:
   - models/schema;
   - storage/import services;
   - API routes;
   - redaction/encryption helpers;
   - background-job records, even if workers are skeletal.
6. Build a usable frontend path that exercises the product promise:
   - dashboard/home;
   - inbox/library;
   - upload;
   - review page with preview and editable metadata;
   - account/compliance/consent UX if platform review depends on it.
7. Add Docker/Makefile/env/docs in the same first commit so another operator can start the app.
8. Verify with real outputs:
   - backend tests and linter;
   - frontend typecheck/build;
   - local API smoke test on a free port;
   - browser smoke test and console check when a UI exists;
   - static compose/config validation if Docker is unavailable.
9. Commit/push and report exact commit, branch, test output, known gaps, and next phase.

## Pitfalls

- Do not stop at “skeleton generated” when the user requested an MVP. Include at least one end-to-end product workflow path.
- If a default port is occupied by another service, use a different port for smoke tests and mention the conflict as transient context, not a durable constraint.
- When a platform verification review is part of the product, make the required human-control fields visible in the first UI pass: preview, account, editable metadata, platform options, compliance toggles, consent, and status/logs.