HLO — FRESH SESSION / PROJECT RECOVERY / CONTINUE FROM CHECK...

Prompt

HLO — FRESH SESSION / PROJECT RECOVERY / CONTINUE FROM CHECKPOINT You are starting a completely NEW development session for my project Hlo. The previous AI session reached its token/context limit and ended. You have NO access to that conversation. Reconstruct the project from the latest ZIP and this brief. 1. LATEST PROJECT CHECKPOINT The latest/current project ZIP is on Google Drive: https://drive.google.com/file/d/18pv3c5Fih8vi8FnmF-k70elScGdvD2Az/view?usp=drivesdk FIRST ACTION Use your available tools/capabilities to DOWNLOAD this ZIP from Google Drive. Then: 1. Extract it. 2. Identify the project root. 3. Inspect the COMPLETE file tree. 4. Read all relevant documentation. 5. Inspect frontend and backend source. 6. Inspect package/config files. 7. Inspect database schema and migrations. 8. Inspect APIs and authorization. 9. Inspect tests. 10. Inspect infrastructure/deployment configuration. 11. Run appropriate verification. 12. Determine the REAL current implementation state. Do not ask me to manually paste the source code if you can access the ZIP yourself. Do not assume the previous conversation exists. Do not start from the original project. Do not delete or overwrite the checkpoint before inspecting it. The downloaded ZIP is the current source-of-truth checkpoint. --- 2. RECOVERY PRINCIPLE The existing ZIP contains substantial work. Follow: DOWNLOAD → EXTRACT → INVENTORY → INSPECT → UNDERSTAND → VERIFY → CONTINUE NOT: DOWNLOAD → DELETE → REBUILD Preserve valuable existing implementation, UI, architecture, tests and documentation. Refactor or replace components only when technically justified. --- 3. WHAT IS HLO? Hlo is intended to become a privacy-first, full-stack social communication platform combining social networking, private communication, media, communities and professional networking into one unified product. The final platform should have its own original: - architecture - identity - branding - UX - UI - implementation Do not copy proprietary source code, branding, assets or exact designs from existing platforms. The product concept includes capabilities commonly found across social, messaging and professional platforms, but Hlo must remain its own product. --- 4. TARGET PRODUCT Ultimately support: Identity - registration/login/logout - email verification - password recovery/change - sessions - devices - 2FA - recovery codes - passkeys where appropriate - account deletion/deactivation - data export Profiles - personal profiles - avatars - bios - links - professional profiles - skills - experience - education - certifications - projects - portfolios Social - posts - comments - reactions - reposts - bookmarks - follows - followers/following - connections - connection requests - mentions - hashtags - feeds - blocks - mutes - restrictions Stories - text/image/video stories - audience controls - close friends - replies - views - expiration - archive - highlights Short Video - creation - recording - upload - trimming - captions - audio - thumbnails - hashtags - mentions - reactions - comments - shares - saves - creator profiles - recommendations Messaging - 1:1 chats - groups - channels - communities - replies - reactions - editing - deletion - disappearing messages - pinned messages - saved messages - attachments - voice messages - video messages - polls - mentions Communities - public/private/invite-only communities - channels - threads - roles - permissions - moderators - announcements - rules - bans - reports - appeals - audit logs Professional Network - professional profiles - companies - company pages - jobs - applications - professional connections - professional posts - skills/experience/education/certifications/projects Search Search people, profiles, posts, hashtags, communities, channels, companies, jobs and videos while strictly respecting authorization and privacy. Never expose private resources through search. Never create an insecure plaintext server-side index of E2EE message contents. Notifications - in-app - push - message notifications - social notifications - security alerts - preferences - quiet hours - deduplication - retries Never place sensitive E2EE plaintext into notification payloads. Calling Eventually support: - voice calls - video calls - group calls - screen sharing Use appropriate WebRTC architecture including signaling, TURN and/or SFU where required. Clearly distinguish transport encryption, signaling security, media encryption and application-level E2EE. --- 5. E2EE / PRIVACY Private messaging must eventually use genuine end-to-end encryption. Do NOT invent cryptography. Evaluate mature protocols/implementations such as Signal-style protocols and MLS according to actual requirements. Consider: - forward secrecy - post-compromise security - multi-device - group messaging - key management - device verification - device revocation - membership changes - replay protection - recovery - implementation maturity - platform compatibility The server must not receive plaintext private message content. Base64 is NOT encryption. Hashing is NOT encryption. Obfuscation is NOT E2EE. Never claim E2EE unless it is actually implemented and appropriately tested. Privacy must include: - profile visibility - post audiences - story audiences - close friends - message permissions - discoverability - online status - read receipts - blocking - muting - restrictions - device management - session management - data export - deletion - deactivation - retention controls --- 6. MULTI-DEVICE Support a secure device/session architecture: - device registration - device verification - device listing - device revocation - session management - cryptographic identity - key rotation - compromised-device handling --- 7. REALTIME Implement authenticated realtime infrastructure for: - messages - presence - typing - delivery receipts - read receipts - notifications Handle: - reconnect - offline clients - duplicate events - event ordering - stale connections - server restarts - backpressure --- 8. MEDIA Build a real media pipeline: CLIENT ↓ AUTHENTICATED UPLOAD ↓ VALIDATION ↓ QUARANTINE ↓ SECURITY SCAN ↓ PROCESSING ↓ OBJECT STORAGE ↓ CDN Support images, video, avatars, stories, short videos, documents, voice/video messages and attachments. Private media must remain authorization-protected. --- 9. SECURITY Security must cover the COMPLETE stack: FRONTEND ↓ API ↓ AUTHENTICATION ↓ AUTHORIZATION ↓ BUSINESS LOGIC ↓ DATABASE ↓ STORAGE ↓ WORKERS ↓ REALTIME ↓ INFRASTRUCTURE Review/test for: - authentication bypass - authorization bypass - IDOR - BOLA - privilege escalation - XSS - CSRF - SSRF - injection - race conditions - replay - rate-limit bypass - secret leakage - privacy leakage - malicious uploads - WebSocket authorization flaws - media authorization flaws - cryptographic integration errors Also implement appropriate moderation, spam protection, abuse controls, reporting, moderator roles, audit logs and appeals. --- 10. HISTORICAL PROJECT STATE The original Hlo project was a substantial frontend/local prototype. Previous development reached approximately: ITERATION 20 That was NOT a complete production backend. A previous session then recovered the project and began converting it into a real connected application. The latest ZIP is the result of that work. The previous session reported that it had: - preserved the original archive - created inventory/checksums - reviewed documentation/tests - preserved the UI - restored/documented missing media - added PostgreSQL - added accounts - added sessions - added profiles - added posts - added comments - added reactions - added bookmarks - added search - added server authorization - added validation - added rate limiting - added transactional writes - added audit events - added migrations It reported: 58/58 unit tests passed 27/27 browser/API tests passed It also reported successful: - type generation - TypeScript - formatting - production build - managed startup - health checks It explicitly stated that these remained incomplete: - E2EE - realtime messaging - production media - calling - remaining backend domains - verified backups It also stated: 0/50 production review cycles completed These are HISTORICAL CLAIMS ONLY. Do not trust them automatically. Verify them against the actual ZIP and actual tests. --- 11. CURRENT-STATE AUDIT After extracting the ZIP, create a factual implementation matrix. Classify every major capability as: IMPLEMENTED + VERIFIED IMPLEMENTED + UNVERIFIED PARTIAL MOCK PLANNED BLOCKED MISSING The actual source code and test evidence determine the state. Documentation does not override reality. Before making major architectural decisions, understand the existing architecture. --- 12. PHASE A — COMPLETE THE PRODUCTION PLATFORM After recovery and verification, continue development. Do not stop at the existing connected slice. Complete the missing production systems, including: - identity - authentication - authorization - database - E2EE - multi-device - messaging - realtime - media - stories - social graph - feeds - short video - communities - professional networking - search - notifications - calling - moderation - privacy - observability - backups - deployment Use production-quality architecture rather than UI-only simulations. --- 13. PRODUCTION RELEASE GATE Do NOT start the 50-cycle process until the complete production platform has been implemented and verified. Verify the complete stack: - frontend - backend - database - API - authentication - authorization - encryption - realtime - media/storage - workers - notifications - calling - privacy - moderation - observability - deployment - backups/recovery No fake functionality. No mock functionality presented as production functionality. No unsupported security claims. --- 14. PHASE B — 50 LOOP ENGINEERING CYCLES ONLY after the production release gate passes, execute: CYCLE 01 CYCLE 02 CYCLE 03 ... CYCLE 50 The unit of review is the ENTIRE SYSTEM, not one file or one feature. Each cycle must follow: FULL SYSTEM REVIEW ↓ FIND DEFECTS / RISKS ↓ IMPLEMENT IMPROVEMENTS ↓ FULL REGRESSION ↓ REVIEW THE ENTIRE SYSTEM AGAIN ↓ FIX REGRESSIONS ↓ VERIFY AGAIN ↓ DOCUMENT ↓ NEXT CYCLE --- 15. WHOLE-STACK REVIEW — EVERY CYCLE Review the entire: - frontend - backend - API - database - authentication - authorization - E2EE - device/key system - messaging - realtime - media - stories - social graph - feeds - short video - communities - professional networking - search - notifications - calling - moderation - privacy - observability - infrastructure - deployment - backups - tests - documentation Do not review only recently modified files. --- 16. SECURITY REVIEW — EVERY CYCLE Actively attempt to identify weaknesses. Test appropriate cases including: - IDOR - BOLA - privilege escalation - auth bypass - session attacks - XSS - CSRF - SSRF - injection - race conditions - replay - rate-limit bypass - privacy leakage - secret leakage - malicious uploads - WebSocket authorization - media authorization - crypto integration Fix real findings and regression-test them. Do not invent vulnerabilities simply to make a cycle appear productive. --- 17. PERFORMANCE REVIEW — EVERY CYCLE Inspect actual: - API latency - database performance - expensive queries - indexes - frontend performance - bundle size - memory - CPU - realtime performance - queue latency - media processing Use real measurements where possible. Never fabricate benchmarks. --- 18. CROSS-LAYER IMPACT Every major change must be followed through its dependent layers. Example: MESSAGE CHANGE ↓ DATABASE ↓ E2EE ↓ DEVICE KEYS ↓ API ↓ REALTIME ↓ NOTIFICATIONS ↓ OFFLINE STATE ↓ FRONTEND ↓ TESTS Example: AUTH CHANGE ↓ SESSIONS ↓ DEVICES ↓ WEBSOCKETS ↓ WEBRTC ↓ API AUTHORIZATION ↓ FRONTEND ↓ RECOVERY ↓ AUDIT --- 19. NO FAKE CYCLES Changing only: - colors - text - formatting - variable names - trivial refactoring does NOT constitute a meaningful engineering cycle. Every cycle must perform a genuine whole-system review. If no significant change is justified, document the evidence rather than inventing work. --- 20. CYCLE DOCUMENTATION Create: docs/LOOPS/CYCLE-01.md docs/LOOPS/CYCLE-02.md ... docs/LOOPS/CYCLE-50.md Each cycle document must record: - baseline - whole-system findings - security findings - performance findings - changes - tests - regressions - fixes - unresolved issues - next-cycle focus Maintain: docs/PROJECT_STATE.md It must accurately report: - current phase - current cycle - implemented features - verified features - partial features - mocks - blocked features - test results - security results - performance results - known limitations - remaining work --- 21. CYCLE 50 — FINAL INDEPENDENT AUDIT Cycle 50 is NOT simply another routine pass. Treat Hlo as if a completely new engineering/security team has received the final system. Independently inspect the complete platform. Attempt to break it. Fix discovered problems. Run: - complete test suite - unit tests - integration tests - API tests - E2E tests - accessibility tests - security verification - performance verification - deployment checks - backup/restore verification Create: docs/FINAL_SYSTEM_AUDIT.md --- 22. ABSOLUTE TRUTHFULNESS Never fabricate: - implementation - tests - benchmarks - security results - E2EE - backups - deployment - completed cycles - production readiness Use explicit states: VERIFIED IMPLEMENTED PARTIAL MOCK BLOCKED UNVERIFIED If something cannot be verified, say so. --- 23. FINAL EXECUTION ORDER Follow this sequence: GOOGLE DRIVE CHECKPOINT ↓ DOWNLOAD ↓ EXTRACT ↓ COMPLETE INVENTORY ↓ FORENSIC/ARCHITECTURAL INSPECTION ↓ VERIFY CURRENT STATE ↓ PRESERVE EXISTING WORK ↓ COMPLETE PRODUCTION IMPLEMENTATION ↓ PRODUCTION RELEASE GATE ↓ CYCLE 01 ↓ FULL-SYSTEM REVIEW ↓ UPGRADE ↓ FULL REGRESSION ↓ FULL-SYSTEM REVIEW AGAIN ↓ CYCLE 02 ↓ ... ↓ CYCLE 50 ↓ FINAL INDEPENDENT AUDIT --- 24. START NOW Download this exact latest checkpoint: https://drive.google.com/file/d/18pv3c5Fih8vi8FnmF-k70elScGdvD2Az/view?usp=drivesdk Extract it. Inspect it. Verify it. Understand the actual implementation. Continue Hlo from that checkpoint. Do not ask me to reconstruct the previous conversation. Do not restart from zero. Do not claim work is complete until it is actually implemented and verified. START NOW.