Shipping checklist
What's left to ship v1
Everything that's done, in progress, or still needed to turn the prototype into a shippable product. Mirrors and extends the §8 roadmap from the setup runbook.
48Done
0In Progress
2To Do
1. Urgent — Ship-blocking All done
▼
DONE
Fix docs — sign_in_anonymous is stale —
docs.html:278 · docs.html:779
docs.html:278 now says "Anonymous sign-in works", docs.html:779 says tokens are issued automatically.
DONE
Leaderboard top — respect count param —
index.ts:252
src/index.ts:252 now parses ?count=N query param, clamped to 1–500. Defaults to 100.
DONE
WAF rate-limit + billing alerts — Cloudflare dashboard ops: WAF rule on
Cloudflare dashboard
/v1/* to cap requests per IP at the edge. Enable billing notifications as human spend backstop.2. Domain & DNS
▼
DONE
Point
Cloudflare dashboard · slatefire_http.gd
slatefire.dev nameservers to Cloudflare. Add custom domains: slatefire.dev (site), api.slatefire.dev (Worker). Reserve app., docs., status.. Update SDK default base URL from workers.dev to api.slatefire.dev/v1.3. Backend feature gaps All done
▼
DONE
Leaderboard: around_player + player_entry — rank-neighborhood and single-player lookup routes.
index.ts:268 · index.ts:292 · leaderboards.gd:48 · docs.html:471
GET /me and GET /around wired in backend, SDK stubs replaced, docs updated.
DONE
Leaderboard: friends + add/remove —
index.ts:229 · index.ts:242 · index.ts:390
friends(), add_friend(), remove_friend() implemented. friends table in D1, GET /v1/leaderboards/{board}/friends joins scores, POST /v1/friends/add and POST /v1/friends/remove.
DONE
Saves: versioning envelope — R2 custom metadata tracks
index.ts:202 · index.ts:283
version + updated_at per slot. PUT returns version/updated_at. GET returns JSON {key, data, version, updated_at}. Supports expected_version for optimistic concurrency (409 on conflict).
DONE
Saves: list endpoint —
index.ts:267
GET /v1/saves lists all save keys for the current player via R2 list with prefix filter.
DONE
Analytics flush endpoint —
index.ts:253 · analytics.gd:62
POST /v1/analytics/batch stores batched events in D1. SDK _flush() sends queue on 5s debounce, clears on success.
DONE
Config endpoint —
index.ts:244 · config.gd:17
GET /v1/config returns project's KV-stored config. SDK fetch() calls backend, falls back to local cache.
DONE
Player auth: email + provider sign-in —
index.ts:412 · index.ts:437 · index.ts:454
POST /v1/players/register (PBKDF2 hashing), POST /v1/players/signin (password verify), POST /v1/players/provider (find-or-create by provider ID). All return signed tokens like anonymous auth. SDK methods updated.
DONE
Player auth: link/unlink + update traits —
index.ts:305 · index.ts:319 · index.ts:338
POST /v1/players/link-email, POST /v1/players/link-provider, POST /v1/players/update (display_name, avatar_url). All require player token. SDK methods updated.4. Publishing
▼
TODO
Godot Asset Library — package and submit
godotengine.org/asset-library
addons/slatefire/. Needs README + screenshots + tag review.
TODO
JavaScript / TypeScript SDK — for web builds and non-Godot clients.
new project
TODO
README.md — project overview, quick start, link to docs. Needed for open-source repo + Asset Library.
README.md
TODO
Link setup runbook from site nav —
setup guide
slatefire_setup_guide_dark.html is comprehensive but not linked anywhere.5. Testing & QA
▼
DONE
E2E PowerShell test suite — exercises every endpoint: auth, leaderboards, saves, friends, config, analytics, usage. Run with
e2e.ps1
.\tests\e2e.ps1 -ApiKey pk_live_xxx.
DONE
Vitest unit tests —
plans.test.ts · util.test.ts
plans.test.ts tests tier limits & constants. util.test.ts tests base64 round-trip, cookie parser, token generator. 17 tests pass.
DONE
Godot integration test — automated scene calling every SDK method. Attach to any node, set
godot_sdk_test.gd
api_key, and run. Console output shows pass/fail per method.
DONE
Load test — Node.js script (Node 18+) fires concurrent leaderboard submits. Usage:
load-test.js
node tests/load/load-test.js <api-key> [base-url] [concurrency] [iterations].
TODO
Cost analysis — worst-case monthly bill at max free-tier. Document expected costs.
doc
6. Infrastructure & Ops
▼
DONE
Single deploy command —
package.json · wrangler.toml
npm run deploy runs wrangler deploy which deploys Worker + Assets in one command. Added deploy:all that runs schema migration + deploy. Workers + Assets covers the site, no separate Pages deploy needed.
DONE
CI/CD pipeline — GitHub Action workflow exists but auto-trigger is disabled (manual dispatch only). Enable by adding push/branch rules back to
.github/workflows/deploy.yml
.github/workflows/deploy.yml once Cloudflare secrets are set in repo.
TODO
CI/CD secrets —
GitHub repo → Settings → Secrets and variables → Actions
CLOUDFLARE_API_TOKEN and CLOUDFLARE_ACCOUNT_ID need to be set in repo secrets before the pipeline can deploy.
DONE
Monitoring & alerting — structured JSON logging emitted to
logger.ts · Cloudflare dashboard
wrangler tail. Configure Cloudflare dashboard alerts on workers.errors, workers.requests spikes, and 429 surge patterns. Run npm run logs to tail live.
DONE
Logging / observability —
logger.ts · index.ts
Logger.ts emits structured JSON per request (method, path, status, latency, projectId, playerId). Every fetch handler path logs start & end. npm run logs tails formatted output.
DONE
Zombie data sweep — hourly cron deletes R2 saves + D1 leaderboard rows for free-tier projects inactive 3+ months. Also auto-recovers budget-triggered panic when usage drops below 50%.
index.ts:131
DONE
Backup / export —
backup.ps1
tests/backup.ps1 exports D1 schema + table data + R2 object listing to timestamped directory. Recovery instructions printed at end.
Legend:
DONE Finished and verified
WIP In progress
TODO Not started
NEEDS UPDATE Exists but is stale/wrong