selfphoneng/docs/v1-checklist.md

Ready for v1 checklist

v1.0 ships when every box is ticked. It gathers the roadmap's definition of done (09) and its open real-hardware checks, plus the security leftovers (08 §6). Tick a box only with proof: a date and what was seen.

Built

• Milestones M0–M11 built and tested (simulated phones and a simulated voip.ms).
• Security review (M11-T8), with an independent review (08 §6).
• Second security review of everything after it, with an independent review; all eight findings fixed with tests (08 §7, 2026-10-28).

Real voip.ms account (M3)

• The trunk shows Registered in the UI (2026-10-21: green, voip.ms, the sub-account at its POP).
• A mobile → DID call rings a phone. 2026-10-21: DID → digital receptionist → browser phone; the DID came in the Request-URI (written down in 06 §3).
• An outbound call shows the DID as caller ID on the mobile (2026-10-21, owner).
• Write down in 06 §4 whether per-call caller ID (Remote-Party-ID) is honored.

Real phones (M8, M10)

• Linphone on a real phone registers by scanning the QR (2026-10-20, iPhone).
• An incoming call rings that Linphone while the app is open (2026-10-21, v0.0.2: DID → receptionist → 100 rings the iPhone).
• A factory-reset Yealink pointed at the setup URL registers with the right name and BLF keys.
• A Grandstream gets its keys the same way.
• Paging auto-answers on a real Yealink or Grandstream.

On hold until the owner has the phones (2026-10-21).

Someone else installs it (M11)

• An outside tester follows only the admin guide and gets inbound and outbound calls working on a fresh VM (2026-10-28, owner).
• A backup restores on a second VM (2026-10-28, owner).

A week on the owner's server

• 7 days handling real calls with no crash or restart of the api or Asterisk (2026-10-28, owner).
• Nightly backups restore cleanly (2026-10-28, owner).

Updating

Docker only, never bare metal (owner, 2026-10-21).

• The api backs up before it changes the database, and stops if it can't (2026-10-21).
• scripts/update.sh for compose installs, and the admin guide's "Updating" section for compose and Portainer (2026-10-21).
• scripts/update.sh on a throwaway compose install (Docker in Docker, 2026-10-21): install.sh at v0.0.2, then a test v0.0.3 with a migration (the api backed up, then migrated), then a test v0.0.4 whose api crashes after migrating: one backup despite the restarts, and the script went back to v0.0.3 with that backup restored.
• A real compose install with the bundled Caddy updated with scripts/update.sh, with calls and backups.
• The owner's Portainer stack updated to a release that changes the database, several times (2026-10-28, owner).

Security leftovers (08 §6)

Owner's decision (2026-10-21): fix all of them. Each is in 08 §6 with its test.

• Asterisk no longer loads app_system, func_shell, app_disa, res_agi or app_externalivr; pnpm test:asterisk passes.
• Turning two-step sign-in on asks for the password again.
• *97/*98: one voicemail login at a time per phone, 10 an hour.
• An unknown MAC answers /prov like a known one (401).
• The login limiter forgets old entries.

The release

• Version 1.0.0 in every package.json, and a v1.0.0 entry in the changelog.
• The release builds and pushes images to both the Gitea registry and ghcr.io (2026-10-28, owner).

Not needed for v1

The mobile app (owner, 2026-10-28), more SIP providers (Telnyx, Flowroute, Twilio), SMS, push notifications for phone apps, and the M12 list in the roadmap.