Roadmap check-in: priorities after the July 10 batch

[testtest126]

Today's agent-driven batch landed a lot at once, so this is a natural point to agree on what's next.

Landed on main today

• Rematch after online games (Rematch button after online games #12, PR Rematch after online games (closes #12) #22)
• iOS build + UI tests in CI (Run the iOS build and UI tests in CI #15, PR Run the iOS build and UI tests in CI (closes #15) #23; toolchain fix in PR Fix iOS CI: compile-gate the Liquid Glass button styles #24)
• Engine: persistent transposition table + pondering (Engine: pondering and a persistent transposition table across moves #16, PR Engine: persistent transposition table and pondering #25)
• vapor/jwt 5 migration (Migrate to vapor/jwt 5 (JWTKit 5) #21, PR Migrate to vapor/jwt 5 (JWTKit 5) #42)
• Display-name editing, sounds, board themes (Let players edit their display name #9/Add sound effects for moves, captures, and game end #10/Board themes: alternative square color presets #11, PR Display-name editing, game sounds, board themes (closes #9, #10, #11) #20)

In flight

• Selectable time controls (Selectable time controls (bullet / blitz / rapid) #13) — agent implementing

Proposed priority order for the rest

1. Platform hygiene: CI: build the app with Xcode 26 so the Liquid Glass styles actually compile #44 (CI on Xcode 26 so the glass styles compile), CI: boot chess-server on the runner so the online E2E test stops skipping itself #35 (boot the server in CI so the E2E test runs), Adopt Swift 6 language mode across the three packages #45 (Swift 6 language mode), Engine: bound the persistent transposition table's memory #46 (bound the TT memory).
2. Product features that build on today's work: Rematch: add a decline action and offer expiry #39 (rematch decline/expiry), Matchmaking: pair players by rating, widening the window over wait time #43 (matchmaking by rating), Show an active online game on the home screen (resume banner) #29 (resume banner), Show server-side game history (online games from any device) #30 (server-side game history), Player profiles: tap a leaderboard row for record and recent games #33 (profiles), Selectable bot difficulty for offline games #36 (bot difficulty), Localize the app with a String Catalog #34 (localization), Rate-limit auth endpoints and clean up abandoned guest accounts #32 (auth rate limiting).

Note on #37 (swift-nio-http2 security advisory): investigated — the patched 1.44.1 release doesn't exist upstream yet, so nothing can be bumped; the issue now tracks the upstream release instead of being actionable first.

Two things only the repo owner can unblock

• Sign in with Apple for account recovery #14 Sign in with Apple — code scaffolding is starting now that Migrate to vapor/jwt 5 (JWTKit 5) #21 merged, but Apple team ID / bundle ID / entitlement / key registration decisions are needed to finish.
• Deploy chess-server publicly and point release builds at it #28 public server deployment — needs a hosting choice; several features above (Show server-side game history (online games from any device) #30, Player profiles: tap a leaderboard row for record and recent games #33) get much more interesting once release builds point at a real server.

Reply with reordering or vetoes; otherwise the agents will keep working roughly top-down.

[testtest126]

Cross-linking from #47 (now consolidated here — two orchestrating sessions posted roadmap threads within minutes of each other): three follow-up issues were filed today after fact-checking against the code, and they slot into the priorities above: #39 (rematch decline + offer expiry, good first issue), #43 (rating-window matchmaking — pairing is currently pure FIFO), #46 (bound the persistent transposition table's memory on mobile, follow-up to PR #25).

🤖 Generated with Claude Code

[testtest126]

Duplicate of #47, which came first — consolidated there (the execution-order proposal and status corrections from this post now live in a comment on #47). Closing.

[testtest126]

Housekeeping: two parallel sessions each closed the other's roadmap post as a duplicate at the same time, so for a few minutes both were closed. Resolved: this discussion (#48) is the canonical roadmap — reopened, body kept current (JWT 5 merged via PR #42; the swift-nio-http2 advisory #37 is blocked on an unreleased upstream patch). #47 stays closed as the duplicate and links here. Sorry for the noise.

[testtest126]

Roadmap check-in — 2026-07-12 (48 hours on from the July 10 batch)

A lot has landed since this thread opened.

Shipped

• Account deletion (DELETE /me + in-app flow), warm-classic home screen + polish, README screenshots via an on-demand CI harness, SwiftFormat/SwiftLint, a nightly flake-telemetry lane, and broader test coverage.
• Both remaining security fixes merged today: refresh-token rotation is now atomic — one DELETE … RETURNING closes a replay window (Auth: consume refresh tokens atomically to close a replay window (closes #147) #148, closes Security: refresh-token rotation is non-atomic — a replayed token can mint a parallel session #147); and guest cleanup now batches candidate IDs under the driver bind-parameter ceiling and re-asserts the delete predicate to close a TOCTOU (Guest cleanup: batch candidate IDs and re-assert the delete predicate (closes #155) #156, closes Guest cleanup: bind-param ceiling stops reaping permanently (M3) + delete TOCTOU (L1) #155). Both were reviewed at their exact heads and revert-verified — the regression tests were confirmed to fail on the old code, so they actually catch the bug class. main is green.
• Docs are public on GitHub Pages: the architecture overview, plus a new "How the Agents Talked" page (the making-of).

Verified

• Full auth/session/account audit: the core is soundly built (JWKS-only Apple verification, JWT_SECRET mandatory in production, instant deleted-account invalidation, fully server-authoritative game integrity). No High/Medium findings beyond the two just fixed; residuals are Low/Info (a TRUST_PROXY_HEADERS note for the deploy runbook; inherent guest-collusion rating abuse).
• Engine move generation is perft-proven to ~16M nodes (extended the suite with deeper counts + the previously-missing CPW Position 6). Whole project builds + tests green locally at main (179 tests, 0 failures).

Engine direction (see #40)

Keep the native negamax; borrow ideas, not code, from Stockfish (its GPL + NNUE/bitboard architecture don't fit). The high-payoff, low-effort wins are Late Move Reductions + Principal Variation Search — behind a measurement harness (self-play + fixed-node bench) so gains are measured, not guessed. That harness is PR #159, in progress.

Process note

The multi-session development fleet has stood down to a single root agent. That reopens one direction worth logging: the custom orchestrator-approval required status was a workaround for many sessions sharing one git identity, and it now sits perpetually "pending" on every PR. With one agent it can likely be replaced by native branch protection (real CI checks + linear history + a proper security-review gate), removing the always-pending noise without losing the "green on the current merge state" guarantee. Repo-settings changes are owner-only — flagging it here as the direction.

Toward 1.0 / TestFlight (see #38, #41)

Deploy remains intentionally frozen (owner decision). A public TestFlight still needs the $99/yr Apple Developer Program. The app + server themselves are in good shape.