# App completion checklist - Verify the real authorized execution host before editing it. - Check a slug for collisions; preserve the previous release and source. - App has index.html, app.json, relative assets and a responsive layout. - Test its main flow, empty/error states, keyboard controls and phone layout. - State whether data is browser-only or cross-device. No fictional connected state. - Keep secrets, private notes, datasets and runtime data out of web output. - Deploy via authorized local/SSH tools, not an unauthenticated browser endpoint. - Verify the actual app URL and catalog tile. - Record the release ID and rollback command. - Do not restart unrelated services or change DNS for an ordinary private static app. - Preserve private login, existing public websites and mail records. - Standard publishing must update the canonical app register, preserving owner/private access and existing showcase settings. - Backend services need a separate private operating manifest recording service, runtime, port, dependencies and startup; never put these details or credentials into public app metadata. - Every app needs an appropriate favicon; verify that its declared icon URL loads. - Public showcase metadata and actual app access are separate approvals. A private card never exposes its data. # aidhd shared design and installation standard Use **aidhd**, lowercase, for the platform wordmark everywhere. Retain each app's own name. Platform wordmark is the eight-spoke SVG mark plus bold lowercase wordmark, ink #28243c on paper #f7f0df. Purple #6240d1, lime #d9ef8c, pink #f4c5ef and pastel app colours are shared accents. ## Shared shell The trusted AIDHD gateway adds /brand/brand.css and /brand/brand.js to HTML pages and supplies launcher metadata. It preserves existing authentication and Content Security Policy. Generated studio apps stay inside their isolated iframe: the trusted parent supplies the navigation, footer and install action. Do not duplicate these inside generated code or weaken the sandbox. - Header: shared wordmark/home, curved Back (previous browser page when available, otherwise playground), Playground, My collection, Learn, Build, Install. The Admin cog is always available and still requires Sophie’s login. Keep app-specific actions (filters, save, refresh etc) in a separate small app header. - Footer: aidhd home and Explore the playground, identical across apps. Keep necessary legal/attribution links available. Do not erase functional app controls. - Use accessible names, keyboard focus, hover/focus tooltips and at least 44px touch targets. Never rely on hover for the only accessible label. Avoid horizontal page overflow at phone widths. Respect reduced motion. - App symbols must be simple original SVG vectors with consistent round strokes, not emoji, text glyphs or stock photos. Prefer the canonical motifs: dinner plate, guide crosshair, calendar, plant, coin, TV, book and spark. Register a new meaningful motif in the canonical icon generator for a new subject; do not invent a different platform logo. ## Home-screen launchers Every app needs its own stable manifest id, start_url, scope, title, theme colour, SVG favicon and real PNG icons: apple-touch-icon 180px, manifest 192px and 512px. Generate PNGs from the vector source; do not use emoji screenshots. Keep these safe public metadata only: no user identifiers, transaction names, tokens, or query strings. Manifests never grant access. The shared Install action uses beforeinstallprompt only when the browser actually offers it. For Chrome on iPhone: Share beside address bar → Add to Home Screen → Add. Safari: Share → Add to Home Screen. Otherwise show the browser's available installation instructions. A website cannot silently install itself. No offline promise: internet and normal login remain required. Do not cache private financial/calendar/API responses, authentication pages or credentials in a service worker. ## Publishing and maintenance Canonical files: ~/Projects/aidhd-platform/brand.py and web/brand/, generated from the vector icon source. The gateway applies the shell to current and future managed apps. Standalone Guide has a versioned copy of brand.py/assets; Dinner/Chad serve the canonical assets through their exact static allowlist. Deploy shared changes to those copies together. Preserve app-specific branding and legal attribution, auth checks, state, user data and route aliases. For new standalone hosts, install the shared same-origin asset route and HTML metadata; test CSP, manifest/icon URLs, buttons and phone layout before publication. Do not reference external brand scripts if the CSP only allows self. Register the app through existing publisher hooks so admin/library stay current. Existing archive/delete safeguards and Sophie-only publication stay unchanged. # aidhd product language and interaction standard This is the product glossary for all future building and maintenance. Use these names consistently in headings, buttons, navigation, instructions and generated examples. Historical folders/URLs may remain as compatibility aliases; they are not product names. ## Three layers 1. **Platform features** are parts of aidhd: Playground, My apps, Build, Learn, Domain Garden and Admin. They are not app tiles or rows in the normal app inventory. Admin contains Publishing & people, Domains, and Platform & server. **Server & recovery** is a subsection of Admin; retire “Control room”, “control centre”, “admin control centre”, “prompt desk” and “studio” as competing top-level user-facing names. 2. **Apps** are useful standalone projects, such as Dinner, decided., That Dam Guide, Money garden, A little ahead and Tonight, Maybe. Show title, meaningful description, access and lifecycle. Keep app-specific branding; the platform wordmark stays lowercase aidhd and uses the shared vector mark. 3. **App management tools** belong to their app inside Admin. That Dam Guide has “Review recommendations”, not a separate “Sophie’s guide desk” app. Generated-app publication lives in Admin → Publishing & people. Keep legacy URLs as safe redirects, not duplicate concepts. ## Visibility, access and lifecycle - **App access** answers “Who can open this app and its data?”: Public, or Private. This is separate from all catalogue switches. In Admin → App settings, isolated studio apps can switch Public/Private. Private studio apps authenticate through /workspace/app/SLUG/ and are restricted to their creator and Sophie. Previously downloaded public copies cannot be recalled. Never expose a connected backend by changing its catalogue record: calendar, finance, other connected/legacy sites need a real privacy/route/dependency review first. The UI explains this and copies a review request; it does not pretend to publish them. - **Playground gallery** independently chooses Hidden, Description only, or Live app card (title, description and Open app button). A live app card requires a public app; a private app may show only its description. - **aidhd homepage** independently chooses Hidden, Description only, or Live app card. It does NOT depend on Playground gallery. Never silently clear a saved homepage choice. A description-only card has no app-opening link, even if the app is public. App access is a separate setting. Call controls by destination; “showcase” and “spotlight” are legacy storage/API fields, not product labels. - **My apps** controls inclusion in Sophie's personal library only. - **Available** turns a managed app on/off through archive, retaining files. External websites use **Listed** because their standalone domain stays live. Explain this distinction next to the setting. - **Lifecycle** is Live, Testing or Prototype. New owner-deployed apps begin Testing unless explicitly classified; approved studio publication begins Live. Lifecycle is not access and does not delete anything. Hub check and Hello, little app are Testing; One thing at a time is Prototype. Only Sophie chooses permanent deletion through App settings, with existing exact-slug/path confirmation. Never delete a test app automatically. ## Interaction rules Use the shared same-origin navigation/footer/icon assets; never duplicate or redesign the platform logo per app. Admin has a consistent cog link on every shared toolbar, labelled Admin; the link grants no access. On mobile keep logo and primary icons in one aligned row; secondary actions go into More. Back, Playground, My apps, Admin and More use 44px targets (at very narrow widths My apps remains in More). Desktop exposes Learn, Build and Install too. Align navigation and main content to the same gutters. Hover/focus text supplements accessible labels; mobile must not depend on hovering. My apps presents three consistently styled tasks: Build an app, Copy a prompt for another AI, App-building guide. Account/navigation actions belong in the shared toolbar, not a mixed row of duplicate links. App lists show descriptions and clear badges; Admin inventory has fixed aligned setting/action columns, soft horizontal separators and ONE Settings action per row. Delete belongs inside App settings so missing delete permissions never shift other rows. Keep design playful and readable: the homepage planet and playful playground forms are platform artwork; preserve “What if… you made it?” on the playground. Use original monochrome SVG icons, no emoji app symbols. Existing shared footer, per-app icon/manifest, mobile installation guidance, private data protection and reduced-motion rules remain mandatory. Generated apps receive the shell in their trusted parent and must not recreate it inside the sandbox. Before publishing changes, check desktop and actual available mobile-sized UI, wording and alignment across public home, playground, My apps, Build, Admin and an app. Never claim real iPhone testing if it was not performed. Do not change unrelated app content/curation or loosen auth to simplify navigation. The canonical registry and publisher hooks keep registrations current; curation and access decisions survive re-deployment. ## Public copy, navigation rollout and secure URLs Public cards show the chosen project title/description and, for live app cards, an Open app button. Never print internal settings language such as “Description only”, “app access is unchanged”, “showcase” or hosting/access implementation notes on a public project card. Such explanations belong in Admin help. Preserve functional footer buttons and legal links in About this app rather than hiding them. App-specific controls use one compact local toolbar with readable grouped buttons. Always use HTTPS in shared links, manifests and deployment examples. Public HTTP requests must redirect to HTTPS before serving app content. Verify both HTTP redirects and HTTPS trust after routing changes. Increment the shared asset version in brand.py and existing standalone HTML when changing navigation, and update the versioned Guide/Refynd/FP&YAY copies together. ## November 1 experience update Shared navigation includes an explicit Home house and a distinct carousel for Playground. Keep these separate. Sign in/out reflects the verified portal session; this is display only, never an access grant. The trusted session-status bridge sends only a boolean to exact allowed same-site parents; never export JWTs, emails or account data, never use its result to authorize private requests. Keep existing private route JWT checks. Public preview uses ?view=public, preserves real sign-in and never retrieves private Admin, finance, calendar, library or workspace payloads. Show a clear visitor sign-in boundary instead. Return to my view removes preview without logging out. Do not fake the exact external Cloudflare login page or claim the preview changes permissions. Learn always opens Getting started; retain saved progress and offer Continue/Lessons. The playground introduction explains invites, own AI connection, one small first version, previewing and Sophie’s approval using the ticket and green backstage-pass panel. Ask Sophie to publish must visibly confirm a successful server response beside the clicked button: Sent to Sophie, checkmark, persistent queued state and brief optional confetti. Respect reduced motion. Never celebrate before success, never call an error a success, avoid duplicate same-version review requests, and let a new version be submitted separately. Canonical navigation and entrances (November 1 trial): aidhd.nl is the single public entrance with selected highlights, wider approved public gallery, interactive idea planet and backstage-pass ticket/explanation. playground.aidhd.nl/ redirects to the public home. The carousel is My playground and opens playground.aidhd.nl/library/ (authenticated personal apps and project/build entry). Remove the separate leaf/My apps navigation icon. Home=public showcase, carousel=personal playground, Learn=Getting started, Build=workspace, Admin=management, bell=notifications. Do not create a competing public Playground welcome page. Preserve old app links, app privacy and independently curated homepage/gallery settings. ## Current experience contract — 2 November 2026 - My playground is personal: members see only projects they own. Sophie sees Built by me and Built by others, with creator names. The public homepage collection is separate. - Show Draft, Building, Pending approval, Published or Failed. Link separately to Open app and Edit in Build. Only the creator may delete an unpublished, idle project, after confirmation; withdraw pending review. Published deletion stays in Admin. - The shared toolbar has Back, Refresh, Home, My playground, Admin and More on mobile. Label Admin simply Admin. Retain its owner-only access checks. Refresh reloads the current app without signing out. - Signed-out navigation to Playground, Build and Admin uses https://aidhd.nl/enter/playground/, /enter/build/ and /enter/admin/. These are real public welcome pages; their explicit Sign in button leads to the protected destination. Direct protected bookmarks still invoke Cloudflare. Never weaken private data access to customise an entrance. - Public preview must use these same public entrances, never a pretend logged-out page. - Canonical visible app addresses are https://playground.aidhd.nl//. Preserve legacy addresses as redirects and preserve standalone domains including eat.aidhd.nl. Private clean routes verify the signed Cloudflare identity before serving data; assets and APIs retain their access guards. - Every generated app supplies app.json icon_path (original SVG path d data, 64x64 viewBox, command letters/numbers only; max 1500 characters), icon_color (#RRGGBB) and icon (short noun). Platform validates and renders it as 180/192/512px launcher artwork and favicon. Artwork must be distinct, simple, bold, no emoji. Shared wrapper owns navigation, manifests and installation guidance. Test the final published wrapper, not just the sandboxed app preview. Icon failures must never take an app offline. - Rating dots are equal-sized drawn circles, not font glyphs.