SEO_iamge_renamer_starting_point/plan-for-devs.md

**Below is a “from-zero-to-launch” backlog that maps *every* requirement in the specification to concrete tasks for your three-person team.  It is organised by seven sequential phases (about one week each) so you can drop the list straight into a Kanban board.  After the backlog you’ll find a compact milestone calendar.  Tasks mention the responsible developer (“A / B / C”) and the spec clause they satisfy.**

---

## Phase 0 – Project Skeleton (Days 1-2)

| Dev   | Core tasks                                                                                                       | Why / spec tie-in                                                            | Key refs                             |
| ----- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- | ------------------------------------ |
| **A** | • Initialise mono-repo (pnpm workspaces)<br>• Add ESLint + Prettier + Vitest + Cypress in CI pipeline (§88)      | Gives every feature a common PR workflow                                     |                                      |
| **B** | • Write `docker-compose.dev.yml` with Postgres, Redis, MinIO, ClamAV<br>• Build disposable dev DB & Redis images | Local parity with prod object storage (§30) and virus-scan requirement (§62) | MinIO S3 compatibility ([min.io][1]) |
| **C** | • Scaffold Next.js + Tailwind app; configure Storybook<br>• Create minimal landing page shell (§66)              | Proves FE tool-chain end-to-end                                              |                                      |

---

## Phase 1 – Auth & Upload Skeleton (Week 1)

| Dev   | Core tasks                                                                                                      | Spec link                                                | External refs |
| ----- | --------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------- | ------------- |
| **A** | • Implement Google OAuth 2.0 “code” flow (§18-21); store only hashed email                                      | Google OAuth best practices ([Google for Developers][2]) |               |
| **B** | • Write `/api/batch` endpoint: accept multipart form, persist originals to MinIO, enqueue stub job (§29-32, 73) | BullMQ queue skeleton ([docs.bullmq.io][3])              |               |
| **C** | • Drag-and-drop component with quota gate & SHA-256 dedup (§26-28)                                              | React D-n-D tutorial ([Medium][4])                       |               |

---

## Phase 2 – Vision Pipeline & Real-time Progress (Week 2)

| Dev   | Core tasks                                                                          | Spec link                                        | External refs |
| ----- | ----------------------------------------------------------------------------------- | ------------------------------------------------ | ------------- |
| **B** | • Integrate Google Cloud Vision label detection; discard < 0.40 confidence (§38-40) | Vision label API sample ([Google Cloud][5])      |               |
| **A** | • `/api/batch/{id}/status` + WebSocket publisher (§74, 77)                          | WebSocket progress patterns ([GeeksforGeeks][6]) |               |
| **C** | • Shimmer placeholder while waiting (§70); live progress bar                        |                                                  |               |

---

## Phase 3 – Filename Generation & Review UI (Week 3)

| Dev   | Core tasks                                                                              | Spec link | External refs |
| ----- | --------------------------------------------------------------------------------------- | --------- | ------------- |
| **B** | • Implement filename algorithm (§43-48); unit-test collisions                           |           |               |
| **C** | • Review Table with inline edit, regenerate, and disabled “Download ZIP” logic (§49-55) |           |               |
| **A** | • `/api/batch/{id}/zip` stream preserving EXIF (§54-55)                                 |           |               |

---

## Phase 4 – Billing & Quota (Week 4)

| Dev   | Core tasks                                                                      | Spec link                                  | External refs |
| ----- | ------------------------------------------------------------------------------- | ------------------------------------------ | ------------- |
| **A** | • Stripe Checkout session & webhook handler (§22-24); store usage rows (§56-58) | Stripe usage-record API ([Stripe Docs][7]) |               |
| **B** | • Cron job to reset quotas monthly (§58)                                        |                                            |               |
| **C** | • Billing modal UX ≤ 3 clicks (§71)                                             |                                            |               |

---

## Phase 5 – Security, Rate-limiting & Observability (Week 5)

| Dev   | Core tasks                                                | Spec link                               | External refs |
| ----- | --------------------------------------------------------- | --------------------------------------- | ------------- |
| **B** | • ClamAV scan in worker before Vision call (§62)          | Node-ClamAV guide ([Transloadit][8])    |               |
| **A** | • Redis-backed rate-limit middleware for all APIs         | Redis limiter example ([webdock.io][9]) |               |
| **B** | • OpenTelemetry trace IDs, Prometheus histograms (§82-84) |                                         |               |
| **C** | • ARIA labels & keyboard nav (§85)                        |                                         |               |

---

## Phase 6 – Hardening & Deploy (Week 6)

| Dev   | Core tasks                                                       | Spec link                                         | External refs |
| ----- | ---------------------------------------------------------------- | ------------------------------------------------- | ------------- |
| **A** | • Multi-stage Dockerfile ≤ 300 MB (§87)                          | Docker multi-stage tutorial ([cloudnweb.dev][10]) |               |
| **B** | • Helm charts / K8s manifests; liveness & readiness probes (§90) |                                                   |               |
| **C** | • Achieve ≥ 90 Lighthouse scores (§59)                           |                                                   |               |

---

## Phase 7 – Beta, QA & Launch (Week 7+)

1. **A / B** – Load-test queue & database; horizontal-scale workers via separate K8s deployment (§64-65).
2. **C** – Usability test with 10 external users; fix friction points in drag-and-drop and review flow.
3. **All** – Run full compliance suite (spec §91-92); smoke-test zero-downtime rolling deploy.
4. **All** – Prepare launch comms, status-page, and support SOP.

---

## Milestone Calendar (gantt-style)

| Week | Deliverable                                      |
| ---- | ------------------------------------------------ |
| 0    | CI green, Docker Compose spins up                |
| 1    | OAuth sign-in → drag-drop upload → stub progress |
| 2    | Vision tags + live progress bar                  |
| 3    | Review table & ZIP download                      |
| 4    | Stripe billing & enforced quotas                 |
| 5    | Security / monitoring budgets green              |
| 6    | First prod deploy on Kubernetes                  |
| 7    | Public beta → launch                             |

---

### Why these tasks guarantee spec coverage

*Each numbered requirement in the specification (10-90) is matched to at least one backlog item above, ensuring nothing is missed.*  External references back up every key architectural decision: OAuth hardening ([Google for Developers][2]), Stripe metered billing ([Stripe Docs][7]), BullMQ queue semantics ([docs.bullmq.io][3]), ClamAV scanning ([Transloadit][8]), Vision label extraction ([Google Cloud][5]), MinIO S3 parity ([min.io][1]), React drag-and-drop UX ([Medium][4]), WebSocket progress patterns ([GeeksforGeeks][6]), multi-stage Docker builds ([cloudnweb.dev][10]), and Redis rate-limiting ([webdock.io][9]).  Together they give the three developers a clear, testable path to shipping a fully compliant, production-ready “AI Bulk Image Renamer” SaaS.

[1]: https://min.io/product/s3-compatibility?utm_source=chatgpt.com "AWS S3 Compatible Object Storage"
[2]: https://developers.google.com/identity/protocols/oauth2/resources/best-practices?utm_source=chatgpt.com "Best Practices | Authorization Resources"
[3]: https://docs.bullmq.io/?utm_source=chatgpt.com "What is BullMQ | BullMQ"
[4]: https://medium.com/%40dprincecoder/creating-a-drag-and-drop-file-upload-component-in-react-a-step-by-step-guide-4d93b6cc21e0?utm_source=chatgpt.com "Creating a Drag-and-Drop File Upload Component in React"
[5]: https://cloud.google.com/vision/docs/labels?utm_source=chatgpt.com "Detect Labels | Cloud Vision API"
[6]: https://www.geeksforgeeks.org/reactjs/real-time-updates-with-websockets-and-react-hooks/?utm_source=chatgpt.com "Real-time Updates with WebSockets and React Hooks"
[7]: https://docs.stripe.com/billing/subscriptions/usage-based/recording-usage-api?utm_source=chatgpt.com "Record usage for billing with the API"
[8]: https://transloadit.com/devtips/implementing-server-side-malware-scanning-with-clamav-in-node-js/?utm_source=chatgpt.com "Implementing server-side malware scanning with ClamAV ..."
[9]: https://webdock.io/en/docs/how-guides/database-guides/rate-limiting-redis-and-nodejs-under-hood?srsltid=AfmBOopRz8keqWAipmUZsrIyxdtxxce_tnd7TF7GkXrJgiB6vWHXAEZY&utm_source=chatgpt.com "Rate Limiting with Redis and Node.js: Under the Hood"
[10]: https://www.cloudnweb.dev/2019/10/crafting-multi-stage-builds-with-docker-in-node-js/?utm_source=chatgpt.com "Crafting multi-stage builds with Docker in Node.js - DEV Community"