Deep scan & engineering standards overhaul for March 2026 #3995 — ccantynz/48co.v1

Originally written by @ccantynz-alt on GitHub.
Imported from https://github.com/ccantynz-alt/48co.v1/pull/42

Summary

Comprehensive update to CLAUDE.md engineering standards document reflecting a deep scan of the 48co codebase completed March 27, 2026. This establishes clear technology mandates, identifies 15 critical gaps between current implementation and product promises, and resets engineering priorities to focus on shipping production-ready features.

Key Changes

Deep Scan Results

Documented what actually works: Tauri desktop app, audio recording, grammar correction, keyboard simulation, Chrome extension, website
Identified 15 critical gaps: no payment system, empty mobile scaffolding, missing custom keyboards, duplicate backends, no release pipeline, missing streaming transcription, no meeting transcription, missing team dashboard, no monitoring, legacy Electron still present, unsafe OAuth fallback, unencrypted API keys, no email verification, deprecated execCommand() in extension

Technology Mandate (Locked-In Decisions)

Desktop: Tauri 2.0 (Rust + React) — kill legacy Electron
Mobile: Native Swift (iOS) + Native Kotlin (Android) for custom keyboards — replace Expo scaffolding
Chrome Extension: Manifest V3 with fixes for deprecated execCommand()
Website: Next.js 14 + Vercel — consolidate duplicate Express API
AI Models: Always use latest versions (Claude Haiku/Sonnet, Whisper API, whisper.cpp)
Real-time Streaming: Deepgram Nova-3 or AssemblyAI Universal-2 required to match competitors

Competitive Gap Analysis

Added detailed comparison matrix vs Grammarly, Wispr Flow, and SuperWhisper showing:

Critical gaps: custom keyboards (iOS/Android), payment system, real-time streaming, meeting transcription
Competitive advantages: "Preserve My Voice" feature, offline mode, Windows support, grammar correction
Priority build order: payments → streaming → mobile keyboards → meetings → dashboard

Updated Build Phases

Restructured from 5 phases to 4 focused phases:

Current state (desktop + extension + website) with Stripe blocker
Payments + streaming + desktop release pipeline
Mobile custom keyboards (Swift/Kotlin with shared Rust core)
Enterprise features (meetings, team dashboard, SSO)

Engineering Rules Enhancements

Rule 3: Upgraded to "Best In Class Or Don't Ship" — always use March 2026 state-of-the-art
Rule 4: Added zero-tolerance for gaps between marketing promises and code
Rule 5: Mandatory technology currency checks and deprecated API replacement
Rule 8: Require automated tests for all modules
New Rule 8 addition: Kill dead code without sentimentality

Quality Standards & Security

Added non-negotiable security requirements: keychain storage, rate limiting, OAuth fail-safe, CORS restrictions, bcrypt hashing
Added performance requirements: <10MB installer, <2s launch, <500ms voice latency
Added pre-commit checklist with dependency version checks and deprecated API detection

File Structure Cleanup

Documented what gets deleted: desktop/ (Electron), api/ (Express), mobile/ (Expo)
Defined new structure for native mobile: ios-keyboard/, android-keyboard/, shared-rust/
Clarified single backend consolidation to Next.js API routes

Notable Implementation Details

Established "WAR MODE" mentality: "Ship or die" — no more limping forward with broken features
Set clear competitive positioning: "80-90% ahead of every competitor. Not 'as good as' — BETTER THAN."
Defined target users explicitly: professionals (lawyers, accountants, doctors, executives) — not casual users
Made CLAUDE.md the single source of truth for all engineering decisions
Tied all decisions to core question: "Would a lawyer pay $12/month for this?"

https://claude.ai/code/session_01SotBeGcFHVJHhUbobSEnYS