docs: define milestone v2.0 requirements

.planning/REQUIREMENTS.md

@@ -1,52 +1,94 @@
-# Requirements: GearBox v1.3 Research & Decision Tools
+# Requirements: GearBox v2.0 Platform Foundation
 
-**Defined:** 2026-03-16
-**Core Value:** Make it effortless to manage gear and plan new purchases -- see how a potential buy affects your total setup weight and cost before committing.
+**Defined:** 2026-04-03
+**Core Value:** Help people make better gear decisions — discover what others use, compare real-world data, and see how a potential buy affects your setup before committing.
 
-## v1.3 Requirements
+## v2.0 Requirements
 
 Requirements for this milestone. Each maps to roadmap phases.
 
-### Comparison View
+### Database Migration
 
-- [x] **COMP-01**: User can view candidates side-by-side in a tabular comparison layout (weight, price, images, notes, links, status)
-- [x] **COMP-02**: User can see relative deltas highlighting the lightest and cheapest candidate with +/- differences
-- [x] **COMP-03**: Comparison table scrolls horizontally with a sticky label column on narrow viewports
-- [x] **COMP-04**: Comparison view displays read-only summary for resolved threads
+- [ ] **DB-01**: Application runs on PostgreSQL instead of SQLite
+- [ ] **DB-02**: All service functions use async database operations
+- [ ] **DB-03**: Test infrastructure uses PGlite instead of bun:sqlite in-memory databases
+- [ ] **DB-04**: Existing SQLite data can be migrated to Postgres via a one-time script
+- [ ] **DB-05**: Docker Compose provides Postgres for local development
 
-### Candidate Ranking
+### Authentication
 
-- [x] **RANK-01**: User can drag candidates to reorder priority ranking within a thread
-- [x] **RANK-02**: Top 3 ranked candidates display rank badges (gold, silver, bronze)
-- [x] **RANK-03**: User can add pros and cons text per candidate displayed as bullet lists
-- [x] **RANK-04**: Candidate rank order persists across sessions
-- [x] **RANK-05**: Drag handles and ranking are disabled on resolved threads
+- [ ] **AUTH-01**: User can register an account via external OIDC auth provider
+- [ ] **AUTH-02**: User can log in via external auth provider and access their data
+- [ ] **AUTH-03**: API keys remain functional for programmatic access (MCP, scripts)
+- [ ] **AUTH-04**: Auth provider runs self-hosted alongside the application
+- [ ] **AUTH-05**: E2E tests authenticate via API keys without depending on the auth provider
 
-### Impact Preview
+### Multi-User Data Model
 
-- [ ] **IMPC-01**: User can select a setup and see weight and cost delta for each candidate
-- [ ] **IMPC-02**: Impact preview auto-detects replace mode when a setup item exists in the same category as the thread
-- [ ] **IMPC-03**: Impact preview shows add mode (pure addition) when no category match exists in the selected setup
-- [ ] **IMPC-04**: Candidates with missing weight data show a clear indicator instead of misleading zero deltas
+- [ ] **MULTI-01**: Every item, category, thread, and setup is owned by a specific user
+- [ ] **MULTI-02**: User can only see and modify their own data (cross-user isolation)
+- [ ] **MULTI-03**: Categories use composite unique constraint (userId + name)
+- [ ] **MULTI-04**: Existing data is assigned to the original user during migration
+- [ ] **MULTI-05**: MCP tools operate within the authenticated user's scope
+- [ ] **MULTI-06**: Settings are per-user rather than global
+
+### Image Storage
+
+- [ ] **IMG-01**: Images are stored in MinIO (S3-compatible) instead of local filesystem
+- [ ] **IMG-02**: Existing uploaded images are migrated to MinIO
+- [ ] **IMG-03**: Image upload and retrieval work through the new storage layer
+- [ ] **IMG-04**: Docker Compose provides MinIO for local development
+
+### Global Item Database
+
+- [ ] **GLOB-01**: A global item catalog exists with brand, model, category, manufacturer specs, and image
+- [ ] **GLOB-02**: Global catalog is seeded with initial items from manufacturer data
+- [ ] **GLOB-03**: User can search the global catalog by name or brand
+- [ ] **GLOB-04**: User can link a personal collection item to a global catalog entry
+- [ ] **GLOB-05**: Global item pages show basic info and owner count
+
+### User Profiles & Sharing
+
+- [ ] **PROF-01**: User has a profile with display name, avatar, and bio
+- [ ] **PROF-02**: User can view their own public profile page
+- [ ] **PROF-03**: User can set a setup as public or private
+- [ ] **PROF-04**: Public setups are viewable by anyone without authentication
+- [ ] **PROF-05**: Public profile page lists the user's public setups
 
 ## Future Requirements
 
 Deferred to future milestones. Tracked but not in current roadmap.
 
-### Data Management
+### Reviews & Ratings
 
-- **DATA-01**: User can import gear collection from CSV
-- **DATA-02**: User can export gear collection to CSV
+- **REV-01**: User can rate a global item with an overall star rating
+- **REV-02**: User can rate a global item on predefined dimensions (durability, value, etc.)
+- **REV-03**: Item detail pages show average ratings from all reviewers
 
-### Social & Multi-User
+### Discovery
 
-- **SOCL-01**: User can create an account with authentication
-- **SOCL-02**: User can share collections and setups publicly
-- **SOCL-03**: User can view other users' public profiles and setups
+- **DISC-01**: User can browse recently shared public setups
+- **DISC-02**: User can browse recently reviewed items
+- **DISC-03**: User can browse popular gear by owner count
 
-### Automation
+### Aggregation
 
-- **AUTO-01**: System can auto-fill product information (price, weight, images) from external sources
+- **AGG-01**: Item detail pages show crowd-verified specs (manufacturer vs community-measured weight)
+- **AGG-02**: Item detail pages show which setups include this item
+- **AGG-03**: Setup composition insights ("commonly paired with")
+
+### Social
+
+- **SOCL-01**: User can fork/copy a public setup as a template
+- **SOCL-02**: Planning thread candidates can link to global items for auto-populated specs
+- **SOCL-03**: User can follow other users
+- **SOCL-04**: User can view an activity feed of followed users' content
+
+### Content Moderation
+
+- **MOD-01**: User can submit freeform text reviews
+- **MOD-02**: User can report inappropriate content
+- **MOD-03**: Admin can review and act on reported content
 
 ## Out of Scope
 
@@ -54,13 +96,19 @@ Explicitly excluded. Documented to prevent scope creep.
 
 | Feature | Reason |
 |---------|--------|
-| Custom comparison attributes | Complexity trap -- weight/price covers 80% of cases |
-| Score/rating calculation | Opaque algorithms distrust; manual ranking expresses user preference better |
-| Cross-thread comparison | Candidates are decision-scoped; different categories are not apples-to-apples |
-| Classification-aware impact breakdown | Data available but UI complexity high; flat delta covers 90% of use case |
-| Comparison permalink | Requires auth/multi-user work not in scope for v1 |
-| Mobile-optimized comparison (swipe) | Horizontal scroll works for now |
-| Rank badge on card grid view | Low urgency; add when users express confusion |
+| Freeform text reviews | Requires moderation infrastructure not yet built |
+| Comments on setups | Moderation burden, notification system needed |
+| User-to-user messaging | High moderation burden, not core to discovery |
+| Wiki-style open item editing | Quality control risk; structured contributions only |
+| Marketplace / buy-sell | Payment processing, fraud, legal liability |
+| AI gear recommendations | Training data requirements, hallucination risk |
+| Gamification (badges, points) | Incentivizes quantity over quality |
+| Instagram-style infinite scroll | Engagement-maximizing conflicts with utility focus |
+| Price tracking / deal alerts | Requires scraping, fragile, legal gray area |
+| Mobile native app | Web-first, responsive design sufficient |
+| Real-time collaborative setups | WebSocket complexity for niche use case |
+| Maintaining SQLite single-user mode | Platform features irrelevant for solo use; diverged at v2.0 |
+| Redis infrastructure | Not needed at v2.0 scale; auth provider (Logto) doesn't require it |
 
 ## Traceability
 
@@ -68,25 +116,42 @@ Which phases cover which requirements. Updated during roadmap creation.
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
-| COMP-01 | Phase 12 | Complete |
-| COMP-02 | Phase 12 | Complete |
-| COMP-03 | Phase 12 | Complete |
-| COMP-04 | Phase 12 | Complete |
-| RANK-01 | Phase 11 | Complete |
-| RANK-02 | Phase 11 | Complete |
-| RANK-03 | Phase 10 | Complete |
-| RANK-04 | Phase 11 | Complete |
-| RANK-05 | Phase 11 | Complete |
-| IMPC-01 | Phase 13 | Pending |
-| IMPC-02 | Phase 13 | Pending |
-| IMPC-03 | Phase 13 | Pending |
-| IMPC-04 | Phase 13 | Pending |
+| DB-01 | — | Pending |
+| DB-02 | — | Pending |
+| DB-03 | — | Pending |
+| DB-04 | — | Pending |
+| DB-05 | — | Pending |
+| AUTH-01 | — | Pending |
+| AUTH-02 | — | Pending |
+| AUTH-03 | — | Pending |
+| AUTH-04 | — | Pending |
+| AUTH-05 | — | Pending |
+| MULTI-01 | — | Pending |
+| MULTI-02 | — | Pending |
+| MULTI-03 | — | Pending |
+| MULTI-04 | — | Pending |
+| MULTI-05 | — | Pending |
+| MULTI-06 | — | Pending |
+| IMG-01 | — | Pending |
+| IMG-02 | — | Pending |
+| IMG-03 | — | Pending |
+| IMG-04 | — | Pending |
+| GLOB-01 | — | Pending |
+| GLOB-02 | — | Pending |
+| GLOB-03 | — | Pending |
+| GLOB-04 | — | Pending |
+| GLOB-05 | — | Pending |
+| PROF-01 | — | Pending |
+| PROF-02 | — | Pending |
+| PROF-03 | — | Pending |
+| PROF-04 | — | Pending |
+| PROF-05 | — | Pending |
 
 **Coverage:**
-- v1.3 requirements: 13 total
-- Mapped to phases: 13
-- Unmapped: 0
+- v2.0 requirements: 30 total
+- Mapped to phases: 0
+- Unmapped: 30
 
 ---
-*Requirements defined: 2026-03-16*
-*Last updated: 2026-03-16*
+*Requirements defined: 2026-04-03*
+*Last updated: 2026-04-03 after initial definition*