Companions Launch Audit — how far from users?
Status: Audited 2026-07-09 · everything below verified against live prod + the merged code
TL;DR: the feature is done and its backend is live in prod — but zero installable builds contain it. TestFlight is ~3–5 days away (one EAS build cycle + device validation). An un-embarrassing public launch is ~2–3 weeks away, gated on cost controls, monitoring, and the paywall. One item is urgent today regardless of any release: the voice WebSocket is publicly reachable without auth.
What's already shipped
| Layer | State |
|---|---|
| Mobile code | ✅ Full Kaori 3D companion merged to v2-rebuild (PR #4, squash b7b94ce, 2026-07-08) |
| Backend | ✅ Deployed to prod EC2 (2fa8388, 2026-07-09): persona, unified memory, stage gating, vendored Kith sidecar, voice cutover |
| Voice infra | ✅ kith-voice PM2 service on :3040, nginx /kith/ws proxy verified externally, E2E speak test passed |
| Web | ✅ kaori-live deployed on Amplify |
Gap list
🔥 Do first — live exposure today
| Gap | Detail | Effort |
|---|---|---|
| Unauthenticated public voice WS | wss://api.thetrickbook.com/kith/ws upgrades ANY connection — no JWT, no session cap, no text-length cap. Each session spawns its own Python runtime on the same EC2 box as the whole API. A scripted client could drain the entire ElevenLabs quota and OOM the API host without installing the app. Fix: JWT check on WS upgrade, per-user + global session ceilings, speak-text length cap, restrict/remove the client-side speak path (backend /speak/:sessionId is the legit path). | 1–2 days |
Blockers for TestFlight
| Gap | Detail | Effort |
|---|---|---|
| No build contains the feature | Latest dev-client (2026-07-07) predates the merge. New native modules (expo-gl/three, audio-api, speech-recognition) → full EAS rebuild; MToon needs physical-device validation | 1–2 days |
| Stale store pipeline + version bump | No TestFlight-profile build since ~Feb (v2.1.0); app.config.js version/buildNumber need a coherent bump (→ v3.2.0). Signing is fine (cert renewed 2026-06-30) | 0.5–1 day |
| Release notes page | Per our process: docs/releases/v3.2.0.md + screenshots when the build ships | 0.5 day |
Blockers for public launch
| Gap | Detail | Effort |
|---|---|---|
| No rate limits / metering on bot-chat | POST /api/bot-chat/message = JWT only; no per-user caps, no message-length cap, no usage ledger. Every message costs OpenRouter + (on stage) ElevenLabs. One scripted account = unbounded spend | 1–2 days basic caps; 5–10 for full token metering |
| Companion 100% ungated | Both entry points reachable by every user; zero entitlement/paywall code anywhere. Free-sample model unbuilt (the existing Stripe hasPremiumAccess pattern is the reusable foundation) | 5–10 days |
| iOS IAP compliance | In-app digital gating on iOS needs StoreKit/RevenueCat, not the existing Stripe web checkout — see monetization | 5–10 days (parallel) |
| No monitoring / quota alarm | PM2 only; kith-voice isn't in ecosystem.config.js; no Sentry, no uptime checks, and no ElevenLabs credit alarm — quota exhaustion degrades voice silently | 1–3 days |
| Shared-EC2 blast radius | Voice sessions (one Python runtime each) share the instance with the entire API. Global session cap + max_memory_restart now; separate instance/container before scale | 2–4 days |
| App-review prep for AI chat | Apple's age-rating questionnaire now asks about AI chat (expect 13+); add AI disclosure, a report/flag mechanism for bot replies, and documented safety rails for review notes | 1–3 days |
Nice-to-have
| Gap | Detail | Effort |
|---|---|---|
| 14 MB VRM in every download | kaori.vrm bundles into every IPA/AAB. Move companion models to CDN + cache-on-first-open — also the prerequisite for shipping outfits/companions without app releases | 1–2 days |
| Voice-client resilience polish | Fixed 3s reconnect (no backoff); voiceReady not reset on WS close (UI can show voice as available after a drop) | 0.5 day |
Path to launch
- This week: secure kith WS (do first) → EAS dev-client build → physical-device validation → v3.2.0 TestFlight build + release notes
- Weeks 2–3: basic rate caps → metering foundation + free-sample gating (monetization phases 1–2) → monitoring + ElevenLabs alarm → app-review prep
- Launch: public store release with the paywall live from day one — the free sample IS the launch funnel