# MSOS — Pre-Launch To-Do (master list)

Paused before go-live. This is the running list of what's left. Detailed
placeholder inventory lives in `PRE-LAUNCH-CHECKLIST.md`; GA4 setup in
`GA4-ASSISTANT-REPORT.md`.

## 🔴 Must do before launch

- [ ] **Domain decision (most important).** The live site runs on
      `msos.spletnimojster.si`. `msosorg.com` does NOT serve the files (404s),
      but all SEO tags (canonical/hreflang/sitemap) point to it.
      - Option A: ask the host (Spletni Mojster) to point `msosorg.com` at the
        same site folder → then re-add the canonical redirect (Claude can do the code).
      - Option B: stay on `msos.spletnimojster.si` → flip the SEO tags to it (Claude can script this).
- [ ] **Homepage placeholder content** — replace Lorem-ipsum testimonials and the
      leftover "Everything you need to know about the product and billing" line (en/mk/si).
- [ ] **"Coming soon" cards** — blog index (9) and news index (3), ×3 languages: publish or hide.
- [ ] **Student-guide hero images** — 31 pages ×3 languages still show an "Image placeholder" box.
- [ ] **MSOS Hub photos** — replace the temporary placeholder photos (see code comments in `msos-hub`).
- [ ] **Proofread MK/SI** — the machine-drafted curated assistant answers (`assistant.js` INTENTS)
      and meta descriptions on legal / msos-hub / support.
- [ ] **Confirm Support-page bank details** are correct real values (IBAN SI56 0284 3026 6115 703 / SWIFT LJBASI2X).

## 🟡 Should do

- [ ] **GA4 custom dimensions** for the assistant (`q`, `result`, `q_lang`, `page_lang`) — see `GA4-ASSISTANT-REPORT.md`. Do this early so data collects.
- [ ] **Test the newsletter end-to-end** — a real MailerLite subscribe + confirmation email.
- [ ] **Commit the blog pages** once their content is finished (they already have the assistant widget in the working tree, uncommitted).
- [ ] **Privacy/cookie policy** — confirm it names Google (Analytics + Forms) and MailerLite as processors, and explains how to request data deletion (email info@msosorg.com). (Covers GDPR "user data deletion".)

## 🟢 Nice to have

- [ ] Wire the homepage "story" video (currently the play button was removed; image kept), or leave as-is.
- [ ] Re-compress the 6 images >250 KB; delete the stale unused `style.css`.
- [ ] Periodically bump Font Awesome (currently 6.5.1, pinned + SRI) and regenerate its integrity hash.
- [ ] Confirm the host takes docroot backups (source is already version-controlled in Gitea; form data in Google Sheets / MailerLite).

## 🛠 Maintenance / build steps to remember

- [ ] **After adding a brand-new page, run SEO.** The pre-commit hook
      (`tools/git-hooks/pre-commit`, activate once with
      `git config core.hooksPath tools/git-hooks`) auto-syncs the News hub,
      homepage "Latest news", `/llms.txt` and `/links-for-bots/` on every commit —
      but it does **not** run SEO. For a new page also:
      1. add its date to `ARTICLE_DATES` in `tools/seo_inject.py`, then
      2. run `python tools/seo_inject.py --all --sitemap` (SEO meta + canonical/hreflang + sitemap entry).
      - Open decision: fold `seo_inject` into the hook or a deploy step so even this is hands-off
        (kept out by default because it rewrites all ~225 pages).

## ✅ Done (for reference — already live/hardened)

- Security headers (HSTS, enforcing CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
- HTTPS forced (http→https) + HSTS
- Content-Security-Policy **enforcing** (browser + production verified, 0 violations)
- Exposed-file lockdown (code dump, dev scripts, `.git`, `docs/`, directory listing all 403 live)
- XSS-safe output escaping (+ live-tested the one user-input page)
- No secrets in code; no PII in browser storage/URLs; no file uploads; no permissive CORS
- Accessibility (alt text, lang, labels, keyboard mobile menu), image dimensions (CLS), broken-page fixes
- Offline "Ask MSOS" assistant (search + curated answers, analytics, auto-rebuilding index)