msos/docs/PRE-LAUNCH-TODO.md

MSOS — Pre-Launch To-Do (master list)

Paused before go-live. This is the running list of what's left. Detailed placeholder inventory lives in PRE-LAUNCH-CHECKLIST.md; GA4 setup in GA4-ASSISTANT-REPORT.md.

🔴 Must do before launch

• Domain decision (most important). The live site runs on msos.spletnimojster.si. msosorg.com does NOT serve the files (404s), but all SEO tags (canonical/hreflang/sitemap) point to it. - Option A: ask the host (Spletni Mojster) to point msosorg.com at the same site folder → then re-add the canonical redirect (Claude can do the code). - Option B: stay on msos.spletnimojster.si → flip the SEO tags to it (Claude can script this).
• Homepage placeholder content — replace Lorem-ipsum testimonials and the leftover "Everything you need to know about the product and billing" line (en/mk/si).
• "Coming soon" cards — blog index (9) and news index (3), ×3 languages: publish or hide.
• Student-guide hero images — 31 pages ×3 languages still show an "Image placeholder" box.
• MSOS Hub photos — replace the temporary placeholder photos (see code comments in msos-hub).
• Proofread MK/SI — the machine-drafted curated assistant answers (assistant.js INTENTS) and meta descriptions on legal / msos-hub / support.
• Confirm Support-page bank details are correct real values (IBAN SI56 0284 3026 6115 703 / SWIFT LJBASI2X).

🟡 Should do

• GA4 custom dimensions for the assistant (q, result, q_lang, page_lang) — see GA4-ASSISTANT-REPORT.md. Do this early so data collects.
• Test the newsletter end-to-end — a real MailerLite subscribe + confirmation email.
• Commit the blog pages once their content is finished (they already have the assistant widget in the working tree, uncommitted).
• Privacy/cookie policy — confirm it names Google (Analytics + Forms) and MailerLite as processors, and explains how to request data deletion (email info@msosorg.com). (Covers GDPR "user data deletion".)

🟢 Nice to have

• Wire the homepage "story" video (currently the play button was removed; image kept), or leave as-is.
• Re-compress the 6 images >250 KB; delete the stale unused style.css.
• Periodically bump Font Awesome (currently 6.5.1, pinned + SRI) and regenerate its integrity hash.
• Confirm the host takes docroot backups (source is already version-controlled in Gitea; form data in Google Sheets / MailerLite).

🛠 Maintenance / build steps to remember

• After adding a brand-new page, run SEO. The pre-commit hook (tools/git-hooks/pre-commit, activate once with git config core.hooksPath tools/git-hooks) auto-syncs the News hub, homepage "Latest news", /llms.txt and /links-for-bots/ on every commit — but it does not run SEO. For a new page also: 1. add its date to ARTICLE_DATES in tools/seo_inject.py, then 2. run python tools/seo_inject.py --all --sitemap (SEO meta + canonical/hreflang + sitemap entry). - Open decision: fold seo_inject into the hook or a deploy step so even this is hands-off (kept out by default because it rewrites all ~225 pages).

✅ Done (for reference — already live/hardened)

• Security headers (HSTS, enforcing CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy)
• HTTPS forced (http→https) + HSTS
• Content-Security-Policy enforcing (browser + production verified, 0 violations)
• Exposed-file lockdown (code dump, dev scripts, .git, docs/, directory listing all 403 live)
• XSS-safe output escaping (+ live-tested the one user-input page)
• No secrets in code; no PII in browser storage/URLs; no file uploads; no permissive CORS
• Accessibility (alt text, lang, labels, keyboard mobile menu), image dimensions (CLS), broken-page fixes
• Offline "Ask MSOS" assistant (search + curated answers, analytics, auto-rebuilding index)