Life OS — system blueprint

Life OS is a single private workspace per person, split into seven modules that all feed one dashboard. The organising principle: every obligation has a date, an owner, and a single next action. Anything without those three is noise.

• Capture layer — quick entry for tasks, deadlines, bills, transactions.
• Record layer — durable objects: bills, properties, ventures, deadlines.
• Signal layer — the dashboard computes urgency and surfaces only what needs you today.
• Automation layer — recurring deadlines roll forward; reminder windows drive alerts.

Stack: React + TanStack Start on the front, Lovable Cloud (Postgres, Auth, row-level security) on the back. Nothing sensitive is cached in the browser beyond your signed-in session.

• Email + password and Google sign-in. Passwords are hashed with bcrypt by the auth service — the app never sees or stores a plaintext password.
• Every table carries a user_id column referencing the authenticated user.
• Row-level security is enabled on every table with an owner-only policy: auth.uid() = user_id. A query for someone else's row returns zero rows, even if the app code is wrong or malicious.
• Roles live in a separate user_roles table (never on the profile) and are checked through a SECURITY DEFINER has_role() function, which prevents privilege-escalation via row edits.
• Protected routes sit behind an authenticated layout; the client never receives another account's data because the database refuses to send it.

-- applied to every table
alter table public.deadlines enable row level security;
create policy "owner only" on public.deadlines
  for all to authenticated
  using (auth.uid() = user_id)
  with check (auth.uid() = user_id);

• Life dashboard — monthly bill load, overdue and upcoming items, open tasks.
• Finance — recurring bills with frequency and autopay, plus the transactions that matter.
• Property — one record per property: type, status, address, estimated value, monthly income, document notes.
• Deadlines — taxes, renewals, insurance, legal, with priority, reminder window and recurrence.
• Tasks — life-admin capture list grouped by area and priority.
• Future planning — ventures at every stage from idea to exit, each with one explicit next step.

profiles(id → auth user, display_name, timezone, created_at)
user_roles(id, user_id, role)            -- roles isolated from profile

transactions(id, user_id, amount, direction, category, occurred_on, note)
bills(id, user_id, name, amount, category, frequency, next_due_date, autopay, notes)

properties(id, user_id, name, type, status, address,
           estimated_value, monthly_income, notes)

ventures(id, user_id, name, stage, role, monthly_income, next_step, notes)

deadlines(id, user_id, title, category, due_date, priority,
          remind_days_before, recurrence, completed_at, notes)

tasks(id, user_id, title, area, priority, due_date, done)

Every table above has user_id, RLS enabled, an owner-only policy, and explicit grants to the authenticated role only — no anonymous read anywhere.

• Recurring deadlines: ticking a monthly/quarterly/annual item advances its due date instead of deleting it.
• Reminder windows: each deadline stores remind_days_before, which drives the dashboard's Needs attention list.
• Urgency computation: items are classified overdue / soon / upcoming / later on every render — no stale flags in the database.
• Bill load: monthly obligation is recalculated from bill frequency, so adding an annual bill instantly changes your monthly picture.
• Extendable: a scheduled job can post digests to email or push once you want alerts outside the app.

• Daily (3 min) — open the dashboard, clear anything overdue, capture new tasks as they occur to you.
• Weekly (20 min) — review deadlines for the next 30 days, pay or schedule due bills, set one next step per venture.
• Monthly (45 min) — log significant transactions, review property values and renewals, prune finished tasks.
• Quarterly — tax checkpoints, insurance review, records audit: remove what's stale, confirm what's current.

• Defence at the data layer: authorisation lives in RLS policies, not in UI conditionals.
• Roles in a dedicated table checked by a SECURITY DEFINER function with a pinned search_path.
• Least privilege grants: authenticated only, service role for maintenance, no anonymous access.
• Sign-out cancels in-flight queries and clears the cache so no cached data survives the session.

If you want to start smaller than the full app, this is the 20% that carries the load:

• One deadlines table with title, due date, category and reminder window.
• One bills list with amounts and due dates, reviewed monthly.
• One capture list for life admin.
• A weekly 20-minute review — without the ritual, no system survives.

Everything else in this app is an expansion of those four. Add a module only when the existing one starts to feel cramped.