This chapter is the consolidated product requirements document for v1. It turns the frozen feature scope into a single delivery contract for product, design, engineering, content, cultural review, and release work.

The canonical feature records remain in /prd/02-feature-specification/. The v1 selection lives in /prd/04-v1-feature-set-selection/, and the formal freeze packet lives in /prd/05-feature-freeze/. Where this chapter conflicts with accepted architecture decisions, /architecture/01-architecture-decisions/ wins.

Source-of-truth hierarchy and maintenance

This chapter consolidates content that lives canonically elsewhere. Where wording differs, the authoritative source below wins:

Domain	Authoritative source
Feature catalogue and supporting infrastructure	/prd/02-feature-specification/
User journeys	/prd/03-user-journey-flows/
V1 scope selection rationale	/prd/04-v1-feature-set-selection/
Formal freeze and approval state	/prd/05-feature-freeze/
Monetisation	/spec/04-features/ §4.7
Tone of voice and banned UI conventions	/spec/02-product/ §2.5
Performance gates	/spec/17-phases/ Phase 0
Accessibility	/spec/12-accessibility/ and ADR-012
Architecture, trust boundaries, ADRs	/architecture/01-architecture-decisions/

Maintenance rule. This chapter must be refreshed whenever any of the chapters above changes user-visible scope, gates, or constraints. Any approved Six-Dimension Change Exception (/prd/05-feature-freeze/ §5.5) that updates a v1 boundary must also update §06 in the same change.

6.1 — v1 product goals

Goal	Requirement	Success signal
Prove the core colouring loop	A new anonymous user can reach a satisfying fill on a free starter artwork without sign-up, payment, or a feature tour.	Time to first satisfying fill is tracked and reviewed after launch.
Validate the calm cultural positioning	The product feels like a polished digital colouring book rooted in Black culture, not a noisy free-to-play game.	Cultural review passes all launch artwork; banned UI and copy conventions from /spec/02-product/ §2.5 do not appear.
Establish local-first play	Any downloaded artwork remains playable offline with progress preserved locally and synced opportunistically.	Downloaded artwork opens offline; sync failures preserve local progress and recover later.
Validate pack-based monetisation	Users can buy one-off content packs after experiencing free value, with receipt validation and entitlement truth handled server-side.	Paywall view, purchase start, purchase success, failure, and restore events are instrumented.
Ship a repeatable content pipeline	The team can author, validate, review, upload, preview, and publish artwork without manual database surgery.	Launch library target of approximately 25 culturally reviewed artworks is ready and publishable.
Meet launch-quality safety and accessibility	Child-mode analytics, accessibility defaults, and platform purchase constraints are implemented before release.	Child-mode event suppression, screen-reader semantics, always-show numbers, reduce motion, pattern fills, and tap forgiveness pass release checks.

6.2 — Personas and delivery implications

These are delivery personas, not marketing segments. Each persona creates a product requirement that must be visible in v1.

Persona	Primary need	v1 requirement
Adult seeking calm creative downtime	A relaxing creative break with culturally resonant content.	Onboarding reaches canvas value quickly; interface motion and copy stay restrained; no streaks, countdowns, interstitial ads, or aggressive prompts.
Parent or carer choosing content	Safe, positive, child-friendly artwork with low-friction offline use.	Audience selection and child-mode settings are present; cultural review gates publication; purchases use platform controls and clear account requirements.
Child using the app directly or jointly	Simple guidance, trustworthy content, and forgiving interaction.	The starter artwork works anonymously; first-tap guidance is light; child-mode analytics restrictions apply; small-region taps are forgiving.
User with colour-vision or accessibility needs	Colouring that does not rely on colour discrimination alone.	Numbers are visible by default; palette and canvas expose useful semantics; pattern fills, contrast, reduce-motion, and non-colour cues are included.
Content operator and cultural reviewer	A reliable way to ship reviewed artwork safely.	Bundle validation, review state, upload tooling, internal preview, and publish/unpublish controls are included in v1 tooling.

6.3 — Core v1 journeys

flowchart TD
    Start["Anonymous first launch"] --> Onboarding["Welcome, themes, audience, accessibility defaults"]
    Onboarding --> Library["Personalised library reveal"]
    Library --> Starter["Open starter artwork"]
    Starter --> Canvas["Tap-to-colour canvas"]
    Canvas --> Progress["Local progress and completion"]
    Progress --> Note["Founder's note and soft account prompt"]
    Library --> FreeDownload["Download free artwork"]
    FreeDownload --> Offline["Offline play"]
    Library --> Premium["Open locked pack artwork"]
    Premium --> Paywall["Pack paywall and account upgrade"]
    Paywall --> Purchase["Native purchase and server validation"]
    Purchase --> Entitlement["Entitled download"]
    Pipeline["Content pipeline and cultural review"] --> Library

Journey	Must support	Primary source
First-time anonymous user reaches the aha moment	Welcome, preferences, accessibility quick-set, personalised library, guided first taps, founder note, and soft account prompt.	JRN-P01 in /prd/03-user-journey-flows/.
Returning user resumes downloaded artwork	Continue row, local cache, instant progress load, offline colouring, and background sync.	JRN-P02.
Free artwork download and play	Artwork detail, public download URL, verified bundle cache, and offline-ready canvas.	JRN-P03.
Content pack purchase unlocks artwork	Locked artwork state, paywall, account upgrade if anonymous, native purchase, server validation, and entitled download.	JRN-P04.
Content operator publishes artwork	Authoring, segmentation, validation, cultural review, upload, preview, publish, and public catalogue appearance.	JRN-P05.
Failure and recovery	Sign-in-required premium state, missing entitlement, failed receipt validation, checksum mismatch, expired signed URL, offline catalogue refresh, sync failure, incompatible artwork version, validator block, and child-mode restricted action.	JRN-F01 to JRN-F10.

In addition to the primary journeys above, v1 must support eight alternate journeys — JRN-A01 through JRN-A08 in /prd/03-user-journey-flows/. These cover the routine return paths and account-state transitions that sit alongside the primary loop: settings adjustments (audience, accessibility, notifications), restore purchases from settings, anonymous-to-signed-in upgrade where an existing account is detected and progress is union-merged, offline browsing of cached content with deferred catalogue refresh, content-operator publish updates after a republished cultural review, and child-mode toggles. They are part of the frozen scope per /prd/05-feature-freeze/ §5.3 and must be designed and QA-tested before release even though they are not the headline loops in the diagram above.

6.4 — Functional requirements

The Feature IDs column names both user-facing FEAT-* records from /prd/02-feature-specification/ and the supporting-infrastructure records (DATA, API, PROG-004, OPEN) on which the row depends. The Phase column maps the row to its delivery phase in /spec/17-phases/; the full phase plan and gate detail live in /prd/04-v1-feature-set-selection/ §4.3.

Area	Requirement	Feature IDs	Phase	Acceptance summary
Onboarding and retention	New installs show an outcome-led welcome, capture cultural themes, audience, and accessibility defaults, then reveal a personalised starter path. The first-steps retention checklist is the only persistent return-path surface in v1. ONB-007 through ONB-009 are covered in the Trust moment and Notifications rows below.	FEAT-ONB-001 to FEAT-ONB-006, FEAT-RET-001	Phase 1	No mandatory sign-up; reduce motion is respected; selected preferences persist; starter artwork is prominent and playable; the retention checklist survives restarts for the first three sessions unless dismissed.
Trust moment	The founder’s note appears only after first completion or a qualifying milestone, followed by a non-blocking soft account prompt fired by the post-aha trigger.	FEAT-ONB-007, FEAT-ONB-008, FEAT-PROG-003, FEAT-PROG-004, FEAT-OPEN-001	Phase 1 + Phase 2	The note never appears before value; account prompt can be dismissed; user returns to the prior task; founder’s-note copy is resolved per OD-10 (FEAT-OPEN-001).
Notifications	New-artwork notifications are opt-in and use a pre-permission screen before the OS prompt.	FEAT-ONB-009, FEAT-NOT-001, FEAT-OPEN-003	Phase 1 + Phase 5	Decline path does not trigger the OS prompt; settings can later manage notification state; pre-permission copy is resolved per OD-12 (FEAT-OPEN-003).
Library	Users can browse featured, new, category, theme, difficulty, free/premium, downloaded, in-progress, and completed artwork groupings.	FEAT-LIB-001 to FEAT-LIB-004, FEAT-DATA-002, FEAT-API-001	Phase 1 + Phase 2	Published artwork renders for anonymous users; local progress and cache state are reflected; child audience filters are respected; catalogue reads use RLS-published rows only.
Artwork detail	Artwork detail shows required metadata, preview, artist credit, cultural context where approved, progress, and the correct action state.	FEAT-ART-001, FEAT-ART-002, FEAT-DATA-002	Phase 1 + Phase 2	Free, owned premium, and locked premium states are visually and semantically distinct.
Download and cache	The app downloads, verifies, atomically stores, reconciles, and opens artwork bundles in the CLRX v1 format.	FEAT-DL-001, FEAT-DL-002, FEAT-CACHE-001, FEAT-CACHE-002, FEAT-NET-001, FEAT-DATA-003	Phase 2	Cached artwork opens offline; checksum failures are recoverable; signed URLs renew when needed; bundles parse against the CLRX v1 data model (FEAT-DATA-003).
Canvas and palette	Users can zoom, pan, select numbered colours, tap matching regions, receive calm feedback, and track per-colour progress.	FEAT-CAN-001 to FEAT-CAN-004, FEAT-PAL-001, FEAT-PAL-002, FEAT-DATA-003	Phase 0 + Phase 1	F-small, F-typical, and F-stress fixtures render; tap accuracy and latency meet Phase 0 gates (see §6.5); completed colours are dimmed or moved.
Progress	Progress is stored locally as a bitset, completion is detected, and sync merges via server-side bitset union.	FEAT-PROG-001 to FEAT-PROG-003, FEAT-DATA-004, FEAT-API-002	Phase 1 + Phase 2	No colouring interaction waits on sync; failed sync preserves local state and retries.
Identity	Every install starts with anonymous identity and can later upgrade or merge with an existing account.	FEAT-ID-001 to FEAT-ID-003, FEAT-DATA-001, FEAT-API-003	Phase 2	Catalogue access uses an anonymous JWT; account upgrade preserves progress; existing-account merge unions progress bitsets.
Monetisation	v1 supports one-off content packs, paywall, native purchase, restore purchases, receipt validation, and entitlements.	FEAT-IAP-001 to FEAT-IAP-004, FEAT-DATA-005, FEAT-API-004	Phase 4	Client never grants entitlement; subscription copy does not appear; restore is available from paywall and settings.
Settings	Settings exposes account, accessibility, preferences, child mode, notifications, restore purchases, and support/reporting paths.	FEAT-SET-001 to FEAT-SET-003	Phase 1 + Phase 2	Changes persist; child-mode analytics policy updates immediately; restricted actions explain their state.
Accessibility	Accessibility is built into the canvas and palette, not deferred to settings.	FEAT-ACC-001 to FEAT-ACC-003	Phase 0 + Phase 1	Always-show numbers default on; screen-reader labels cover core state; pattern fills, contrast, reduce motion, and snap-to-nearest small region are supported.
Content pipeline	Launch artwork is created, validated, culturally reviewed, uploaded, previewed, and published through tooling.	FEAT-CONT-001 to FEAT-CONT-003, FEAT-CULT-001, FEAT-ADMIN-001, FEAT-DATA-006, FEAT-API-005	Phase 3	Invalid bundles block publish; cultural approval is required; admin tooling does not expose service-role keys.
Banned UI conventions	The launch product respects the tone-of-voice and UI bans in /spec/02-product/ §2.5. No countdown timers, streak mechanics, badges, daily-reward dialogs, interstitial ads, or rate-this-app prompts during a colouring session.	Cross-cutting — constrains every FEAT-* row above.	Phase 1 + Phase 5	Design and QA review confirm no banned patterns ship; copy review checks for banned phrases (see /spec/02-product/ §2.5 banned-words list).
Observability and release	Product analytics, purchase analytics, crash/performance monitoring, CI/CD, accessibility checks, and store-readiness gates are in place.	FEAT-OBS-001 to FEAT-OBS-003, FEAT-REL-001	Phase 5	Child-mode event policy is enforced; performance timers report canvas budgets; release gates are recorded before store submission.

6.5 — Non-functional requirements

Requirement	Threshold or rule	Source
Canvas performance	All Phase 0 metrics pass on the same Pixel 6a-equivalent release build: cold start ≤ 1.8 s, cached F-stress open ≤ 600 ms, frame time ≤ 16 ms p95, zero frames > 50 ms, tap-to-fill ≤ 50 ms p95, 99% tap accuracy at 4x zoom, memory ≤ 220 MB, battery drain ≤ 6% per 30 min.	/spec/17-phases/, ADR-010.
Offline play	Downloaded artwork must remain playable without network access. Colouring, progress writes, pan, zoom, and palette interaction cannot depend on a network round-trip.	/architecture/01-architecture-decisions/ §4.
Security and trust	RLS is the primary authorisation layer; service-role keys never ship to the client; premium access and receipt validation are server-side.	/spec/07-data-layer/, /spec/08-api/, ADR-006, ADR-007.
Privacy and child mode	Behavioural analytics are disabled in child mode except app_opened and crash signals. Purchase and external-link actions respect parental and platform requirements.	/spec/13-observability/, JRN-F10.
Accessibility	Colour cannot be the only signal; non-canvas screens support Dynamic Type; canvas supports number labels, halos, pattern fills, reduce motion, semantics, and tap forgiveness.	/spec/12-accessibility/, ADR-012.
Content integrity	Artwork cannot publish without cultural review approval and validator success or explicit warning sign-off.	/spec/14-culture/, ADR-009.
Monetisation integrity	Packs are the only paid surface at launch; no subscription, rewarded adverts, behavioural adverts, or in-app currency.	/spec/04-features/ §4.7, ADR-008.
Maintainability	The app uses feature-first clean architecture; shared code belongs in core/; canvas complexity stays isolated behind clear contracts.	/architecture/01-architecture-decisions/ §2.1 component layers and ADR-002 (feature-first clean architecture).

6.6 — Acceptance criteria

Acceptance gate	Pass condition
Scope gate	The 53 user-facing v1 feature records plus 14 supporting infrastructure records are either implemented or intentionally waived through the Six-Dimension Change Exception process in /prd/05-feature-freeze/ §5.5.
Aha moment gate	A first-time anonymous user can complete JRN-P01 through first satisfying fill without account creation, payment, or unsupported network waits.
Offline gate	A downloaded free artwork and an entitled premium artwork can both open and continue colouring without connectivity after successful download.
Purchase gate	Locked premium artwork routes to account upgrade if anonymous, paywall if unentitled, native purchase, server receipt validation, entitlement application, and restore path.
Content gate	Launch artwork bundles validate, culturally approved artwork can publish, rejected artwork remains unpublished, and regular users cannot see drafts.
Accessibility gate	Always-show numbers, palette semantics, screen-reader state, reduce motion, pattern fills, colour-vision validation, and small-region tap assistance are verified before release.
Child-mode gate	Child-mode profile state suppresses behavioural analytics and applies restricted-action handling for purchases or external links.
Performance gate	Phase 0 proof passes every quantitative row before later phases proceed. Performance regressions after Phase 0 are treated as release blockers.
Observability gate	Required analytics and crash/performance signals are present without leaking sensitive content or child-mode identifiers.
Store-readiness gate	iOS and Android builds satisfy purchase, restore, privacy, family, and accessibility checks before submission.

6.7 — Success metrics

These metrics are directional design heuristics, not committed conversion targets. In particular, the Activation row inherits the caveat in /prd/01-product-brief/ §1.5: the figures cited in the cited onboarding study (/spec/09-user-flows/ §9.7) are reference points, not numbers v1 is on the hook to reproduce. Performance, Accessibility, Content integrity, and Privacy & safety rows are gated (their thresholds live in §6.5 and §6.6); Activation, Engagement, and Monetisation rows are tracked, not contracted.

Metric area	v1 metric	Use
Activation	Time to first satisfying fill on the starter artwork.	Primary signal for whether onboarding is too heavy.
Engagement	Starter artwork completion rate, return to library after first canvas session, repeat opens of downloaded artworks.	Indicates whether the first session creates enough value to return.
Monetisation	Paywall view → purchase start → purchase success for content packs; restore success and failure.	Validates pack demand and purchase reliability without subscriptions.
Reliability	Crash-free sessions, download completion rate, checksum failure rate, sync failure rate by reason.	Protects the calm product promise and guides hardening.
Performance	Phase 0 and release-build canvas budgets, plus ongoing custom canvas timers.	Detects whether the core engine remains viable as real content grows.
Accessibility	Adoption and completion behaviour with always-show numbers, pattern fills, reduce motion, and screen-reader configurations.	Confirms that accessibility features are discoverable and useful.
Content integrity	Number of published artworks with approved cultural review, validator errors by category, changes-requested rate.	Shows whether the content pipeline is reliable enough to scale.
Privacy and safety	Child-mode sessions with only allowed events, restricted-action handling completion, no behavioural ad activity.	Confirms launch behaviour respects child-mode and platform constraints.

6.8 — Non-goals and release boundaries

The following are explicitly outside v1 and cannot be added without a Six-Dimension Change Exception after freeze approval:

Boundary	Out-of-scope item	Reason
Monetisation	Subscription tier, rewarded ads, behavioural advertising, in-app currency.	v1 validates one-off content packs only and avoids child-mode privacy risk.
Social surface	Social graph, public profiles, sharing mechanics, multiplayer.	Privacy, moderation, and safety complexity exceed the v1 proof.
Content creation	User-generated content and AI artwork generation.	Rights, cultural authenticity, moderation, and review risk require separate policy work.
Retention mechanics	Streaks, badges, countdowns, daily rewards, heavy animation.	These undermine the calm colouring-book positioning and compete with performance budgets.
Family account depth	Advanced child profiles and multi-child management.	v1 uses audience selection and a child-mode flag only.
Media and commerce expansion	Audio narration and merchandise.	Adds unrelated production, storage, rights, and fulfilment complexity.
Admin experience	Full admin dashboard.	Tooling-only admin is sufficient until repeated publishing work proves the needed operator UI.
Acquisition tooling	Attribution providers and full marketing deep-link infrastructure.	Not required to prove first value, offline play, content pipeline, or pack conversion.

6.9 — Risk register

Risk IDs RISK-001 through RISK-010 are durable references. RISK-001 and RISK-002 are cited from /spec/17-phases/ Phase 0 as the trigger conditions that reopen the stack decision. Any open risk at moderate-or-higher impact must be named explicitly in the Dimension 1 (user value or risk) entry of a Six-Dimension Change Exception (/prd/05-feature-freeze/ §5.5). Adding or retiring a risk in this register requires a one-line note in the affected source doc so the cross-references stay live.

Risk ID	Risk	Impact	Mitigation	Owner
RISK-001	Flutter canvas cannot meet Phase 0 performance thresholds on mid-range Android.	v1 implementation path may need redesign before Phase 1.	Build Phase 0 first, measure all fixtures on the same release build, and treat any failed row as a stack review trigger.	Engineering
RISK-002	Real artwork complexity exceeds fixture assumptions.	Launch content may stutter, consume too much memory, or produce poor tap accuracy.	Keep F-small, F-typical, and F-stress in the repo; add representative launch artwork to performance runs before release.	Engineering / Content
RISK-003	Content pipeline is too manual or error-prone.	Launch artwork volume slips or broken bundles reach users.	Ship validator, bundle generator, upload tooling, and internal preview before publishing production artwork.	Content / Engineering
RISK-004	Cultural review becomes a late-stage bottleneck.	Publication cadence slows or trust standards are weakened under schedule pressure.	Treat approval as a technical publish gate, record reviewer notes, and plan content production around review capacity.	Content and cultural review owner
RISK-005	Purchase validation or entitlement handling fails.	Users may pay without receiving access, or premium assets may be exposed incorrectly.	Keep receipt validation server-side, test restore and Family Sharing paths, and monitor coarse failure reasons.	Engineering / Product
RISK-006	Anonymous-to-account promotion or merge loses progress.	Users lose trust after deciding to create an account or purchase.	Use server-side promotion/merge functions and bitset union; include existing-account merge in test coverage.	Engineering
RISK-007	Child-mode analytics or purchase behaviour breaches platform expectations.	Store review, legal, or trust failure.	Enforce child-mode event restrictions, rely on platform purchase controls, and review privacy text before submission.	Legal / Engineering
RISK-008	Accessibility is treated as post-launch polish.	Colour-vision and assistive-technology users may be unable to play.	Keep accessibility in the canvas acceptance gate and bundle validator; verify non-colour cues before release.	Design / Engineering
RISK-009	Product tone drifts towards free-to-play patterns.	Ochre & Soul loses its calm differentiation.	Apply banned copy and UI conventions from /spec/02-product/ §2.5 during design and QA review.	Product / Design
RISK-010	Observability is either too thin or too invasive.	Team cannot judge launch health, or child-mode privacy is compromised.	Track only the agreed event taxonomy, suppress child-mode behavioural events, and use Sentry/PostHog within the approved policy.	Product / Engineering

6.10 — Release readiness summary

v1 is ready to release only when every condition below is true. This list is the operational closer for §6.6: where §6.6 names which gates exist, this list names what evidence proves them passed and who signs off.

Readiness item	Evidence	Sign-off
Freeze packet approved	All five §5.2 approver rows show “Approved” with a named owner-or-delegate and a timestamp.	Product owner per /prd/05-feature-freeze/ §5.2.
Functional requirements implemented	Every §6.4 row has either a working implementation or a recorded Six-Dimension Change Exception waiver per /prd/05-feature-freeze/ §5.5.	Engineering + Product.
Non-functional requirements verified	§6.5 thresholds measured on a release build; the eight Phase 0 metrics recorded row-by-row per ADR-010.	Engineering.
Acceptance gates passed	Each §6.6 gate has a pass record stored against the release tag.	The owner named on each gate.
Risk register reviewed	Every §6.9 risk has a current state; no moderate-or-higher-impact risk is open without an explicit mitigation note.	Product + Engineering.
Release coordination complete	Store readiness, privacy text, family compliance, accessibility audit, and crash baseline per /spec/16-release/ are signed off.	Legal/privacy + Engineering.
Launch library reviewed	The ~25-artwork launch library is culturally reviewed, validated, and publishable; rejected items are clearly excluded.	Content and cultural review owner.

The minimum release claim is narrow by design: a calm, culturally grounded, accessible mobile colouring app with anonymous-first onboarding, offline play after download, one-off content packs, and a reviewed launch library. Anything not in §6.4 or §6.5 is post-v1 by default and needs the Six-Dimension Change Exception process to enter scope.