What mindteaser.io Is
Puzzle and brain-training games for adults. Pick a game, fill it with your own content — terms and meanings, people and roles, dates and events — and share a link so a friend or a whole team plays the same board. It’s positioned as cognitive fitness for grown-ups, not a classroom tool.
It started as an empty repo on September 22nd. What’s below is what’s actually deployed to production today — not what’s planned.
One Content Model, Three Games
Memory, Match Up, and Quiz are all live. Each one feels different to play, but every one of them reads the exact same content shape: pairs. A term and its meaning. A question and its answer. Write your pairs once, and all three games can play them.
Memory
Cards face down in a grid. Turn two at a time and remember where the matches were.
Match Up
Two shuffled columns, both visible. Pick an item, then pick the one that goes with it.
Quiz
Four options per question. A wrong pick costs an attempt — the wrong options are borrowed from your other pairs, so Quiz needs no content of its own.
What’s not here on purpose
Word search, scramble, and crossword were in the catalogue as “planned” and were removed. A catalogue that advertises three games nobody can play reads as half-finished — and those three need a content type (lists of words) this product doesn’t have yet. They come back the day they actually ship, not before.
Multiplayer Rooms — Polling First
Rooms let a group join the same board, start together, and see each other’s progress. Create, join, start, kick, flip, answer, attempt — the full room lifecycle is live today, built on polling. A WebSocket upgrade is planned terraform-first, additive infrastructure dropped in alongside the existing API, not a rewrite of it. Rooms don’t wait on it to work.
Production Practices From Commit One
Early and unfinished doesn’t mean unguarded. The same ADRs that govern the rest of the OutcomeOps portfolio apply here from the first commit:
- Single-table DynamoDB, query-only. Every access pattern is a bounded Query on one partition — no Scan-with-filter, by standard, not convention.
- Secrets in SSM SecureString, never environment variables. Same rule as every other OutcomeOps-standard repo.
- WAFv2 on CloudFront in production. And a Trivy IaC scan on every commit that already caught a real pyjwt authentication-bypass CVE before it shipped — not hypothetically, it happened.
- Passwordless magic-link auth. No password table to breach, nothing to phish.
- A documented runbook for data deletion requests — and an honest accounting of what the tooling can’t reach yet.
The Point
This isn’t the polished case study — it’s the one still being written. ADR-driven standards mean a three-week-old product already has the same audit gates, the same secret handling, the same honest-status discipline as everything else we ship.
Context Engineering doesn’t wait for a product to be finished to be done right.