Sixty-five commits landed on the working branch since the last entry. Every slice of the second sprint is done and its closing checks have been worked through, the console’s account rooms are redrawn to the two Design rounds behind them, and the gate every change has to clear has grown to 47 checks.
Create a strong password, made where you are
Under the password field on the register screen there is a second act now: Create a strong password. It replaces the field with twenty characters of all four kinds, drawn in your own browser with no modulo bias and redrawn until every kind is in, and the result sits in a wrapping mono box with Copy and Make another inside it.
A security pass changed one thing before it went anywhere: the box could take a line break, from Enter or a multi-line paste, and the break would have been kept as part of a password nobody could type into a sign-in field afterwards. The box drops line breaks now and Enter submits. Six mutants ran over the generator and all six were killed; the register spec reads 12 of 12 green with its accessibility pass.
Changing a password, taking a key off, giving one a name
Change the password is its own screen: the current password, the new one with the generator beside it, and no confirmation field. Taking a way in off was redrawn to the same round — a sheet on the phone, the row opening in place from 834 px up, the consequences written per width, and at 1180 a side column that says why a step is asked at all. Every passkey row can be renamed, within an allow-list of characters.
An account built on passkeys alone can set its first password from Ways in, where the password’s place is drawn as a dashed slot rather than a way in. And Sign out everywhere else landed on the server: it asks for the password or one of the account’s own passkeys, decides again after the proof, ends every other session and keeps the one asking. Across those three slices the mutation runs read 10, 8 and 8, every mutant killed.
Four decisions, written down before they are built
Registration has a minimum now: a username, a given name and surnames, a confirmed address, a password, and a date of birth for the app’s users only. The username is three to thirty characters, case-insensitive and unique across gymai.coach and the instances we host. A registry of those names is specified as an internal service, one signed key pair per hosted instance.
Nobody is registered without an address confirmed by a mail actually sent to it; an instance that cannot send refuses the registration before the password is hashed and before the account exists.
Leaving has a screen of its own. Delete account and Close account sit side by side with a date each, confirmed the same way. A closed account is kept untouched for six months, coming back is simply signing in, and an opt-in reminder goes out thirty days before the date with no sign-in link in it. A lapsed payment locks nobody out either: renew, close and delete stay open, and so does the backup.
And the addresses on the map get a geocoder of our own, built over OpenStreetMap data.
The console in Design’s own theme
The console renders under the theme Design drew for it. The board’s colours are mapped to roles rather than literals, every control measures 3:1 or better against its ground, the page columns are centred inside a 20 px gutter that opens to 30 px from 834, and the inventory ladder’s groups are drawn as rows. A new browser suite measures all of it and reads 8 of 8, with 313 browser and 710 unit tests green across the affected selection.
Design rounds 58 to 62 were curated in, every file copied byte-identical and measured by checksum before anything moved, and three open requests came back answered and closed.
47 checks, 9,566 unit tests and 1,267 browser tests
The gate stands at 47 checks, up from 45, and the suites read 9,566 unit tests and 1,267 browser tests green, up from 9,236 and 1,165 at the last entry. Two of those checks are new: one reads the API index’s rows as well as its headings, the other refuses a tracked source file that no code-map row names.
The standing counts, each written by the check that derives it: 55 routes, 27 of them rate-limited; 1,749 rule citations resolving by number, up from 1,660; documented coverage across 239 modules, up from 228; 80 artboards, each claimed by a specification or exempt with a reason; and Node pinned at 22.23.2.
The security audit over the registration work returned no critical, high or medium finding, and the accessibility pass drove 216 runs across three widths and both themes, its five findings fixed red-first. The repository now carries a walkthrough for running the second sprint yourself, walked in a headless browser before it was written down.
What comes next
The account’s rooms are drawn, the way out is specified and the console wears its own theme. The rest of the gym console’s rooms follow.
If you would rather be told when GymAI opens than keep checking, the waiting list is on gymai.coach.
No comments yet
Nobody has written anything here. You can be the first.