Twenty-eight commits landed on the working branch since the last entry. The first sprint is closed and the second turns on one sentence: a gym can add itself, and the account behind it exists. Four things are worth writing down, and all four are that sentence being built.
Sprint one is closed, and sprint two is about gyms
The owner closed the first sprint in his own words, which is the only way a sprint here gets closed — never by a session’s reading of its state. The second was named in the same breath. The plan’s own figure — written by the check that derives it, never by hand — moved from 33.7 per cent to 63.4 per cent done across three sprints and 29 slices.
A gym owner has an account, and the password rule came first
A gym owner’s account now exists on the site itself, with five additive tables behind it: register with an address and a password, sign in by password or by passkey, sessions stored as a token’s hash rather than the token, an authenticator app, and the edit gate as one server rule rather than a rule re-derived in each place that needs it. Ten routes, each answering in state names only, every write behind the cross-site guard.
The password rule was settled before the route that would need it, and read at the source rather than copied from a summary: at least 15 code points after normalisation, up to 256, no composition rules, no rotation, and a bundled list of common passwords compared whole and case-folded wherever a password is chosen. Stored with scrypt at N=2^15, r=8, p=3 — salted, versioned, compared in constant time, and with a full hash computed even when no account matches, so an address that exists takes no less time than one that does not. The rule lives in one module the browser and the server both read, and a test asserts the two bindings are the same object.
A gym can be found, added and claimed
The search is deliberately modest: every word typed has to start a word of the name, the result list asserts nothing beyond five fields, and a suppressed record is never found. It is public and cookie-blind, limited to 30 requests a minute per client address, and the query is kept nowhere — asserted against the files on disk, not promised in prose.
A record can be added with no keeper at all, and whoever added it is published to nobody. Claiming it is separate: a claim is an item of a queue, with routes to make one, list your own and withdraw one. The module behind it covers which methods are offered at all — that follows from what can be proved — the request, a dispute, eligibility for an automatic grant, the grant itself (a keeper and a proof, never an edited fact), a fourteen-day window on a re-claim, and release. 29 tests, 19 mutations, every one killed. Underneath, the console’s routes moved to the server that holds the identity they point at, and the console is served from a build of its own.
The address is made of parts, and the form is on screen
A gym’s address stopped being a line of text. It is one dated fact with parts: country as an ISO 3166-1 alpha-2 code, from the 249 codes carried in the repository with their provenance, then province or state, town, a postal code or a recorded none, street, and a number or an explicit “sin número” — all required. Block, portal or staircase, floor, door and one free line are optional. Every missing part is named back to you, a contradiction is refused, and an unknown country is never echoed. Several matching gyms list by town, then street, none picked out for you.
The pre-registration form is on screen, served at its own path and mounting the console’s inventory ladder — phone, laptop, and a chain as a list, with consent a real required checkbox. The browser run then found the sticky action bar covering a field at the fold; on the five screens that have one it is now a row under a scrolling page, so nothing passes beneath it. And one product decision sits behind all of it: a gym declares what it has, its inventory and its services, and the exercises it can support are computed from that inventory rather than typed in by hand.
44 checks, 7,828 unit tests and 924 browser tests
The gate every change has to clear holds at 44 checks, and the suites read 7,828 unit tests and 924 browser tests green — up from 7,458 and 894 at the last entry, assertions this week’s work brought with it rather than a recount. The standing counts, each written by the check that derives it: 55 routes counted against what the documentation claims, 27 of them rate-limited; 1,407 rule citations resolving by number, up from 1,306; coverage across 197 modules; and the pinned build of Node at 22.23.2.
What comes next
The gym side now has an account, a record, a claim, a search and an address that can be checked part by part. What follows is the screens that sit on top of them.
If you would rather be told when GymAI opens than keep checking, the waiting list is on gymai.coach.
No comments yet
Nobody has written anything here. You can be the first.