Dev log #9: every way in asks who you are first

Sixty-two commits landed on the working branch since the last entry. Most of them answer one question from four directions: what does it take to change the way somebody gets into an account? Adding a key, taking one off, setting a first password and replacing an authenticator app now ask the same first step, and none of them can leave an account with nothing to sign in with.

Adding a way in asks again, and so does taking one off

Adding a passkey now asks for the password again. On an account that has no password it asks instead for a passkey already there, verified by the person rather than merely present. One addition is granted per passed check and any verification spends it, so a check cannot be banked. The account’s own record keeps the addition, and a notice goes to the confirmed address.

Taking a way in off asks exactly the same first step, and that is the point: a key is no easier to remove than to add. Both reviews of that work were acted on before it closed, including a race between two removals arriving together that could have left an account with no way in. Twenty-six mutants went through that path and twenty-five were killed, the last proven equivalent.

A passwordless account can set a first password

An account built on passkeys alone can now be given its first password, decided on the server and proved by one of the account’s own keys. The decision is taken again after every wait, so a change that lands while the request is in flight cannot be written over, and the password is kept once, in a single transaction.

Then the same ground was gone over again, so that a proof can never become a lever for locking somebody out: a re-check challenge is bound to the account it was issued for, passkey tries and the removal limit are counted per session, and an account with no password is recognised as such before the key is asked for. The site suite reads 1,179 green across that work, and the unit suites 2,747 across server, site and console.

The authenticator app, drawn in-house and replaced without a gap

The console draws the QR square itself now: byte mode, level M, versions 1 to 40, the mask chosen by penalty, 196 px black on white beside the letters and hidden from assistive technology, since the letters are what a screen reader should read. The test browser has no barcode reader, so a separate tool decodes the rendered bitmaps and reports back the version, mask and level. Parts of the encoder follow Project Nayuki’s MIT-licensed generator closely enough to say so, so its copyright notice travels with the module.

Setting the app up asks for the password first, on a confirmed address and against a per-identity limit; the letters are good for ten minutes. Replacing an app already in use was decided in the person’s favour: the new letters wait beside the confirmed app instead of replacing it, so the old app holds the gate and the reset until the new code is accepted. There is no moment in which neither works. Thirty-eight mutants ran over that route, thirty-seven killed and the last proven equivalent.

The pre-registration takes a real address, and the map waits to be asked

The pre-registration form takes the structured address now, and it draws the same map the add path uses: a pushed Where the gym is step on the phone and the tablet, opened once the address is complete, and at 1180 the map inside the address’s own section. A placed pin is written straight into the typed pair, so the route behind it needed no change. There is still no geocoder, and a map that does not load never blocks Send.

At 1024 px and above the map mounts only when somebody presses for it with a complete address, so opening the page sends nothing to the tile host. The privacy page now names that host, OpenFreeMap, who runs it and what reaches it on the press. The affected suites read 1,594 unit and 1,183 browser green.

45 checks, 9,236 unit tests and 1,165 browser tests

The gate every change has to clear holds at 45 checks, and the suites read 9,236 unit tests and 1,165 browser tests green, up from 9,015 and 1,142 at the last entry. The standing counts, each written by the check that derives it: 55 routes, 27 of them rate-limited; 1,660 rule citations resolving by number, up from 1,641; documented coverage across 228 modules, up from 223; 80 artboards, each claimed by a specification or exempt with a reason; and Node pinned at 22.23.2.

Design rounds 54, 55, 56 and 57 were all curated in, each file copied byte-identical and measured by checksum before anything moved, and round 53’s fidelity pass was built out: English dates read day month year everywhere, console stamps are lower case, and every panel date carries its year.

What comes next

An account’s ways in can now be added, replaced and taken off, each asking who you are first, and a gym can be pre-registered with a real address and a pin. The rest of the console’s rooms follow.

If you would rather be told when GymAI opens than keep checking, the waiting list is on gymai.coach.