Eight commits closed all seven items from `.planning/v1422-backlog.md`.
STATE entry documents the per-item changes; new
`phase-W5-v1423-report.md` captures the H5 deploy decision, the H7
admin view path + the first useful question it answers, and the
OpenAPI registry additions (3 routes — H4 GET + PUT, H7 POST).
Test deltas: 2191 → 2223 unit (+32), +2 integration files, no
regressions.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wave 4 closes the v1.4.23 foundation track. F5 (OpenAPI 3.1 drift
gate, warn-only for v1.4.23), F6 (Coach schema slot for Apple Health
metrics + PROMPT_VERSION 4.23.0), F7 (per-device refresh-token reuse
detection + device-management endpoints), and F8 (Coolify auto-deploy
runbook) all green.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two halves of the contract — workflow-side webhook (v1.4.22 C3 force=true
already in place) and Coolify-side image-digest watch toggle — must
both be on for tag pushes to land on production without an SSH retag.
The runbook in .planning/coolify-auto-deploy-howto.md now spells out
both pieces verbatim plus the verification curl + host-side fallback.
The workflow gains a single ::notice:: line after the webhook call so
future Actions runs surface the timestamp + sha for triage without
opening the verbose log.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extends the device-registration body schema with the paired APNs
identity fields the iOS client populates once it has an APNs token from
`application:didRegisterForRemoteNotificationsWithDeviceToken:`.
Validation rejects half-supplied requests (`apnsToken` without
`apnsEnvironment` or vice versa) with 422 and enforces hex format on
the token — catching the common iOS implementation bug where the token
gets serialised through Swift's `Data.description` (which renders
`<deadbeef cafebabe>` with spaces and angle brackets) instead of the
hex-join shape Apple's docs spec.
The cross-user-hijack guard from CLAUDE.md is duplicated at the
APNs-token layer: a registration whose `apnsToken` is already owned by
another user returns 409 with reason `apns_token_owned_by_other_user`.
APNs tokens aren't secrets, so trusting wire input would let any
client who learns one redirect another user's pushes — same threat
model as the existing `token` guard, applied to the new field.
Audit-log details for `devices.register` now carry `hasApnsToken` and
`apnsEnvironment` so admin trails surface APNs pairing events without
leaking the raw token. Five new route tests cover the validation +
hijack paths (paired-or-omitted, hex regex, create-with-pair,
cross-user-409, the original 401/422/409/201 contracts stay green).
Ticks STATE.md F4 and lands `.planning/phase-W3-v1423-report.md`
covering the six W3 commits.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
STATE.md flips F1 / F2 / F3 to done with the inline narrative needed
for the next wave to pick up cleanly: 7 net new measurement types
(W1's 6 plus BODY_TEMPERATURE the iOS DTO already shipped), unit
shift on SLEEP_DURATION from hours to minutes, the new SleepStage
enum + composite dedup index.
W2 report enumerates the six commits, the +19 unit / +8 integration
test delta, the migration name + SQL summary, the W1 recommendations
adopted verbatim, and the open questions for the maintainer about
the iOS DTO contract (the rename HEALTHKIT → APPLE_HEALTH stays the
load-bearing item).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wave 5 reconcile pass complete: 7 HIGH applied inline, ~6 MEDs
applied inline, remaining MED + LOW deferred to
`.planning/v1422-backlog.md` under "Wave 5 reconcile carry-over".
- `.planning/phase-W5-v1422-reconcile-report.md`: 10 commit SHAs
with cross-references to each finding, test count delta
(+14 unit tests, +3 integration tests; final 2111 / 245 files),
per-bucket HIGH / MED / LOW disposition, and items the
maintainer should weigh in on (CSP scope, insights split, sentinel
parser malformed-enum priority, /me resync stays as fall-back).
- `.planning/v1422-backlog.md`: every deferred MED + LOW with a
one-line trace per item, organised by review bucket.
- `.planning/STATE.md`: Wave 5 ticked complete; tail updated to
point at the W5 review files + reconcile report.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Maintainer-voice sweep across `src/`. ~190 references to the
maintainer by first name in code comments and JSDoc neutralised to
"the maintainer", "the live tenant", "users", or "the user" depending
on context. Three sed passes covering ~50 distinct patterns
(`Marc reported`, `Marc wants`, `Marc kept`, `Marc rolled back`, etc.).
Test fixtures (`displayName: "Marc B."`, `username: "marc"`,
`<HeroStrip userName="Marc">`) kept as opaque test data per the brief.
CHANGELOG normalisation. The v1.4.14 + v1.4.15 entries paired a
German bullet with its English translation by historical design — the
in-app copy is English-default and the user docs are English, so the
mixed-language style was a holdover from the early-marathon notes.
A one-off node script extracted the `_..._` English paragraph from
each bilingual bullet and rewrote the entry as that text. ~44 bullets
reduced; one Docs bullet that lost a leading word in the regex
fixed by hand.
CLAUDE.md → CONTRIBUTING-AI.md rename so the filename is no longer
AI-vendor-specific. `CONTRIBUTING.md` reference updated. `AGENTS.md`
stays in place for multi-agent compatibility (the conventions doc is
shared with Codex / Cursor / etc.).
Wave-4 state wrap. STATE.md now records C1–C5 + D + D2 as complete;
v1421-backlog.md grew a "Closed in v1.4.22" header listing the 20
items the marathon landed; `.planning/phase-W4-report.md` documents
the per-commit decisions, test deltas, and the 23 items deferred to
v1.4.23 with reasoning.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
C3 — every v1.4.19/20/21 release required a host-side `docker tag`
fallback because Coolify pulled `:latest` from its image cache without
re-checking the GHCR registry digest. The workflow now appends
`?force=true` (or `&force=true` if other params are present) to the
deploy webhook URL so a doc-only push still triggers a registry-digest
check. The complementary maintainer-side toggle ("Watch image registry
for new digests" in the Coolify application config) is documented in
`.planning/coolify-auto-deploy-howto.md` — one checkbox flip in the UI,
no code change required.
C5 — the dependabot PR bumping node:22-alpine → node:26-alpine fails
at build because node:26-alpine no longer ships with corepack
pre-installed (`/bin/sh: corepack: not found`, exit 127). Next.js 16
also still pins node 22 LTS as its supported minimum, so a corepack
workaround would put the runtime ahead of the framework. Closed PR
#162 with a comment; reopen when Next.js bumps its node-version pin.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tick B1-B5 in STATE and capture the sentinel-parse design notes,
test count delta, and the synthesised prose example showing how the
new prompt handles "Meinst du, ich sollte mehr Sport machen?" with
the invitation pivot from rule 3.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Six atomic commits landed for A1-A6: BP target headline re-anchor,
BP tile feature parity, comparison-toggle moved to Settings only,
layout grid normalisation, "Muster" rename + section tabs lifted
above the hero, and the recommendation-card token-leak fix plus DE
component-label normalisation.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captures the same-day patch on top of v1.4.20: Daily Briefing
regenerate fix, Coach day-level snapshot, duplicate streaming bubble,
drawer header, scope picker UI. STATE + ROADMAP rolled forward; v1.4.22
slot scaffolded for the e2e fix wave already in flight on develop.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
New `.planning/phase-v1421-hotfix-report.md` summarises the six
fixes (Daily Briefing regenerate · Coach day-level snapshot · Coach
prompt update · streaming-bubble dedup · drawer header · sources rail
scope picker), the test-count delta (2026 → 2036 unit), the
token-budget impact of the day-level snapshot (~190 → ~3000 tokens
per full-scope turn), and a recommendation to ship as a v1.4.20.1
hotfix.
STATE.md grows a Phase F section + status block tracking the six
commits on develop. Includes prettier polish across the touched
coach surfaces (sources-rail, drawer, message-thread, snapshot,
chat route).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Phase E ticked complete in STATE.md; v1.4.20 archived to ROADMAP
"Previous milestone" with completion timestamp. Top of ROADMAP
scaffolds v1.4.21 with carry-over candidates from
.planning/v1421-backlog.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
11 commits landed on develop covering every Wave-D HIGH (13/13), the
design pushback on the disabled weekly-report button, 6 MED items,
and every simplify-apply-yes item. 22 MED + 16 LOW + 4 simplify-
apply-maybe deferred to v1421-backlog under a new "Phase D — v1.4.20
reconcile carry-over" section. Tests unchanged at 2026 unit + 81
integration; typecheck + lint clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
B5 ticked complete in STATE.md; added Wave-B summary table covering
B1–B5 commits (29 total) and cumulative test deltas (+354 unit,
+14 integration). Status block records the canonical sample score
(95, green) and the integration test count.
phase-B5-report.md replaces the v1.4.15 onboarding-tour stub with
a fresh write-up of the Health Score formula, its sub-component
helpers, the route wiring, the panel slots, and the 4 flagged-
uncertain items for maintainer review.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Five-commit Phase B4 lands the printable weekly report route, the
hero banner card surfacing fresh weekly reports, additive storyboard
annotations on the 90-day BP chart, and mobile rail trays for the AI
Coach drawer. PROMPT_VERSION 4.20.1 -> 4.20.2 with new GROUND RULES
10/11 covering both new schema blocks.
Tests 1902 -> 1975 (+73). Typecheck + lint clean.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Tick B3 in `.planning/STATE.md` against the six commit drops on
`develop` (correlation maths, schema + prompt rule,
TrendAnnotation + TrendsRow, CorrelationCard + CorrelationRow,
analytics route + page wiring, this report). Replace the stale
v1.4.16 host-load report with the v1.4.20 narrative — what
shipped, synthetic-data spot checks for each hypothesis, and
flagged-uncertain items for maintainer review (confidence-band
thresholds, eta-squared mapping, interpretation localisation
strategy).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
B2b drawer UI shipped in four atomic commits on develop:
- TanStack Query hooks + SSE streaming client
- Drawer shell + message thread + source chips
- Composer + history rail + sources rail
- /insights wires the drawer via the hero strip's "Ask the coach"
button + suggested-prompt chips
Tests: 1781 → 1833 unit (+52). Integration unchanged at 78.
Six new test files cover the streaming parser, every drawer column,
the thread state machine, locale-aware labels, and the page wiring.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
The Coach backend half of v1.4.20 wave B is complete; STATE.md
splits B2 into B2a (backend, done) + B2b (drawer UI, deferred to a
later dispatch) and records the test-count delta plus the migration
file in the status block. phase-B2a-report.md captures the five-
commit timeline, schema, helpers, route surface, token-budget
rationale, provenance JSON shape, and flagged-uncertain items.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
STATE.md: Wave B1 ticked (hero strip / daily briefing / suggested
prompts / schema / prompt bump). The Apple-Health vitals tile row
is annotated as descoped + deferred to B3 — the per-section status
cards already render the same numbers, so a tile row above them
would duplicate the surface.
New `phase-B1-v1420-report.md` captures the 5 SHAs (9873363 →
7d29596), the test-count delta (1672 → 1753, +81 tests), the
deferral list (Coach wiring → B2, weekly-report → B4, Health Score
→ B5, Briefing variants → backlog, source-chips → B3), and 5
prompt-copy decisions flagged for maintainer review.
The older `.planning/phase-B1-report.md` (v1.4.18 achievements
marathon) is left untouched; v1.4.20's report uses the v1420
suffix to avoid the collision.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- STATE.md: F5 ticked complete with the four atomic commits referenced
- phase-F5-report.md: scope + per-commit justification + deferral list
- v1421-backlog.md: new backlog file for F5 LOW carry-over plus the
FX cleanup carry-over (source-comment sweep, bilingual CHANGELOG,
CLAUDE.md/AGENTS.md filenames)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
CONTRIBUTING.md gains a "Branch Model" section with an ASCII flow
diagram and the two-rule summary (develop = daily target, main =
release-only). Hotfix flow + end-user-vs-contributor guidance
included. Mirror page on docs.healthlog.dev landed in healthlog-docs
5d96861.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
- STATE.md: F1 ticked complete, F3+F4 collapsed into FX (combined
cleanup wave), all bullets reflect what shipped on origin/main
- phase-F1-report.md: GHCR workflow audit + branch model contract
- phase-FX-report.md: 3-repo PII/jargon/German scrub (HealthLog,
healthlog-docs, healthlog-landing) with carry-overs and the
pre-release PII grep gate spec
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Captures the next-session brief: foundation tasks F1-F6 (develop branch
model, CONTRIBUTING docs, retroactive jargon cleanup, release-notes
language audit, repo best-practice audit, doc-hallucination QA), then
the 5-phase Insights redesign + AI Coach work, then standard QA + release
on the new branch flow.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marc-Brief plus what-landed / deferred / CI / production-deploy /
v1.4.20-preview sections. Mirrors the v1.4.18 report shape.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
STATE update + reconcile report captures the six reviewer briefs and
the inline triage outcome (one CRITICAL fixed, seven HIGH applied,
three HIGH carried over). Backlogs updated: the v1.4.20 file gains a
"Phase D reconcile carry-over" block with file:line references; the
v1.5 file inherits the strategic risk watchlist (conversation
persistence eviction, correlation FDR control, streaming UX,
prompt-injection refusal, safeParse legacy-payload audit pattern).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wave B completed: 6 / 6 CRITICAL applied, 21 / 25 HIGH
applied, 4 HIGH deferred (3 not-an-issue, 1 owned by v1.4.20
Insights redesign), 31 MED + 16 LOW seeded as v1.4.20
backlog. Final verification clean. STATE.md status block
appended; A8 raw findings added to repo for future reference.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marks Wave A bucket A3 complete. Six commits on origin/main
(60a91af → f2b21a4) covered all six concerns Marc raised about the
/insights page on 2026-05-10. Detailed walkthrough in
.planning/phase-A3-report.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Source-grep guards for the four /insights polish concerns Marc
flagged on 2026-05-10 plus drift guards for the chart-token leak
fix:
1. Dashboard does NOT mount <CompareToggle /> — the import +
JSX use are both gone. Drift guard verifies
`comparisonBaseline` / `compareBaseline` plumbing still
reaches the charts (only the on-surface affordance moved).
2. /insights renders exactly ONE `onRegenerate={advisor.regenerate}`
prop — the page hero. The advisor card's duplicate handlers
are gone.
3. /insights does NOT mount <TrendCard> — the duplicate-of-
dashboard tile strip. Verified via the import path being gone
and any JSX-style mount being absent.
4. /insights does NOT pass `t("insights.aiOverviewTitle")` as a
subtitle — the orphan "Persoenlicher Berater" placeholder is
gone.
5. `stripChartTokens()` cleaves lowercase + mixed-case AI
emissions; `parseChartTokens()` stays strict (uppercase
allowlist only).
Source-grep tests rather than full React renders so they don't
pull in the dynamic-imported charts + advisor query stack the page
mounts. The cost is a slight false-positive risk if a future
refactor renames the JSX literal we're matching, but the comments
on each test point at the load-bearing assertion so a renamer can
update the guard without losing the contract.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a Playwright spec that runs only on the chromium-mobile project
(Pixel 5, 393 × 851) and gates the two regressions the previous
chart commit cleared:
- Every chart card on the dashboard keeps its range tabs on a single
horizontal row (asserts that all `[data-slot=chart-range-tab]`
inside a card share one rounded `top` coordinate). Mock data feeds
every chart 30 days of measurements + 30 days of compliance points
so the controls row actually paints with all chips and tabs.
- Every recharts x-axis paints at most seven visible tick labels at
Pixel 5. The helper caps at six; the seven-tick allowance covers
Recharts' preserveStartEnd interaction with rounding.
The PROD probe script that drove the audit is also committed at
.planning/v1419-a2-prod-probe.mjs for future regression runs, with
the findings recorded in .planning/phase-A2-mobile-findings.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Pre-fix the per-card vertical rhythm was either `space-y-3` (AI
provider config forms), `space-y-5` (dashboard layout card) or
`space-y-4` (Account → Profile form). Three competing strides for
forms that visually live in the same shell, so the eye picks up the
discontinuity even though the section-level `space-y-6` outer rhythm
was already consistent.
Standardize on `space-y-4` between fields inside any single Settings
card:
- Dashboard "Customize layout" card: `space-y-5` -> `space-y-4`
- AI Codex / OpenAI / Anthropic / Local provider forms: `space-y-3` ->
`space-y-4`
Account, Notifications and Export already used `space-y-4`. Section
roots and the AI parent card keep their `space-y-6` so distinct cards
still read as distinct surfaces.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Adds a Playwright spec that runs only on the chromium-mobile project
(Pixel 5, 393 × 851) and gates the two regressions the previous
commit cleared:
- Every chart card on the dashboard keeps its range tabs on a single
horizontal row (asserts that all `[data-slot=chart-range-tab]`
inside a card share one rounded `top` coordinate). Mock data feeds
every chart 30 days of measurements + 30 days of compliance points
so the controls row actually paints with all chips and tabs.
- Every recharts x-axis paints at most seven visible tick labels at
Pixel 5. The helper caps at six; the seven-tick allowance covers
Recharts' preserveStartEnd interaction with rounding.
The PROD probe script that drove the audit is also committed at
.planning/v1419-a2-prod-probe.mjs for future regression runs, with
the findings recorded in .planning/phase-A2-mobile-findings.md.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Live-DB audit confirmed the headline was a literal copy of 30T
(`bpInTargetPct = windows.last30Days?.pct`); fix added an `allTime`
window so the three numbers compute independently. Marc's prod data
verifies the asymmetry: 7d=50%, 30d=50%, all-time≈11%.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Settings → Integrations had three- to four-fold redundant status
displays per card. The new pill is the one place a connection status
appears: top-right, Dracula-tokenized chip, "Connected · 12 min ago"
relative-time pattern. Locale-aware (EN + DE), mobile-safe (whitespace-
nowrap, abbreviated "min" / "h" / "d" forms so it fits a 360px card).
Reusable for v1.4.20's Apple Health card on iOS.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Polish/bugfix release. Wave A spans eight buckets — BD-Zielbereich
constant 50% (4th attempt, live-DB audit), charts mobile axis-label
overflow + X-tick-density consistency, /insights polish with
comparison-toggle relocation and placeholder-leak cleanup, AI prompt
rework dropping the auto "Datengrundlage stark" first sentence,
Settings/Integrations status-UI consolidation, Settings mobile audit,
Admin polish (Feedback tabs, api-tokens 4th attempt via ellipsis +
tooltip, Zielwerte i18n + whitespace), and a write-only quality-of-
life audit feeding Wave B. Wave D ends on a Product-Lead pass briefed
for the next strategic milestone (Insights redesign + AI Coach).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Marc-Brief + per-area landed/deferred breakdown for the v1.4.18
release. Charts walked back from gradients/emoji/auto-mean to clean
lines + opt-in per-chart overlay toggles, achievements roster grew
38 → 59 with 6 hidden Easter-eggs, BD-Zielbereich tile sub-values
wired, /admin/api-tokens scrollbar finally pinned to AdminShell.
STATE.md flipped to `finished`; final status block + Phase E3 block
appended; Phase E checklist all-ticked. Phase E1 and E3 reports
included with this commit (drift left from earlier marathon waves).
v1.4.18 LIVE — image digest sha256:c636fca7db66…, /api/version=1.4.18.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Whitespace + table alignment to keep the planning markdown
consistent with the rest of the tree.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Wave-D reconcile report at .planning/phase-D-reconcile-report.md;
deferred items seeded to .planning/v1419-backlog.md; strategic
v1.5 items appended to .planning/v15-backlog.md from the v1.4.18
Product-Lead review. STATE.md marks Wave D done.
Prettier sweep also touched the planning markdown table widths;
no content change.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Mark the A3 task list complete in STATE.md and ship the detailed
report covering the six atomic commits, the architectural deviations
(consolidated HealthChart wrapper, JSON-blob persistence instead of a
new column), and the test deltas.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
All six checklist items closed. Roster 38 → 59 (+21 = 15 public +
6 hidden) with discovery-filter logic so locked public badges only
appear when the user has the underlying data, and hidden cards
paint opaque placeholders that never leak their triggers to the
DOM.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Benchmark Apple Health, Withings, Oura, Strava, Habitica. Pick a
mood category, an entry-consistency category, and a small hidden /
Easter-egg group. Lock in the discovery rule (only show public
achievements when the user has data for the metric).
Total proposed: 15 public + 6 hidden = 21, taking the roster from
38 to 59.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
