mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 12:32:43 +00:00
Marc-André Bombeck
7ddcee0445
/api/auth/me/health-score-config shipped in v1.35.0 with a settings page in front of it and no entry in the contract at all — no path, no schemas, nothing. A client had the surface and no way to generate against it. This is publication only; the route does what it already did. Both verbs are registered off what the route actually returns rather than off a neighbour's shape. The asymmetry matters and is now written down: the request speaks the positive selection, the pillars that should count, while the response carries both sides resolved plus the recipe version. The column stores the complement, which is storage and no client's business. The response's updatedAt is documented as optional because it genuinely is absent until a selection exists — an account that never chose has nothing to guard a write against, and a decoder that required the field would break on that read. The PATCH 422 is written out rather than reusing the shared base-token response, because this route has four of them and a client branching on meta.errorCode needs all four: the breadth refusal with the sentence to show the person, the validation failure, the unparseable base token, and the non-JSON body. Naming only the token would have been a contract that omits the refusal people actually hit. The route test now drives the real route to produce each of those responses and asserts the published contract names every code that comes back, so a response the route can emit but the spec does not describe fails the suite. That closes the base-token ledger: nine routes emit invalid_base_updated_at and all nine now document it.
docs/ — internal reference + operator playbooks
The user-facing documentation lives at https://docs.healthlog.dev — that's the canonical surface for self-hosting guides, integration walkthroughs, AI-provider setup, and the doctor-report workflow.
The files in this directory are the internal operator playbooks, audit notes, and machine-readable specs that ship alongside the source:
api/— the OpenAPI 3.1 spec for the native-client subset (iOS DTO codegen target). Seeapi/README.mdfor the preview commands. Also home to the MCP-server contract:api/mcp-capabilities.md(tools, resources, prompts, write model) andapi/mcp-skills.md(building a connector / skill).ops/— backup / restore + encryption-key-rotation playbooks. These are the runbooks an operator reaches for during an incident.self-hosting/— horizontal-scaling notes (HEALTHLOG_PROCESS_TYPE=web|worker|all) and the deploy-pipeline recipe. Routine install steps stay ondocs.healthlog.dev. Includesself-hosting/mcp.md— enabling the off-by-default MCP connector and pointing Claude.ai / ChatGPT / Claude Desktop at it, andself-hosting/sso.md— OIDC SSO login: IdP setup, the identity-pinning security model,OIDC_ONLYconsequences, and the break-glass runbook. Alsoself-hosting/geolite2.md— bringing your own offline GeoLite2 databases viaGEOLITE2_DIRinstead of sending login IPs to a third-party lookup.migration/— release-by-release migration notes. Read the entry for the version you're upgrading from.audit/— per-release audit summaries archived for forensic traceability.apple-store-connect-checklist.md— the iOS submission gate.doctor-report.md— PDF generator design notes.codex-protocol-spec.md— Codex / ChatGPT OAuth protocol reverse-engineering notes.ui-guidelines.md— UI / a11y house style.
If you're a self-hoster looking to spin up an instance, start at https://docs.healthlog.dev or jump to the Quick Start in the project README.