Forged in the open.

Crucible begins

The first commit scaffolded an Expo app, and a project briefing and decisions log were added the same day so every working session could pick up where the last one stopped. The founding bets were set at once: one flagship 91-day program (13 clean weeks, not a ragged 90), no difficulty picker at signup, and a harder tier that can only be earned by finishing the first.

Method The briefing and the decisions log became the project's memory. Every session since has started by reading them.

Supabase chosen, the backend scaffolded

Supabase was chosen over Firebase, Clerk and Convex for its Postgres foundation, its free tier and a clean way out if one were ever needed. The first build wired onboarding, the tab layout and sign-in, under a standing rule that every user table carries both row-level security and an explicit access grant.

The daily loop, and a real dev build

The core daily check-off loop, onboarding and notifications shipped, with streak and stats bugs fixed the same day. A custom development build replaced Expo Go so real push notifications could be tested, and the app moved from Expo SDK 54 to 56 two days after it was scaffolded.

Server push, and a silent delivery failure

A server function began composing each user's notifications from their actual completions and time zone, on a schedule. On Android, a send that reported success was not a delivery: a missing account permission was blocking every message, visible only in the delivery receipts.

Calendar, themes, deletion, push-to-deploy

A 91-day calendar, a weekly summary card and a light and dark theme system shipped, along with full account deletion, the Terms and Privacy screens and an accessibility pass. Pushes to the main branch began deploying backend changes automatically.

Notifications follow the right account

Server push was fixed to follow the account currently signed in, not whichever account last registered the device. The program's start date began syncing, with the cloud copy authoritative.

Harder trials and secret achievements

Advanced trials shipped as a separate layer over the six base trials, so unlocking one mid-run can never rewrite XP, levels or streaks, with ten secret achievements hidden until earned. A profile tab (identity first, stats second) and a rank system with badge art arrived the same day, and notifications split into a free, completion-aware tier and a premium AI tier.

The covenant becomes a full-screen gate

Accepting the trials moved from a pop-up to a full-screen "I ACCEPT" ceremony, and nobody reaches the trials until every one has been sworn. A relaunch mid-ceremony resumes where it stopped.

Badges renamed, rebalanced, decoupled

Badge thresholds were rebalanced to escalate cleanly, and each badge's id was separated from its threshold, so retuning can never rename art or orphan saved progress. Titles became escalating Greco-Roman names, and a developer time machine was built to walk all 91 days in minutes.

Method Checked on a real device before it was pushed.

The first badge art, sent back

The first badge set, cropped from generated sheets, was judged on a device and found short of the bar, and the method too brittle to keep. The next pass generated one image per badge, which became the standing workflow.

Unlocks re-checked before they land

Unlocking a trial began re-deriving eligibility before anything was written, closing a path where a malformed link could have unlocked a trial that was never earned. Sync around sign-in was hardened the next day: safer merging of local and cloud state, and retries for offline writes.

The Ascendant Crucible, and a complete backend

The Ascendant Crucible shipped as the earned harder tier, opening every trial from day one for anyone who finishes the main program. The backend closed its last multi-device gaps: run history, unlock progress and identity all sync, so any device restores the whole account.

An audit before calling it done

Before the week's batch was called finished, a four-agent audit checked it against the running app and found real bugs: a mistimed unlock offer, a startup race, a stale achievement cache and missing divide-by-zero guards. All were fixed and confirmed on a device.

Method Four audit agents in parallel; every fix confirmed on hardware.

The social layer ships, security first

The social layer that became the Coliseum shipped: friends by unique handle, a daily leaderboard and peer nudges, with every cross-user read routed through narrow server functions. An automated security advisory then showed those functions could be reached without signing in, though each still checked identity itself; a migration the same day closed that off.

A paywall ahead of real billing

Premium shipped as a paywall over a stand-in entitlement, a deliberate placeholder until real store billing. The one feature that spends AI budget on every call got a per-user daily limit, checked before any request is composed.

The first full-app audit

A full audit of security, correctness and copy found the biggest risk was not technical: it was the path back after a missed day. The fixes locked the social features behind server-verified functions, made a premium spend atomic, and cleared stale cloud data on restart and account switch.

The social tab becomes the Coliseum

The social feature was reframed from a buddy list into an arena: the tab became the Coliseum, and nudges split into a Taunt or a Salute, the sender's choice. The code kept its old names to avoid a migration; only the words people see changed.

Competition becomes ghost-racing

Live ranked matchmaking was set aside for ghost-racing: racing a recorded run instead of a live opponent, which sidesteps empty lobbies, time zones and opponents who are not what they seem. It shipped the same day against AI rivals, your own past runs and friends. Team modes were deferred.

A champion, and a way back from failure

A customizable champion, Warrior or Shieldmaiden, shipped with the audit's top recommendation: a return rite that meets a broken streak by quoting one of the user's own reasons back and showing the longest chain as still theirs. A weekly Council review began judging each finished week.

The Aegis and the Decrees of the Council

The Aegis shipped: earned armor that spends a charge so one missed day doesn't break the streak, reframed from losing health to spending protection you earned. The miss still records. Weekend Decrees of the Council, aimed at the weakest trial, pay out Aegis charges, never XP or ranked points.

Champion art, reset twice

A hand-coded armor proof read as blocky and was set aside for illustration-grade art in the manner of bas-relief and engraved statues. A generated body pass was then rejected for looking like a mannequin, and the art stayed on placeholders.

Weekly skirmishes replace the dead race

A 91-day head-to-head is usually decided weeks before it ends, and weeks of daily losses undercut a motivation app. Weekly skirmishes replaced it: a seven-day race against a rival that steps a difficulty band up or down with each result. Difficulty moves the rival, never the trials.

Friend duels

A calendar-week head-to-head between two people shipped. Each side is scored on their own completion percentage, so different difficulty tiers stay fairly matched, and results build a lifetime rivalry record rather than ranked points.

Method Built by implementer agents under a plan-and-review cycle, adopted that day as the standing way feature work gets done.

Where the money line sits

The champion and everything earned through the trials stayed free, because paywalling status earned by discipline would break the covenant. Premium sells style. The Ascendant Crucible stays earned, never bought, and the app launches subscription-only, with no lifetime purchase.

Brian's call Phase One ends with the champion, not before it.

One AI rivalry, thirty named fighters

The manual rival-difficulty picker was retired for contradicting the rule against choosing difficulty. The weekly skirmish became the only AI rivalry, its difficulty hidden across five tiers and dressed as six rotating houses of thirty named fighters.

Armor wired before the art existed

Champion armor shipped as wiring only: achievements and skirmish wins granted gear to equip by hand, with the art deferred. Device testing the same day folded a separate hub and armory into one Forge screen, and the next day gear was split from achievements into a catalog of its own.

A second audit, and a stress test

A second full-app audit, run adversarially across many agents, found nothing critical; its theme was data integrity across devices. The fixes stopped a program restart from resurrecting old data. A stress test the same day added a crash boundary and a full data export.

Method Findings recorded apart from fixes, then a bounded re-audit to verify. The lesson kept: one huge fan-out drops findings under rate limits, so later audits ran in smaller batches.

Strict types, with real guards

Deferred work was cleared: strict array-index checking across 148 call sites, satisfied with real guards rather than blanket suppressions, a deprecated gesture API replaced, and twelve sign-in data loads made to run in parallel safely.

A fifth audit, run in batches

A fifth full-app audit ran in smaller, paced batches and closed two open worklists. Premium AI spending began checking status on the server behind a circuit breaker, and accessibility labels were rewritten in plain English.

The summit belongs to the Ascendant

The top Endurance and Mobility badges and the Level-100 rank were placed behind finishing the Ascendant Crucible, so a flawless Mortal run tops out just below the ceiling by design. The Aegis's charge cap rose from two to three.

A sixth audit: a backend that would have shipped dark

A sixth full-app audit made the stretch's most valuable catch: the first production build would have shipped with its backend silently switched off. Ten fix batches followed, including a stricter database check on recorded completions and consent to the Terms and Privacy captured at signup.

Method Multi-agent adversarial audit; every fix batch passed the build gates before merge.

Sleep Covenants, and an Aegis that starts charged

The sleep schedule became Sleep Covenants, and every new user starts with one Aegis charge and an explainer, so the mechanic is understood before it's needed. The profile's consistency view split into this week and the whole campaign, so one old miss stops drowning out a clean week.

Rewards made rewireable

Profile crests and banners moved to a registry that separates each item from the deed that earns it, so re-pointing a reward became a one-line change. A shareable end-of-duel card shipped with it, and a layout rebuilt from memory came out wrong and was restored from git history instead of patched.

Badge art recovered from a session log

The Conquest badge art never reached disk from the image tool, so it was recovered from the tool's raw session log and matched to tiers by prestige. A first pass had wired in blank placeholders; they were caught and replaced the same day, and the set was checked on a device.

Method Generated with Codex; a purpose-built script extracted the images from its log.

An account becomes required

Anonymous, local-only use was removed, so every test had exactly two variables: the backend and the app. It reversed a founding decision. Existing local data was kept and adopted at the next sign-in, never erased.

Brian's call Require an account and retire anonymous mode.

The sign-in bug, found on the phone

After a provisioning fix failed on a real phone, on-device instrumentation found the true cause: a session-storage adapter built on an assumption that no longer held was corrupting login sessions, so every request after signup ran signed out. Replacing it fixed account creation outright, and a multi-agent re-audit of the whole change followed.

Method Root-caused with instrumentation on the device, not guessed.

The trial roster, reshaped and frozen

Water replaced reading among the six base trials, and the earnable set grew from two to four (reading, a step count, a self-control trial and stretching), each unlocking on its own day. A review of the change caught three defects before any device saw them. The roster freezes at the first production build, because a later change would orphan runs in progress.

The Oracle debuts

An AI mentor arrived as a character, not a chatbot: an orb with free, templated encouragement for everyone and a premium consult drawn from a closed set of prompts, with no free-text input. Onboarding gained a reasons picker, and progress photos arrived, kept on the device and never uploaded.

Deserters named, the apex made beatable

Restarting mid-duel to dodge a loss now counts against the one who restarts, and the duel card names them DESERTED. The hardest AI rival, which matched a perfect run exactly, now drops one trial a week in a set pattern, so a flawless week wins outright.

Brian's call Whoever abandons a duel is the loser, and the card says so.

"Build malleable" becomes a principle

Every fact the app depends on (the roster, the thresholds, the totals) was made to live in one place, with everything else derived from it. It paid off at once: a perfect run's trial totals recomputed themselves, 640 to 764 in the Mortal Crucible and 728 to 910 in the Ascendant.

Brian's call Build it malleable: one source for every fact.

Every synced field gets a merge rule

Synced data was classified field by field (overwrite, union, keep-the-highest, or server-decided) instead of being treated as uniformly local-first. That closed a bug where a weekend decree could grant Aegis charges twice across two devices: every charge change became a single server event.

Audits seven and eight

Aegis spends were tied to the append-only charge ledger instead of its cached copy. An overnight pass fixed a right-to-erasure failure, where an active duel could block an account from being deleted.

Method The eighth audit ran overnight, unattended.

An overnight loop closes three security calls

An eight-round overnight audit settled three open questions: the server became the only author and judge of weekend decrees, so a forged one cannot mint Aegis charges; a duel only starts if its window fits both players' programs; and a rate-limited notification now fails closed.

Method Unattended overnight loop, with Codex running half the rounds in parallel.

A bloat audit says no rewrite

A bloat audit read about 29,700 lines and found worthwhile simplification in roughly 0.3 percent of them: evidence that a rewrite was not warranted. It also found the ghost-racing engine intact but cut off from the interface, and it came back as a narrower screen: race your own past run or a friend's.

Method Run through a third-party rule set, installed only after two independent security reviews found no network, execution or exfiltration risk.

Device testing becomes one final pass

Rather than test on devices now and again once the art landed, device testing was deferred to one comprehensive pass when the app is release-ready.

Brian's call One final device pass instead of two.

The launch waits for the company

Store listings, legal pages and a real support address were deferred until Crucible's operating company, Artorias Group LLC, became official. Building and testing carried on in the meantime.

Brian's call The business and legal foundation airtight before anything goes public.

The Grounds: earned backdrops

The statue gained a backdrop for each trial, earned rather than picked and set behind the figure on its stage. The next day a scriptable image pipeline generated the seven remaining families in one parallel run.

Method Codex image generation, run headless and in parallel.

An audit that argues with itself

A new adversarial audit system raised 85 findings on its first run. Verification confirmed 22, found 25 already partly handled, refuted 30 and left 4 for a product decision. Only the confirmed 22 were fixed.

Method Each finding argued by a defender and a prosecutor, and ruled on by a judge, before any fix was written.

The art, from 161 MB to 39 MB

Every in-app illustration moved to WebP, cutting the art from 161 MB to 39 MB: a smaller install and faster loading on older phones.

The company, the website, the pipeline

Crucible's infrastructure moved under Artorias Group LLC, and usecrucible.app went live with a waitlist, deploying automatically on every push that touches it.

Subscriptions and analytics, wired

RevenueCat subscriptions and PostHog analytics were wired across the app and the server. Premium status is set only by the server after RevenueCat confirms a purchase; the app can never grant it to itself.

Declared minor-facing, with a 13+ floor

Setting up the AI account behind the Oracle forced the question of whether Crucible serves minors. The honest answer was yes, since much of its audience is 16 or 17, so the app committed to a 13+ minimum and extra privacy care rather than an 18+ rating.

The champion is a statue

A full direction review pinned the champion as a carved Greco-Roman statue, ruled out 3D for good and parked human-styled avatars. Pets, mounts and calorie tracking were cut as off-identity. Artorias Group LLC became official the same day.

Brian's call The statue, and keeping every competitive mode for launch.

Obsidian, not marble

The first look at the statue on a device showed seams between armor layers and a stray white patch. Moving the statue from white marble to dark obsidian with muted gold became both the look and the test, because the new surface made those errors impossible to miss.

An audit finds sync could lose progress

A full audit found the server sound, but the app's offline sync able to lose check-offs and streaks after a failed write. The fix was a durable write queue and locked server-side merges, so no pending change can be dropped. The Coliseum gained report and block, and the privacy policy was rewritten to name its vendors.

Method A dual-model audit. Codex wrote each fix first, and every diff was reviewed before it landed.

The backlog, emptied

All eleven high-severity findings were fixed first, among them a sign-out that could fail silently and leave a session behind. Twenty-six medium findings followed, then the seventeen low ones, emptying the backlog. Every tab gained its own error recovery, and onboarding now survives an interrupted signup.

Method Codex first on each fix, every diff reviewed.

Twelve fixes, almost lost

A hygiene sweep found a branch of twelve finished fixes from early July that had never been merged, while nine days of work had since touched the same code. Each was reconciled by hand against the current code rather than forced in with a merge.

The champion becomes the Sanctum

Generated armor could never hold alignment across separately drawn pieces, so a helmet or a sword always read as pasted on. The layering pipeline was retired: champions became pre-made statues that change with rank, gear became collectible Artifacts, and the champion's home became the Sanctum.

Brian's call Retire the layering pipeline, and keep the pivot reversible: equipment on the statue can return after launch without orphaning anything earned.

Tabs renamed, referrals, a new website

Profile and Calendar became Legacy and Chronicle, in the app's own language. A referral system was built to reward a week of premium for a successful invite, and usecrucible.app was rebuilt around the statue with phone-frame previews.

Brian's call Every surface in-world.

Five features in one day

Everything approved the day before, built in a single session: the Sanctum and its statue champions, reworked weekend decrees, the Oracle's memory, rivals who move through the day, and invites.

Method Five parallel agent lanes, each reviewed and gated before it landed.

Real references, or the art waits

An overnight run added relics across five equipment families, each drawn from a real historical or museum reference. One piece was held back rather than drawn from a wrong-culture source, and arena weapons were renamed to match what each fighter's portrait actually carries.

Method Codex image generation, one reference per piece.

The reward economy lands

Rewards became one system rather than a scattering of bonuses: a laurel for every flawless day, one clear way to earn each rare Artifact, and badges for answering the Council's weekend decrees.

Badges paced, the Council rescoped

Badge thresholds were restaggered so a flawless run no longer earns a pile of badges on one day, held in place by a test that simulates the whole run. The Council's judgement moved from weekly to campaign scope after ties and missed days broke the weekly version. Advice stays with the Oracle.

Brian's call The Council stays, judging the campaign.

A design prototype, ported in an evening

Eighteen changes from an approved design prototype were built in one evening, among them trial cards with an undo, a tab-bar badge and closed-set Oracle prompts. The port also found that the setting to turn off animations, a standing promise of the project, had never existed. It was built.

Method Four parallel agent lanes and a follow-up. Where the written brief and the prototype disagreed, the prototype won.

An audit aimed at doing less

A pass hunting only overengineering: 88 findings raised, 30 confirmed and fixed, and the app nearly 1,900 lines lighter. The typecheck gate was rebuilt to be trustworthy, not merely green.

Method Refute-by-default verification. Five of the audit's own proposals were checked against the code and corrected or declined.

A second audit catches what the first missed

A follow-up audit, scoped away from the morning's pass, found that a data-loss fix made that morning had closed only one of two paths: the other could wipe a local sync record on every account switch. It was fixed for the whole class of bug the same day, and the build gates were widened to cover code they had been skipping.

Method Eight parallel finders, an independent verifier on every finding, and a completeness critic.

Legacy and Stats, one subject each

Two tabs had drifted into printing the same lists. Past campaigns and arena records moved to Legacy, the lasting record, and Stats kept the campaign in progress.

Design gets one source of truth

The design identity (the statue test, the palette, type, layout and voice) moved out of scattered notes into one design document, with the values themselves kept in code.

The final pre-release audit

A full audit ahead of launch raised 98 findings across security, correctness, accessibility and documentation, and confirmed 48: 5 high, 33 medium and 10 low. It also listed the 14 gaps it admitted it had not covered.

Method 381 agents across finder, verifier and judge stages. A second model re-checked the ten high findings and argued five of them down to medium.

Five high findings, fixed and then checked

The five high findings were fixed within the day, and three of them shared one root cause: a local change whose cloud write could fail without anyone knowing. A review by an agent that had not written the fixes then found problems the fixes themselves had introduced, and those were closed before anything was marked resolved.

Method The fixer never checks its own fix.

Tests that had never run

Removing a catch that swallowed errors turned eight passing tests red. The test runner had been silently skipping one kind of import, so the offline queue's flush step, and every test that seemed to cover it, had never actually run. The first diagnosis was wrong and was corrected the same day.

A day of medium fixes

Titles and cosmetics now survive an account switch, a stalled sync queue can no longer fail silently, and one failed notification no longer takes the day's others down with it. Colors that failed WCAG AA contrast were fixed across the app and the website.

Eight reviewers check the fixes

Eight reviewers who had not written the fixes re-read the code behind all eighteen fix commits, not the commit messages: 24 resolved, 7 partly resolved, 2 regressions. One fix had opened a path for one account's progress to reach another's cloud on a shared device, and a failing check had been silently holding every new migration back from production. Both were closed.

Method Eight independent agents, refute-by-default, reading code rather than commit messages.

An age gate that stores a band, not a birthday

Onboarding gained an age gate. It records which band you fall into and never the date itself — the less personal data the app holds, the less there is to lose.

The Oracle sends less

Before the Oracle reached any user, an audit found its server call included a display name and a sleep schedule that the Privacy Policy said were never sent. Neither was used by any prompt, so both were removed rather than disclosed.

First tests for the untested

Core logic gained its first real tests: the Coliseum's tie-breaker, the Aegis walk run against real completions, the multi-device run merge and the program clock's boundary days. The server functions went from zero test assertions to 87.

The day-91 boundary, from both sides

A graduate would have kept receiving three accountability pushes a day, forever, including a warning that a streak was about to die. Every other part of the app recognized the end of the program; one notification path did not. Separately, restarting on the final day could file a finished campaign as unfinished, permanently.

A badge earned by doing nothing

A capstone meant for finishing 91 days without spending the Aegis could be earned by installing the app and doing nothing: it checked that the shield never rose, not that the chain never fell. The badge's own description settled the fix.

The top security rule, finally executed

The highest house rule, that every cross-user database function is locked down, had never been executed by a test; every existing check mocked the database. A static guard now replays every migration and checks the final state of each function. All fifty passed.

Method A cheap check that always runs was chosen over an expensive one that runs rarely.

The compiler froze one card

The React Compiler was enabled, but none of the checks ran with it. Compiling all 87 components against it found exactly one problem: a daily quote card that read the date once and froze on the day the tab first opened.

The audit closes on code

A three-day security and quality audit finished: every confirmed finding fixed and re-verified, and the release gates widened to test the server code and the day-91 finish line. What remains is outside the code.

Method Of the audit's fourteen admitted blind spots, three were closed earlier. Each of the other eleven was checked against the code before anything was changed: seven were real, four rested on a false premise.

Security headers, and a button that hides

The website gained stricter security headers and a privacy notice beside both of its email forms. Google sign-in could have shipped broken on iOS, so its button now appears only where it can work.

One reference, one prompt

The art process dropped its research-logging step for one reference image, one prompt, a visual check and registration: recognizable and epic over archival. The Sanctum's catalog went from 117 items to 97, dropping 20 that were neither gear nor named relics, so every item left answers how it is earned in one sentence.

Simpler, one refactor at a time

About twenty commits removed leftover compatibility code, merged duplicated modals and lock handling, and rewrote comments to state present rules instead of history. A storage key behind the same data-loss bug three times was moved into one place, closing that class of bug.

Entering an account, as one function

Sign-in, account switching and account creation had each hand-copied the same setup steps. Folding them into one function, with a test written first as the contract, caught an ordering mismatch between two screens that an earlier audit had missed.

Portraits, and painted banners

Profile portraits arrived: an earned emblem that can stand in place of the profile photo, defaulting to the photo so nothing changes unasked. Banners began moving from procedural drawing to painted art, a family finished overnight.

Every statue carved

21 statue champions across seven families, 97 Artifacts for the Sanctum — each with its own lore card — and 65 banners, crest rings and portraits.

Method Codex image generation, one reference per piece. Rules the generator kept breaking became automated checks instead of firmer prompts: gold appears only at a statue's final stage, and a crest ring's inner edge sits exactly where it should.

Notifications, decided in one place

Four entry points had each decided, slightly differently, whether server push or local reminders owned a user's notifications. They were folded into one decision, closing the last open item from the previous audit.

A defect no single image showed

Each of the 47 newest Artifact images passed inspection alone, but the set came back darker and cooler than everything already shipped. Only measuring the batch together caught it, and one uniform exposure correction fixed it without generating anything again.

The last badge is cast

The final sixteen badges finished — 77 of 77. One of them, the campaign's capstone, had been showing a placeholder since it shipped; the check that should have caught it now covers every badge. No placeholder art remains anywhere in the app.

Tiles stop reading full-size art

A slow Sanctum screen was decoding about 63 megapixels of art to paint a page of thumbnails. Every art family now ships thumbnails sized for its grid, and a grid tile never reads a full-size image.

A build you can install

The first Android build compiled the way the store release will be: release mode, the live backend, the developer tools stripped out. The next pass happens on a real phone.

Method Installing over USB was chosen because it leaves a channel open: the phone can then be operated and measured from the development machine without anyone watching the screen.

A second audit, aimed at everything new

A full audit of everything built since the first one — the art, the refactors, the notification rework. 120 findings raised, 83 confirmed, every high and medium one fixed before the month was out.

Method 29 audit dimensions. An unattended overnight fix-out stalled with 34 commits from about fourteen parallel lanes; the next session recovered it from its own history and re-ran every gate on the merged result.

A line-by-line review

After the fix-out, the lead AI developer read the progression math, the Coliseum and the daily check-off flow line by line. The verdict was up to standard. The one risk it could not close was that nothing had yet run on real hardware.

Comments that state the rule

A house rule, that a comment states the invariant rather than the incident behind it, was applied across the app and all eight server functions. Application comment lines fell from 8,306 to 6,238, and the read-through caught a duplicated write in onboarding.

A single home, and this log

usecrucible.app became Crucible's single public home, and the build log moved here. Every entry was checked against the project's own records before it was published, and the five carried over from the developer's own site were corrected where they overstated.

Brian's call The full history, from the first commit, on its own page.