feat: package focused private Huddle portfolio demo by alexdancer · Pull Request #7 · alexdancer/Huddle

alexdancer · 2026-07-30T14:19:39Z

Intent

Finish Huddle as a focused, polished, private, resettable, synthetic-only TSA Junior Software Engineer portfolio demo whose teacher golden path is sign in, upload the fixed CSV, validate and commit, refresh, see the ranked Evidence Desk, open exact evidence, observe Seen acknowledgment, and verify deterministic fallback. The recovery pass must simplify the teacher-facing UI to match the accepted prototype by removing nonessential controls, explanatory chrome, visual density, unnecessary states, and excess code rather than restyling the same complexity. Preserve authentication, server-side Supabase/PostgreSQL boundaries with no browser-held service credential, synthetic-only enforcement, trust-boundary validation, accessibility, responsive desktop/narrow behavior, exact dominant and additional evidence, priority and confidence, acknowledgment, deterministic behavior, reviewed zero-model-call evaluation artifacts, explicit no-accuracy-claim posture, reproducible local/reset/deploy/hosted-smoke commands, and private Vercel plus Supabase reviewer packaging. Reuse the merged Operations and Evidence Desk implementations and existing dependencies; do not add speculative infrastructure, tenancy, model providers, portals, notifications, simulator breadth, or a broader evaluation platform. The captain will perform the final manual walkthrough; validation should focus on the real golden path and produce a PR with green CI.

What Changed

Streamlined the authenticated teacher flow around fixed synthetic CSV import, deterministic board refresh, and a responsive ranked Evidence Desk with exact dominant/additional evidence and persisted Seen acknowledgment.
Added synthetic demo seed/reset support, server-scoped evidence operations, acknowledgment persistence, health policy reporting, and database TLS safeguards.
Packaged reproducible quickstart, model-free portfolio evaluation, private Vercel deployment, and protected hosted-smoke workflows with supporting documentation and CI coverage.

Risk Assessment

✅ Low: The Vercel protection fix is well-bounded, rejects the previously reachable ordinary-redirect false positive, and introduces no substantiated source or intent regressions.

Testing

Prior baseline visual artifacts showed the sign-in, ranked Evidence Desk, Seen state, fallback posture, and exact evidence; this round proved the previous clean-quickstart failure fixed by rebuilding from absent package outputs, reran the focused credential-free checks, exercised live routes and CSV delivery, and cleaned the transient Next.js output, with the credentialed walkthrough correctly left to the captain.

Evidence: Private synthetic sign-in surface (local file: /var/folders/nt/rdk7cjs538l8zphln24q2k900000gn/T/no-mistakes-evidence/01KYRRD7ZDKXJRX44DN3K3ES19/login-rendered.html.png)
Evidence: Ranked Evidence Desk with Seen state and deterministic fallback (local file: /var/folders/nt/rdk7cjs538l8zphln24q2k900000gn/T/no-mistakes-evidence/01KYRRD7ZDKXJRX44DN3K3ES19/evidence-desk-rendered.html.png)
Evidence: Exact evidence disclosure (local file: /var/folders/nt/rdk7cjs538l8zphln24q2k900000gn/T/no-mistakes-evidence/01KYRRD7ZDKXJRX44DN3K3ES19/exact-evidence-rendered.html.png)

Evidence: Anonymous board fails closed after clean install

<!DOCTYPE html><html lang="en"><head><meta charSet="utf-8"/><meta name="viewport" content="width=device-width, initial-scale=1"/><link rel="stylesheet" href="/_next/static/css/app/layout.css?v=1785420511942" data-precedence="next_static/css/app/layout.css"/><link rel="preload" as="script" fetchPriority="low" href="/_next/static/chunks/webpack.js?v=1785420511942"/><script src="/_next/static/chunks/main-app.js?v=1785420511942" async=""></script><script src="/_next/static/chunks/app-pages-internals.js" async=""></script><script src="/_next/static/chunks/app/board/error.js" async=""></script><title>Huddle Evidence Desk</title><meta name="description" content="Synthetic-only deterministic morning triage for guides and coaches"/><script src="/_next/static/chunks/polyfills.js" noModule=""></script></head><body><div hidden=""><!--$--><!--/$--></div><header class="app-header"><a class="app-brand" href="/"><span class="app-logo" aria-hidden="true">H</span>Huddle</a><nav class="app-nav" aria-label="Primary navigation"><a href="/board">Morning board</a><a href="/import">Import</a></nav><p class="app-scope"><strong>Synthetic Grade 4</strong>Private reviewer demo</p></header><!--$?--><template id="B:0"></template><main class="desk-state" aria-busy="true"><p>Checking your guide workspace…</p></main><!--/$--><script>requestAnimationFrame(function(){$RT=performance.now()});</script><script src="/_next/static/chunks/webpack.js?v=1785420511942" id="_R_" async=""></script><div hidden id="S:0"><template id="P:1"></template><!--$--><!--/$--></div><script>(self.__next_f=self.__next_f||[]).push([0])</script><script>self.__next_f.push([1,"5:I[\"(app-pages-browser)/../../node_modules/next/dist/next-devtools/userspace/app/segment-explorer-node.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"SegmentViewNode\"]\n7:\"$Sreact.fragment\"\n1e:I[\"(app-pages-browser)/../../node_modules/next/dist/client/components/layout-router.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"\"]\n20:I[\"(app-pages-browser)/../../node_modules/next/dist/client/components/render-from-template-context.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"\"]\n30:I[\"(app-pages-browser)/./app/board/error.tsx\",[\"app/board/error\",\"static/chunks/app/board/error.js\"],\"default\"]\n3c:I[\"(app-pages-browser)/../../node_modules/next/dist/lib/framework/boundary-components.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"OutletBoundary\"]\n43:I[\"(app-pages-browser)/../../node_modules/next/dist/client/components/metadata/async-metadata.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"AsyncMetadataOutlet\"]\n50:I[\"(app-pages-browser)/../../node_modules/next/dist/lib/framework/boundary-components.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"ViewportBoundary\"]\n56:I[\"(app-pages-browser)/../../node_modules/next/dist/lib/framework/boundary-components.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"MetadataBoundary\"]\n5b:\"$Sreact.suspense\"\n5f:I[\"(app-pages-browser)/../../node_modules/next/dist/client/components/builtin/global-error.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"\"]\n:HL[\"/_next/static/css/app/layout.css?v=1785420511942\",\"style\"]\n:N1785420511979.199\n3:\"$EObject.defineProperty(()=\u003e{ctx.componentMod.preloadStyle(fullHref,ctx.renderOpts.crossOrigin,ctx.nonce)},\\\"name\\\",{value:\\\"\\\"})\"\n2:{\"name\":\"Preloads\",\"key\":null,\"env\":\"Server\",\"stack\":[],\"props\":{\"preloadCallbacks\":[\"$3\"]}}\n4:[]\n6:[]\n8:[[\"Array.map\",\"\",0,0,0,0,false]]\nb:I[\"(app-pages-browser)/../../node_modules/next/dist/client/components/layout-router.js\",[\"app-pages-internals\",\"static/chunks/app-p"])</script><script>self.__next_f.push([1,"ages-internals.js\"],\"\"]\ne:I[\"(app-pages-browser)/../../node_modules/next/dist/client/components/render-from-template-context.js\",[\"app-pages-internals\",\"static/chunks/app-pages-internals.js\"],\"\"]\nf:{}\n10:[[\"Function.all\",\"\",0,0,0,0,true]]\nd:{\"children\":[\"$\",\"$Le\",null,\"$f\",null,\"$10\",1]}\n11:[[\"Function.all\",\"\",0,0,0,0,true]]\nc:{\"parallelRouterKey\":\"children\",\"error\":\"$undefined\",\"errorStyles\":\"$undefined\",\"errorScripts\":\"$undefined\",\"template\":[\"$\",\"$7\",null,\"$d\",null,\"$11\",0],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$Y\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\",\"segmentViewBoundaries\":\"$Y\"}\n12:[[\"Function.all\",\"\",0,0,0,0,true]]\na:{\"name\":\"RootLayout\",\"key\":null,\"env\":\"Server\",\"stack\":[],\"props\":{\"children\":[\"$\",\"$Lb\",null,\"$c\",null,\"$12\",1],\"params\":\"$Y\"}}\n13:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",16,87,15,1,false]]\n14:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",18,94,15,1,false]]\n15:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",20,92,15,1,false]]\n16:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",23,100,15,1,false]]\n17:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",27,108,15,1,false]]\n18:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",43,100,15,1,false]]\n19:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",47,108,15,1,false]]\n1a:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",55,108,15,1,false]]\n1b:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",69,100,15,1,false]]\n1c:[[\"RootLayout\",\"webpack-internal:///(rsc)/./app/layout.tsx\",72,108,15,1,false]]\n1d:[[\"Function.all\",\"\",0,0,0,0,true]]\n1f:[[\"Function.all\",\"\",0,0,0,0,true]]\n21:[]\n23:{\"name\":\"NotFound\",\"key\":null,\"env\":\"Server\",\"stack\":[],\"props\":{}}\n24:{\"name\":\"HTTPAccessErrorFallback\",\"key\":null,\"env\":\"Server\",\"owner\":\"$23\",\"stack\":[],\"props\":{\"status\":404,\"message\":\"This page could not be found.\"}}\n25:[]\n26:[]\n27:[]\n28:[]\n29:[]\n2a:[]\n2b:[]\n2c:[[\"Function.all\",\"\",0,0,0,0,true]]\n2d:[[\"Function.all\",\"\","])</script><script>self.__next_f.push([1,"0,0,0,0,true]]\n2e:[[\"Function.all\",\"\",0,0,0,0,true]]\n2f:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n31:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n32:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n33:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n34:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n35:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n36:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n38:{\"name\":\"BoardPage\",\"key\":null,\"env\":\"Server\",\"stack\":[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]],\"props\":{\"params\":\"$@39\",\"searchParams\":\"$@3a\"}}\n3b:[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]]\n3f:\"$EObject.defineProperty(async function getViewportReady() {\\n        await viewport();\\n        return undefined;\\n    },\\\"name\\\",{value:\\\"getViewportReady\\\"})\"\n3e:{\"name\":\"__next_outlet_boundary__\",\"key\":null,\"env\":\"Server\",\"stack\":[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]],\"props\":{\"ready\":\"$3f\"}}\n41:{\"name\":\"StreamingMetadataOutletImpl\",\"key\":null,\"env\":\"Server\",\"stack\":[[\"Function.all\",\"\",0,0,0,0,true],[\"Function.all\",\"\",0,0,0,0,true]],\"props\":{}}\n42:[]\n45:[[\"Function.all\",\"\",0,0,0,0,true]]\n47:{\"name\":\"LoadingBoard\",\"key\":\"l\",\"env\":\"Server\",\"stack\":[[\"Function.all\",\"\",0,0,0,0,true]],\"props\":{}}\n48:[[\"LoadingBoard\",\"webpack-internal:///(rsc)/./app/board/loading.tsx\",9,87,8,1,false]]\n49:[[\"LoadingBoard\",\"webpack-internal:///(rsc)/./app/board/loading.tsx\",12,94,8,1,false]]\n4a:[]\n4c:{\"name\":\"NonIndex\",\"key\":null,\"env\":\"Server\",\"stack\":[],\"props\":{\"pagePath\":\"/board\",\"statusCode\":200,\"isPossibleServerAction\":false}}\n4e

... [3147 bytes truncated] ...

ndefined\",\"template\":[\"$\",\"$L20\",null,{},null,\"$1f\",1],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":[\"$\",\"$L5\",\"c-not-found\",{\"type\":\"not-found\",\"pagePath\":\"__next_builtin__not-found.js\",\"children\":[\"$22\",[]]},null,\"$21\",0],\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\",\"segmentViewBoundaries\":[[\"$\",\"$L5\",null,{\"type\":\"boundary:not-found\",\"pagePath\":\"__next_builtin__not-found.js@boundary\"},null,\"$2c\",1],\"$undefined\",\"$undefined\",[\"$\",\"$L5\",null,{\"type\":\"boundary:global-error\",\"pagePath\":\"__next_builtin__global-error.js\"},null,\"$2d\",1]]},null,\"$1d\",1]]},\"$a\",\"$14\",1]},\"$a\",\"$13\",1]\n"])</script><script>self.__next_f.push([1,"37:D\"$38\"\n3d:D\"$3e\"\n40:D\"$41\"\n40:[\"$\",\"$L43\",null,{\"promise\":\"$@44\"},\"$41\",\"$42\",1]\n46:D\"$47\"\n46:[\"$\",\"main\",\"l\",{\"className\":\"desk-state\",\"aria-busy\":\"true\",\"children\":[\"$\",\"p\",null,{\"children\":\"Checking your guide workspace…\"},\"$47\",\"$49\",1]},\"$47\",\"$48\",1]\n4b:D\"$4c\"\n4b:null\n4d:D\"$4e\"\n51:D\"$52\"\n4d:[[\"$\",\"$L50\",null,{\"children\":\"$L51\"},\"$4e\",\"$4f\",1],null]\n53:D\"$54\"\n57:D\"$58\"\n5c:D\"$5d\"\n57:[\"$\",\"div\",null,{\"hidden\":true,\"children\":[\"$\",\"$5b\",null,{\"fallback\":null,\"children\":\"$L5c\"},\"$58\",\"$5a\",1]},\"$58\",\"$59\",1]\n53:[\"$\",\"$L56\",null,{\"children\":\"$57\"},\"$54\",\"$55\",1]\n5e:[]\n"])</script><script>self.__next_f.push([1,"0:{\"P\":\"$1\",\"b\":\"development\",\"p\":\"\",\"c\":[\"\",\"board\"],\"i\":false,\"f\":[[[\"\",{\"children\":[\"board\",{\"children\":[\"__PAGE__\",{}]}]},\"$undefined\",\"$undefined\",true],[\"\",[\"$\",\"$L5\",\"layout\",{\"type\":\"layout\",\"pagePath\":\"layout.tsx\",\"children\":[\"$\",\"$7\",\"c\",{\"children\":[[[\"$\",\"link\",\"0\",{\"rel\":\"stylesheet\",\"href\":\"/_next/static/css/app/layout.css?v=1785420511942\",\"precedence\":\"next_static/css/app/layout.css\",\"crossOrigin\":\"$undefined\",\"nonce\":\"$undefined\"},null,\"$8\",0]],\"$9\"]},null,\"$6\",1]},null,\"$4\",0],{\"children\":[\"board\",[\"$\",\"$7\",\"c\",{\"children\":[null,[\"$\",\"$L1e\",null,{\"parallelRouterKey\":\"children\",\"error\":\"$30\",\"errorStyles\":[\"$\",\"$L5\",null,{\"type\":\"error\",\"pagePath\":\"board/error.tsx\",\"children\":[]},null,\"$31\",0],\"errorScripts\":[],\"template\":[\"$\",\"$L20\",null,{},null,\"$32\",1],\"templateStyles\":\"$undefined\",\"templateScripts\":\"$undefined\",\"notFound\":\"$undefined\",\"forbidden\":\"$undefined\",\"unauthorized\":\"$undefined\",\"segmentViewBoundaries\":[\"$undefined\",[\"$\",\"$L5\",null,{\"type\":\"boundary:loading\",\"pagePath\":\"board/loading.tsx@boundary\"},null,\"$33\",1],[\"$\",\"$L5\",null,{\"type\":\"boundary:error\",\"pagePath\":\"board/error.tsx@boundary\"},null,\"$34\",1],\"$undefined\"]},null,\"$2f\",1]]},null,\"$2e\",0],{\"children\":[\"__PAGE__\",[\"$\",\"$7\",\"c\",{\"children\":[[\"$\",\"$L5\",\"c-page\",{\"type\":\"page\",\"pagePath\":\"board/page.tsx\",\"children\":\"$L37\"},null,\"$36\",1],null,[\"$\",\"$L3c\",null,{\"children\":[\"$L3d\",\"$40\"]},null,\"$3b\",1]]},null,\"$35\",0],{},null,false]},[[\"$\",\"$L5\",\"c-loading\",{\"type\":\"loading\",\"pagePath\":\"board/loading.tsx\",\"children\":\"$46\"},null,\"$45\",0],[],[]],false]},null,false],[\"$\",\"$7\",\"h\",{\"children\":[\"$4b\",\"$4d\",\"$53\"]},null,\"$4a\",0],false]],\"m\":\"$W5e\",\"G\":[\"$5f\",[\"$\",\"$L5\",\"ge-svn\",{\"type\":\"global-error\",\"pagePath\":\"__next_builtin__global-error.js\",\"children\":[]},null,\"$60\",0]],\"s\":false,\"S\":false}\n"])</script><script>self.__next_f.push([1,"51:[[\"$\",\"meta\",\"0\",{\"charSet\":\"utf-8\"},\"$3e\",\"$61\",0],[\"$\",\"meta\",\"1\",{\"name\":\"viewport\",\"content\":\"width=device-width, initial-scale=1\"},\"$3e\",\"$62\",0]]\n3d:null\n44:{\"metadata\":[[\"$\",\"title\",\"0\",{\"children\":\"Huddle Evidence Desk\"},\"$41\",\"$63\",0],[\"$\",\"meta\",\"1\",{\"name\":\"description\",\"content\":\"Synthetic-only deterministic morning triage for guides and coaches\"},\"$41\",\"$64\",0]],\"error\":null,\"digest\":\"$undefined\"}\n5c:\"$44:metadata\"\n"])</script><script>self.__next_f.push([1,"66:[]\n65:J{\"name\":\"\",\"start\":-35.20820800000001,\"end\":52.41291700000147,\"env\":\"Server\",\"stack\":\"$66\",\"value\":\"$@67\"}\n68:[[\"BoardPage\",\"webpack-internal:///(rsc)/./app/board/page.tsx\",27,19,26,1,false]]\n67:\"$undefined\"\n6a:\"$EObject.defineProperty(async function authorizeVisibleOpenAction(input) {\\n    const evidenceReader = (0,_lib_evidence_desk_operations__WEBPACK_IMPORTED_MODULE_3__.evidenceReaderForRequest)();\\n    if (!evidenceReader) return {\\n        kind: 'not-found'\\n    };\\n    return (0,_lib_visible_open_action_handler__WEBPACK_IMPORTED_MODULE_4__.runAuthorizeVisibleOpen)({\\n        resolveAccess: _lib_guide_access__WEBPACK_IMPORTED_MODULE_2__.resolveGuideAccess,\\n        evidenceReader\\n    }, input);\\n},\\\"name\\\",{value:\\\"authorizeVisibleOpenAction\\\"})\"\n6b:\"$EObject.defineProperty(async function acknowledgeVisibleOpenAction(input) {\\n    const evidenceReader = (0,_lib_evidence_desk_operations__WEBPACK_IMPORTED_MODULE_3__.evidenceReaderForRequest)();\\n    if (!evidenceReader) return {\\n        kind: 'not-found'\\n    };\\n    return (0,_lib_visible_open_action_handler__WEBPACK_IMPORTED_MODULE_4__.runAcknowledgeVisibleOpen)({\\n        resolveAccess: _lib_guide_access__WEBPACK_IMPORTED_MODULE_2__.resolveGuideAccess,\\n        evidenceReader\\n    }, input);\\n},\\\"name\\\",{value:\\\"acknowledgeVisibleOpenAction\\\"})\"\n69:{\"name\":\"EvidenceDesk\",\"key\":null,\"env\":\"Server\",\"owner\":\"$38\",\"stack\":[[\"BoardPage\",\"webpack-internal:///(rsc)/./app/board/page.tsx\",38,87,26,1,false]],\"props\":{\"state\":{\"kind\":\"denied\"},\"authorizationAction\":\"$6a\",\"action\":\"$6b\"}}\n6c:[[\"EvidenceDesk\",\"webpack-internal:///(rsc)/./app/board/evidence-desk.tsx\",1496,116,1481,1,false]]\n6d:[[\"EvidenceDesk\",\"webpack-internal:///(rsc)/./app/board/evidence-desk.tsx\",1499,88,1481,1,false]]\n6e:[[\"EvidenceDesk\",\"webpack-internal:///(rsc)/./app/board/evidence-desk.tsx\",1506,88,1481,1,false]]\n6f:[[\"EvidenceDesk\",\"webpack-internal:///(rsc)/./app/board/evidence-desk.tsx\",1513,88,1481,1,false]]\n37:D{\"awaited\":\"$65\",\"env\":\"Server\",\"owner\":\"$38\",\"stack\":\"$68\"}\n37:D\"$"])</script><script>self.__next_f.push([1,"69\"\n37:[\"$\",\"main\",null,{\"className\":\"desk-state\",\"children\":[[\"$\",\"h1\",null,{\"children\":\"Guide workspace unavailable\"},\"$69\",\"$6d\",1],[\"$\",\"p\",null,{\"children\":\"Sign in with the private synthetic guide account to continue.\"},\"$69\",\"$6e\",1],[\"$\",\"a\",null,{\"className\":\"button\",\"href\":\"/login\",\"children\":\"Sign in\"},\"$69\",\"$6f\",1]]},\"$69\",\"$6c\",1]\n"])</script><div hidden id="S:1"><main class="desk-state"><h1>Guide workspace unavailable</h1><p>Sign in with the private synthetic guide account to continue.</p><a class="button" href="/login">Sign in</a></main></div><script>$RS=function(a,b){a=document.getElementById(a);b=document.getElementById(b);for(a.parentNode.removeChild(a);a.firstChild;)b.parentNode.insertBefore(a.firstChild,b);b.parentNode.removeChild(b)};$RS("S:1","P:1")</script><script>$RB=[];$RV=function(a){$RT=performance.now();for(var b=0;b<a.length;b+=2){var c=a[b],e=a[b+1];null!==e.parentNode&&e.parentNode.removeChild(e);var f=c.parentNode;if(f){var g=c.previousSibling,h=0;do{if(c&&8===c.nodeType){var d=c.data;if("/$"===d||"/&"===d)if(0===h)break;else h--;else"$"!==d&&"$?"!==d&&"$~"!==d&&"$!"!==d&&"&"!==d||h++}d=c.nextSibling;f.removeChild(c);c=d}while(c);for(;e.firstChild;)f.insertBefore(e.firstChild,c);g.data="$";g._reactRetry&&requestAnimationFrame(g._reactRetry)}}a.length=0};
$RC=function(a,b){if(b=document.getElementById(b))(a=document.getElementById(a))?(a.previousSibling.data="$~",$RB.push(a,b),2===$RB.length&&("number"!==typeof $RT?requestAnimationFrame($RV.bind(null,$RB)):(a=performance.now(),setTimeout($RV.bind(null,$RB),2300>a&&2E3<a?2300-a:$RT+300-a)))):b.parentNode.removeChild(b)};$RC("B:0","S:0")</script></body></html>

Evidence: Live health and policy response

{"ok":true,"service":"huddle","dataPolicy":"synthetic-only","decisionSupport":"deterministic","accuracyClaim":"none"}

{"ok":true,"service":"huddle","dataPolicy":"synthetic-only","decisionSupport":"deterministic","accuracyClaim":"none"}

Evidence: Zero-model deterministic portfolio report

{
  "schemaVersion": "portfolio-eval-report-v1",
  "passed": true,
  "corpusFingerprint": "edbbe35d9dccd9d2c46c1181bc8f7b3284af8b03871067a6cab95bb7d3303f45",
  "corpusEntries": 8,
  "causeCoverage": [
    "guessing",
    "prerequisite_gap",
    "grinding",
    "hint_farming",
    "no_read_retry",
    "decay",
    "disengagement",
    "fine"
  ],
  "modelCalls": 0,
  "deterministicFallbackByteStable": true,
  "groundingInjectionHardFailures": {
    "unknownCatalogIdRejected": 8,
    "unauthorizedSlotRejected": 8
  },
  "accuracyPosture": "No diagnosis-accuracy claim; this gate covers fallback and grounding only."
}

Evidence: Clean installation recreating all workspace outputs


> huddle@0.1.0 postinstall
> npm run build:packages


> huddle@0.1.0 build:packages
> tsc -b packages/core packages/ingest packages/application packages/db packages/signal-engine packages/narrator packages/simulator packages/eval


added 222 packages, and audited 232 packages in 5s

56 packages are looking for funding
  run `npm fund` for details

10 vulnerabilities (3 moderate, 6 high, 1 critical)

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

- Outcome: 🔧 2 issues found → auto-fixed ✅ across 2 runs (24m32s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

🔧 **Review** - 5 issues found → auto-fixed (3) ✅

🚨 apps/web/app/board/evidence-desk.tsx:414 - The required report progression is reversed: the report header omits the dominant cause, while exact attempts render before prerequisite/conflict details inside the shared EvidenceDetails component. This contradicts the required preservation of dominant/additional evidence and the Evidence Desk contract’s cause → comparison/prerequisite/conflict → exact-record order. Surface the cause in the report header and restore that ordering for dominant and additional findings.
🚨 apps/web/app/board/evidence-desk.tsx:442 - The visible trust label says only “Deterministic fallback”; the required degraded status and reason are hidden under collapsed Technical provenance. This also contradicts the README walkthrough’s promised “Deterministic fallback · degraded” state. Confirm whether hiding the reason was intentional, or surface it without expansion.
⚠️ .github/workflows/ci.yml:45 - CI uploads artifacts/portfolio-eval-report.json, but verify:quickstart writes the report to /tmp/huddle-portfolio-eval-report.json. The upload therefore retains no report and only warns. Align the paths and set if-no-files-found: error.
⚠️ apps/web/app/board/evidence/[entry_id]/page.tsx:11 - The legacy page still imports a low-level DB helper directly, contradicting FR-058’s requirement that pages use the application interfaces rather than repositories. Route this lookup through an application-owned boundary or explicitly retire the legacy route.
🚨 README.md:111 - The required “reproducible ... deploy” and “private Vercel” packaging is incomplete: no deployment command is documented, and Deployment Protection is described as optional (“when ... enabled”). Require and document the private deployment/protection workflow and reviewer access, or explicitly approve Supabase-auth-only containment.

🔧 Fix: Restore report trust and private deployment guarantees
2 errors still open:

🚨 apps/web/app/board/evidence-desk.tsx:414 - The required evidence progression remains incomplete: prerequisite and conflict facts are inside the collapsed “Show exact contributing evidence” disclosure and a second collapsed “Rule and quality details” disclosure. Opening the exact-evidence section therefore exposes attempts while these level-2 facts remain hidden, contrary to the required comparison/prerequisite/conflict → exact-record sequence. Move a compact prerequisite/conflict presentation before the exact-record disclosure.
🚨 scripts/smoke-hosted.ts:22 - The change claims to guarantee “private Vercel plus Supabase reviewer packaging,” but the hosted smoke still makes VERCEL_PROTECTION_BYPASS optional and only checks bypassed application responses. A public deployment can therefore pass and print success. For hosted URLs, require the bypass and first verify that an unbypassed request is stopped by Deployment Protection before running application checks with the bypass.

🔧 Fix: Expose evidence context and enforce hosted protection
1 error still open:

🚨 scripts/smoke-hosted.ts:36 - The required “private Vercel plus Supabase reviewer packaging” invariant remains bypassable: the changed hunk accepts any 3xx response with a Location header as Deployment Protection. A public alias that redirects to its canonical deployment passes this probe, after which the application checks follow that ordinary redirect and can report success. Validate a Vercel-authentication-specific challenge marker and cover an ordinary public redirect in the smoke test. See Vercel Deployment Protection.

🔧 Fix: Require Vercel-specific authentication challenge
✅ Re-checked - no issues remain.

🔧 **Test** - 2 issues found → auto-fixed ✅

🚨 README.md:53 - The documented clean quickstart is not reproducible immediately after npm ci. npm run dev returns HTTP 500 for /board because @huddle/db/scoped.js points to an absent generated dist file; npm run eval:portfolio likewise cannot resolve @huddle/narrator/dist/src/catalog.js. Building the relevant workspaces first unblocks both, but README does not document this prerequisite and the root commands do not ensure it.
⚠️ The authenticated upload → validate/commit → refresh → evidence reveal → persisted Seen journey could not be executed end-to-end because this worktree has no .env, Supabase reviewer credentials, or database connection. Reviewer-visible component renders and focused boundary tests cover these surfaces, but they do not replace a credentialed walkthrough. Decide whether to supply a reviewer environment for automated evidence or retain this as the captain-owned final walkthrough.
Inspected a61db956f7df275dff7b5dc1727a575c8bed8b3a..0c5ead7241d642f878d9ac07d9869c52ba1d936f, the implementation plan, constitution, README, and golden-path scripts/tests.
npm exec vitest run packages/ingest/test/portfolio-csv.test.ts packages/eval/test/portfolio-gate.test.ts apps/web/test/demo-config.test.ts apps/web/test/import-actions-fail-closed.test.ts apps/web/test/quick-demo-access.test.ts apps/web/test/evidence-desk-rendering.test.ts apps/web/test/evidence-desk-state.test.ts apps/web/test/acknowledgment-tokens.test.ts apps/web/test/report-reveal-server-action.test.ts apps/web/test/health-route.test.ts scripts/smoke-hosted.test.ts packages/db/test/evidence-persistence.test.ts packages/db/test/evidence-acknowledgment-migration.test.ts (initially exposed missing workspace outputs; completed assertions passed).
npm run build -w @huddle/narrator followed by npm exec vitest run apps/web/test/quick-demo-access.test.ts to repair and verify test setup.
env -u ANTHROPIC_API_KEY npm run eval:portfolio -- --out /var/folders/nt/rdk7cjs538l8zphln24q2k900000gn/T/no-mistakes-evidence/01KYRRD7ZDKXJRX44DN3K3ES19/portfolio-eval-report.json (initial clean-output attempt failed; retry after workspace generation passed).
npm run db:migrate -- --help, npm run demo:seed -- --help, npm run demo:reset -- --help, and npm run smoke:hosted -- --help.
Started the real Next.js app and ran npm run smoke:hosted -- --base-url http://127.0.0.1:3107 from a clean generated-output state; /board failed with HTTP 500 due unresolved @huddle/db/scoped.js.
npm run build -w @huddle/db, restarted Next.js, then reran npm run smoke:hosted -- --base-url http://127.0.0.1:3107; health, login, fixed CSV, and anonymous fail-closed board behavior passed.
Fetched /health and verified anonymous /board rendered Guide workspace unavailable without synthetic roster names.
Rendered and visually inspected the live /login response plus actual EvidenceDesk, ReportHeading, NarrationTrust, and EvidenceRecordDisclosure components with synthetic fixtures.
Removed generated .next and workspace dist directories; final git status --short was clean.

🔧 Fix: Build workspace outputs during dependency installation
✅ Re-checked - no issues remain.

Removed the eight ignored packages/*/dist directories, ran npm ci, and verified all eight workspace outputs were recreated, including packages/db/dist/src/scoped.js and packages/narrator/dist/src/catalog.js.
Ran env -u ANTHROPIC_API_KEY npm run eval:portfolio -- --out …/portfolio-eval-after-clean-install.json.
Ran env -u ANTHROPIC_API_KEY npm run verify:quickstart, covering determinism, strict portfolio CSV, demo configuration, Evidence Desk rendering, health policy, reveal action, and hosted-protection behavior.
Started the real application with npm run dev after the clean install and requested /login, /board, /import, /health, and /synthetic-huddle-sample.csv.
Verified /login rendered, anonymous /board and /import showed the private-guide denial state, /health declared synthetic-only/deterministic/no-accuracy-claim policy, and the fixed CSV contained 53 lines.
Inspected the retained reviewer-visible sign-in, ranked Evidence Desk, Seen acknowledgment, deterministic fallback, and exact-evidence screenshots.
The initial evaluator attempt set ANTHROPIC_API_KEY to an empty string and was rejected by configuration validation; retrying with the variable genuinely unset matched the documented workflow and passed.

✅ **Document** - passed

✅ No issues found.

🔧 **Lint** - 1 issue found → auto-fixed ✅

🚨 scripts/smoke-hosted.test.ts:75 - npm run typecheck fails because protectedDeployment(): HostedSmokeFetch erases Vitest mock metadata, leaving fetcher.mock untyped at lines 75 and 78. The mechanical fix requires changing a test, which this phase forbids.

🔧 Fix: Preserve Vitest mock typing
✅ Re-checked - no issues remain.

✅ **Push** - passed

✅ No issues found.

…antees

…ction

…tion

alexdancer added 13 commits July 29, 2026 21:57

feat: package focused Huddle portfolio demo

bc366a2

fix: verify hosted database TLS

7087feb

fix: smoke protected hosted demo

171a263

fix: keep reveal dependencies out of Flight payload

3c51b98

feat: simplify teacher demo experience

56e590e

test: align hosted smoke with guide sign-in

e7c5946

test: preserve TLS in credentialed database checks

1d3a018

no-mistakes(review): Restore report trust and private deployment guar…

eef67ea

…antees

no-mistakes(review): Expose evidence context and enforce hosted prote…

6427224

…ction

no-mistakes(review): Require Vercel-specific authentication challenge

0c5ead7

no-mistakes(test): Build workspace outputs during dependency installa…

ae24285

…tion

no-mistakes(document): Refresh demo documentation and schema pointers

3f8cff1

no-mistakes(lint): Preserve Vitest mock typing

d40fff5

alexdancer merged commit 00d6d6f into main Jul 30, 2026
1 check passed

Navigation Menu

feat: package focused private Huddle portfolio demo - #7

feat: package focused private Huddle portfolio demo#7
alexdancer merged 13 commits into
mainfrom
fm/huddle-quick-demo-integration-package-a1

alexdancer commented Jul 30, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

alexdancer commented Jul 30, 2026

Intent

What Changed

Risk Assessment

Testing

Pipeline

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant