From 69affcb27ef90766f74e12458c3e4e834118ff88 Mon Sep 17 00:00:00 2001 From: Alex Jenkinson Date: Wed, 8 Jul 2026 23:15:43 +0100 Subject: [PATCH] =?UTF-8?q?chore(journal):=20catch=20up=2029=20Jun?= =?UTF-8?q?=E2=80=931=20Jul=202026=20ADS=20entries=20+=20Pairflix=20Phase?= =?UTF-8?q?=20F?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Website journal was stuck at 23 Jun; internal changelog current through 1 Jul for ADS and 2 Jun for Pairflix Phase F. Adds: - 1 Jul: session token hardening, API contract corrections (939 tests), frontend cold-start reliability fix - 30 Jun: rescue events feature, live analytics, profile-save fix, password-reset token hardening - 29 Jun: saved reports end-to-end (run/schedule/share), adoption-policy save fix, application identity lock - 2 Jun: Pairflix pick lifecycle tracking + provider launch buttons Also updates the ADS venture-page snapshot (date heading Jul 2026, ships the three new features into the Shipped list). --- journal/index.html | 40 +++++++++++++++++++++++++++-- ventures/adopt-dont-shop/index.html | 12 ++++----- 2 files changed, 44 insertions(+), 8 deletions(-) diff --git a/journal/index.html b/journal/index.html index 2a4ad4a..627413e 100644 --- a/journal/index.html +++ b/journal/index.html @@ -37,7 +37,7 @@
The journal -

What's shipping across the studio, in the open.

+

What’s shipping across the studio, in the open.

Dated entries from the live ventures, newest first. Each entry links to the venture brief for the full current snapshot — roadmap, stack and stage.

@@ -49,6 +49,33 @@

Studio log.

+
+
+ AdoptDontShop + 1 Jul 2026 +
+

Security: session tokens hardened; API contract corrections; cold-start reliability.

+

Refresh tokens are now stored as one-way hashes — a database exposure can no longer be used to hijack an active session. A schema correction resolves issues where some list and delete endpoints were mis-handling requests; all 939 API gateway tests now pass. The adopter portal, rescue dashboard and admin panel no longer show errors for ~40 seconds after a cold boot while the gateway warms up.

+
+ +
+
+ AdoptDontShop + 30 Jun 2026 +
+

Rescue events; live analytics; profile saves fixed; password-reset tokens hardened.

+

Rescues can now create and publish events — adoption days, fundraisers, volunteer days and community meetups — with attendee registration, check-in and live capacity analytics. The rescue dashboard analytics page now shows real-time figures for adoption trends, application status, pet performance and top breeds; mock data placeholders have been removed. Profile changes on rescue dashboards now save correctly after a routing mismatch introduced during the gateway migration. Password-reset and email-verification links are now backed by SHA-256 hashes, closing a window where a database snapshot could have produced valid account-takeover links.

+
+ +
+
+ AdoptDontShop + 29 Jun 2026 +
+

Saved reports: run, schedule and share; adoption policy saves; application identity locked.

+

Rescue analytics reports can now be run to produce live figures, previewed, scheduled for recurring delivery, and shared with team members — delivering the saved-reports feature end-to-end. Changes to a rescue’s adoption policy on the Settings page now save correctly after previously returning an error. Adoption applications now derive the applicant’s identity from the authenticated session only, closing a gap where a crafted request could have submitted an application as a different user.

+
+
AdoptDontShop @@ -157,6 +184,15 @@

Microservices migration complete. Security hardening pass done.

All ten domain services now run as independent containers — the legacy monolith is deleted. Separately: all high-severity findings from an automated static-analysis security audit have been resolved, and the API documentation page is now gated behind admin credentials. The platform is closer to closed beta readiness.

+
+
+ Pairflix + 2 Jun 2026 +
+

Tonight’s pick tracks what you chose; provider badges are now launch buttons.

+

Every recommendation now records its outcome — accepted, swapped or dismissed — and per-household 30-day stats surface first-pick acceptance rate alongside per-provider click counts. The platform badges in the Tonight Picker are now deep-link buttons that open Netflix, Prime, Disney+ and friends directly in a new tab.

+
+
AdoptDontShop @@ -251,4 +287,4 @@

Workflow-breaking only

- + \ No newline at end of file diff --git a/ventures/adopt-dont-shop/index.html b/ventures/adopt-dont-shop/index.html index c166414..7f6de29 100644 --- a/ventures/adopt-dont-shop/index.html +++ b/ventures/adopt-dont-shop/index.html @@ -157,7 +157,7 @@

Modern UX, adoption-only, multi-rescue in one app.

Go-to-market

Cluster, then influence, then national.

-

Two-sided marketplaces don't survive a national cold start. We onboard density first.

+

Two-sided marketplaces don’t survive a national cold start. We onboard density first.

@@ -177,14 +177,14 @@

Phase 3 · National

- Where we are · June 2026 + Where we are · July 2026

Alpha build is feature-complete. Compliance is the gate.

The core adoption flow ships end-to-end in the alpha. The path to closed beta now runs through legal foundation, the data protection package and platform hardening — not more product code.

Shipped in the alpha

-

Auth, rescue verification, pet listings with staff permissions, adopter browse/filter/like flow, rescue search & discovery, real-time chat with unread counts and full-text search, email and in-app notifications with per-account channel preferences, admin broadcasts, document and image upload with signed delivery, automated content moderation, matching recommendations, saved analytics reports, a CMS for rescue-owned content pages, field-level role permissions, two-factor authentication (TOTP), per-user pet favourites, rescue custom application questions, staff invitation accept, GDPR right-to-erasure, personalised pet recommendations (Top Picks), autosaving application drafts, and account sanction notices. Microservices migration complete — all ten domain services (auth, pets, rescue, applications, notifications, chat, moderation, matching, audit, storage) run as independent gRPC containers behind the API gateway and the legacy monolith is deleted, with Redis-backed rate limiting, per-service circuit breakers, OpenTelemetry distributed tracing, Sigstore container signing, and full Docker dev + prod environments. Security hardening pass done: signed inter-service identity tokens, a full audit trail with payload redaction, an auditable deploy safety gate, interactive OpenAPI docs gated behind admin auth, all high-severity static-analysis findings resolved, and CI gating every merge on service tests and E2E.

+

Auth, rescue verification, pet listings with staff permissions, adopter browse/filter/like flow, rescue search & discovery, real-time chat with unread counts and full-text search, email and in-app notifications with per-account channel preferences, admin broadcasts, document and image upload with signed delivery, automated content moderation, matching recommendations, saved analytics reports (run to produce live figures, schedule for recurring delivery, and share with team members), a CMS for rescue-owned content pages, field-level role permissions, two-factor authentication (TOTP), per-user pet favourites, rescue custom application questions, staff invitation accept, GDPR right-to-erasure, personalised pet recommendations (Top Picks), autosaving application drafts, account sanction notices, rescue events (adoption days, fundraisers, volunteer days and community meetups with attendee registration, check-in and live capacity analytics), and live rescue dashboard analytics (real-time adoption trends, application status, pet performance and breed breakdowns). Microservices migration complete — all ten domain services (auth, pets, rescue, applications, notifications, chat, moderation, matching, audit, storage) run as independent gRPC containers behind the API gateway and the legacy monolith is deleted, with Redis-backed rate limiting, per-service circuit breakers, OpenTelemetry distributed tracing, Sigstore container signing, and full Docker dev + prod environments. Security hardening pass done: signed inter-service identity tokens, a full audit trail with payload redaction, an auditable deploy safety gate, interactive OpenAPI docs gated behind admin auth, all high-severity static-analysis findings resolved, and CI gating every merge on service tests and E2E.

Three frontends, one platform

@@ -278,14 +278,14 @@

Reduced euthanasia rates

“Adopt first” before “buy”

-

The cultural shift we're after — making adoption the default expectation, not the more difficult option.

+

The cultural shift we’re after — making adoption the default expectation, not the more difficult option.

-
“The path to adoption should be simpler than the path to a breeder. Today it's the opposite.”
+
“The path to adoption should be simpler than the path to a breeder. Today it’s the opposite.”
@@ -310,4 +310,4 @@

“Adopt first” before “buy”

- + \ No newline at end of file