Built a complete personal wellness tracking platform — architecture plan, four-phase implementation, security audit, Docker deployment on Titan, and live user testing — in a single session. The personal instance is branded "GoldengloomHQ" and runs encrypted on the LAN.
The Architecture Review
Before writing a line of code, four specialist agents reviewed the plan in parallel: code-reviewer assessed ecosystem consistency and schema design, security-engineer audited all 16 security requirements for a health data application, a DBA review evaluated SQLite vs PostgreSQL and rejected the EAV pattern in favor of dedicated tables per category, and jefe-pm assessed priority fit and scope risk. All four signed off with minor notes. Key decisions: SQLCipher mandatory encryption, dedicated tables (not EAV), Titan/Docker deployment, JefeGit-only repo (no GitHub for health data), and basic auth from Phase 1.
Four Phases, One Session
Phase 1 delivered the FastAPI backend with SQLCipher-encrypted SQLite, bcrypt auth with hashed session tokens, CRUD for eight wellness categories (sleep, exercise, diet, water, mood, hygiene, digestive, gardening), and a React 19 frontend with the GoldengloomHQ dark theme. Phase 2 added natural language parsing — a rule-based regex engine handles ~80% of inputs ("drank 3 glasses of water, pooped twice"), with local Ollama (qwen3:8b) as fallback for complex text. Phase 3 brought analytics: streak computation via gaps-and-islands SQL, time-series trend aggregation, Pearson correlation across categories, Chart.js visualizations, and a mood quick-logger. Phase 4 completed multi-user access grants, data export/import, a JefeHQ summary widget, and inline entry editing with daily aggregates.
Security Model
This tracks bowel movements, mood, anxiety, and diet for two people — the security bar is higher than a TODO app. SQLCipher encrypts the database at rest, session tokens are SHA-256 hashed before storage, all health data is excluded from logs, the NL parser runs on local Ollama only (no LAN transit of health text), access grants enforce owner-only creation with immediate revocation, and the UFW firewall restricts access to the home subnet. A new standing rule was established: security-engineer recommendations are authoritative by default and require explicit override.
The Smoke Test Gauntlet
Deploying a full-stack app to Docker on a remote server surfaced the expected integration bugs. The CLI crashed on startup (Typer passes OptionInfo objects, not None, for unspecified options). Static assets were stale in Docker's build cache. The access grants endpoint returned a flat array but the frontend expected an object with granted_by_me and granted_to_me keys, crashing React's component tree. SPA client-side routes returned 404 because the catch-all static mount intercepted them. The range parameter went as "7d" but the backend wanted an integer. Each fix was a reminder that end-to-end verification before "try it now" is not optional.
What Shipped
| Metric | Value |
|---|---|
| Total lines | ~17,000 |
| Commits | 9 (JefeLife) + 1 (JefeHQ) |
| Backend modules | 14 Python files |
| Frontend components | 30+ React/TypeScript files |
| Tracking categories | 8 (sleep, exercise, diet, water, mood, hygiene, digestive, gardening) |
| NL parser patterns | Water, exercise, hygiene, bowel, gardening, sleep, mood + Ollama fallback |
| Schema version | 2 (added bowel count field via migration) |
| New agent created | dba-engineer (available next session) |
What's Next
- Category-level access grants (share exercise data but keep mood private)
- Automated testing pipeline for the Docker build
- Create Kerikah's user account and test multi-user flows
- More NL parser patterns based on real usage
- Phase 5 (product fork) remains gated behind JefeWorks revenue