The factory stopped and I locked the API down

Context

The factory stopped this afternoon at its third tick: the agent it spawned had an expired login. One task off the board all day. The rest of the day went into the backend, which was still open to anyone who knew the URL.

What I did

• Made every API endpoint require a signed-in caller unless it says otherwise.
• Added a rate limit bounding how often one caller may reach the backend.
• Moved the optimistic lock into EF and the updated_at stamp into one place.
• Sorted the persistence layer by area instead of by kind of file.
• Gave time_categories and push_subscriptions a layer above their repository, habits their read path, and mapped ritual_standard_checkins as habit_checkins, pointing at nothing yet.
• Added two board states: Declined for cancelled work, Waiting for what needs a decision from me.
• Refactored the design folder by knowledge ownership and distilled STYLE.md.
• Made the constitution load from CLAUDE.md instead of each agent fetching it.
• Documented the backend’s database. Gave the caller rules an owner in the architecture set.
• Made the console render the agent event stream, through the renderer the transcript already uses.
• Filed twelve tasks for tomorrow: a layer above the repository for every table without one.

What the factory did

• One task off the board: ui, patterns and templates merged into one component layer split by composition depth. It is the task the daemon was holding when it stopped.

Notes

• Nothing announced the stop. agent-failed is the only stop path that sends no message. The task to fix that has been in Ready since 8 August.
• It would not have reached me anyway. The Discord bot has not run since 26 August, so today’s 88 alerts sit unread in the outbox.
• Every tick logged 29 warnings: branch cleanup cannot remove two worktrees holding uncommitted work for over 300 hours.