Wobblepot

AI-powered weekly meal planning for families. Wobblepot builds a household's week of meals around what the family likes and what is already in the pantry, then turns the plan into a shopping list with nutrition you can actually read. It is live at wobblepot.com.

This is the production codebase, published for transparency and as a working example of an agent-driven engineering process. It is not an open-source project: all rights reserved, and pull requests are not accepted. Reading and learning from it are welcome; questions can go to [email protected].

The product brand is Wobblepot. Honkadori OÜ is the legal entity behind it, and "Honkadori" appears only in legal text and internal identifiers such as the package name, the Linear workspace, and vendor accounts.

What is worth looking at

Most of this repository is an ordinary Next.js application. The parts that are less ordinary:

Agent-driven development

Nearly every change here was planned, implemented, reviewed, and merged by Claude Code working from Linear issues, with a human deciding what to build and reviewing what shipped.

• CLAUDE.md is the operating manual the agent reads every session: coding patterns, the definition of done, and rules learned from things that went wrong. Each rule carries its reason; the incident behind it, by issue number, is in docs/AGENT_HISTORY.md.
• .claude/skills/ holds the sixteen project skills that make up the workflow: next-issue → plan-issue → implement-issue → branch-review → commit --pr → triage-pr-comments → merge. auto-implement runs the whole cycle unattended for one issue.
• scripts/orchestrator.sh polls Linear for ready issues and spawns one worker per issue, each in its own git worktree with its own Neon database branch. docs/PARALLEL_WORKFLOW.md explains the model; scripts/worktree-claude.sh is the wt entry point.
• scripts/pr-review.sh posts a Claude review on every pull request opened through the workflow. The same skills then triage the comments and address the ones that matter, and the merge skill runs the review first if a PR was opened by hand, so nothing merges unreviewed.

Quality gates

• Storybook with an accessibility gate. Over eighty colocated story files run through axe in CI, and modal stories carry play functions that assert focus trapping, Escape handling, and tab order. Browse the published build at kaupok.github.io/wobblepot, rebuilt from main whenever a merge touches the stories or their inputs. See .storybook/README.md.
• Tests at three levels. Around two hundred colocated Vitest files, plus Playwright specs in two tiers: the core suite on every push, and a staging smoke run that gates promotion to production. See tests/e2e/README.md.
• Environment drift audit. A blocking CI step diffs the Vercel environment against the variables the code actually reads, so dead or missing configuration fails the build. See scripts/env-audit.ts.
• Pre-commit checks. Type-check, ESLint, and Prettier run on staged files through Husky and lint-staged.

Privacy and compliance

Built to run in the EU under GDPR from the first user, with the paperwork in the repository rather than in a drawer.

• docs/RUNBOOKS/: breach notification, data subject request intake, account deletion, database recovery, Neon branch cleanup, post-launch translation maintenance, and the public status page.
• Grace-window account deletion with a scheduled purge, and a data-export endpoint for portability.
• compliance/: the subprocessor register and vendor data-processing agreements. Executed contracts that carry signatory details stay out of the tree.
• Cookie consent that gates analytics, and a public subprocessor page inside the app.

Localization

Estonian is the first non-English locale. docs/LOCALIZATION.md describes a three-tier model: AI-generated content gets prompt work and voice judgment, domain content gets translation with native review, and UI chrome gets externalized and translated in volume. The interesting decision is treating the AI's voice as the highest-leverage surface, because most of what a family reads over time is generated, not seeded.

Feature flags and security headers

• PostHog-backed kill-switches that fail open, so an outage of the flag service never takes the product down. See docs/FEATURE_FLAGS.md.
• A Content Security Policy with per-request nonces and strict-dynamic, plus HSTS, Referrer-Policy, and Permissions-Policy. See docs/SECURITY.md.

Stack

Layer	Choice
Framework	Next.js 16, React 19, TypeScript 5.9
UI	Tailwind CSS 4, shadcn/ui, Storybook 10
Data	PostgreSQL on Neon, Prisma 7
Client state	TanStack Query 5
Auth	Better Auth, email and password
AI	Anthropic Claude through the Vercel AI SDK
Localization	next-intl
Analytics and flags	PostHog, EU region
Email	Resend
Rate limiting	Upstash Redis
Hosting	Vercel
Tests	Vitest, Playwright, Storybook with axe

This is the beginning of the README. Read the rest at the original. Read the full README ↗