CELESTUAL

A double blind, mutual reveal product. Live at https://celestual.us.

You place a ping on somebody's Instagram handle. They are never told. If and only if they independently place one on you, you both find out at the same moment. If it is never mutual, nothing is revealed to anybody, and because the server stores who you entered only as a salted one way hash, nothing ever can be.

---

The two surfaces

The wall, at /. The front door is the wall for everybody: short anonymous letters, each addressed to one Instagram handle or to a first name. The list of names is public, and since 26 September so is every letter on it, whole, to anybody, as many as they care to read (migration 0066). It used to be the first eight letters and then a proof. Now nothing is withheld: a reader who is not signed in is nudged, a small note under the card from the eighth letter this browser opens and again every twelve after that, which they can put away and which never stands in front of a word.

Anybody can write, to an @ or to a name, and what they write is read before it goes up: a pass goes up, a doubt waits for a person at the desk, a refusal never goes up. A writer who has proved a berkeley.edu address can post as a Berkeley student instead, and that letter goes up at once, is read where it stands, and carries the Berkeley mark: the network's name, CAL, the aerial lit in gold and a star, in the status row of its screen, the way an old phone named its carrier. Either way, what comes down is a letter with a consequence in it, never a tone (supabase/functions/celestual-wall-moderate). The @ is never printed on a letter or its picture: a letter to a handle says dear and the writer's greeting, or the first name the resolver has for the handle, or dear you, and the handle stays the key it is filed and found under.

Every letter's thread of replies (migration 0068) is a sheet raised from the foot of the glass by its right soft key, a speech bubble and its count drawn as the heart beside it is (sharing is the first row of the options), with the letter's phone rising and stepping back to stand whole over it, as a reel stands over its comments; in a wide room the letter slides aside and the replies stand beside it as a panel. When the person the letter is to has answered, an envelope stands by the letter's aerial. The sheet is the wall's unlit panel, lit only where the letter's own light falls on it: anonymous to everybody reading, each writer a small creature in chalk with one old word for a name (kairos, aporia), written from a proved school address or by the person the letter is to, whose replies carry a badge lit in the letter's colour, and read before they go up (supabase/functions/celestual-wall-reply). A heart on a letter, and a like on a reply, is anybody's. The field of names can be looked at four ways, all, newest, most liked and Berkeley, from a key at the end of its search (migration 0067).

Signing in is any of the four proofs of a person the product takes: a verified Instagram handle, a Google account, an address a link was mailed to (migration 0065: the product's own link, since the code Supabase mailed could never be typed back), or a campus address. Any of them is what reporting a letter asks for; a private note, and the email that says a letter was written to you, ask for the Instagram one, because both are about the @. Reading never asks.

The wall at Berkeley. It used to be a second wall, at /berkeley, reached by scanning a code off a flyer, where writing needed a berkeley.edu address. Since 25 September it is one wall (docs/ONE-WALL.md): /berkeley and /beta redirect to /, and a letter's campus is the school it carries, not the wall it is on.

Main, at /ping. The product the wall hands off into: place a ping, hold two at a time, sixty days each, and a reveal that happens to both people or to neither.

They are one session. Any proof, on any surface, signs you in to all of them.

---

Where things are

app/                the SPA. Vite + React, no router library
  src/main.jsx      the fork. Which surface owns this address, decided before
                    anything mounts, so a route is never rendered twice
  src/cards.js      the five printed cards, and where each one lands. Read by
                    the fork above, and by the desk
  src/main/         Main. hero (at /ping), place, sky, reveal, optout, copy,
                    signin
  src/wall/         the wall, drawn for two walls (campus.js): the one at /
                    and the one at /berkeley. ten screens, its own art and
                    its own store
  src/signature/    where the two signature surfaces were approved. static
  src/admin/        the desk at /admin
  src/api/          every call to Supabase, one module per concern
  public/           the legal pages, the faces, the mark, the share card

supabase/
  migrations/       0001 to 0073, in order. 0029 onward is the rebuild; 0038 is
                    the audit; 0057 is the wall at the root and the login;
                    0058 gives every letter a colour of the screens; 0063 is
                    the one wall; 0065 is the login by our own mailed link,
                    and the @ that comes back with the person; 0066 opens
                    every letter and lets anybody write to an @; 0067 sorts
                    the wall; 0068 is the replies, and the heart open to
                    anybody; 0069 is the weekly reveal, private notes that
                    run to Saturday at 9pm Pacific and pairs sealed until
                    then; 0070 makes the link enough, with no number, by
                    signing in only the browser that opens it; 0071 is
                    pings by the week, one free ping for every reveal and
                    more bought at $2.99 each, ten a reveal at most; 0072
                    keeps a mutual on both lists as it was told, so a person
                    can write to the same somebody again or take a mutual off
                    their own list, and the other is told nothing; 0073 keeps
                    the line across a private note's top and its battery,
                    which its writer sets on its screen
  functions/        the edge functions. celestual-resolve, -admin,
                    -wall-moderate, -wall-reply, -edu-verify, -ig-webhook,
                    -manychat, -mutual-dm, -notify, -remind, -stripe,
                    -stripe-webhook

design/             the design system. DESIGN.md is the source of truth
scripts/            the tooling: migrations, screenshots, the mark, the voice
docs/               the rebuild's own record, and the runbooks

Anything referenced by string is live even when it looks dead: route names, Supabase RPC names, edge function names and storage bucket names do not appear in an import graph.

---

Running it

npm install
npm run dev            the app on :5173
npm run build          the production build
npm run lint           eslint over app/
npm run lint:voice     the copy tripwire (design/VOICE.md section 6)

app/.env.example documents every environment variable. Nothing needs a backend to boot: with no Supabase configured the app runs on local fallbacks.

The tooling

scripts/verify-migrations.sh --test    apply every migration to a bare
                                       PostgreSQL, then run scripts/sql/test-*
node scripts/preview.mjs               screenshot every route, with fixtures
node scripts/mail-preview.mjs          screenshot every email template
node scripts/perf-letter.mjs           the letter's frames, measured: open, swipe,
                                       keys, a name, close, and the replies
                                       raised and laid down by the grip, on a
                                       phone at 4x cpu (PERF_MODE=phone|desk)
node scripts/check-stories.mjs         the stories on the glass, checked on
                                       every frame: the two come on together,
                                       and a note never touches either of them
node scripts/shots.mjs /terms          screenshot one address or one file
node scripts/export-mark.mjs           the logo, out of the code that draws it
node scripts/export-liquid.mjs         the liquid metal mask, from the same geometry
node scripts/export-og.mjs             the share card and the Instagram post and
                                       story, photographed off the real screen
node scripts/export-mail.mjs           the mails' screens (GIFs), keys and lockup,
                                       the same way; both need npm --prefix app install

---

The rebuild

The product was rebuilt in eight phases against docs/rebuild-spec.md, which is the source of truth for it. docs/plan.md records what each phase actually did and what it found, docs/launchsteps.md is everything that has to happen outside the repo, and docs/open-questions.md and docs/deletions.md carry the decisions and the deletions.

Most of the schema is live. The database carries every migration through 0045, and 0047; 0038 and 0046 are not recorded as applied, and docs/launchsteps.md says what that means and in what order to apply what is left.

---

The documents

docs/rebuild-spec.md	The rebuild: the phases, the visual bar, the definition of done
docs/plan.md	What each phase did, and the nine things the audit found
docs/launchsteps.md	Everything to do outside the repo, in order
docs/deletions.md	Every file and database object proposed for deletion, and why
docs/open-questions.md	Every decision the spec did not answer, and how it was answered
design/DESIGN.md	The design system. Anything visual references this
design/VOICE.md	The copy rules, and what the voice lint enforces
design/components.html	The system rendered: every component, colour, type size and state
docs/SECURITY.md	The privacy model: hashed targets, the slot rule, the purge, the opt out
docs/HANDLE-RESOLVER.md	The resolver: Apify, the permanent cache, the three caps, the stored face

---

The addresses

/	the wall for everybody, and its sheets under it: /letter/<id>, /find, /write, /gate, /report/<id>, /remove/<handle>, /join
/ping	Main. The hero, the ping's own front door
/place, /place/<handle>, /@handle	placing one
/sky	what you have out
/reveal/<handle>	a mutual, opened
/berkeley, /beta	the wall's printed addresses. They were the wall at Berkeley, with its own sheets under it; since 25 September they redirect to /, keeping what follows them (/berkeley/letter/<id> is /letter/<id>, docs/ONE-WALL.md)
/verify#t=	the link every mail that proves an address carries: a login, a school address or an alert address. It confirms at once for the browser that opened it, with nothing typed, and signs in the browser that asked only when that is the same one; opened elsewhere, it carries the waiting letter there, to post with one key (migration 0070)
/c/<code>	what the five printed cards carry in their QR. Logs the scan, then hands the visitor to wherever that card is pointed
/optout	take a handle off, permanently, proved with one DM, no account
/signin	the link a mail sends somebody to
/copy	the code off a mail, on the clipboard. Nothing sends anybody here any more: the code is copied out of the mail itself, and the page is kept for the mails already in inboxes
/admin	the desk. Password checked server side. #reports, #cards, #people=@handle and the other section names in the fragment open a screen directly
/signature, /signature/reveal	where the two signature surfaces were approved
/terms, /privacy, /data-deletion	static, served by a rewrite

Anything else draws a not found, in the current design.