Wobblepot
AI-powered weekly meal planning for families. Wobblepot builds a household's week of meals around what the family likes and what is already in the pantry, then turns the plan into a shopping list with nutrition you can actually read. It is live at wobblepot.com.
This is the production codebase, published for transparency and as a working example of an agent-driven engineering process. It is not an open-source project: all rights reserved, and pull requests are not accepted. Reading and learning from it are welcome; questions can go to [email protected].
The product brand is Wobblepot. Honkadori OÜ is the legal entity behind it, and "Honkadori" appears only in legal text and internal identifiers such as the package name, the Linear workspace, and vendor accounts.
What is worth looking at
Most of this repository is an ordinary Next.js application. The parts that are less ordinary:
Agent-driven development
Nearly every change here was planned, implemented, reviewed, and merged by Claude Code working from Linear issues, with a human deciding what to build and reviewing what shipped.
CLAUDE.md is the operating manual the agent reads every session: coding patterns, the definition of done, and rules learned from things that went wrong. Each rule carries its reason; the incident behind it, by issue number, is in docs/AGENT_HISTORY.md..claude/skills/ holds the sixteen project skills that make up the workflow: next-issue → plan-issue → implement-issue → branch-review → commit --pr → triage-pr-comments → merge. auto-implement runs the whole cycle unattended for one issue.scripts/orchestrator.sh polls Linear for ready issues and spawns one worker per issue, each in its own git worktree with its own Neon database branch. docs/PARALLEL_WORKFLOW.md explains the model; scripts/worktree-claude.sh is the wt entry point.scripts/pr-review.sh posts a Claude review on every pull request opened through the workflow. The same skills then triage the comments and address the ones that matter, and the merge skill runs the review first if a PR was opened by hand, so nothing merges unreviewed.
Quality gates
- Storybook with an accessibility gate. Over eighty colocated story files run through axe in CI, and modal stories carry play functions that assert focus trapping, Escape handling, and tab order. Browse the published build at kaupok.github.io/wobblepot, rebuilt from
main whenever a merge touches the stories or their inputs. See .storybook/README.md.
- Tests at three levels. Around two hundred colocated Vitest files, plus Playwright specs in two tiers: the core suite on every push, and a staging smoke run that gates promotion to production. See
tests/e2e/README.md.
- Environment drift audit. A blocking CI step diffs the Vercel environment against the variables the code actually reads, so dead or missing configuration fails the build. See
scripts/env-audit.ts.
- Pre-commit checks. Type-check, ESLint, and Prettier run on staged files through Husky and lint-staged.
Privacy and compliance
Built to run in the EU under GDPR from the first user, with the paperwork in the repository rather than in a drawer.
docs/RUNBOOKS/: breach notification, data subject request intake, account deletion, database recovery, Neon branch cleanup, post-launch translation maintenance, and the public status page.- Grace-window account deletion with a scheduled purge, and a data-export endpoint for portability.
compliance/: the subprocessor register and vendor data-processing agreements. Executed contracts that carry signatory details stay out of the tree.- Cookie consent that gates analytics, and a public subprocessor page inside the app.
Localization
Estonian is the first non-English locale. docs/LOCALIZATION.md describes a three-tier model: AI-generated content gets prompt work and voice judgment, domain content gets translation with native review, and UI chrome gets externalized and translated in volume. The interesting decision is treating the AI's voice as the highest-leverage surface, because most of what a family reads over time is generated, not seeded.
Feature flags and security headers
- PostHog-backed kill-switches that fail open, so an outage of the flag service never takes the product down. See
docs/FEATURE_FLAGS.md.
- A Content Security Policy with per-request nonces and
strict-dynamic, plus HSTS, Referrer-Policy, and Permissions-Policy. See docs/SECURITY.md.
Stack
| Layer | Choice |
|---|
| Framework | Next.js 16, React 19, TypeScript 5.9 |
| UI | Tailwind CSS 4, shadcn/ui, Storybook 10 |
| Data | PostgreSQL on Neon, Prisma 7 |
| Client state | TanStack Query 5 |
| Auth | Better Auth, email and password |
| AI | Anthropic Claude through the Vercel AI SDK |
| Localization | next-intl |
| Analytics and flags | PostHog, EU region |
| Email | Resend |
| Rate limiting | Upstash Redis |
| Hosting | Vercel |
| Tests | Vitest, Playwright, Storybook with axe |
Running it locally
You can, but this is a production application with real vendor dependencies rather than a demo. A full local run needs a PostgreSQL database, an Anthropic API key, and, for the features that use them, Resend and Upstash accounts. src/lib/env.ts is the authoritative list of every variable and which ones are optional; docs/ENVIRONMENT_SETUP.md covers the vendor setup behind them.
These instructions are provided for transparency and evaluation of the published source; running the software is not licensed beyond what LICENSE states.
pnpm install
cp .env.example .env # at minimum: DATABASE_URL, DATABASE_URL_UNPOOLED, BETTER_AUTH_SECRET, ANTHROPIC_API_KEY
pnpm db:push # Prisma CLI commands read DATABASE_URL_UNPOOLED; the app reads DATABASE_URL
pnpm db:seed
pnpm dev # http://localhost:3000
Useful commands once it runs:
pnpm lint && pnpm type-check && pnpm test # the pre-commit bar
pnpm test:e2e:local # Playwright on a throwaway Neon branch (needs NEON_API_KEY)
pnpm storybook # component workbench on port 6006
pnpm test-storybook:ci # every story through axe, once
pnpm db:studio # Prisma Studio
Documentation
Security
If you find a vulnerability, email [email protected] rather than opening a public issue. Privacy questions go to [email protected].
License
All rights reserved. The source is published so the product and the process behind it can be inspected, not so it can be reused. See LICENSE. Third-party components committed to this repository keep their own licences, listed in THIRD-PARTY-NOTICES.md.
