Wobblepot

AI-powered weekly meal planning for families. Wobblepot builds a household's week of meals around what the family likes and what is already in the pantry, then turns the plan into a shopping list with nutrition you can actually read. It is live at wobblepot.com.

This is the production codebase, published for transparency and as a working example of an agent-driven engineering process. It is not an open-source project: all rights reserved, and pull requests are not accepted. Reading and learning from it are welcome; questions can go to [email protected].

The product brand is Wobblepot. Honkadori OÜ is the legal entity behind it, and "Honkadori" appears only in legal text and internal identifiers such as the package name, the Linear workspace, and vendor accounts.

What is worth looking at

Most of this repository is an ordinary Next.js application. The parts that are less ordinary:

Agent-driven development

Nearly every change here was planned, implemented, reviewed, and merged by Claude Code working from Linear issues, with a human deciding what to build and reviewing what shipped.

• CLAUDE.md is the operating manual the agent reads every session: coding patterns, the definition of done, and rules learned from things that went wrong. Each rule carries its reason; the incident behind it, by issue number, is in docs/AGENT_HISTORY.md.
• .claude/skills/ holds the sixteen project skills that make up the workflow: next-issue → plan-issue → implement-issue → branch-review → commit --pr → triage-pr-comments → merge. auto-implement runs the whole cycle unattended for one issue.
• scripts/orchestrator.sh polls Linear for ready issues and spawns one worker per issue, each in its own git worktree with its own Neon database branch. docs/PARALLEL_WORKFLOW.md explains the model; scripts/worktree-claude.sh is the wt entry point.
• scripts/pr-review.sh posts a Claude review on every pull request opened through the workflow. The same skills then triage the comments and address the ones that matter, and the merge skill runs the review first if a PR was opened by hand, so nothing merges unreviewed.

Quality gates

• Storybook with an accessibility gate. Over eighty colocated story files run through axe in CI, and modal stories carry play functions that assert focus trapping, Escape handling, and tab order. Browse the published build at kaupok.github.io/wobblepot, rebuilt from main whenever a merge touches the stories or their inputs. See .storybook/README.md.
• Tests at three levels. Around two hundred colocated Vitest files, plus Playwright specs in two tiers: the core suite on every push, and a staging smoke run that gates promotion to production. See tests/e2e/README.md.
• Environment drift audit. A blocking CI step diffs the Vercel environment against the variables the code actually reads, so dead or missing configuration fails the build. See scripts/env-audit.ts.
• Pre-commit checks. Type-check, ESLint, and Prettier run on staged files through Husky and lint-staged.

Privacy and compliance

Built to run in the EU under GDPR from the first user, with the paperwork in the repository rather than in a drawer.

• docs/RUNBOOKS/: breach notification, data subject request intake, account deletion, database recovery, Neon branch cleanup, post-launch translation maintenance, and the public status page.
• Grace-window account deletion with a scheduled purge, and a data-export endpoint for portability.
• compliance/: the subprocessor register and vendor data-processing agreements. Executed contracts that carry signatory details stay out of the tree.
• Cookie consent that gates analytics, and a public subprocessor page inside the app.

Localization

Estonian is the first non-English locale. docs/LOCALIZATION.md describes a three-tier model: AI-generated content gets prompt work and voice judgment, domain content gets translation with native review, and UI chrome gets externalized and translated in volume. The interesting decision is treating the AI's voice as the highest-leverage surface, because most of what a family reads over time is generated, not seeded.

Feature flags and security headers

• PostHog-backed kill-switches that fail open, so an outage of the flag service never takes the product down. See docs/FEATURE_FLAGS.md.
• A Content Security Policy with per-request nonces and strict-dynamic, plus HSTS, Referrer-Policy, and Permissions-Policy. See docs/SECURITY.md.

Stack

Layer	Choice
Framework	Next.js 16, React 19, TypeScript 5.9
UI	Tailwind CSS 4, shadcn/ui, Storybook 10
Data	PostgreSQL on Neon, Prisma 7
Client state	TanStack Query 5
Auth	Better Auth, email and password
AI	Anthropic Claude through the Vercel AI SDK
Localization	next-intl
Analytics and flags	PostHog, EU region
Email	Resend
Rate limiting	Upstash Redis
Hosting	Vercel
Tests	Vitest, Playwright, Storybook with axe

Running it locally

You can, but this is a production application with real vendor dependencies rather than a demo. A full local run needs a PostgreSQL database, an Anthropic API key, and, for the features that use them, Resend and Upstash accounts. src/lib/env.ts is the authoritative list of every variable and which ones are optional; docs/ENVIRONMENT_SETUP.md covers the vendor setup behind them.

These instructions are provided for transparency and evaluation of the published source; running the software is not licensed beyond what LICENSE states.

pnpm install
cp .env.example .env    # at minimum: DATABASE_URL, DATABASE_URL_UNPOOLED, BETTER_AUTH_SECRET, ANTHROPIC_API_KEY
pnpm db:push            # Prisma CLI commands read DATABASE_URL_UNPOOLED; the app reads DATABASE_URL
pnpm db:seed
pnpm dev                # http://localhost:3000

Useful commands once it runs:

pnpm lint && pnpm type-check && pnpm test   # the pre-commit bar
pnpm test:e2e:local                         # Playwright on a throwaway Neon branch (needs NEON_API_KEY)
pnpm storybook                              # component workbench on port 6006
pnpm test-storybook:ci                      # every story through axe, once
pnpm db:studio                              # Prisma Studio

Documentation

Document	Contents
CLAUDE.md	Coding guidelines and the agent's operating rules
docs/PROJECT_SPEC.md	Product vision, decisions, domain logic
docs/PARALLEL_WORKFLOW.md	Parallel Claude Code with git worktrees and the orchestrator
docs/GIT_WORKFLOW.md	Branching, commits, PRs, recovery
docs/DEPLOYMENT.md	Staging and production deployment
docs/TESTING.md	Unit, database, route and E2E tests
docs/ENVIRONMENT_SETUP.md	Environment variables
docs/EMAIL_SETUP.md	Transactional email and deliverability
docs/FEATURE_FLAGS.md	Feature flags, kill-switches, fail-open semantics
docs/LOCALIZATION.md	Localization philosophy and the three-tier model
docs/SECURITY.md

Security

If you find a vulnerability, email [email protected] rather than opening a public issue. Privacy questions go to [email protected].

License

All rights reserved. The source is published so the product and the process behind it can be inspected, not so it can be reused. See LICENSE. Third-party components committed to this repository keep their own licences, listed in THIRD-PARTY-NOTICES.md.