Tenancy
The second gym is a row, not a branch. That only stays true if it was true on day one.
- Scoped at the schemaBy construction
A gym's records carry the organization they belong to. Reads are scoped by that organization, and a guard in the database client flags reads that forget. The shared library — exercises, equipment and the base taxonomy — is the deliberate exception, shared by construction and explicitly so.
- Configuration, not forksOne codebase
Branding, timezone, the booking horizon and the late-cancel window are organization settings. No gym gets its own build, so no gym gets left behind on one.
- Support without standing accessLeast privilege
Helping a gym with a problem doesn't require a permanent account inside it. Support access is read-only, has to be granted, cannot be invited through any customer-facing screen, and expires on its own rather than waiting to be revoked.
Health data
Injuries, medications and physio findings are the reason the programming works. They are also the reason the system can't be casual about storage.
- Encrypted at restAES-256-GCM
Medical fields — considerations, medications, injury notes, assessment narratives — are encrypted in the database, not merely behind a login. That text survives a database dump as ciphertext; the key lives elsewhere.
- Every endpoint leaves a traceAudited
Every API endpoint that touches health data declares it, and the declaration is what writes the audit row — so the record of who looked at what is a property of the route, not a thing somebody remembered to add. If that row cannot be written, the read does not succeed.
- One boundary, every roleRole-gated
Admin, coach, physio, athlete, front desk — and the read-only support role above. Injuries, assessments and the medical fields on a profile are admitted to admin, coach and physio; a front-desk account takes a payment and books a session without them.
The generator
The same input produces the same program. That is a design decision with consequences all the way down, and it is the one most often mistaken for a limitation.
- No model in the pathNo inference cost
Generation is a pipeline of filters, scores and ordering rules — not a prompt. Nothing drifts between runs, nothing has to be explained away afterwards, and programming a thousand athletes costs what programming one costs, a thousand times over, which is nearly nothing.
- Every point is trackedExplainable
Every scored exercise carries the breakdown that selected it, and a mandatory one says it was mandatory. “Why this one” is answered with the arithmetic, which is what makes a coach's override a decision rather than a fight with a black box.
- Tuning is dataConfig-driven
Weights, limits and thresholds live in configuration. Changing how the system thinks does not mean changing what it is.
Discipline
Everything above is a claim, and claims rot quietly. Each is held by tests whose job is to fail when it stops being true: tenant scoping (the guard is wired and its escape hatch bounded), the audit trail on health data (every endpoint that reads an encrypted model carries the flag), the role boundaries (every route's role list is inventoried, and the support role cannot write), and the generator's determinism (the same input selects the same program, run twice). They are required to merge, and production is built only from what merged.
