Work log: Authexis — February 27, 2026

What shipped today

Apple app: all v1-apple issues ground in two rounds

The remaining six v1-apple issues were ground in two parallel rounds of three agents each. Round 1 tackled the share sheet extension (GH-454), home screen widgets (GH-483), and notification center (GH-606). Round 2 handled content creation from URL (GH-607), content review workflow (GH-608), and idea promotion (GH-609). All six PRs (#678–#683) merged to main with one notable pbxproj merge conflict between the share extension and widgets targets, resolved by keeping both sides. The v1-apple milestone is now complete.

API key auth fixed for v2 API

The v2 API’s requireAuth() was JWT-only, blocking the paulos CLI from calling endpoints. Initially attempted an env-var approach (wrong), then discovered the existing api_keys table with SHA-256 hashed keys already used by v1 routes. Rewrote authenticateWithApiKey() to do a proper database lookup, supporting both X-API-Key header and Bearer ax_k_... token formats. This unblocked the CLI for pushing ideas and content to Authexis via API.

Ideas experience polished end to end

Four issues shipped in rapid succession around the ideas workflow: dismiss action with telemetry signal (GH-684), hiding dismissed ideas by default with a toggle (same PR), API-created ideas defaulting to strength 10 (GH-687), and inline editing for title and summary (GH-685) with a smart read-only guard when content already exists. Also fixed a longstanding bug where callAction() was swallowing Next.js redirect() errors — the promote-to-content flow was silently failing because the redirect throw got caught as an error. The fix uses isRedirectError() to detect and re-throw.

Content list cleanup

Applied the same dismissed-by-default pattern to the content list (GH-686) — rejected content is now hidden with a toggle to view it.

Prompt audit decomposed

GH-581 (prompt coverage audit) had an extremely detailed existing spec but was too large for a single grind. Decomposed into four child issues: Tier 2 prompts for essay/article (GH-690), format instruction branching (GH-691), generic fallback improvement (GH-692), and a stage-level prompt dead code investigation (GH-693). Three are grindable, one is investigation-only.

Completed

• GH-454 — Apple share sheet extension
• GH-483 — Apple widgets (review count + briefing)
• GH-581 — Audit content type prompt coverage (decomposed → GH-690, 691, 692, 693)
• GH-606 — In-app notification center
• GH-607 — Content creation from URL
• GH-608 — Content review and approval workflow
• GH-609 — Idea promotion to content
• GH-684 — Dismiss action for ideas
• GH-685 — Inline editing for idea title and summary
• GH-686 — Hide rejected content by default
• GH-687 — API-created ideas default to strength 10
• GH-689 — Allow adding sources to ideas (already implemented, closed)

Carry-over

• Grind queue (4 issues): GH-688 (ideas list filtering tabs), GH-690 (essay/article prompts), GH-691 (format instruction branching), GH-692 (generic fallback prompt). All ready-for-grind.
• Investigation: GH-693 — stage-level prompt dead code audit. Not grindable, needs manual trace through engine code.
• DB migration for dismissed status: Migration file exists at supabase/migrations/20260227000001_add_dismissed_idea_status.sql but was applied manually via SQL editor (supabase db push has sync issues with the migration table). Need to mark it as applied or fix migration tracking.

Risks

• Supabase migration tracking is broken. supabase db push tries to replay all migrations from scratch because the migration table is out of sync with the migration files. Migrations are being applied manually via the SQL editor. This will eventually cause problems.
• AUTHEXIS_API_KEY env var on Vercel is orphaned. The API key auth was rewritten to use database lookup, but the old env var is still set on Vercel. Not harmful but should be cleaned up.

Flags and watch-outs

• The callAction redirect fix is a shared utility — any server action using redirect() that was wrapped in callAction was previously broken. The fix covers all of them, but watch for any new server actions that throw other special Next.js errors (like notFound()).
• The ideas status check constraint now allows dismissed but the original migration file still says draft, active, archived. The new migration file adds it correctly but the migration tracking gap means this could confuse future developers.

Next session

1. /grind the queue — 4 issues ready: GH-688 (ideas list tabs), GH-690–692 (prompt improvements). Good batch.
2. Investigate GH-693 — trace stage-level prompt usage in the engine. Quick manual investigation.
3. /prep GH-668 — custom workspace scan intervals. Needs settings schema design.
4. /prep GH-663 — telemetry strategy. Broad design discussion, likely decomposes into multiple issues.
5. Fix Supabase migration tracking — get db push working again so migrations don’t require manual SQL editor runs.