Scry

Scry helps its owner memorize externally authored knowledge. Home leads to native review or the supplied NATO starter; Library is secondary. External agents supply content, while Scry grades answers and schedules recall. Native content generation is retired. Existing exact-text and concept-notebook material, interrupted practice and history remain preserved. SPEC records the owner's 2026-10-27 direction and remaining acceptance work.

The application in this checkout is a ground-up Rust + Cloudflare Workers rewrite, authorized on October 7, 2026. A plain WASM Worker validates private Access ingress and forwards to one SQLite-backed Durable Object. Rust owns learning, immutable history, native grading, and recovery; server-rendered HTML, self-hosted fonts, and a small vanilla controller deliver the notebook. There is no Container or frontend framework in the replacement architecture.

Source changes alone do not establish production serving state. Consult the runbook's dated serving observation. The operational runbook alone owns activation, origins, recovery, and retirement evidence. The old Go source is retained exactly in Git at c6ba395; historical Rust/Postgres/Worker stores and backups remain separate recovery material. This rewrite does not import, reactivate, rename, or erase those stores.

For the current origin and remaining proof, read the runbook's dated promotion observation and the current deployment procedure.

Product intent · Stories and specification · Design · Features · Verification · Current production operations

Start or resume work

Read SPEC, especially its latest scope amendment and the relevant stories, before scoping work. GLOSSARY owns the words. VISION explains intent; USER_STORIES is only a compatibility index. Technical decisions live in ADRs. Use the current operator request as authority; preserve overlapping work and inspect git status --short --branch and git rev-parse HEAD in the selected checkout. GitHub issues own work state: initiative #273 tracks its child issues. Legacy MIS, Linear, Powder and Glass identities are provenance. Link accepted scope, exact source, tests, and remaining evidence from the session/PR.

DESIGN governs visual decisions; SPEC alone governs behavior. Do not synchronize requirements into work instructions or feature maps.

Develop

Use the pinned Rust 1.98.1 toolchain and wasm32-unknown-unknown target, worker-build 0.8.7, Node 22.22.0, Bun, and lockfile-pinned dev dependencies.

rustup target add wasm32-unknown-unknown
cargo install worker-build --version 0.8.7 --locked
npm ci --ignore-scripts --no-audit --no-fund
cargo test --locked
bun run dev

bun run dev / bun run rust-dev run scripts/rust-dev, which builds WASM and launches real local workerd with fresh run-owned SQLite and R2 state. Its private temporary configuration and env -i keep inherited operator/model/deployment capabilities out. It listens only on loopback; set SCRY_DEV_PORT to an unused unprivileged port if necessary. It never loads repository .env or .dev.vars files. The printed directory owns that run's state; stop the process before removing only that directory.

The empty notebook offers an explicitly authored demo only in isolated development. The demo uses no provider and is never advertised in production. New native content-generation requests are refused before creating work, even when provider bindings exist. Local fixture mechanics do not prove live model usefulness, private HTTPS, remote R2 recovery, or phone acceptance.

.dev.vars.example documents synthetic local values only. Production secrets belong in Worker bindings: OWNER_SUBJECT, INTERNAL_KEY, OPENROUTER_API_KEY, JEV_API_KEY, and independently scoped OPERATOR_KEY / RESTORE_TOKEN where required. Public configuration includes the canonical origin, exact Access issuer/audience, singleton namespace, and explicit model choices. Never put secrets in source, flags, logs, screenshots, or artifacts.

Check and build

cargo test --locked
cargo clippy --all-targets -- -D warnings
cargo check --locked --target wasm32-unknown-unknown
worker-build --release --locked
bun run ci

The native suite covers application transitions, generation/critic policy, immutable content, response replay, recovery archives, web secrecy, and pure learning. The scheduler port compares 260 full-state trajectories against the exact pinned Go FSRS adapter. That is scheduler compatibility evidence, not proof of model calibration or learning efficacy.

bun run ci / bun run ci:local use the source-snapshot gate in scripts/scry-ci. Release evidence must bind committed source, the exact WASM Worker assets exercised, lockfiles, and smoke results. Use --require-committed when producing release artifacts; worktree-labeled output is development evidence. Never rebuild between proof and activation. Retained retired operational recovery tools remain available in Git history, not in the deployment path.

Browser QA runs from a shell first: verify-scry's Playwright helpers and the qa/walk story walks, which also produce release receipts. The T3 collaborative preview is an alternative. Exercise real pointer and keyboard events, held results, no-JavaScript forms, both color schemes, narrow screens, offline drafts, access loss, and identical-operation reconciliation. Read Scry QA before verification. Unrun cases remain UNVERIFIED; old Go/Worker receipts do not transfer to this rewrite.

The replacement's operator procedure documents isolated restore and separately authorized future-work resumption. Use the runbook to select compatible recovery procedures; source endpoints alone do not establish deployed recovery support.

Durable boundaries

ADR 004 owns architecture and module boundaries. SPEC owns learning, privacy, spend and recovery policies; this entrypoint is not another copy.

Deployment

The deployment procedure is source PR → passing CI → merge → one master build/test → direct Wrangler deployment → code readback. The same tested Worker bytes are deployed to the existing Cloudflare target. No generated release PR, custom recovery drill, approval window or cleanup lock is a deployment prerequisite. Stored content and authentication are preserved.

CHANGELOG, GitHub Releases and ADR 007 retain release history. /changelog and health identity headers identify a serving build; neither a tag nor a source merge proves deployment or authenticated learner acceptance.

Changed private-data, credential, spend or irreversible-action scope still requires its own authorization. The runbook's dated serving observation owns production serving state. The retained Container hosting notes describe the retired Go configuration.