Beotimok: An Overnight Autonomous MVP Build — From a One-Page Spec to a Working App

What

Beotimok — a keepsake box that holds, privately like a pendant, the things that catch you the moment you're falling apart (the voice, photos, and words of someone you love; writing you cherish). You can add things yourself, or someone you love can add a few words via a link, without signing up. (The product name is a working title, undecided.)

The input is a single work.md (the spec). The output is a full-stack PWA that runs locally right away with npm run dev.

Build order (work.md §22)

1. Data model + backend skeleton (auth / contribution intake / storage)
2. Contribution link screen (the heart) + owner direct add
3. Box view + the surfacing moment (the emotional experience of opening the pendant)
4. PWA installability (Manifest + a hand-written Service Worker) + iOS instructions
5. Web Push (VAPID) + node-cron scheduler
6. Hide/delete, notification settings, safety (professional help) links
7. Validation metrics

Core principle: run immediately with 0 external accounts

Following the "don't stop at external keys" directive in work.md §22, everything that needs a key (social login, DB, storage, VAPID) is placed behind an interface as a local default/mock, and recorded in a "real setup needed later" list (PROGRESS.md).

• DB → embedded PostgreSQL (PGlite), .data/pglite
• Auth → session-cookie dev login (production: Better Auth + Kakao/Apple)
• Storage → local files + auth-gated route (production: R2/S3 + signed URLs)
• Push → VAPID keys auto-generated (web-push.generateVAPIDKeys()), .data/secrets.json
• Icons → generated with a pure Node PNG encoder, no external tool (scripts/gen-icons.mjs)

Validation (no calling it 'done' without running it, §22)

Spun up an actual dev server and checked end-to-end:

• Owner direct add (text/photo) + public contribution (text) → shown mixed in the box with an origin label
• Media access control: with cookie 200, without 401
• Idempotent resubmit → duplicate
• 30 concurrent writes fine, 0 DB conflicts
• Production build 21/21 routes clean compile
• Confirmed Tailwind v4 custom tokens (warm pendant palette) CSS generated correctly

Result (the first commits)

• 7b19c3d Initial commit (spec only)
• e050e41 foundation + backend skeleton (PGlite, auth, storage, APIs)
• e1a924e full UI — owner/contribution flow, surfacing moment, PWA
• f2c40f2 docs — PROGRESS.md (morning handoff) + README

Human vs AI

Direction, spec (the whole work.md), product judgment (adding video, Kakao integration, the trust-design direction), real-device testing, and key issuance were the human. Implementation, architecture decisions, debugging, and validation were this session. These logs are the record for the human to understand and own that implementation — for details on the related decisions, see the stack-decisions, pglite-embedded-db, adversarial-security-review, trust-by-feeling, kakao-oauth-debug, and video-fourth-type entries.