How Wendmark is built

Five documents, each covering one area, in the order they make sense to read. They explain why the code looks the way it does — the constraints that shaped it and the attempts that failed — which is the part source code cannot tell you on its own.

1. The shape of the portal — layers, the ctx object, permissions, and two conventions that explain a lot of the code
2. Auth — first-run setup, passwords, JWT sessions and how revocation works without a session table
3. Apps — public keys, the origin allowlist, the install ping
4. Author mode — pairing, why window messaging failed, and why there are two snippet bundles
5. Flows — the shared schema, the zod problem, saving and listing

The trust model across all of them is in docs/security.md.

The rules these follow — guide never act, the dependency table, the snippet’s constraints — are in CLAUDE.md. Decisions with alternatives weighed are in docs/decisions.