Nothing reaches a real group without Polly reading it first. This is the discipline that makes “safe” mean safe.
Owner MarkRule of the house Draft, never sendMerges to main Mark onlyReference CLAUDE.md is the source of truth
01
How work ships
A deliberately lighter path than the main app — this repo is a proving ground, not production infrastructure. No automated verify script, no bot validator, no deploy step by default. Just clear hand-offs and one person who merges.
Step 1BuildOn its own branch, off the latest main. One chat, one branch.
Step 2 · GateArchitect reviewA second AI session checks the work against CLAUDE.md and the design system — human judgement, applied consistently, not a script.
Step 3Push & verifyLocal HEAD confirmed equal to remote before anything is called “done.”
Step 4 · MarkReview & mergeMark reads the diff himself and merges. No auto-merge exists for this repo.
Step 5Ship — when it's realNo standing deploy target yet. A tool only goes live for Polly once it has somewhere real to run (see Track A, §06).
A second, separate gate sits on top of this. Merging to git and being safe to use near a real Facebook group are different approvals — see §03. Code can be merged and still not be cleared for Polly.
02
The golden rules
Binding on every session. Eight core rules below; eight more (source-of-truth & tooling, the architect gate, and the proving-ground relationship to the main app) live in the fuller sections of CLAUDE.md — this page shows the ones that get broken first.
1
The tool DRAFTS. A human always SENDS.
No posting, no messaging, autonomously — ever. Propose → Polly approves → send. One bad autonomous post can lose a group she spent years earning trust in.
2
The Group Ledger is law
Check a group’s rules and temperature before drafting for it. No adverts, no links, no price-first, no copy-paste across groups, no tagging our own page.
3
Draft in Polly’s voice, or say nothing
Learned from her real, verbatim messages. A roboty reply is the fastest way to get flagged — voice-true is a safety feature, not a nicety.
4
The design system is canonical
Match STURIJ_DESIGN.md; use group_ledger.html as the reference implementation. Tokens only — never invent a different theme.
5
Confidential — nothing leaves the family
Discovery answers, near-misses, lead sources, Polly’s message samples. This data is the moat; protect it like one.
6
Trust code and data, not prose
Verify every claim against the actual files and repo history. A description of the repo can drift from the repo itself — check, don’t assume.
7
Git discipline
One chat = one branch. Never push or merge to main. No force-push or history rewriting. Verify HEAD before claiming “pushed.” One session at a time. No autonomous pushes.
8
Secrets never touch chat or repo
Facebook/Messenger tokens, API keys live only in env/platform config. A secret seen in chat is compromised — revoke it on sight.
03
The architect’s role
Not an automated script — there isn’t one for this repo, and that’s deliberate. A second AI (or Mark) reviews before anything could touch a real group. This gate is separate from a git merge: code can be merged and still not cleared for Polly to rely on near Facebook.
What it checks
›Does anything here touch, or could it touch, a real Facebook group — even indirectly
›Does it follow the golden rules (§02), not just look like it does
›Does it match STURIJ_DESIGN.md exactly, not a plausible-looking approximation
›Is anything stated as fact actually verified against the files, not assumed from a prior summary
›Would this survive contact with a real, trigger-happy group moderator
The verdict
✓ CLEARED FOR POLLY✕ NOT YET CLEARED
Everything built so far is NOT YET CLEARED — nothing in this repo has been used near a real group. That’s the honest current state, not a gap to hide.
Why this exists as its own gate: a code review answers “does this work.” This gate answers “could this get Polly banned.” Those are different questions with different failure costs — a bad merge is annoying, a banned account is unrecoverable.
04
Knowledge architecture
One constitution at the root, everything else pointed to from it. No skills infrastructure yet (no slash-commands) — that’s main-app machinery this repo deliberately hasn’t adopted.
/CLAUDE.mdThe constitution — golden rules, source-of-truth & tooling rules, the architect gate, the proving-ground relationship. Always loaded.always on
STURIJ_DESIGN.mdThe look — DM Serif Display · DM Sans · IBM Plex Mono · warm paper/navy/gold. Canonical, tokens only.
SKILL.md — sturij-scheduled-eventsPer-group posting-day rules, the local events list, and the honest limits of Claude scheduling.
GROUP_LEDGER_SCHEMA.mdSupabase schema spec for the Group Ledger — written, not yet implemented.spec only
artifacts/group_ledger.htmlThe working prototype — and now the canonical reference implementation of the design system in practice, replacing polly_debrief_form.html (retired 10 July — discovery is complete).reference
strategy_framework/ (Google Drive)Discovery, strategy, and learning docs — still living in Drive, not yet migrated to git. A known gap, not a second home.gap
+ start-session+ import-groups+ architect-review
+ proposed, none built yet · skills are procedures; docs are knowledge — don’t conflate them.
05
Program status
Where everything actually stands — pushed and merged are different states, shown honestly as different states. Mark still runs the git merge. Tap a row to open it.
“Why this is safe” line, per §01/§02 rule 1Designed, not built
Real groupsthe actual data this whole repo is waiting on▸
Groups captured so farloading…
Group gathering complete272 real groups seeded (10 July 2026) — original "325" was an early estimate, not a confirmed count
Official rules captured verbatim, per groupOngoing — one at a time, browsing paced, never automated
Capture method settledScreenshots or Claude in Chrome, always attended — never scheduled or unattended, per SKILL.md
06
Development scope & specification
Two tracks, both genuinely next — neither blocks the other.
Track A · Infrastructure
Move the Ledger to a real database
The artifact prototype proved the interaction pattern with demo data. It needs a real home before real data or Polly's own independent access make sense.
Supabase — the schema in GROUP_LEDGER_SCHEMA.md, not a second system
Storage-layer swap only — every UI pattern already proven stays exactly as built
Real deploy — Vercel, matching the main app’s convention
No migration of demo data — the real table starts empty
Spec: GROUP_LEDGER_SCHEMA.md
Track B · Voice
Build the Reply Drafter
The one piece every other tool in this repo exists to support — and the one genuinely blocked on Mark, not on design or engineering.
Collect 10–20 of Polly’s real, verbatim replies (per POLLY_DEBRIEF.md §4)
Match her voice — not a generic assistant tone
Draft, copy, paste — never send; the app’s job stops at the clipboard
Show the “why this is safe” line — the group rule it respects, visibly
Blocked on: Polly’s real replies
The sequence that protects it: the architect gate (§03) sits between “built” and “near a real group,” for both tracks, every time. Database migration and Reply Drafter both still answer to it before either touches anything live.
07
Product concepts · north star
Why this repo exists at all, captured so it can’t drift — from Mark directly, not inferred. See CLAUDE.md’s “Why this exists” section for the full version.
The four threads
In priority order — #1 is not equal to the rest
Every other thread exists in service of the first. If a tool adds friction instead of removing it, it has failed regardless of technical polish.
UX for Polly — the entire justification for this platform
Instrument what exists — the Ledger, debrief data, reply outcomes as aggregate insight
Find the customer who doesn’t know Sturij exists — parallel communities, not just parallel markets
The owned-channel bridge — get a real enquiry off a platform Mark doesn’t control
CLAUDE.md · “Why this exists”
Parked · next debate
The Post Composer
Sibling to the Reply Drafter, for when Polly wants to share something rather than answer someone — three genuinely different angles, remix, a comment box to steer, outcomes logged.
Three real options — different strategies, not three rewordings
Remix — new options if none land
Learns from choices — reads the outcome log before drafting the next batch, doesn’t retrain silently
designed in conversation · not yet specced formally
Why they cohere: both tools are the same grammar — propose, never send — applied to two different starting points. Neither is real infrastructure investment until the Reply Drafter proves the pattern with Polly first.
08
Where the real files live
No published claude.ai gallery yet — nothing here has been published that way, and this page won’t claim links that don’t exist. Once the branch above is merged, the repo itself is the durable index.
Retired: polly_debrief_form.html was delivered earlier as the discovery form and reference implementation. Its discovery role is complete (discovery happened directly with Mark), and group_ledger.html has taken over as the canonical reference — see §04. It should not be added to the repo.
On this page itself: it's a governance reference, not a build artifact — update it by hand when program status changes materially, the same discipline as CLAUDE.md rule 6: trust what's actually true, not what was true last time someone wrote it down.
09
Proposed sprints \u2014 for discussion
The two features already agreed as the real next work. Tabled here to get the shape of each one right before either is built \u2014 not a decision, an invitation to poke holes in it.
Sprint A \u00b7 Database migration
Proposed
Move the Group Ledger off artifact storage and into a real, independently-hosted database \u2014 the thing that lets Polly (or Mark) open it without a Claude session running.
In scope
Implement the schema already written in GROUP_LEDGER_SCHEMA.md \u2014 Supabase, not a new system
Swap window.storage calls for real queries; every UI pattern already proven stays exactly as built
Real deploy target (Vercel), matching the main app's convention
Area-research and image-picker calls are unaffected \u2014 they don't touch storage
Out of scope
Any redesign of the interaction patterns already tested with real data
Migrating the demo [Example] seed data \u2014 the real table starts empty
Multi-user auth/permissions \u2014 not needed until there's more than one real login
Open questions: who holds the Vercel/Supabase account long-term? Does Polly get her own login or a shared workspace \u2014 and does that decision wait until it's actually needed? Trigger for doing this now: 272 real groups exist; the artifact-storage prototype has done its job proving the pattern.
Sprint B \u00b7 Reply Drafter
Proposed
Draft replies to Facebook DMs and comments in Polly's real voice. Drafts, never sends \u2014 the tool's job stops at the clipboard, per golden rule 1.
In scope
Voice-matching draft, learned from Polly's real verbatim replies (10\u201320 examples)
A "why this is safe" line, checked against the group's actual official_rules field
Copy-to-clipboard, one draft at a time \u2014 no send button exists in this tool, ever
Warning shown plainly if a group's official rules haven't been captured yet (true for 270 of 272 today)
Out of scope
Any autonomous sending or posting \u2014 permanently out of scope, not just for v1
The Post Composer (three-option post drafting) \u2014 a related, separate tool, later
Scheduling replies \u2014 see SKILL.md on why that's a different, careful conversation
Blocker, not an open question: this cannot start until Polly's real replies are collected. Everything else about this sprint is ready to build the moment that input exists.
