Hapva Build overhaul plan

Plan for the Build section: App Builder and Locked App Builder. Checked live on hapva.com on Oct 8, 2026, 11:45 PM PT. Prepared by Grok Bot for Justin Chance.

Goal: Build in Hapva should work the way Grok Bot builds your app. You ask for a change in plain English. It shows you a plan, the files it will change and the price, then waits for your OK. Next it backs up, makes the change, tests it, checks it at phone size and saves it to GitHub. It goes live only if every check passes. If something breaks, it undoes itself. You get a short report, and one tap undoes any build.

What it does today

🛠️ App Builder (the agent)

✓ It reads and searches the code, edits a private copy, runs all the tests and fixes its own mistakes (up to 2 tries).
✓ It shows the exact change, and nothing goes live until you tap Apply. It makes a backup first and won't restart while a Council is running.
✓ Every change is saved to GitHub ("App Builder: apply …"). Secrets are scanned out first.
✓ It has a spend cap for each job ($1 by default, up to $5) and $10 a day.
✗ It starts editing right away. You don't see a plan, a file list or a price before it spends money.
✗ Builds have no build number. The GitHub save runs in the background, so you never see whether it worked.
✗ Undo only works for the newest change. There's no list of past builds.
✗ The check after a change only loads the sign-in page. If that check fails, nothing rolls back on its own (it does roll back after 3 failed start-ups). There's no phone-size screenshot.
✗ The live log reads like a programmer's log. There are no clear steps and no plain-English report at the end.
✗ You can't see the list of protected files. A new Python package doesn't get added to requirements.txt.

🔒 Locked App Builder (the older one-shot engine)

✓ It has its own private change log and a PIN or password gate that locks after 10 minutes.
✗ It runs on a different, weaker engine: one AI answer, no test run and no repair. Its backups and Undo are separate (newest change only).

Corrections to earlier notes

Both builders do save to GitHub (git_autosave.py; the last builder saves were Oct 8, 3:32–3:39 AM PT).
requirements.txt exists, with versions pinned.
A wrong PIN no longer sends you to the sign-in page. Retested tonight on both builders: you get "That didn't match" and stay on the screen.

How it will work

Understand. It reads your request and the app's code map.

Plan. It shows the plan in plain English, the files it will change and a dollar estimate. Then it waits for you to tap Approve. Planning is read-only and costs a few cents.

Backup. It saves a copy of every file it will touch.

Build. It edits a private copy. Protected files can't be touched. New files get your creator line.

Test. It runs syntax checks, the safety rails and the full test suite, and fixes anything it broke.

Preview. It checks the change at iPhone size and takes a screenshot.

Deploy. It gives the change a build ID and checks that no Council is running. Then it goes live, restarting only if server code changed.

Live check. If the app doesn't answer properly, it rolls back on its own.

Save. It saves to GitHub with the build ID in the message, and shows you the commit.

Report. You get a short note on what changed, the cost and the test results, plus a screenshot. Every build shows up in Build history with one-tap Undo.

Phases (most useful first)

Phase APlan → Approve → Build → Test → Deploy

A plan with its file list and price before anything is edited. The Approve button starts the build.
Live progress steps: Plan · Approve · Build · Test · Deploy · Live check.
A build ID for every build. The GitHub commit carries that ID, and the result shows it.
Build history with one-tap Undo for each build. If a newer build touched the same files, it tells you so in plain words.
A stronger live check: the sign-in page, the about API and the main scripts. If it fails, the build rolls back and the server restarts on its own.
The protected-files list is shown. New packages are added to requirements.txt.

Phase BOne builder

The Locked tab uses the same engine (plans, tests, repairs, history), with private history kept apart.
One store for backups and history. @App Builder in chat hands its work to the same pipeline.

Phase CPhone preview and screenshot

A preview copy is checked in a headless iPhone-size browser before going live, and again after. The screenshot goes into the report.

Phase DReport and team notes

A plain-English report card for each build: estimate vs actual cost, tests and screenshot. BUILD_LOG and HANDOFF notes are written for you.

Safety rules (kept in every phase)

Council check before any restart. Backup before any change. Secrets are never shown, logged or saved to GitHub.
Creator line on new files. Protected files stay locked: sign-in, keys, Private mode, business sections and the builder itself.
No feature is removed without your OK. Your PIN, Private mode and all tabs keep working.

Status

Phase A is LIVE (Oct 9, 12:15 AM PT. Commits b876613, 9d9d9e3 and df75e59. App build 20261008-235444.)

Plan it, then Approve & build. The plan shows the files, the risk and the price.
Six live steps. It goes live by itself only when every check passes. The live check rolls back on its own if something fails.
Build IDs, a GitHub commit for each build, and Build history with Undo for each build.
The protected-files list is shown. New packages are added to requirements.txt.
Found and fixed: the builder's own test run was only running 94 of 512 tests. 17 test modules couldn't load inside its sandbox. Now all 513 run.
Fixed: the Brain and Spend cap pickers stuck out past the edge of the phone screen.
Real test on hapva.com: it planned in 7 seconds, built, ran 513 tests (all passed), went live as build 20261009-001154 and saved to GitHub. Then Undo in Build history put it back. That cost about 0.2¢.

Next: Phase B (the Locked builder runs on the same engine), Phase C (phone preview with a screenshot), Phase D (report notes).