Identity Demo Build
Verified Demo Identity
The demo build stopped identifying users through downloaded bytes and now verifies registered email instead.
2 milestones 9 tasks 20 agents
4 plan 9 execute 11 review
238k peak context
114k median execute
1h 57m total 9m 27s per task
5m 4s plan 1h execute 19m 5s review
78 edits 614 commands
codex harness
This run rebuilt Gantry's demo identity boundary in two passes. First it removed the abandoned personalized-binary path from the runtime, web app, persistence layer, and documentation. Then it added the replacement flow: the server resolves verified demo licenses by registered email hash, and the client obtains that identity through cache, environment, plain terminal input, or a short modal before the main UI starts.
The decomposition matters because the replacement was not allowed to lean on the old mechanism while it was being built. The first milestone made binary bytes irrelevant to demo identity; the second milestone made email verification live without changing signup, magic links, unlock tokens, or the demo allowance policy itself.
How this walkthrough is structured
Feature
What did the run build and ship?
Gantry now gates demo builds through verified registered email hashes, while the old binary personalization model and its Rails storage are gone from the current tree.
Build
How did Gantry structure the work?
The run split a risky identity change into a removal milestone and a replacement milestone, with only the terminal prompt slice needing a retry before the final merge.
Milestone 1
Personalization Reset
4 tasks 12 agents 55m 52s wall time 238k peak context
The current tree no longer has the personalization stamp module, the issued-binary model, the binary personalizer, or the recovery task that depended on delivered bytes. The demo runtime still has a gate, but its identity source is not the executable. Rails serves release assets without issuing personalized records, and the surviving API code rejects legacy selector-style identity fields.
This milestone carried the negative half of the plan: remove binary-carried identity without designing its successor. That made the boundary small enough for its sprints to prove one contract at a time, from Rust startup behavior to Rails download storage to API vocabulary. The ledger stayed green, and the final documentation sweep was recorded as already satisfied after the earlier cuts had removed the remaining drift.
Runtime Identity Removal
2 agents 9m 27s wall time 105k peak context
The old personalization stamp source file and its slot tests are absent at HEAD. The surviving demo gate code works from cached unlimited licenses, verified demo identity, and server checks. The refusal messages now point to demo email setup rather than a personalized download.
This sprint established that the Rust binary is never the source of demo identity. Its brief was deliberately narrow: remove the reserved region and reader while preserving the existing unlocked shortcut and refusal behavior. The cut held cleanly, which let later web and API work assume the runtime would not scan its own bytes.
Issued Storage Removal
3 agents 23m 25s wall time 238k peak context 1 replan
The issued-binary model, creation migration, binary personalizer, and recovery tests are no longer present. A retained migration drops the obsolete tables for deployed databases. Release asset and license code remain, but the download path is no longer coupled to per-download byte transformation.
This sprint moved the removal to Rails, where personalized downloads had a persistence model and recovery path. It had to keep ordinary release authorization intact while deleting the machinery that remembered issued files. Review produced a replan for the remaining milestone work, so the next sprint inherited a clearer API cleanup boundary instead of a vague storage cleanup tail.
Demo Key Simplification
2 agents 6m 54s wall time 103k peak context
The current demo HTTP and Rails controller code exchange email hashes, build tokens, version identity, nonces, and completion credentials. The server signs check verdicts and verifies completion credentials against the same license and client fingerprint. Legacy selector fields are explicitly refused instead of silently accepted.
After runtime identity and issued storage were gone, this sprint owned the protocol boundary they left behind. The task was to prove that demo check and completion requests used only email-hash identity and ordinary operational fields. It passed without recovery, which fit the brief: harden an already exposed contract rather than introduce a new acquisition path.
Vocabulary Documentation Sweep
1 agents 2m 8s wall time 63k peak context
The dedicated binary personalization document is gone, and the obvious runtime and Rails artifacts it described are gone with it. Some handover and plan documents have since changed or been removed, so this sprint's contribution is not fully isolatable as a current prose patch. The lasting result is the absence of shipped documentation that presents personalized demo binaries as the active boundary.
This sprint was a meaning-based audit over terms and documents, not another feature slice. Its done state depended on the earlier contracts all being true together: no binary identity, no issued-file storage, and no selector-based demo API. Gantry recorded it done with a green gate and no commit, which says the preceding sprints had already satisfied the cleanup target.
Milestone 2
Verified Demo Access
5 tasks 15 agents 1h 2m wall time 143k peak context
The present demo path is email-verified from end to end. Rails stores normalized email hashes for licenses and the Rust client caches only the accepted hash after a server check. Users can arrive through environment input, a plain terminal prompt, or a pre-UI modal, while cached unlimited unlocks still bypass the demo identity path.
This milestone built the replacement on top of the cleaned tree. It was decomposed from the server lookup outward to the shared client core, then to each input surface, and finally to the full policy funnel. That ordering kept each fresh agent on one contract while the previous contract was already available to consume.
Server Email Lookup
2 agents 5m 33s wall time 68k peak context
The License model now derives and validates a normalized email hash, and the migration backfills and indexes that value for demo licenses. The demo API looks up verified demo licenses directly by that persisted hash and compares the stored value before issuing a verdict. The old scan-and-recover path through issued binaries is not part of the current controller.
This sprint gave the web service the lookup contract the rest of the milestone needed. Its scope was server-only: persist the normalized registered email hash, backfill existing licenses, constrain demo uniqueness, and keep signup and magic-link behavior unchanged. The boundary stayed green, so client work could treat email hash lookup as a stable service.
Verified Identity Core
1 agents 11m 35s wall time 113k peak context
The demo gate reads the email environment variable, loads a cached demo identity, or accepts candidate emails supplied by prompts. It writes only the verified hash cache after the server allows the build. Invalid, unknown, offline, exhausted, and cache-write cases return explicit decisions instead of leaving sticky plaintext state.
This sprint built the shared client mechanism before any prompt UI existed. The brief kept presentation out of scope so the agent could focus on normalization, hash derivation, verify-before-cache behavior, refusal states, and the unlimited-token shortcut. That contract became the center for every later acquisition surface.
Terminal Email Prompt
4 agents 14m 47s wall time 114k peak context
Headless and print-style demo commands can now ask for the registered email on stderr and read from stdin when a human terminal is present. The prompt reuses the shared verification path and allows retryable address mistakes without caching them. Runs without usable terminal input refuse cleanly and name the email environment variable.
This was the only sprint that needed a retry. Its job was small in interface but awkward in process: distinguish a headless command attached to a real terminal from an unattended run that must never block. The retry localizes the difficulty at that boundary, where input availability and prompt policy meet.
Pre-UI Email Modal
2 agents 13m 5s wall time 143k peak context
Interactive demo builds now open a short modal for the registered email when no cache or environment value is available. The modal routes accepted and rejected input through the same client identity code as the plain prompt. Acceptance, cancellation, interruption, and prompt errors restore the transient terminal before the main UI or shell resumes.
This sprint owned the ordinary interactive surface, where the gate runs before Gantry's main monitor UI exists. The slice was separate from the plain prompt because terminal lifecycle was the hard part: open a transient modal, collect an email, and restore the terminal before continuing or exiting. It completed green, leaving the shared identity contract unchanged.
Demo Policy Funnel
2 agents 8m 40s wall time 131k peak context
The current controller records completed demo builds through credentials bound to the accepted email hash, version identity, client fingerprint, nonce, and build token. The Rust gate reports completion after allowed demo work and warns without turning a reporting failure into permission failure. Tests have since been reorganized, but the runtime and server code still carry the full counted-build flow.
The final sprint stopped treating the pieces as isolated contracts and exercised the user-visible funnel. Its brief asked the agent to connect signup, verification, prompt input, server allowance, completion reporting, exhaustion, cached identity, no-input refusal, and unlimited unlock bypass. Because the earlier contracts were already in place, this became an integration proof rather than a redesign.