Allin — infrastructure & how it all works

Client

iOS, SwiftUI. Repo Maelwi/allin-ios → local ~/Documents/allin-gh/allin-ios, branch main (commit aa3bd52). Bundle com.allinwellltd.allin, App Store ID 6754271583, current v2.3 (build 1) — archived, uploaded to App Store Connect 2026-08-26, not yet attached to a version/submitted (that step is Marie/Isabel's, in the ASC UI).

Backend

Supabase project wsxpmcbtcknewpiwudsc (us-east-1). Repo Maelwi/allin-backend, branch main (commit 094630f). Postgres + Auth (Sign in with Apple) + Storage (audio) + 9 live Edge Functions, versions confirmed live 2026-08-26 via supabase functions list: recommend-plan v39, revenuecat-webhook v7, recommend-audio v6, classify-affect v6, classify-crisis v5, delete-user-data v2, export-user-data v3, get-emotional-sessions v2, save-emotional-session v5. The last four are new this cycle — see the pseudonymization card below. Auto-deploys from main via GitHub Actions, per-function path-filtered (2026-08-14 fix).

Growth & lifecycle

Segment SDK → Amplitude + Customer.io (EU) + Meta SDK. RevenueCat/StoreKit for subscriptions. Deep links on Cloudflare Pages (link.join-allin.com).

The daily loop

1. Check in — emotion, situation, intensity + body, and the belief beneath.
2. Rewire session — matched guided audio, streamed from Supabase Storage.
3. Reflect — pre/post mood + a note, saved to the journal.
4. Return — journal, streak & progress (non-punitive).

Check-in routing (deterministic gates + AI)

Intensity is the gate, emotion is the content, intent is the lane. A crisis scan intercepts early → region-aware support screen (no audio). "Express": intensity ≥ 8 and unpleasant → straight to a soothe audio. fixed Both gates confirmed at >= 8 in the current working tree — EmotionalCheckIn.swift:871 (the slider gate) and CheckinRouter.swift:188's separate mustSootheFirst gate. Neither is live yet: both ship in v2.3 (build 1), currently uploaded to App Store Connect but not yet submitted — the live App Store build still routes at >= 7.

Recommender

Corrected 2026-08-16: the critical path is NOT LLM-free — the live app's version-gate header activates the Anthropic/Claude composition path on every plan generation; Postgres full-text search is the fallback when Claude errors or fails validation, not the primary path. Tier 2 pgvector + Tier 3 shift-rating learning = sketched, not built.

10-step beliefs plan

Server-generated from an intake (areas + ratings + 4 free-text fields). Rating = life-area satisfaction (lower → more steps). Stored verbatim as intake_json; each step captures mood + shift_rating + feedback.

iOS app

Core/AppView (routing), AuthenticationManager (Apple sign-in), SessionManager + SupabaseService (check-ins), BeliefsPlanManager/Service (plan), Onboarding/OnboardingFlow (8 steps), Core/DeepLink, Core/CrisisResources.

supabase-swift, analytics-swift (Segment), purchases-ios (RevenueCat), facebook-ios-sdk.

Backend / Supabase

recommend-plan (Deno/TS, v33) — JWT-auth; the live app's version-gate header activates a Claude/Anthropic composition path, with deterministic FTS as the fallback only (corrected 2026-08-16 — this card previously said "deterministic + FTS" as the primary path, which was wrong). Plus recommend-audio, classify-affect, classify-crisis, revenuecat-webhook — all live, all now tracked in the repo (found 2026-08-14: they existed live but weren't in git — see the repo/live drift flag below).

GitHub Actions on push to main: migrations → db push, audio metadata → re-seed. still an active landmine, re-confirmed 2026-08-26 The functions job still runs the same single hardcoded supabase functions deploy recommend-plan step it always has — a real per-function path-filtered fix exists (commit 53400bd, branch fix/recommend-plan-repo-drift) but was never merged into main, including in today's consolidation. Practically: pushing a change to any other function (e.g. delete-user-data) still only redeploys recommend-plan — the job goes green, giving false confidence, while the function that actually changed silently doesn't redeploy. All 9 live functions were verified live via direct supabase functions list today, but every one except recommend-plan reached production by manual CLI deploy, not CI. This is the same class of bug the "repo/live drift" box below already describes — it just never got fixed itself.

Bucket of guided-audio mp3s (public-read); only the onboarding video is bundled in the app.

Deep links

Cloudflare Pages allin-links → link.join-allin.com. Serves the AASA for universal links; non-iOS falls back (302) to join-allin.com. Paths: /home /checkin /plan /library /audio/* /journal /progress /profile /settings. Entitlement shipped in v2.2.

Push

APNs entitlement (aps-environment: production) + device token → Customer.io. verify APNs .p8 uploaded to CIO + production push confirmed on a prod build.

What changed

All three special-category tables had their direct user_id foreign key dropped and replaced with pseudonym (a random UUID, cascade-linked via private.user_pseudonyms). Five plaintext columns (trigger, belief, memory, desired_belief, new_belief) are now AES-256-GCM encrypted at rest (_shared/session-encryption.ts), key held only in the SESSION_ENCRYPTION_KEY edge-function secret, never in Postgres.

New edge functions

save-emotional-session and get-emotional-sessions replace the iOS app's old direct-table Supabase calls — the client no longer knows the real user_id at all for these tables, only the edge function (via the caller's JWT) does. export-user-data updated to resolve pseudonym once via RPC for its queries.

Bugs found & fixed getting here

A STABLE-marked my_pseudonym() cached a stale NULL within a single INSERT statement, failing RLS for every brand-new user's first check-in — split into a non-STABLE read function and a separate get-or-create write function. Separately, the critical one: Swift's SupabaseEmotionalSession.userId / BeliefsPlan.userId were non-optional — since Stage 3 removed user_id from every API response, every check-in save/read and plan generation would have thrown a decode error on live main. Found by an audit agent, not by earlier curl-only testing; fixed by making both fields UUID? and verified via an isolated Swift decode of a real captured API response before merging.

Apple Sign-In email capture

Root fix: request.requestedScopes = [.fullName, .email] now set on every signInWithApple() call, and the raw identity-token JWT is passed to Supabase's signInWithIdToken rather than reading credential.email client-side. Apple quirk: the email/name grant locks in permanently at an Apple ID's first-ever authorization with the app — can't be retroactively granted later, so accounts created before this fix (including test accounts) can't demonstrate it without a full "Stop Using Apple ID" reset.

Consent-gated analytics, actually enforced

AnalyticsClient's identify()/track()/screen() now hard-gate on hasAnalyticsConsent — previously, revoking consent mid-session didn't stop tracking because reset() never disarmed the client. Three independent consent toggles (reminders / analytics / advertising) with a Settings → Privacy screen to revisit them; consent is cleared on account deletion specifically (not on plain sign-out, so a returning same-account user keeps their prior consent).

Account deletion hardened

deleteAccount() no longer swallows a failed delete-user-data call and proceeds as if it worked — a failure now surfaces an error and stops, instead of a user believing they'd exercised erasure while their data was still live.

Two crisis-safety race fixes

Same bug class, two call sites: EmotionalCheckIn.swift's CheckinHeader back button, and AppView.swift's outer check-in back-navigation (reachable via assistive-technology activation bypassing a visual-only overlay), could each discard an in-flight true-positive crisis classification before it was checked. Both fixed by reusing existing state flags — no new state, no visual change.