First example of event diary share
The site said one login and had nowhere to perform one. Now there is a sign-in, and an account page you can actually act on.
Michael Statonid.didi.sh
- colour = whenJan 2025 → Sept 2026
130 commits · +28,884 lines
Michael StatonLend a key, keep the receipts
Paste an API key, lend it to a project you're not on, and watch what it pays for. Borrowers spend it; they never see it.
Michael StatonEntities land flat, and invites reach strangers
Tenancy stops being a hierarchy nobody's collaborations fit: organization, workspace and project become three labels on one flat table, with no parent_id and no inheritance. Membership removal never cascades, and the API says out loud what a removal did not do. Adding an email that has no didi account now sends an invite from no-reply@didi.sh and attaches the membership when it's redeemed.
Michael StatonRepo scaffold — the identity plane gets its home
id-didi-sh exists: the repo for the didi.sh identity service, scaffolded with the tree's universal directories, a README that carries the contract and the increment plan, and a CLAUDE.md that marks this as the Lossless tree's polyglot (Elixir) exception.
Michael StatonWalking skeleton — magic link to signed cookie, proven live
Increment 1 ships the same day as the scaffold: a Phoenix app with the full identity schema, an Ed25519 keypair behind a JWKS endpoint, and the whole magic-link → didi_session cookie → /api/me → refresh → logout loop — 19 tests green and every step proven against the live server by a curl script.
Michael StatonCredential-posture splash — the one-login pitch goes public
The repo gets its GitHub Pages presence: an Astro splash dressed as an identity document — guilloche engraving, a SPECIMEN ID card as the hero object, stamp chrome — pitching one login to fast-track DD-ready materials, with the three services near-copied from ai-labs/splash and a CTA pointed at id.didi.sh.
Michael StatonDeployed — the identity service goes live on Fly
The walking skeleton left the laptop: id-didi-sh runs on Fly.io in lax with the libSQL file on a mounted volume, secrets set without ever being displayed, JWKS serving the production Ed25519 key at id-didi-sh.fly.dev — and a TLS cert issued for id.didi.sh, two DNS records away from the real domain.
Michael StatonOne person, many addresses — email aliases land
A didi.sh ID now carries alt emails: a magic link to any alias authenticates the same didi_id. Normalized from the start (a user_emails table, globally unique across primaries and aliases) instead of merge-chained after the fact — the fullstack-vc lesson, applied preemptively.
Michael StatonProduction magic links land in a real inbox
Steps 1 and 2 of the humain-vc unlock close on production: a hand-rolled Resend adapter over Req delivers real sign-in emails from the deployed service, orgs and memberships exist with mix tasks to seed them, and production carries Michael's full identity — plus two infrastructure bugs found and fixed along the way.
Michael Statonid.didi.sh is live — the full loop, clicked
DNS validated, the Let's Encrypt cert issued, and the operator clicked a production magic link end to end: an email from no-reply@didi.sh, the scanner-proof /access confirm page at https://id.didi.sh, and a didi_session cookie scoped to .didi.sh. The platform's one-login promise works in production, on the canonical URL, same day the domain was bought.
Michael Staton