# Where Woof — Project Highlights (resume-ready)

A production return-item tag platform built end-to-end on a home-lab stack, from spec to live deployment.

## What it is
A SaaS-style product: physical QR/NFC tags for pets/luggage; a finder scans → sees return details → the owner is alerted by SMS with the finder's location. Includes a full admin dashboard for users, tags, products and orders.

## What I built (the pipeline)
1. **Spec-driven development** — OpenSpec: every feature went through proposal → design → specs (testable requirements) → tasks, validated, and tracked through the whole project.
2. **Public web app (Go)** — "GOAT" stack: Go stdlib + HTMX + Alpine.js + Tailwind + Postgres. Auth, tag registry (anti-scam), scan flow with geolocation, location-aware SMS throttling, browser-fingerprint anti-spam, photo uploads.
3. **Admin app (Laravel + Filament)** — CRUD for users/tags/products/orders, dashboard stats, admin auth gating — against the **same** shared Postgres.
4. **Real SMS integration** — SMSGlobal HTTP API (verified sender), with a swappable sender abstraction and a log-mode fake for testing.
5. **Deployment** — Go binary as a systemd service, Laravel in Docker, Caddy reverse proxy with automatic TLS, DNS migration off legacy hosting, internal DNS (Pi-hole), firewall management on NixOS.
6. **AI-assisted engineering workflow** — used the pi coding agent with subagent delegation (database/coder/review agents), plan review tooling, memory/runbooks, and regression test suites (53 HTTP-level checks).

## Stack highlights
Go 1.26 · HTMX · Alpine.js · Tailwind · PostgreSQL 16 · sqlc (type-safe SQL) · Laravel 13 · Filament v3 · Docker · NixOS · systemd · Caddy · Gitea · SMSGlobal API · OpenSpec · pi/agent tooling

## Things I'm proud of / learned
- Decrypted a legacy AES-256-ECB product-ID scheme (100 encrypted sequential IDs recovered and re-seeded as a tamper-proof registry).
- Debugged and fixed production-only issues: Filament's 403-after-login (model must implement `FilamentUser`), mixed-content asset blocking behind a reverse proxy, and a Caddy config crash from duplicate site blocks.
- Rebuilt my own 2014-era product design (its comments anticipated distance throttling and fingerprint anti-spam) with modern tooling.

## Where it runs
Live on `where-woof.com` and `admin.where-woof.com` — home-lab infra: desktop (.27, dev) → server (.13, prod) → Caddy box (.35), one shared Postgres.