Go to file
Krzysztof kuhy Rudnicki 967e3cd322 Key every workout day on the LOCAL calendar day, not UTC
A manual workout logged at 00:02 CEST on 2026-09-13 was filed under
2026-09-12: every day-key derivation used datetime.now(tz=UTC), and at
that instant UTC was still yesterday. The 09:18 lock check looked for
2026-09-13, found nothing, and locked the PC — for a workout that was on
disk. The budget counter (a trailing window) counted it fine, which is
why the status showed 1/2 used while the locker still locked. Any log
between local midnight and 02:00 CEST hit this; it had happened before.

- New screen_locker/_day.py: today_str() is the one definition of "what
  day is it" — the local calendar day the user sees on the clock, which
  is also what the phone app, RunnerUp verification, the status window
  and the freedays pool already used. All 14 UTC sites (log writer, lock
  predicates, explain chain, early-bird, wake state, shutdown/sick state,
  sick budget, manual CLI, phone verification) now go through it, writers
  and readers together so no new midnight window opens between them.
- write_signed_entry dedups by workout_id across ALL days: a workout id is
  globally unique, and an entry moved to its correct day must not let its
  synced twin (still stamped with the old day) re-ingest as a duplicate.
- scripts/rekey_log_entry.py: move a wrongly-filed entry to its real day
  (the HMAC never covered the day key, so it still verifies).
- test_local_day_key.py freezes the clock at the exact failing instant.

Replayed the real timeline (log at 00:02:35, evaluate at 09:18:53, weekly
3/5) against HEAD in a throwaway worktree vs this tree:
  HEAD  -> logged under 2026-09-12, LOCK
  fixed -> logged under 2026-09-13, no lock (already_logged)

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FcU5dCcUNHMAMzUNChdrrJ
2026-09-13 09:50:06 +02:00
.github/workflows Take the freshness gate's ten bumps: Flutter 3.47.4, mcp 2.2.0, React 19.3, node 24.21 2026-09-12 19:52:30 +02:00
docs Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
prompts Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
screen_locker Key every workout day on the LOCAL calendar day, not UTC 2026-09-13 09:50:06 +02:00
scripts Key every workout day on the LOCAL calendar day, not UTC 2026-09-13 09:50:06 +02:00
stronglift_replacement Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
web Take the freshness gate's ten bumps: Flutter 3.47.4, mcp 2.2.0, React 19.3, node 24.21 2026-09-12 19:52:30 +02:00
.fvmrc Take the freshness gate's ten bumps: Flutter 3.47.4, mcp 2.2.0, React 19.3, node 24.21 2026-09-12 19:52:30 +02:00
.gitignore Serve the lock decision, its history and its health at 127.0.0.1:8770 2026-08-29 22:50:19 +02:00
.mcp.json Add read-only MCP server exposing workout/lock status 2026-07-10 21:28:09 +02:00
.pre-commit-config.yaml Take gatelock 0.8.1: nested LockConfig 2026-09-12 19:52:38 +02:00
AGENTS.md Tell "could not check" apart from "no workout", and stop double-granting bonuses 2026-08-24 13:07:20 +02:00
arm.sh Make disarming survive the install scripts, not just systemd 2026-08-22 12:54:13 +02:00
CLAUDE.md Adopt crdt-sync v0.9.0's bundled sync_log signature 2026-08-21 14:28:14 +02:00
early-bird-workout-check.timer Re-arm the locker, and make a disarmed enforcer impossible to miss 2026-08-17 16:47:25 +02:00
install_autostart.sh chore: set up as standalone repo 2026-05-28 07:43:06 +02:00
install_systemd.sh Take gatelock 0.8.1: nested LockConfig 2026-09-12 19:52:38 +02:00
install.sh Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
pyproject.toml Take gatelock 0.8.1: nested LockConfig 2026-09-12 19:52:38 +02:00
README.md Add read-only MCP server exposing workout/lock status 2026-07-10 21:28:09 +02:00
remove_autostart.sh chore: set up as standalone repo 2026-05-28 07:43:06 +02:00
remove_systemd.sh Let the PC see phone workouts again, and stop losing progression on reinstall 2026-08-10 14:39:02 +02:00
requirements.txt Take gatelock 0.8.1: nested LockConfig 2026-09-12 19:52:38 +02:00
run.sh Reconcile the venv on launch, so a pin bump cannot sit unnoticed 2026-08-23 06:56:26 +02:00
screen-locker-web.service Serve the lock decision, its history and its health at 127.0.0.1:8770 2026-08-29 22:50:19 +02:00
TODO-file-length-250.md Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
TODO-finish-dart-250.md Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
TODO-pylint-to-ten.md Add the removal marker to every TODO file 2026-08-24 15:56:24 +02:00
workout-locker.service Close the four gaps that let a decided lock never reach the screen 2026-08-30 15:24:45 +02:00
workout-locker.timer Close the four gaps that let a decided lock never reach the screen 2026-08-30 15:24:45 +02:00
workout-sync.service Re-point paths for the ~ reorganisation (home-tidy) 2026-09-11 18:46:28 +02:00
workout-sync.timer Let the PC see phone workouts again, and stop losing progression on reinstall 2026-08-10 14:39:02 +02:00

screen-locker

Tkinter/systemd screen locker with workout tracking, sick-day management, and wake-alarm integration. It enforces a workout cadence by locking the screen until a RunnerUp-verified (or explicitly justified) workout is logged.

MCP server (Claude Code integration)

screen-locker exposes a read-only MCP server (screen_locker._mcp) so Claude Code and its subagents can query workout compliance and the lock-decision state through typed tools — without shelling out to the screen-locker-status CLI or opening the Tk window.

  • Read-only tools: get_status (full status snapshot), get_summary (one-line i3blocks summary + ok/warn/lock state word), explain_lock (why the screen is / isn't locked right now), get_flags (the individual boolean lock-decision predicates for today).
  • There are no write/action tools, by design. Nothing here logs a workout or mutates state — workouts are logged only from RunnerUp-verified TCX data, never from a caller's claim. No tool exposes the sync token or any HMAC key.

The mcp SDK is an optional dependency (pip install -e '.[mcp]'), kept out of the CLI/systemd system-python path. One-time setup of the dedicated venv that Claude Code spawns:

./scripts/setup_mcp.sh

Registration lives in the checked-in .mcp.json (project scope). Restart Claude Code in this repo and approve the project MCP-server prompt for it to load. Verify with claude mcp list.