MC2 Mastermind

Problem

The founder wanted a small, private accountability group (a 4-person mastermind) to run its whole operating rhythm — discussion, decision-making, goal tracking, shared notes — in one place, without adopting a generic project-management tool built for larger teams. Existing tools didn't offer a lightweight ritual-driven format built around a single shared table: a place where a small group pitches ideas, votes, commits to goals, and keeps a decision log, with a session structure (a recurring meeting ritual with streaks) rather than an open-ended backlog. The system also needed to scale past the founding group without becoming a generic SaaS product, i.e. the same room mechanic had to be replicable into new private pods on demand.

What was built

A private web app, installable to a phone home screen like a native app, that four people share as "the table." It has six surfaces: a threaded chat with categories, reactions, photos, and voice memos; a board where ideas get pitched and dot-voted through stages, including private "storm" brainstorm rounds; per-topic mind maps; goal commitments with progress percentages and target dates; shared documents with a single-writer "pen" lock so two people can't overwrite each other; and a decision log with owners and deadlines. A built-in session engine runs the group's meeting ritual and tracks streaks over time. Every Monday morning the app sends a push notification and email summarizing goals due, overdue, or completed. The founding table can "mint" new, fully isolated pod tables for other four-person groups, each with its own chat, board, and data, all running on the same underlying system. A separate coming-soon landing page at mcsq.me collects a waitlist with a founding-member counter and one-click unsubscribe.

Technical approach

Each table — the founding room or any minted pod — is backed by one Cloudflare Durable Object using WebSocket hibernation, so idle connections cost nothing while still supporting instant realtime sync. All persistent data lives in one shared D1 database, with every row scoped by a table_id column (default founding), so a pod is a logical partition rather than a separate database — deleting a pod means deleting its rows across every table plus its Durable Object storage, with no dedicated delete endpoint. Media (photos and voice memos) is stored in a single flat R2 bucket keyed photo/<uuid> regardless of type, served through a GET /photo/:id endpoint that must honor HTTP Range requests and answer 206 — iOS Safari silently refuses to play an <audio> element whose source doesn't support range requests, which is why voice memos didn't work on phones until this was fixed. Auth uses HMAC-signed seat tokens rather than a user/password system; secret rotation is graceful via a previous-secret fallback that lets old and new tokens validate simultaneously during a rollover window, verified in production by minting a test token against the old secret and confirming it flipped to a 403 only after the grace window closed. TypeScript checking is split across two tsconfigs (src/app/src/shared vs. the worker) because a bare tsc --noEmit silently skips the worker entirely — a real incident where a broadcast call was passing four of five required arguments (silently dropping storm-round pushes) and a message type that didn't exist both went undetected by a plain typecheck and were only caught once npm run check ran both configs. The project ships an unusually large versioned E2E suite (scripts e2e-live through e2e-v12) run against live seat links to cover reconnect behavior, threads, tags/mentions, stages/dots/storm rounds, photos, desktop "war room" layout, canvas drag, and the docs pen-lock — each addressing a feature wave in the git history (v1 through v12 tags).

Creative approach

Craft

The app opens behind a frosted-glass night card playing a short tropical brand film before granting entry — a "claim your seat" ritual rather than a plain login form. The visual language ("tropical night" retheme: ocean, mango, coral) was deliberately matched between the landing page and the product itself so the waitlist experience and the live app feel like one brand, not a marketing page bolted onto a different tool. Interaction details are tuned for a small, intimate group rather than a general audience: one-tap navigation across all five tabs, a single-writer pen lock on shared documents so collaborative editing has an unambiguous owner at any moment, and long-press-to-promote gestures that let a chat message become a board card without a separate creation flow.

Reframe

The product insight is treating a mastermind as a replicable ritual, not a configurable tool. Instead of building a flexible platform where any group configures its own workflow, the founding table's exact structure — the six surfaces, the session engine, the Monday pulse — gets "minted" wholesale into new pods. The rigidity is the feature: every pod inherits a proven meeting format instead of each group having to invent its own use of a blank canvas, which is the failure mode of most generic collaboration tools. A second, quieter reframe shows up in the auth model: rather than user accounts with passwords, the product uses seat-bound, HMAC-signed invite links as the entire identity layer, which fits a fixed 4-seat room far better than general-purpose auth — a seat either has a valid link or it doesn't, and revoking access is a single secret rotation rather than a per-user permission change. Making that rotation graceful (old and new links both work during a handoff window) turned what would otherwise be a disruptive security operation into something that costs the group nothing.

Process and what failed

The build history shows heavy load-bearing dogfooding: the founding room went live with real seats early, and the HANDOFF explicitly warns future sessions not to reset it. A serious data-loss bug was found and fixed after the room was already in real use — the room-reset function purged the entire R2 photo prefix rather than just the room being reset, because media keys were stored flat with no table scoping while every D1 statement around them was correctly scoped; fixed by having reset collect that room's own media IDs from D1 before deleting anything. A second production-only class of bug came from Cloudflare's own deploy tooling: the deploy command reliably prints a routes-API error and appears to fail because the API token lacks Workers Routes:Edit, when the worker has actually shipped successfully — the real verification method became comparing the live asset hash against the local build output rather than trusting the CLI's own exit signal. The product itself was also rebranded mid-build (from "The Table" to "MC² Mastermind") with a deliberate decision to leave every piece of infrastructure — the worker name, the D1 database, the Durable Object class, the Keychain secret names — on the old name permanently, to avoid the operational risk of renaming live production resources for a purely cosmetic reason.

Outcome

The founding table is live in production at table.mcsq.me with real seats in active use, secret rotation and pod replication proven safe under real load, and a waitlist landing page collecting founding members ahead of a wider "doors open" launch (unsubscribe flow shipped in preparation for that send). The legacy hostname was fully retired in favor of the canonical mcsq.me domain, so every join link and bookmark now resolves through one origin. The product has run through roughly a dozen versioned feature waves (v1 through v12 in the commit history), each shipped behind its own live end-to-end test against real seat links rather than a staging environment, which is the level of verification the team applied before calling any surface — chat, board, docs, canvas — done.