Diagnose what is fake

Map exactly which parts of auth are theater before rebuilding.

First time here? Paste the Context Pack first so the AI understands your project - open it from the header above.

Prompt Capsule

Audit the current auth implementation and report precisely what is real vs fake: Does signup write a user record (show where)? Does login verify a password against a stored hash or accept anything? Where does auth state live and does it survive refresh? Are routes guarded before render? Do backend endpoints check the session? Output a table: component -> current behavior -> required behavior.

Paste into EmergentFull Build: complete implementation prompt with explicit requirements

Quick is short. Full Build is recommended for most steps. Strict forces real logic when the AI keeps faking output.

Actual change check

Expected after this step

An honest diagnosis table of the entire auth surface.

Should NOT happen

An existing feature broke
A button only logs to console
Data disappears after refresh
Errors fail silently with no visible state

This is what should exist before you continue. If reality does not match, do not move on.

Your notes for this step

Track what changed, failed, or needs follow-up. Notes export with the flow.

Pass the Verify Gate to complete this step

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Signup persistence verified in the databaseLogin verification logic inspectedRoute and API guards checked

Do not continue if…

! Login that accepts any credentials
! Auth state in memory only, gone on refresh
! Protected pages reachable by URL
! APIs serving private data without any session check

If the AI messes this up

Use this when:

- it only made visual forms or placeholder UI
- buttons do nothing or only log to console
- data is not persisted - state disappears on refresh
- something that worked before is now broken

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

The diagnosis is optimistic guesswork. Trace the actual code paths: run a signup, query the user store, attempt a wrong-password login, and hit a private API logged-out. Report what actually happened.