A flag for every thousand who raise one, yours is the one that falls

FlagBreaker is an AI-persona-supervised self-discipline app: finish your goal and the AI cheers; miss it and the AI roasts you. The core driver is emotional contrast, not cold reminders or self-blame. It ships two AI personas, bro (your sharp-tongued buddy) and senpai (an aloof ice-queen), each with its own System Prompt and Few-Shot samples. Built on Next.js 14 + Supabase + Doubao API (Volcano Ark), with PWA offline check-in and Web Push reminders.

Bro is your long-time friend: colloquial, net-native, fast and punchy, occasionally dropping "hey man" to close the distance; replies are 1-3 sentences, max 60 chars. Senpai is a detached older-woman character, economical with words, 1-2 sentences max 40 chars, no filler words or memes, using one short rhetorical question to make you reflect. Both share the same feedback decision tree and compliance red lines.

Not random. A strict decision tree applies: first success triggers exaggerated praise; 3+ days of consecutive success upgrades the praise; a comeback after a miss highlights the comeback; two consecutive misses trigger moderate roasting; 3+ consecutive misses force protection mode (80% encouragement + 20% roast with one positive line); first miss or easy-goal miss gets light roast. Emotion ratios are fixed too: praise mode is 60% warmth + 30% humor + 10% earnest encouragement.

Protection mode triggers after 3 consecutive days of missing a goal (PROTECTION_MODE_THRESHOLD): the AI drops roast intensity to 20% and adds 80% encouragement, with one mandatory positive line. It is re-decided in the backend doubao.ts, not trusted to the AI itself. Minors (under MINOR_AGE=18) get forced kind-only mode throughout, with roasting disabled. The check lives on the backend and cannot be bypassed from the client.

It never attacks identity. The AI is forbidden from saying "you are useless" or "you are a failure", and from touching appearance, weight, intelligence, family, origin, illness, gender, sexual orientation, religion, or race. Roasts target behavior, never the person. The Doubao API does content filtering on its side; persona.ts adds a BANNED_WORDS array as a second filter (14 words). Every AI reply is written to ai_feedback_logs with a consecutive_fail snapshot for audit.

Seven consecutive days of hitting a goal (CLEAN_STREAK_DAYS) auto-wipes the failed records for that goal, giving the user psychological room to restart. It is a comeback narrative: failure is not the end, sustained consistency erases the black history.

MVP ships 3 goal types: early_rise, fitness, study. Each has 3 difficulty levels: easy (miss it and you get roasted hard), medium (normal intensity), hard (the AI understands if you miss). Check-in has 3 states: success, failed, skipped (rest day). Custom goal types are planned for P1.

Yes. A PWA Service Worker with multi-strategy caching plus a localStorage offline queue (offlineQueue.ts) buffers check-ins while offline; once back online, /api/checkin/sync reconciles automatically. Dashboard triggers replayQueue() on launch. Web Push notifications are independent of the open tab; you still get reminders and failure pings with the tab closed.

Forest relies on positive tree-growing incentives and does not address flag failures. TickTick is a task manager with no AI feedback. Keep is a fitness content community, not a supervision tool. FlagBreaker’s core differentiation is AI-persona contrast companionship: a sharp-tongued buddy or an ice-queen senpai driving discipline through emotional contrast, avoiding shame and social death. Protection mode keeps the roast above a floor; minors get forced kind-only mode.

Supabase PostgreSQL has Row Level Security (RLS) on every table: users can only read and write their own rows. CSP and HTTP security headers (X-Frame-Options: DENY, X-Content-Type-Options: nosniff, etc.) are set in next.config.js. Every API route validates input with Zod. /api/checkin is rate-limited to 10/60s, /api/ai-feedback to 5/60s via a sliding-window algorithm. Server-side keys like ARK_API_KEY and CRON_SECRET never carry the NEXT_PUBLIC_ prefix and are never exposed to the browser.