Heatwayve

Heatwayve

Unveil the best you. Evidence-based, autoregulated strength training — cast your frame, move with intent. Next.js PWA, live at heatwayve.app.

A 3-day-a-week strength programme (A/B/C — Squat & Push, Hinge & Pull, Power & Volume) with a progression engine that responds to how hard the work felt, per-muscle volume held against evidence-based landmarks (MEV/MAV/MRV), an accessory rotation engine that keeps the stimulus fresh without you thinking about it, and the Locker Room — where the work stops being numbers and starts being a body.

┌─────────────────────────────────────────────────────────────┐│  Mon   Tue   Wed   Thu   Fri   Sat   Sun                    ││  ───   ───   ───   ───   ───   ───   ───                    ││  A     Z2    B     Mod   C     HIIT  Rest                   ││  Sq    60m   Hinge 35m   Pwr   8-10  ─                      ││  +Push       +Pull       +Vol  ×20s                         │└─────────────────────────────────────────────────────────────┘

That's WEEK in lib/programme.js — the default shape, not a cage. The week is user-editable; the engine walks whatever week you build and hands the strength slots A → B → C in order.

Why this repo is public

So the science can be checked. The programming, the progression rules and the volume landmarks are inspectable — read them, question them, hold them against the literature (Israetel / Nuckols / Helms). That's the whole grant: the repo is the evidence, not a handbook. It is source-available, not open-source — see License.

The programme

SESSIONS (lib/programme.js) is the three-day template:

Each accessory slot has a pre-vetted pool of alternatives rotation can substitute in; pools declare a load profile so a heavy-low-rep movement can't sneak into a finisher slot. Main lifts don't auto-rotate — an enumerated set of approved functional equivalents is available through the swap overlay.

Progression

lib/progression.js reads the last session's effort signal and either advances load, holds, or backs off proportionally to the miss. A cooked readiness rating forces a hold outright — no session logged in a hole gets to set the next prescription. Step sizes and thresholds are per movement category; starting weights are bodyweight-derived and rounded to the loadable increment. The rules live in the code and are pinned by tests/progression.test.js — read those rather than a prose summary that can drift.

What you log is what you did; the prescription is separate. Logging fewer reps than prescribed never changes the prescription on its own, and every set is judged against the target it was attempted under. One short session is noise: repeat-testing studies put day-to-day variation at about a rep per set (1RM test-retest CV ≈ 4%, Grgic et al. 2020). A short set with no reps in reserve is a capacity miss and is answered with load (hold, or a 5–10% drop); a short last set at high effort is fatigue, held rather than punished. A repeated voluntary shortfall — first set short of target with reps still in reserve, on the prescribed load, three qualifying sessions running — is adopted as the lift's rep target, by the smallest change all three sessions support. Three is convention, not a measured threshold: the count Starting Strength and StrongLifts use before resetting, and the count this engine already uses for stalls and repeated light misses; no study has tested the number. It is safe because strength gains are relatively insensitive to how close sets end to failure (Robinson et al. 2024; Pareja-Blanco et al. 2017), so a slightly lower rep target at the same effort costs little. Cooked and travel sessions pause the count.

A stall is answered with reps, then weight. After three held sessions on a loaded lift, a target met close to the limit but short of failure raises the target by a rep, at most two over base; meeting the top of that at RPE 9.5 or easier adds weight and returns the reps to base, a miss or a set to failure never raises the target, and a drop in weight returns the reps to base. A session to failure holds, and finishing the next at RPE 9.5 or easier adds weight.

Volume vs landmarks (MEV/MAV/MRV)

Two surfaces hold actual volume against evidence-based landmarks. npm run audit:volume prints what the default programme delivers per muscle — the static audit. In the app, the Performance Lab audits the trailing four weeks of logged sessions and flags muscles below MEV (won't drive growth) or above MRV (junk volume, recovery cost) with the specific shortfall.

Both operate at the granular muscle level — 16 tracked muscles, each delt head and each arm muscle distinct — because "Rear Delts under MEV" is actionable and "Shoulders under MEV" is not. Traps, Erectors and Core carry mev: 0: fatigue ceilings that flag excess without ever nagging a shortfall nobody should chase.

Privacy posture

Passkeys are an optional lock on destructive operations and the photo layer — not an account system; a profile without one works locally, forever. Progress photos are re-encoded on capture, stripping all EXIF by construction, and no open-read path for a photo exists. Session records are immutable and append-only; the only delete that exists is a whole profile, passkey-gated and user-initiated.

Quickstart

git clone https://github.com/abraraaa/project-forge.gitcd project-forgenpm installnpm run dev           # http://localhost:3000

npm test · npm run lint · npm run typecheck · npm run build · npm run audit:volume

The repo name and the forge:/forge/ storage prefixes keep their old spelling on purpose — deep plumbing, invisible to users, not worth a migration.

MCP

Heatwayve exposes a remote Model Context Protocol server for read-only training tools.

• Endpoint: https://heatwayve.app/mcp (Streamable HTTP)
• Connect: heatwayve.app/connect — OAuth with Face ID / passkey; scope training:read
• Tools (read-only): training_snapshot, recent_sessions, programme, chart_style, current_loads, lift_history
• Claude: Add Heatwayve connector

Unauthenticated calls receive 401 with WWW-Authenticate pointing at the OAuth protected-resource metadata.

License

Heatwayve is source-available, not open-source. The default terms are PolyForm Strict 1.0.0 (read, study, run privately; no redistribution, no derivatives, no reuse of code or content) — see LICENSE for the binding text and LICENSING.md for what it means in practice. Commercial licences (SaaS, white-label, integrations, any commercial use) are available — contact [email protected].

Conduct: CODE_OF_CONDUCT.md. What belongs in this repo and what doesn't: docs/internal-notes.md.