Four distinct roles — client, trader, operations, admin — each need a different view of the same challenge account, with no leakage between them.
What I did about it
argon2 password hashing with TOTP second factor from the start rather than retrofitted.
The full public marketing group is server-rendered; the four role dashboards are client-rendered behind auth.
What I rejected, and why
Nine commits, one test file, no CI and no migrations. The architecture is sound; the engineering discipline around it is not there yet. Listed because it is real work, not because it is finished.
Nine commits, one test file, no CI and no migrations, on a platform that takes payments for trading challenges. The architecture is sound and the engineering discipline around it is not there yet — it needs the same treatment the Quata products got.