05Toul'BarzUnder construction

“we've seen there are loads of crazy things being done with automation. you know this stuff, do you think it could help us run the club?”

the board of a street workout club, in Toulouse

A club driven from the LLMs it already uses.

The board writes to Claude or to ChatGPT, the way it already does. Behind that, a gateway recognises the club and refuses whatever goes too far; a monochrome dashboard holds the events, the memberships and the sends. Nothing goes out without passing through the choke point, nothing is lost in silence.

From the first file to the modules in service
6 weeks
What's left of it today
233 members, 76 events out of the spreadsheets
Core in production
3 June 2026

tbEnter The club's private platform · designed, coded and shipped, solo

WhatsApp programme du lundi · envoyé Mail relance · partie par mail Push notification push · envoyée Événements En préparation → Prêt Membres relance de renouvellement Programme programme du lundi · composé le bureau · dans son assistant
The club's board inside its assistant, and six arms reaching out to what the assistant does for them: WhatsApp, email, push, events, members, programme. Every pulse is a real action of the product, said in its own words. The drawing beats without end.

What the sentence meant

A volunteer board spending its evenings in spreadsheets and on paper: events, memberships, chasers, group messages. That board already uses Claude and ChatGPT for the club, and watches “loads of crazy things being done with automation” go by. Nobody was asking for a platform. The question put was: can this give us time back.

Not to teach them a new tool: to plug their LLMs, over MCP, into a gateway that knows who is speaking and what they are allowed to send. And to lift out of the spreadsheets whatever repeats: the events followed through five states, the HelloAsso memberships handled as they arrive, the chasers sent on time, the WhatsApp groups served on Monday morning.

What was built

A silver-and-ink dashboard behind a threshold; an API on a server, with a scheduler on Paris time; a sending gateway shared by every project in the house; and MCP access so the board can drive it all from its own LLMs.

Driven from their own LLMs, over MCP

The club has no new tool to learn. Its LLMs connect to the sending gateway over MCP; the token carries the club's identity, and every call goes through the same choke point as every other send on the platform. Whatever the LLM asks for, the server checks: a refusal comes back readable, with the reason and the exact wait before the next window.

THE BOARD Claude, ChatGPT the LLMs already in use for the club from their own tools MCP token in the name of the club THE SENDING GATEWAY THE CHOKE POINT kill switch, suspension quotas and rate consent suppression list WhatsApp anti-ban content guard rails server side, never in the prompt allowed WHAT GOES OUT Email contact@admin.toulbarz.fr WhatsApp the club's number Push notification on the phone · to come readable refusal: quota, consent, exact wait before the next window the key, exchanged once, never enters the LLM's context
The gateway's client access (spec 1 of the platform, ADR-020 and ADR-021 of the sending service): the project key serves as an OAuth credential once only, the token carries the tenant, and the tools read that identity. No falling back on a default project: at the slightest ambiguity, refusal.

Security does not rest on the language model. It is in the server, and it applies before the model: a model asking for a forbidden send is refused, whatever anybody wrote to it.

The club's emails go out from contact@admin.toulbarz.fr, with their own ceiling and their own domain.

La limite, côté serveur

Mécanique. Rien ici ne dépend de ce qu'on écrit au modèle ; l'ensemble est vérifié de bout en bout à deux associations.

  • identité par jeton : l'appel porte l'association, pas le modèle
  • cloisonnement : aucune donnée d'une autre association n'est atteignable
  • quotas et débit, réglés en dessous des politiques d'usage des messageries et de WhatsApp
  • consentement et liste de suppression, vérifiés à chaque envoi
  • propriété du numéro WhatsApp, et cadence anti-blocage
  • coupe-circuit et révocation, immédiats

La consigne, côté modèle

Un extrait. Indicative : elle ne protège rien, elle évite de buter sur des portes déjà fermées.

Tu agis pour Toul'Barz, association de street workout de Toulouse. Tu envoies au nom de l'asso, jamais en ton nom propre.

DESTINATAIRES PERMIS : membres et adhérents de l'asso, personnes qui ont écrit d'elles-mêmes, référents et partenaires d'événements. RIEN d'autre.

INTERDITS, sans exception : démarchage à froid ; envoi de masse non sollicité ; contourner un désabonnement en changeant de canal. Le serveur refusera de toute façon.

AVANT D'ENVOYER : fais relire tout message à un humain de l'asso. En cas de refus du serveur, lis le code renvoyé et l'outil limits ; ne boucle jamais sur un refus.

What runs on its own

The platform does not wait for anybody to think of it. A scheduler in the API wakes every minute, on Paris time, and sets off the automations at fixed hours. Every send has three positions: off, prepared and approved by hand, or automatic. It is born off.

every minute, on Paris time 04:10every night, clearing the technical logsmaintenance, nothing to set 07:30every morning, reminders to the leadto the lead, alone 08:00on Monday, the week's programme on WhatsAppto the subscribed groups 08:05on the 1st of the month, activity debriefto the board 08:15every morning, renewal chasersoff, to approve or auto 15 minall day long, health watch and incident emailto the board, if there is an incident
The times are declared by the modules themselves.

A new member arrives

Somebody pays their membership on HelloAsso. It comes in straight away. Nobody has anything left to type: the member's complete record exists in the club's system within the minute, they join the members mailing list on their own, and the welcome message, with the getting-started guide, goes out if the board has switched it on.

TRIGGER Membership paid on HelloAsso, signed webhook STRAIGHT AWAY Member record created membership valid one year 7 records created on their own from 6 to 12 August 2026 THEN Joins the Members list kept up on its own FINALLY Welcome message once only the board's choice: off, to approve, or auto never twice, even if HelloAsso notifies twice
In production since 13 July 2026.

The message goes out on the first membership, never on renewals. And once only: if HelloAsso announces the same membership twice, the person receives one message.

Toul'Barz

Objet : Bienvenue chez Toul'Barz

Bienvenue dans l'asso

Bonjour Camille,

Ton adhésion à Toul'Barz est bien enregistrée. Bienvenue dans l'asso.

Les entraînements, les événements et les infos pratiques arrivent dans les groupes WhatsApp : si tu n'y es pas encore, réponds à ce message.

L'équipe Toul'Barz

Toul'Barz, message automatique.

One example email, adjustable at 100 %.

The membership comes up for renewal

Every morning at 08:15, the platform looks at who is reaching the end of their year and prepares the chaser.

one chaser per due date: the most urgent one that applies D-30 D-7 DUE DATE SIXTY DAYS LATER one month before,a gentle warning one week before,the final stretch on the day itself,membership expired the automatic chasersstop, the board takes over the check runs every morning the send is set: off, to approve, or auto

A payment is declined

The bank declines a membership payment. Rather than writing behind the board's back, the platform prepares the case and lets them decide who to chase. This “on approval” mode is the one in service; automatic mode exists, with at most one chaser a day per person.

TRIGGER Payment declined flagged by HelloAsso STRAIGHT AWAY The case enters the queue amount, link to put it right YOU You tick who to chase mode in service: on approval RESULT The message goes the case moves to chased at most one chaser a day per person the only message signed by people: “À vite aux barres, L'équipe Toul'Barz”
HelloAsso sometimes re-notifies the same decline: the case stays marked as chased instead of starting over.

The lead is reminded, and only the lead

Every event has a lead. The platform follows the calendar in their place and chases them at the four moments that count, every morning at 07:30. The reminder stops as soon as it is done; a milestone once chased is never played again.

the lead chased at 07:30 D-15 D-7 D-DAY D+5 D+10 the templateto fill in the teamto confirm the eventtakes place the write-upnot started the write-uplate the reminder stops as soon as it is done; a milestone once chased is never played again send impossible: written on the record, to be done by hand
The milestones are worked out from the record, never stored (events/services/milestones.ts). Events imported from the history have none: nobody gets chased about an event from 2024.

The event files itself

Creating an event in the dashboard is enough. As soon as it moves to in preparation or ready, the platform publishes it in the right calendar, opens it a folder and books the equipment.

Événements

Le cœur de l'asso, de l'idée jusqu'au bilan.

Prochain programme WhatsApp (lundi)

The life cycle of an event, taken from the dashboard's code (StatusStepper.vue, ADR 0020): five states, from the idea to the review. Click a state to move to it, or cancel: the rules, the delays and the confirmation message are the product's own. Nothing is saved here. The copy button takes the Monday programme reproduced below.
TRIGGER The event moves to in preparation or ready cancelled: removed, equipment freed visibility changed: other calendar finished: stays in the calendar THREE EFFECTS, IN A CHAIN Calendar public or members, depending on visibility Drive folder named after the event, created once Equipment each item booked in its own calendar
An event created once ends up in the right calendar, with its folder and its equipment booked. Nothing to copy anywhere else, nothing to keep up by hand.

WhatsApp, without thinking about it

Two automations: the week's programme goes out on its own on Monday morning to the subscribed groups, and any event is announced in one click from its record, to the channel of your choice.

EVERY MONDAY AT 08:00 08:00, on Monday the scheduler wakes Programme composed the week's events AN ANNOUNCEMENT, IN ONE CLICK The event record one button, one click Channel chosen Announcements, Trial sessions, Members ONE GATEWAY ONLY Sending gateway quotas, pacing, consent, log THREE WAYS OUT WhatsApp the subscribed groups Email the list concerned Push notification on the phone · to come a week with no event: nothing goes out every attempt written to the log, with its reason

The same engine gives, on every record, a text ready to paste for Instagram, behind a copy button. The next step is written down: for the story to go out on its own, through the same gateway, with the same guard rails.

Programme de la semaine (du 20/07/2026 au 26/07/2026)

- mercredi 22/07/2026, 18h30 : Entrainement barres - Parc Compans (adherents)
- samedi 25/07/2026, 14h30 : Show Capitole - Place du Capitole
The programme as events/services/texts.ts composes it, without accents for WhatsApp. The two events are the examples from the club's process booklet.

Opening an account for somebody

Nobody creates an account on their own, and nobody picks a password in somebody else's place. The board invites; the person chooses their own password, and sees what their role lets them see.

YOU You create the account address, name, role STRAIGHT AWAY A single-use link valid one hour THE PERSON They choose their password RESULT They see what their role allows Removing an account logged out within the second, on every device; reversible Three guard rails no removing your own admin rights, no deactivating yourself, no removing the last admin

The threshold, and the material

Before writing a line, I spent time inside their world: their photographs, their videos, what they publish, what they do not. Street workout, seen close up, is performance and show, but above all it is a sensation, the sensation of hanging in the air, defying gravity. That is what I wanted people to feel on arriving.

Hence a home page that sells nothing and explains nothing: an athlete in a human flag under the oculus of a dome. No menu, no pitch. You click anywhere and you are in. The black and white is not an affectation: it is their own eye, something with class that has nothing to prove. Any colour added from now on takes a written decision, so that nobody spoils it by accident.

The platform's front page: an athlete in a human flag on a bar, under the lit oculus of a dome, in black and white; at the bottom left, the monogram, the word Entrer and Mentions légales.
The same front page on a phone: the scene cropped to the athlete and the oculus, the stack monogram, Entrer, Mentions légales at the bottom left.
On a phone the scene re-crops; the stack stays in the same place.
An athlete balanced on a bar, arms out, in a monochrome wireframe cosmos: meridians drawn in line, a glowing galaxy on the right, a dense silver grain.
The threshold open: the scene has darkened and come closer, and a login form is born in the light of the oculus, with the monogram, the E-mail and Mot de passe fields, the Se connecter button and a Retour link.
The threshold. A successful login sends the scene diving through the oculus (scale 8 in 1.75 s), and the dashboard condenses out of the silver material behind it, with three doors.

Fraunces for the headings, Archivo for the interface, JetBrains Mono for whatever gets copied; all three self-hosted. No radius on the primitives, no shadow: depth comes from flat layers stacked, from halos, and from a silver grain that is the only noise allowed.

  • VisiteurLe visage public de l'asso.
  • MembreL'espace des adhérents.
  • AdminLe poste de pilotage.

What the platform does, by use

Four families, in the order the board meets them.

Memberships
  • Member records created when the HelloAsso payment lands, with nothing to type
  • Members list kept up on its own
  • Welcome message, once only, never on renewals
  • Renewal chasers at D-30, D-7 and on the day itself
  • Declined payments: the case is prepared, the board chooses who to chase
Events
  • Five states, from draft to finished, on a single thread
  • Reminders to the lead, four milestones around the day
  • Calendar and folder opened on their own when the event moves to in preparation
  • Equipment booking in its own calendar
Communication
  • The week's programme on Monday at 08:00, composed from the events
  • One-click announcement from the record, to the channel chosen
  • Email campaigns, ten templates, dedicated sending account
  • Instagram text ready to paste, automatic story to come
  • Push notification on the phone, to come
Driving it
  • MCP: everything above can be asked for from the LLMs the board already uses
  • Accounts and roles: invitation, password chosen by the person, reversible deactivation
  • Health watch every fifteen minutes, incident email, debrief on the first of the month
  • Log: every send, successful or refused, with its reason

Nothing goes out by surprise. A silent failure is a bug (ADR 0022): anything that does not go out says so, with the reason, and can be played again.

And the platform watches over itself: every fifteen minutes it checks that it is well and writes an email if there is an incident; on the first of the month it sends a summary of its activity; every night it clears its technical logs, without touching the club's history (ADR 0025).

The result

“Do you think it could help us?” became: a core in production on 3 June 2026, modules in service on 13 July; on 20 July, 216 members and 76 events out of the spreadsheets; in August, seven memberships handled without anybody touching them; and since 20 August, a gateway that recognises the club when its LLM knocks at the door.