Made of little things.

# Body Journal

An MIT-licensed napplet UI prototype for describing symptoms with an interactive 3D body, concern forms and a readable history. Built in the existing soyLI workspace with TypeScript, Three.js and the napplet SDK.

## Try it

Run `soyli dev` and open its printed URL. Choose **Mark** and paint on the body to start a concern. Rotate, zoom, change height/weight and explore the position presets. On mobile, use About you / Body / Concerns to switch panels. Stop the preview with Ctrl+C when finished.

Right-button drag (including a two-finger trackpad click held while moving)
rotates in every tool. Two-finger trackpad scrolling, wheel and pinch zoom.
On touchscreens, two-finger movement orbits and pinch zooms; one-finger taps and
drags use the selected tool. Lift both fingers before painting again.

The **Anatomy** panel starts open beside the body. Its checkboxes show or hide
whole branches; select a name and press **Focus** to move the camera. Toggle
Anatomy to reclaim the canvas. On narrow frames it opens as a side drawer.

Choose **Pose** to drag the wrist and ankle balls. **Fingers** frames a hand and
shows fingertip balls; drag a tip or use the existing bend sliders. A focused
handle also accepts arrow keys (Shift for smaller steps). Right-drag still rotates.
Working poses and the panel's open/closed preference survive session reloads.
See [anatomy controls and verification](docs/anatomy-controls-slice.md).

Choose **Layer → Muscles**, **Organs** or **Skeleton** to mark named anatomical structures. Selecting
an observation restores its layer and pose. Switching to another layer starts a
separate observation on the next painted stroke. Muscles and organs have a faint body outline
for orientation. These reference layers have incomplete coverage; they are not a
prediction of your personal anatomy.

## Implemented

- Continuous MakeHuman/MPFB skin mesh: 13,380 vertices, 53 bones and nine shape samples; approximate height, weight and body-shape changes.
- Paintable BodyParts3D layers with 345 named muscle/tendon structures and 92 organ structures, including sex-dependent reproductive anatomy. Muscles use region-constrained weights; palms and wrists share a coherent fit.
- A [Mouth layer](docs/oral-inspection.md) with 28 separately paintable adult teeth (FDI names/numbers), tongue and jaw reference meshes; independent visibility and saved jaw-opening illustrations and a skin-landmark fit for the mouth in profile.
- A paintable BodyParts3D skeleton with 238 named bones, discs and costal cartilages, fitted to the posing rig; layer-specific annotations, persistence and image capture.
- Paintable schematic adult external anatomy (penis/scrotum and vulva), independently selectable with a pelvis close-up.
- Versioned triangle/UV paint anchors that follow skin deformation and survive drafts; multiple concerns, undo by stroke, patient-left/right labels and editable locations.
- Standing, sitting, lying, walking and jogging presets; activity playback and illustrative limb dragging. Individual concerns retain pose snapshots.
- Pain/skin-change/numbness/swelling/other concerns; approximate or exact onset, free-text timing, explicit chronic/long-term status, sudden/gradual onset, intensity, course, daily impact, treatments tried and triggers; unlocalized symptoms.
- Health background, medication, allergy, smoking, pregnancy context and recent changes. Unknown and unconfirmed measurements stay unknown in AI requests.
- Shell-owned model selection and BYOK credentials through the experimental NAP-LLM adapter, with explicit input review.
- Automatic body-map image sheets for each painted observation, with saved poses, a context view, targeted angles, coverage notes and review before sharing.
- An alternative paid ContextVM report service using native CEP-8 checkout, shell wallet approval, invoice QR/string fallback and durable order recovery.
- A dedicated report identity with create/restore onboarding, printable private-key QR/PDF backup, optional host remembering, multi-report history and completed-report deletion.
- Automatic host-scoped session save and restore, including forms, body markings, poses, resized photos, current step and completed AI report. Clear a session without removing AI connections.
- Desktop, phone and compact-frame layouts; text region selection; optional-domain fallbacks and app-owned white/off-black colors with reddish orange emphasis.

## Prototype boundaries

The skin is a CC0 MakeHuman asset prepared in Blender. Shape interpolation is illustrative, not an individual anatomical prediction. Surface labels distinguish limb levels, front/back/inner/outer surfaces and fingers using an approximate atlas; they need anatomical review. Brush dabs have exact mesh anchors but are surface-aligned discs, not a geodesic texture mask. Collision-aware posing and measured range of motion remain future work. The soft-tissue atlas is partial: whole lungs, several large trunk muscles and detailed cavities are not included. Male reproductive structures come from the atlas; female reproductive structures are original schematics. The illustration follows the sex field unless overridden. The skeleton is an approximate fit of a separate reference atlas, not a personal anatomy prediction. Lying is supine only. See [skin model and rebuild instructions](docs/skin-model.md).

AI calls use a compatible shell's experimental LLM interface or a configured paid CVM service. Provider keys remain outside this app. Tests use synthetic data and fixture providers; live billing and medical accuracy are unverified. Case/report storage remains host-managed and may contain sensitive information. The paid service's disclosed retention and provider policies apply. See [reference contracts and setup](docs/llm-value-reference.md).

JPEG, PNG and WebP photo import uses the host file picker through SDK 0.30.0. Up to four resized JPEG copies (at most 1280 pixels on the long edge and 65,000 data-URL characters each) are saved atomically with the case; the actual session size is also bounded. Fine detail may be lost. Originals remain on the device, and no public upload is used. Photo selection is opt-in in the editor or AI request review. A verified vision connection can receive selected photos and generated body-map illustrations with distinct source labels. An unverified model requires an explicit text-only choice. PDF/document import and original-resolution attachment storage remain future work. See [photos and reports](docs/photos-and-reports.md).

Use **Examples** in the header to preview three detailed fictional cases before loading. They cover activity-related observations, recurring skin symptoms, and decades/lifelong timing; each includes health background, multiple concerns, impact, treatments tried and patient-suspected groups. A populated case requires explicit replacement confirmation. A persistent banner and AI payload label identify synthetic cases; loading never sends an AI request.

## Connect AI or use a paid report

Open **AI options**. Choose **Your shell connection** to select a configured BYOK/local-model connection in the shell. Choose **Paid report service → Review report & price** to continue with the default service; a different CVM can be configured under **Change service (advanced)**. Saved shell connections do not need a JSON-mode capability flag: report JSON is validated with either text or JSON transport. In either case, review the exact text and selected images before sending. The paid flow shows the price and reviewed input first. Preparing an order saves its receipt without invoicing. The paid tool then opens the shell’s native CEP-8 checkout, with its wallet controls and invoice QR/string fallback. For Minibits, select **I’ve paid — check payment** in the app after completing checkout: this makes one explicit receiving-wallet lookup. Status and recovery never poll that wallet. A verified payment allows the report to run once; reopening a paid receipt does not charge again. Older receipts retain their invoice QR recovery path. The compatible shell and private service were deployed on 6 November 2026. On napplet.soy, sign in and configure an AI connection in the shell before choosing a BYOK model. Paid reports use the configured report service independently.

The paid service offers **Your report identity & history**: create a dedicated key or restore an `nsec`/hex key, including from a QR photograph. Save the printable recovery PDF offline. Remembering the key in host storage is optional; otherwise it lasts for this session. The same key recovers multiple retained reports, independently of your shell login. Existing receipts still work and can be attached explicitly. Completed reports can be deleted from the service; payment records and backups may remain. See [privacy and recovery](docs/REPORT-PRIVACY.md).

Your case and completed report save through host storage. Keep paid recovery receipts private; import one in AI options to resume after a browser reset. No reload automatically repeats inference or payment. Legacy saved provider keys are no longer read; remove them through AI options after configuring your shell.

See [service deployment, recovery and limits](docs/llm-value-reference.md). The previous [bridge](docs/ai-connections.md) and [diagnostics](docs/ai-diagnostics.md) documents describe the retained legacy implementation, not the current app UI. Blender is only required to rebuild anatomy assets.

## Verification

```sh
pnpm verify
pnpm test:ai:transport
pnpm test:ai:ui
pnpm test:evidence
pnpm test:diagnostics
pnpm test:conformance
soyli dev --port 0 --no-open
# In another terminal, using the URL printed above:
pnpm test:evidence:ui http://127.0.0.1:PORT/
pnpm test:prototype http://127.0.0.1:PORT/
pnpm test:anatomy http://127.0.0.1:PORT/
pnpm test:layers:ui http://127.0.0.1:PORT/
node tests/gestures-smoke.mjs http://127.0.0.1:PORT/
node tests/mouth-smoke.mjs http://127.0.0.1:PORT/
soyli check
```

The browser test uses the Chromium already managed by soyLI and Playwright supplied by the existing conformance dependency. It saves synthetic screenshots and results under ignored `.napplet-space/prototype-checks/`. It explicitly sizes the sandbox iframe to verify actual app dimensions; those host-style overrides exist only in the test. Stop the owned dev session after testing.

The transport check runs actual encrypted ContextVM messages over a disposable loopback relay with a synthetic vendor. The AI UI test uses explicit test-only SDK fixtures; the hosted prototype test verifies the actual soyLI storage and UI path. These checks do not establish a live vendor assessment or clinical quality.

See [prototype notes](docs/prototype.md), the [AI integration notes](docs/ai-connections.md), the [research plan](docs/product-plan.md), and [workspace commands/capabilities](docs/napplet-space.md). Follow [sandbox boundaries](docs/boundaries.md) and [mobile guidance](docs/napplet-mobile.md) when extending the app.

## License

[MIT](LICENSE), provided as-is, for this project's authored code. Dependencies retain their own licenses. The optional server imports the unmodified ContextVM SDK as an external package; it is not included in the napplet HTML. Its package metadata says LGPL while its shipped license file says GPL; this discrepancy is recorded in [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md). The skin mesh, rig data and shape assets derive from MakeHuman/MPFB core CC0 assets. Attribution, version and the asset license are retained under [assets/skin](assets/skin) and in the third-party notices. No MPFB program code or external textures are bundled into the napplet.

The skeleton, muscle, organ and mouth data derive from BodyParts3D, © The Database Center for Life Science,
under [CC BY 4.0](https://dbarchive.biosciencedbc.jp/en/bodyparts3d/lic.html).
See [skeleton notice](assets/skeleton/NOTICE.md), [soft-tissue notice](assets/anatomy/NOTICE.md),
[mouth notice](assets/mouth/NOTICE.md), [source/output provenance](assets/anatomy/muscles-provenance.json) and [layer implementation/rebuild notes](docs/anatomy-layers.md). This separate
asset license does not change the authored app code's MIT license.

## Roadmap

The [implementation roadmap](docs/roadmap.md) separates completed anatomy, focused
inspection, direct IK, observation groups, photo attachments, example cases and
detailed/plain-language reports from planned PDF import/export, internationalization, expanded poses, complete case export/import,
encrypted Nostr persistence, child proportions and camera pose detection.

Observation groups: use **+ Group** in the concerns sidebar to name a suspected
connection, explain it and check its members. A concern can be in multiple groups.
Removing a group keeps its concerns. Groups save with the session and appear as
patient-suspected relationships in the reviewed summary and AI request.
See [group behavior and verification](docs/observation-groups.md).

Native payments use standard `cvm.callTool` with `payment: "prompt"`. Free disclosure, input staging, status and explicit confirmation use `payment: "deny"`. The local NAP-VALUE amendment is deferred; this app no longer calls a VALUE interface. Shell BYOK through the optional NAP-LLM draft is unchanged.