Plans · updated 2026-10-01

PRD 003 - Go live Saturday, October 10, 2026

Status: Working plan. Written 2026-10-01, late evening. Section 2 is the brief for the CTO review on Friday morning. Owner: Sheila. Builder: Claude Code, in wtf-app, wtfisai-web, and a new wtf-builders repo. Where things are: web app on staging at staging.wtfisai.co, admin at /admin on staging only, website live at wtfisai.co. Production does not exist yet.

1What goes live on October 10

Decided 2026-10-01: paid playbooks are $29 each and $79 for three. Builders is a private documentation site behind Cloudflare Access. Target go-live is Saturday, October 10.

Decided 2026-10-01, late: money goes to the Tandem Stripe account. Builders is live at wtf-builders.pages.dev pending the custom domain and Access (section 6). Playwright smoke tests run against staging and production from wtf-app (section 2.7). Still open, needed by Sunday night: production gate on day one, open or allowlisted.

2The technical brief, for the CTO review on Friday

Everything below is already built or decided unless marked proposed. Questions for the CTO are at the end.

2.1 Repos and folders

One product, three repos. There are no per-environment folders. Environments are branches and deploy targets, not copies of the code.

The iOS app, when it starts, gets a fourth repo. It will have two Xcode build schemes, Staging and Production, that differ only in the API base URL and the Supabase keys. Same rule: one codebase, two targets.

Why not wtf-app/staging-webapp and wtf-app/production-webapp: two folders drift. A fix lands in one and not the other, and within a month nobody knows which is true. A branch merge from staging to main is the only promotion step, and the diff between them is always visible.

2.2 Hosting and runtime

• Cloudflare Workers, git-connected. One Worker per environment: wtf-app-staging and wtf-app. The Worker serves the static bundle and answers /api/*. Workers rather than Pages because the app runs the plan agent server-side and will hand out signed download links.
• Cloudflare Workflows run the plan agent as a durable multi-step job, so a slow model call survives a dropped connection.
• Cloudflare R2, proposed for this week: one private bucket for paid PDFs. The Worker checks the purchase and issues a short-lived signed URL. Free magnets stay in the public bundle.
• Secrets live in Cloudflare as Worker secrets, set with wrangler secret put, never in the repo. Public-safe config is in wrangler.jsonc.

2.3 Identity and data

• Supabase Auth, email code only. No passwords, no social login, no Sign in with Apple at MVP. One project per environment: wtfisai-staging exists, wtfisai-prod is created this weekend.
• Sign-in emails are sent through Resend over SMTP from hello@wtfisai.co. Both Supabase templates, Confirm signup and Magic Link, carry the code, because Supabase uses one for new addresses and the other for returning ones.
• Postgres in Supabase for profiles, plans, waitlists, and this week purchases. Row Level Security is on with no policies, so the browser's publishable key can read nothing. All data access goes through the Worker with the secret key after verifying the user's JWT.
• The future iOS app calls the same /api/* routes with the same Supabase token.

2.4 Payments, proposed design

• Stripe Checkout, hosted by Stripe. The app never touches card data. One item per checkout, no cart.
• Buy button -> Worker creates a Checkout Session with the Stripe price id from the manifest and the user id in metadata -> Stripe hosted page -> redirect back to the Library.
• A webhook /api/stripe/webhook verifies Stripe's signature and, on checkout.session.completed, inserts a row in purchases. The Library reads entitlements from that table, so the item flips to Yours. The redirect is cosmetic. The webhook is the source of truth.
• Promotion codes are on in Checkout from day one, which is how discount and affiliate codes work without building a code system.
• Test mode on staging, live mode on production. Two sets of keys, two webhook endpoints, both registered in the Stripe dashboard.
• The $79 bundle is a fourth Stripe product that grants three entitlements in one webhook event. Second pass.

2.5 Admin and the builders site

• Admin is a CRM at /admin, allowlisted by email in the Worker config. By policy from September 13 it is reachable only on staging and reads production data through read-only secrets. Admin routes return 404 on production, so the production Worker holds no path to customer data beyond each user's own.
• Builders, proposed: a static site at builders.wtfisai.co, generated from the markdown in WTFISAI-APP and WTF-DESIGN, behind Cloudflare Access with Google sign-in restricted to a list of emails. Zero cost under fifty users. Admin gets a Builders link in its submenu. Admin stays data, builders stays documentation.

2.6 Testing, proposed

• Playwright lives in wtf-app/tests. npm run e2e:staging and npm run e2e:production run the same suite against each environment on desktop Chrome and a phone profile. Four smoke tests pass on staging tonight: health names the environment, the welcome form renders with no console errors, the library refuses without a session, admin is guarded on staging and 404 on production.
• Real sign-in test: the suite mints the email code through the Supabase admin API instead of reading an inbox, types it, and expects the path screen. It needs the environment's Supabase URL and secret key in the shell and skips without them. First real run is the Friday morning session with the CTO.
• GitHub Actions workflow e2e.yml runs the suite on every push to staging and main, after waiting for the Worker to answer. It is committed locally and not yet pushed, because the GitHub login on this laptop lacks the workflow scope. One command fixes it: gh auth refresh -h github.com -s workflow, then git push.

2.7 Questions for the CTO

1. Stripe account, decided: Tandem. Anything you would flag about selling under a brand of Tandem and Community, Inc. from that account, for payouts or reporting?
2. Production gate. Open sign-ups from the moment app.wtfisai.co answers, or an allowlist until the 10th? The admin policy already makes the staging allowlist the admin list, so this only affects production.
3. R2 signed URLs for a $29 PDF: is a sixty-second link with the user id in the object key enough, or do you want per-download logging in the purchases table from day one?
4. Webhook idempotency. Plan is a unique constraint on the Stripe session id so a retried webhook is a no-op. Anything else you would insist on before live mode?
5. Backups. Supabase Pro has daily backups. Staging is on the free tier. Should production start on Pro ($25 a month) on day one, or only once there are paying customers?
6. Playwright. Is minting the code through the Supabase admin API acceptable for the sign-in test, or do you want a real inbox? What else belongs in the suite before live mode: a test-mode purchase end to end?
7. Anything in 2.1 to 2.7 you would do differently while it is still cheap to change.

3Working backwards from the 10th

Today is Thursday, October 1. Nine days. The weekend is the build window. Monday to Wednesday is content and polish. Thursday is a freeze. Friday is slack.

The one rule: anything not on this table waits until the 11th. The plan gap section, the 101 modules, the community subscription, the bundle, Kit sync, and iOS are all after.

4Stripe, step by step

4.1 Sheila, Friday, in the Stripe dashboard (test mode)

1. Confirm which account, per CTO question 1. Toggle Test mode on.
2. Products -> Add product, three times:

1. Copy each price id (starts price_) into the keys document next to our id.
2. Developers -> API keys -> copy the test secret key (starts sk_test_) into the keys document.
3. Developers -> Webhooks -> Add endpoint: https://staging.wtfisai.co/api/stripe/webhook, event checkout.session.completed. Copy the signing secret (starts whsec_) into the keys document.
4. Products -> Coupons: one coupon, 50% off, with promotion code TEST50, to prove codes work.

Tuesday, repeat 2 to 5 with Test mode off, endpoint https://app.wtfisai.co/api/stripe/webhook. Live keys go in the keys document under a separate heading.

4.2 Claude Code, Friday and Saturday

1. Migration 0006_purchases.sql: purchases (user_id, item_id, stripe_session_id unique, stripe_payment_intent, amount_cents, currency, promo_code, status, created_at, refunded_at). RLS on, no policies.
2. Manifest gains stripePriceId per paid item, read from env so staging and production can differ.
3. POST /api/checkout/:itemId creates the Checkout Session and returns the URL. POST /api/stripe/webhook verifies the signature and records the purchase. GET /api/library includes owned per item from purchases.
4. Buy button on the Library and item pages opens Checkout. Return page shows Yours.
5. R2 bucket wtf-paid, bound to the Worker. GET /api/download/:itemId checks ownership and returns a signed URL that lives sixty seconds.
6. Admin People card shows purchases. Admin gains a Purchases list.
7. Refund handling: charge.refunded marks the row refunded and the item locks again.

4.3 Second pass, after the 10th

The $79 bundle as a fourth product granting three entitlements. The community at $10 a month as the first subscription, with customer.subscription.* events. The course at $500 with a one-year expiry.

5Production, step by step

Sheila, Friday afternoon, in dashboards. Each line was already done once for staging.

1. Supabase: New project wtfisai-prod, same org, region US East. Settings -> API: copy Project URL, publishable key, secret key into the keys document.
2. Supabase -> Authentication -> Emails -> SMTP Settings: enable custom SMTP. Host smtp.resend.com, port 465, user resend, password a new Resend API key named supabase-production, sender hello@wtfisai.co, sender name WTF is AI.
3. Supabase -> Authentication -> Emails -> Templates: paste the code body into both Confirm signup and Magic Link. Both must contain {{ .Token }}.
4. Supabase -> Authentication -> URL Configuration: Site URL https://app.wtfisai.co. Rate limit for emails 100 an hour.
5. Supabase -> Authentication -> Providers -> Email: sign-ups on or off per the gate decision. Can flip any time.
6. Cloudflare -> Workers & Pages -> Create -> Import repository wtf-app. Name wtf-app, production branch main, build npm run build:production, deploy npx wrangler deploy --env production. Non-production branch builds off.
7. Anthropic Console: a second API key named wtf-app-production, into the keys document.

Claude Code then fills .env.production and the production vars, pushes the five secrets, runs migrations 0001 to 0006 in the production SQL editor with you, and confirms app.wtfisai.co answers.

6Builders

• Built 2026-10-01. Private repo sheilala07/wtf-builders. build.py renders the markdown from WTFISAI-APP/PRDs, WTFISAI-APP/docs, WTF-DESIGN, and its own content/ folder (timelines, pricing sheet, messaging, product roadmap, the quiz brief) into one site. ./deploy.sh builds and uploads.
• Cloudflare Pages project wtf-builders, live at wtf-builders.pages.dev. Custom domain builders.wtfisai.co is a dashboard step.
• Cloudflare Access: Zero Trust -> Access -> Applications -> Self-hosted, domain builders.wtfisai.co, policy Allow, include emails: the admin list. Login method Google, or a one-time PIN to the email, which needs no Google account.
• Front page is this PRD's section 3 table, updated as days close.
• Admin gets a Builders entry in its submenu that opens builders.wtfisai.co in a new tab.

7Website changes, Sunday

No login, signup, or checkout is built on the website. The app owns identity and money. If a product page on the site ever earns its place through search traffic, it links to the same app item.

8Checklist

• Fri: CTO review done, changes folded into this PRD
• Fri: wtfisai-prod created and configured, keys in the document
• Fri: Stripe test products, test keys, test webhook, TEST50
• Fri: opt-in captured on staging
• Sat: test purchase on staging flips to Yours, PDF downloads for buyer only
• Sun: app.wtfisai.co answers, real sign-in on phone and desktop
• Sun: website CTAs, Sign in link, Library section live
• Sun: builders.wtfisai.co behind Access, this PRD on it
• Sun: gate decision made and applied
• Mon: final names, blurbs, prices, testimonials
• Tue: Stripe live products and keys on production
• Wed: one real purchase and refund on production
• Thu: full new-user pass, list of fixes
• Sat Oct 10: live