# Deferred inputs

Updated: 2026-07-31

## Stripe billing — Phase 7.5

Needed from the operator before the implemented flow can be activated:

- Add `STRIPE_SECRET_KEY` to the production environment. Hosted Checkout does not need a publishable key in the browser.
- Create the recurring Premium price and add `STRIPE_PRICE_PREMIUM`.
- Enable the customer portal, register `/api/billing/webhook` for subscription created/updated/deleted events, and add `STRIPE_WEBHOOK_SECRET`.
- Do not store or paste secret values in the repository or chat.

## Production key rotation — Phase 1.4

DataProtection key rotation was confirmed complete by the production operator on 2026-08-02.

## Operator handoff

The remaining work requires external systems or production access, in this order:

1. **Run remote CI** for the reviewed working tree and diagnose the self-hosted runner only if it still fails.
2. **Completed 2026-08-02:** production DataProtection keys rotated.
3. **Deploy and verify production** login, OAuth, registration/Turnstile, real data, public CV/PDF, AI, and attachments.
4. **Activate Stripe billing** after its product, price, portal, webhook, and secrets exist.
5. **Rehearse the legacy-column cutover** against the restored production backup; remove columns only in a later expand/contract release.

### Access and inputs still needed

- **CI:** a reviewed commit/branch submitted to Gitea Actions; runner host/log access if the workflow remains unstable.
- **Stripe:** create/configure the Premium recurring price, portal, and webhook, then set `STRIPE_SECRET_KEY`, `STRIPE_PRICE_PREMIUM`, and `STRIPE_WEBHOOK_SECRET` outside the repository and chat.
- **Production access:** authorized host credentials for backup/restore, deploy, authenticated smoke tests, OAuth, and legacy-data validation.

Recruiter-facing PDF download and job-specific learning paths are implemented and tested in the working tree. Separate recruiter discovery/messaging and portfolio hosting are intentionally outside the current product scope. The existing `.agent.md`/`AGENTS.md` changes and the migration designer's line-ending-only status are unrelated and must be preserved.

## Progress

Phases 2 through 7.9 are implemented. Production reports registration and Turnstile enabled; remote CI, interactive production verification, key rotation, Stripe activation, deployment, and the production-backed legacy cutover remain. Public CV sharing, job-specific learning paths, premium themes, AI call and token limits, visible account usage, storage limits, NAV discovery, provider market dual-write with synchronized edits, CORS hardening, the prospect workflow, migration-history reconciliation, salary insights, browser smoke coverage, and Stripe billing are present in the working tree.