jobtrackingapp/docs/deferred-inputs.md

Deferred inputs

Updated: 2026-07-31

Stripe billing — Phase 7.5

Needed from the operator before the implemented flow can be activated:

• Add STRIPE_SECRET_KEY to the production environment. Hosted Checkout does not need a publishable key in the browser.
• Create the recurring Premium price and add STRIPE_PRICE_PREMIUM.
• Enable the customer portal, register /api/billing/webhook for subscription created/updated/deleted events, and add STRIPE_WEBHOOK_SECRET.
• Do not store or paste secret values in the repository or chat.

Production key rotation — Phase 1.4

DataProtection key rotation was confirmed complete by the production operator on 2026-08-02.

Operator handoff

The remaining work requires external systems or production access, in this order:

1. Run remote CI for the reviewed working tree and diagnose the self-hosted runner only if it still fails.
2. Completed 2026-08-02: production DataProtection keys rotated.
3. Deploy and verify production login, OAuth, registration/Turnstile, real data, public CV/PDF, AI, and attachments.
4. Activate Stripe billing after its product, price, portal, webhook, and secrets exist.
5. Rehearse the legacy-column cutover against the restored production backup; remove columns only in a later expand/contract release.

Access and inputs still needed

• CI: a reviewed commit/branch submitted to Gitea Actions; runner host/log access if the workflow remains unstable.
• Stripe: create/configure the Premium recurring price, portal, and webhook, then set STRIPE_SECRET_KEY, STRIPE_PRICE_PREMIUM, and STRIPE_WEBHOOK_SECRET outside the repository and chat.
• Production access: authorized host credentials for backup/restore, deploy, authenticated smoke tests, OAuth, and legacy-data validation.

Recruiter-facing PDF download and job-specific learning paths are implemented and tested in the working tree. Separate recruiter discovery/messaging and portfolio hosting are intentionally outside the current product scope. The existing .agent.md/AGENTS.md changes and the migration designer's line-ending-only status are unrelated and must be preserved.

Progress

Phases 2 through 7.9 are implemented. Production reports registration and Turnstile enabled; remote CI, interactive production verification, key rotation, Stripe activation, deployment, and the production-backed legacy cutover remain. Public CV sharing, job-specific learning paths, premium themes, AI call and token limits, visible account usage, storage limits, NAV discovery, provider market dual-write with synchronized edits, CORS hardening, the prospect workflow, migration-history reconciliation, salary insights, browser smoke coverage, and Stripe billing are present in the working tree.