Design referral program for vod-manager with tiered storage

next steps

—

key decisions

• Ambassadors use the app-owned free-tier StorageProfile but skip time-purge and count caps
• Referred accounts get boosted free tier (multiplier on retention + count caps, not byte caps)
• Milestone increases apply retroactively to all existing referred accounts
• Vanity URL format is domain.com/{code} with reserved slug protection
• Feature access should be tier-matrix based with AppSettings overrides

open questions

—

next steps

—

key decisions

• Implementation matches the agreed design exactly
• Additional admin-issued invitation/whitelist layer added (not in original spec but sensible)
• Double-credit prevention via lockForUpdate transaction with re-check
• Vanity URL namespace protected by catch-all route with regex constraint

open questions

—

next steps

—

key decisions

• Code regex: /^[a-z0-9]([a-z0-9_]|-[a-z0-9_])*$/ — allows underscores anywhere, single internal hyphens, no leading/trailing/double hyphens
• Default code prefers Twitch login over display name over email prefix
• syncReferredMultipliers now only updates rows where multiplier or referrer_id actually changes

open questions

—

next steps

—

key decisions

• Use one shared CodeHistoryPresenter for both admin and ambassador views, toggling actor display via include_actor flag
• Admin view eager-loads replacedBy/retiredBy/updater/creator; ambassador view only loads replacedBy

open questions

—

next steps

—

key decisions

• Acceptance-page suggested code now correctly defaults to Twitch login over display-name slug; stale test assertion updated rather than reverting behavior
• syncReferredMultipliers only writes rows whose value actually changes, so updated_at isn't churned across the cohort

open questions

—

next steps

—

key decisions

• Deferred reward emails, cost dashboard, live overlays, opt-out, profanity screening, and tier-opening as post-launch follow-ups #574-579

open questions

—

next steps

—

key decisions

• Separate the pre-existing copy-button extraction from the reviewer's own follow-up changes into two commits for clean history

open questions

—

next steps

• Push origin/main once pre-deploy checklist (B2 bucket, Mailgun/yt-dlp/Nightwatch) is cleared

key decisions

• Hold the push: origin/main push likely triggers Forge production deploy, and the feature isn't deploy-ready per HANDOFF.md

open questions

• Is Forge auto-deploy on for origin/main?

next steps

• Sample/refine the email copy at /dev/mail (vodmanager.test/dev/mail)
• Work the HANDOFF pre-deploy checklist: prod free-storage bucket + FREE_STORAGE_ENABLED, reward-email ship decision, run 5 additive migrations, grant first ambassadors
• Wire the reward-email senders (follow-up #576) when ready

key decisions

• Reward emails are templates only; actual dispatch is deferred to Solo follow-up #576
• Preview harness is local-only and aborts (404) in production via app()->isProduction()
• Deployment is deliberately held — do not push origin/main until the pre-deploy checklist clears (mainly prod free-storage + email-ship decision)

open questions

• Whether the reward emails should ship now or remain deferred (a listed pre-deploy decision)

next steps

—

key decisions

• Sending of reward emails deferred to follow-up #576; only templates committed
• /dev/mail preview harness blocked in production via app()->isProduction()
• Keep main unpushed — deploy remains held until pre-deploy checklist clears

open questions

—

next steps

—

key decisions

• Partition security track by Livewire directory; SEO track by public view groups
• Use cheap broad finders then adversarial verification on serious security findings

open questions

—

next steps

• Await workflow completion and digest ambassador + clip reports

key decisions

• Ambassador review uses trusted-small-N lens — abuse/sybil/cost-against-strangers explicitly out of scope
• Clip track must explore conductor + conductor-client and the integration seam

open questions

—

next steps

• Create one brief per review report (SEO, security, ambassador, clip) as workflows land, likely under a shared review epic

key decisions

• Populate review briefs with actual findings as reports land rather than empty shells now
• Agent may create/shape briefs freely without checking in first

open questions

—

next steps

• Read the full task output to extract the security report and SEO report tail
• Create flower briefs capturing the SEO and security findings, cross-linked to #146/#147

key decisions

• Avoid schema-forced structured output for large review agent outputs; use free-text prose agents with an Opus lead to synthesize, because forced JSON tripped the retry cap

open questions

—

next steps

• Create review briefs (SEO, security, ambassador, clip) as each workflow report lands, likely under a review epic
• Provide operator a digest per report

key decisions

• Track the ambassador comms copy refinement as a distinct work item (#147) separate from deploy readiness
• Reward-email dispatch is deliberately not wired; only wire senders (#576) if emails ship at launch
• Agent may create/shape flower briefs freely as reviews return, without operator check-in

open questions

—

next steps

—

key decisions

• Create separate briefs for security and SEO findings based on standing authorization.
• Use the review results as-is; no code changes were made in this session.

open questions

—

next steps

—

key decisions

• Ambassador system needs retuning for a friend-scale community, not a growth funnel.
• Clip pipeline can ship without conductor dependency.
• The three P0 clip issues and the HIGH ambassador bug must be fixed before production deployment.

open questions

—

next steps

—

key decisions

• Wrap QualifyReferralOnVodArchived in try/catch to prevent DB failures from bubbling up and failing UploadVodJob.
• Implement ShouldBeEncrypted for PurgeAccountBucketsJob since it carries plaintext S3 credentials.
• Create PublicEndpointUrl rule to block SSRF via storage endpoint URLs.
• Retune economics to 1000/50/5000GB base/per-ref/cap and 3/7/15/30 milestones for friends program.
• Pin config in demo seed test to original values to decouple from shipped defaults.

open questions

—

next steps

—

key decisions

• Deploy readiness (#146) must wait for ambassador refinement (#150) and comms copy (#147) — dependency enforced in flower.
• Committed fixes (Ambassador §2.1 try/catch, SSRF rule, ShouldBeEncrypted, retuned economics) are on held main, not yet pushed.
• Epic #272 groups all six post-review track briefs under one parent for roadmap clarity.

open questions

—

next steps

• Gate ReferralAttributionService::attribute() and attributeFromSession() with ReferralProgram::enabled() check
• Gate sidebar nav ambassador link in resources/views/layouts/app/sidebar.blade.php
• Gate user-facing ambassador routes: ambassador-dashboard, ambassador.accept, referral landing, overlay/progress endpoints
• Hide ambassador invitation callout on dashboard (Dashboard.php)
• Ensure admin ambassador routes remain accessible regardless of kill-switch
• Run tests to confirm no breakage with REFERRALS_ENABLED=true and false
• Proceed to clip cleanup task after kill-switch is fully wired

key decisions

• Use existing config key referrals.enabled as master kill-switch, defaulting to false via env('REFERRALS_ENABLED', false)
• AppSettings overlay can change it at runtime without redeploy
• Admin tooling (/admin/ambassadors, /admin/settings/referrals) stays accessible so admin can prep and flip the switch
• phpunit sets REFERRALS_ENABLED=true to keep existing tests green

open questions

—