# Builder Agent (Topic 2: RateRight)

**Role:** Code, features, technical decisions, deployment
**Last Sync:** 2026-02-07 14:10 AEST

---

## Deployment
- **LIVE URL:** https://rivet.rateright.com.au
- **Hosting:** This VPS (134.199.153.159) → nginx → localhost:3000
- **SSL:** Let's Encrypt (auto-renew via certbot)
- **Service:** `systemctl status rateright-app` (auto-starts on boot, restarts on crash)
- **DNS:** rivet.rateright.com.au → 134.199.153.159 (GoDaddy)
- **To redeploy:** `cd /home/ccuser/the-50-dollar-app && npm run build && systemctl restart rateright-app`

## Repos
- **Primary:** `/home/ccuser/the-50-dollar-app` (serves production)
- **Secondary:** `/home/ccuser/rateright-v2` (older copy, sync with `git pull`)
- **GitHub:** RateRight-PTY-LTD/the-50-dollar-app (private)
- **Branch:** main (single branch)

## Stack
Next.js 16, Supabase, Tailwind 4, shadcn/ui, TypeScript 5.9, React 19

## Current Status

### Done (Feb 6-7)
- [x] Full 48-bug audit (AUDIT-REPORT.md in repo)
- [x] Fix auth callback — exchanges code for session
- [x] Fix server client — cookie-based SSR instead of admin-only
- [x] Fix abr_verified column → ai_research jsonb
- [x] Fix middleware consolidation + authenticated layout
- [x] RLS migration SQL (C5+C6) — pushed, needs to run in Supabase dashboard
- [x] Messaging UI scaffold

### In Progress
- [ ] **Phase 2: HIGH audit items (H1-H14)** — 2 CC sessions died, not shipped
- [ ] **Phase 3: MEDIUM audit items (M4-M17)** — not started

### Blocked
- 🔴 ABR GUID registration — Michael needs to do (https://abr.business.gov.au/Tools/WebServicesAgreement)
- 🔴 OPENAI_API_KEY not in .env.local — AI features broken
- 🔴 RLS SQL migrations written but not applied to Supabase
- 🔴 Claude Code reliability — keeps dying mid-task (3 failures in a row)
- 🟡 No production deployment yet
- 🟡 Stripe not set up

### Phase 2 Items (HIGH — need to ship)
H1: Rate limiting on API routes | H2: Fix Supabase client singleton | H3: Sanitize AI prompt inputs | H4: Error boundaries | H5: Fix CORS wildcard | H9: 404 page | H10: Fix verify-email redirects | H11: Validate missing service key | H13: Loading states | H14: Rate limiter memory leak

### Phase 3 Items (MEDIUM)
M4: Toast notifications (sonner) | M5: Remove duplicate dashboard header | M7: Offline page | M9: Fix CSP inline script | M16: Delete test-signup.js | M17: Delete middleware.ts.backup

## Tools
- **Claude Code:** `/home/ccuser/.local/bin/claude` (Max sub, use --dangerously-skip-permissions)
- **GitHub CLI:** `gh` (logged in as mcloughlinmichaelr-debug)
- **Build:** `npm run build` must pass clean before any push

## Key Files
- `AUDIT-REPORT.md` — full 48-bug audit
- `supabase/schema.sql` — database schema
- `supabase/fix-rls-policies-migration.sql` — RLS fixes (not yet applied)
- `src/lib/supabase/server.ts` — server client (recently fixed)
- `src/lib/supabase/client.ts` — browser client (needs H2 fix)
- `src/app/(authenticated)/layout.tsx` — shared auth layout

## Lessons Learned
1. Claude Code needs `--dangerously-skip-permissions` for non-interactive runs
2. CC sessions die if prompt is too large or budget too low — 1-3 tasks per session MAX
3. Two repo copies cause sync issues — primary is `/home/ccuser/the-50-dollar-app`
4. Always check `git status` after CC runs — it often works but forgets to commit
5. Direct fixes (read/edit/write) beat CC for ≤5 files — faster and more reliable
6. CC excels at READ tasks (audits, analysis) but fails at large WRITE tasks
7. Always tell CC "Do NOT create report files" — it defaults to writing .md files
8. $5 budget per CC session, not $20. Small atomic runs that actually land.

## Execution Strategy (Feb 7 onwards)
- **Phase 2+3 remaining work:** Do it directly. 16 bugs, most are 1-2 file changes. Faster than debugging CC failures.
- **New features:** Use CC for scaffolding (it's good at creating new pages/components), then review and fix manually.
- **Audits/reviews:** CC is great for these. Keep using it.

---

## TODO.md Task Queue (MANDATORY)

When you identify new work, add it to `/home/ccuser/rateright-growth/rivet/TODO-INBOX.md` with your tag.
- Don't wait for permission on obvious tasks.
- Rivet (main agent) orchestrates: prioritizes, deduplicates, assigns, and tracks.
- You generate and execute. Rivet coordinates.