# $50 App Roadmap — Single Source of Truth

> Builder Agent reads this every session. Update after every change.
> Last updated: 2026-02-07 17:00 AEST

---

## What's Live

**URL:** https://rivet.rateright.com.au
**Hosting:** VPS (134.199.153.159) → nginx → systemd `rateright-app` on port 3000
**Repo:** RateRight-PTY-LTD/the-50-dollar-app (`/home/ccuser/the-50-dollar-app`)
**Stack:** Next.js 16, Supabase, Tailwind 4, shadcn/ui, TypeScript 5.9
**Redeploy:** `cd /home/ccuser/the-50-dollar-app && npm run build && systemctl restart rateright-app`

### Working ✅
- Landing page (good UI, $50 messaging)
- Auth signup form (/auth/signup — email, password, role)
- Auth login form
- Auth callback (exchanges code for session)
- Middleware (protects routes, redirects unauth users)
- Dashboard (role-based, contractor/worker views)
- Contractor ABN lookup UI (form works, API needs real GUID)
- Worker profile builder — 4-step wizard + AI bio generation
- **Voice profile builder** — mic button, Whisper transcription, AI fills form (shipped 2026-02-07)
- Job posting form (3-step UI)
- Swipe-to-browse UI (jobs + matches)
- PWA configured (manifest, service worker)
- Rate limiting on all API routes
- SSL via Let's Encrypt

### Broken / Not Working ❌
- **Worker/contractor signup routes redirect to login** — middleware blocks new users from onboarding pages
- **ABR GUID is placeholder** — contractor ABN verification fails
- **No matching algorithm** — post a job, get zero matches
- **No Stripe** — $50 fee promised but not collected
- **Messaging is mock data** — fake conversations with fake people
- **RLS migrations written but not applied** — SQL files in repo, need to run in Supabase dashboard
- **Verify-email page redirects to non-existent routes** (H10)

### Intentionally Not Building 🚫
- **Worker verification** — contractors verify White Cards on site (Michael's decision 2026-02-07)

---

## Current Sprint (Fix the Foundation)

Priority order. Ship these before adding features.

1. **[ ] Fix signup redirect bug** — worker/contractor signup must be accessible to new unauth users
2. **[ ] Apply RLS migrations** — run SQL files in Supabase dashboard
3. **[ ] Error boundaries + loading states** (H4, H13) — users see blank screens on errors
4. **[ ] Fix verify-email redirects** (H10) — sends to /contractor/dashboard which doesn't exist
5. **[ ] Remove duplicate dashboard header** (M5) — double nav showing

---

## Next Up (Make It Work End-to-End)

6. **[ ] Smart matching algorithm** — distance + trade + availability scoring
7. **[ ] Stripe integration** — $50 per hire, charged on confirmation
8. **[ ] Real messaging** — replace mock data with Supabase Realtime
9. **[ ] Growth Engine integration** — event webhooks: signup → job post → match → hire
10. **[ ] ABR GUID registration** — Michael needs to do this (5 min form)

---

## Week 2+ (Scale)

- Push notifications
- Email notifications (hire confirmed, new match, etc.)
- Admin dashboard
- Analytics
- Worker availability calendar
- GPS-based matching
- Crew hire ($100 for full crew)
- Agency portal

---

## Blocked (Needs Michael)

| Item | What's Needed | How Long |
|------|--------------|----------|
| ABR GUID | Register at https://abr.business.gov.au/Tools/WebServicesAgreement | 5 min form, 1-2 day approval |
| RLS migrations | Run SQL in Supabase dashboard (or give Rivet DB access) | 5 min |
| Stripe account | Set up Stripe, get API keys | 15 min |

---

## Audits & Reports

| Report | Location | Status |
|--------|----------|--------|
| $50 App Audit (48 bugs) | `/home/ccuser/rateright-v2/AUDIT-REPORT.md` | ✅ Complete |
| Growth Engine Audit | `/home/ccuser/GROWTH-ENGINE-AUDIT.md` | ⏳ Running |
| Investigation Report | `/home/ccuser/INVESTIGATION-REPORT.md` | ✅ Complete |
| Integration Spec | TBD | 🔜 After GE audit |

---

## Systems Map

| System | URL | Purpose | Status |
|--------|-----|---------|--------|
| $50 App (v2) | https://rivet.rateright.com.au | The product | LIVE |
| Main Site (v1) | https://rateright.com.au | Old Flask app | LIVE (legacy) |
| Growth Engine | https://rateright-growth-production.up.railway.app | Sales CRM | LIVE |
| Phone AI | VPS local | AI receptionist | Built, status unclear |
| Supabase | memscjotxrzqnhrvnnkc.supabase.co | DB for $50 app + GE | LIVE |

---

## Key Decisions Log

| Date | Decision | Who |
|------|----------|-----|
| 2026-02-07 | Drop worker verification — contractors verify White Cards on site | Michael |
| 2026-02-07 | Voice profile builder shipped — speak instead of type | Builder |
| 2026-02-07 | $50 flat fee model (not percentage-based) | Michael |
| 2026-02-07 | Use ReviewFlow: Kimi drafts → Claude Code reviews → push | Michael |
| 2026-02-07 | Direct fixes for ≤5 files, CC for big refactors only | Builder learning |

---

## Done (Recent)

| Date | What | Commit |
|------|------|--------|
| 2026-02-07 | Voice profile builder shipped | 89174fb |
| 2026-02-07 | Rate limiting on all API routes (H1) | 89174fb |
| 2026-02-07 | CORS fix, server validation, rate limiter leak fix | 89174fb |
| 2026-02-07 | Deleted dead files (test-signup.js, middleware.ts.backup) | 89174fb |
| 2026-02-07 | RLS migration SQL written (C5+C6) | ac27403 |
| 2026-02-07 | systemd service created, app live at rivet.rateright.com.au | — |
| 2026-02-06 | Full 48-bug audit | — |
| 2026-02-06 | Auth callback fix (was dead redirect) | f439fdf |
| 2026-02-06 | Server client fix (was admin-only) | f439fdf |
| 2026-02-06 | abr_verified column fix | f439fdf |
| 2026-02-06 | Middleware consolidation + authenticated layout | b9fa17b |

---

*This file is the Builder Agent's brain. Read it first, update it always.*