Phases 4–5.1: Ads live, Discord community, ParseForge bot (LootList+ parity) + cleanup

.env.example

@@ -10,3 +10,15 @@ NEXT_PUBLIC_POSTHOG_HOST=https://us.i.posthog.com
 # Google AdSense publisher ID — builds the Google Privacy & Messaging CMP script URL.
 # Public identifier (appears in every visitor's script URL), not a secret.
 NEXT_PUBLIC_GOOGLE_CMP_PUB_ID=pub-XXXXXXXXXXXXXXXX
+
+# ParseForge Discord's #announcements incoming webhook URL. A server-only
+# secret (no NEXT_PUBLIC_ prefix — never bundled to the client). Leaving this
+# blank disables the auto-post feature entirely; no code change needed.
+DISCORD_ANNOUNCEMENTS_WEBHOOK_URL=
+
+# D-16: server-only shared secret (at least 32 characters, no NEXT_PUBLIC_
+# prefix) that the ParseForge Discord bot on Railway sends in the
+# x-parseforge-bot-key header so its calls to /api/analyze, /api/raid-overview
+# and /api/report/{code} are limited per Discord member instead of by its one
+# shared Railway IP. Leaving it blank keeps every request on the per-IP limits.
+BOT_INTERNAL_API_KEY=

.planning/PROJECT.md

@@ -37,7 +37,13 @@ A player pastes a Warcraft Logs URL and instantly gets **accurate**, actionable
 - ✓ Healer-relevant analysis: effective HPS / overheal % / uptime from one shared helper on both the player card and the raid Healer Breakdown, plus healer-only suggestion rules thresholded against top healers (ACC-04) — Phase 2
 - ✓ Game data as generated truth: `npm run regen-game-data` wago.tools pipeline, three era modules with Classic/TBC-first collision precedence, `lib/cla-constants.ts` a thin re-export, `docs/GAME-DATA-AUDIT.md` as the standing review artifact (ACC-01) — Phase 2
 - ✓ Regression net: recorded WCL fixtures drive tests for `cla-engine`, `raid-overview-engine`, `wcl-client`, timeline and healer engines (14 files / 135 tests); a red suite now blocks a deploy in the OPS-01 gate (ACC-02) — Phase 2
-- ✓ Phase 2 shipped to production (`dpl_5bwk1fJJNuZXkoC5poPGFZQpGy6c`) after a preview sweep; PR #15 open for review — Phase 2
+- ✓ Phase 2 shipped to production (`dpl_5bwk1fJJNuZXkoC5poPGFZQpGy6c`) after a preview sweep; PR #15 merged 2026-09-14 — Phase 2
+- ✓ Phase 2 code-review findings (CR-01, WR-01..03) fixed and live (PR #16, 2026-09-14); Phase 2.1 review fixes (CR-01, WR-01..04 incl. `consent_resolved` dedupe) live in `dpl_CDCu1FVfPZcd8dHr4RpLcrHWJcJ5` — Phase 2 / 2.1
+- ✓ PostHog capture restored for every non-EEA/UK visitor: server-side geo opt-in via `/api/geo` (`x-vercel-ip-country`, fail-closed to the consent region), no `__tcfapi` dependency; EEA/UK/CH TCF gate byte-for-byte unchanged and confirmed in a real browser (reject / accept / CMP re-confirm, WR-03 dedupe live); every event carries `consent_gate_path` (MONY-01 preserved, OPS-01 re-verified) — Phase 2.1
+- ✓ OPS-01 gate hardened: mandatory post-deploy live-traffic check (item 7: HogQL thresholds, zero-events-is-a-FAIL, bounded netlog proof); Phase 1/2 records carry dated append-only addenda; Phase 2.1 signed 2026-09-15 on counted evidence (25 `$pageview` / 3 countries / 25:23 vs Vercel) — Phase 2.1
+- ✓ Share loop v2: fight-level roast/award cards (15-rule `computeAwards` pool held to the D-01 tone bar), per-player permalinks whose OG image shows that player's parse, normalized share CTAs reachable on desktop and at phone width, and a `ref=` landing funnel instrumented in PostHog (`share_action` / `share_landing` carrying `consent_gate_path`) — Phase 3
+- ✓ `docs/PROTECTED-ELEMENTS.md` checklist + `npm run protected-elements` machine check (6 protected DOM attributes, 4 route/canonical checks, exit 0/1/2 discipline) so Phases 4 and 7 cannot silently regress the share CTA or OG pipeline — Phase 3
+- ✓ OPS-01 Phase 3 gate signed (`docs/OPS-01-SHIP-GATE.md` Part 5, 2026-09-19, `sign-now-conditional`): GSC no-regression on `/` and `/analyze/*` with no separately indexed `?view=`/`?ref=` permutation, item-7 live-traffic thresholds re-measured PASS on a full hour; ASVS L1 security review `03-SECURITY.md` 50/50 threats closed — Phase 3
 
 ### Active
 
@@ -50,7 +56,7 @@ A player pastes a Warcraft Logs URL and instantly gets **accurate**, actionable
 - [ ] Indexing plumbing: structured data fixes (FAQPage not detected on `/tbc-audit`), sitemap health, recrawl nudges, internal links
 
 **Viral loop:**
-- [ ] Raise share rate from ~2.8% of analyses — share UX, shared-page landing experience
+- [ ] Raise share rate from ~2.8% of analyses — share UX and landing funnel shipped in Phase 3; first post-ship reading 0/19 on ~7.5h exposure; confirmatory 7-day re-read due on/after 2026-09-23T09:15Z (WINDOWS #11), then iterate
 
 **Design & UX:**
 - [ ] Site-wide design overhaul (via impeccable workflow) — current UI is "super messy"; reference top ~3 closest-matching styles from https://styles.refero.design/; full redesign allowed but must stay recognizably ParseForge (colors/identity preserved)
@@ -61,7 +67,6 @@ A player pastes a Warcraft Logs URL and instantly gets **accurate**, actionable
 
 **Product quality:**
 - [ ] Expand tool capabilities beyond the Phase 2 accuracy work (per-player share image bakes in the healer percentile basis — a `costly` decision to revisit in Phase 3)
-- [ ] Close the Phase 2 code-review findings: CR-01 healer suggestions fire when `hasHealing` is false (wrong recommendation, live), WR-01 timeline "player not in fight" check is report-scoped not fight-scoped, WR-02 StrictMode double-fires `timeline_filter_used`, WR-03 stale precedence comment in `game-data.test.ts` (`.planning/phases/02-accuracy-analysis-depth/02-REVIEW.md`)
 
 **Ecosystem & community:**
 - [ ] Connect LootList+ ↔ ParseForge (cross-promotion between the two sites)
@@ -89,7 +94,8 @@ A player pastes a Warcraft Logs URL and instantly gets **accurate**, actionable
   - Site-wide CTR is structurally misleading (navigational impressions dominate) — never treat it as a health metric; segment first
   - Title template appends " | ParseForge" (13 chars) — child page titles must stay under ~47 chars; always render pages to verify, don't eyeball metadata
 - **Next keyword candidate**: `wow log analyzer` (392 impr/28d, pos 3.5, tool intent) — segment before building
-- **Known concerns** (from CONCERNS.md): CSP still report-only. *(Resolved Phase 1: PostHog EU consent flow now gated by the Google CMP. Resolved Phase 2: core engines now under a fixture-driven regression net.)* Deferred from Phases 1 and 2: formal ASVS security review — gsd security tooling not installed in this profile; per-plan STRIDE registers exist
+- **Known concerns** (from CONCERNS.md): CSP still report-only. *(Resolved Phase 1: PostHog EU consent flow now gated by the Google CMP. Resolved Phase 2: core engines now under a fixture-driven regression net. Resolved Phase 2.1: the Phase 1 CMP gate had silently dropped ~99.9 % of PostHog capture for non-EEA visitors from 2026-09-06 to 2026-09-14 — fixed by server-side geo opt-in; `02.1-DIAGNOSIS.md`.)* Deferred from Phases 1 and 2: formal ASVS security review — gsd security tooling not installed in this profile; per-plan STRIDE registers exist. Phase 2.1's own `02.1-SECURITY.md` was closed at ASVS L1 grep-depth (45 threats, 0 open)
+- **Operational carry-forward from Phase 2.1**: the `dpl_CDCu1FVfPZcd8dHr4RpLcrHWJcJ5` redeploy's own OPS-01 item-7 row is unsigned (low-traffic window) — re-measure a busier UTC hour at the Phase 3 gate; a PostHog-vs-Vercel capture gap for BR/SG (likely ad blockers) is a `WINDOWS.md` candidate; `NEXT_PUBLIC_GOOGLE_CMP_PUB_ID` is Production-only, so the TCF path is observable only on prod
 - **Manual follow-ups after Phase 2**: paste `https://parseforge.gg/privacy` into AdSense → Privacy & messaging → message site settings (still open); PostHog event definitions (`timeline_viewed`, `timeline_error`, `timeline_filter_used`, `analysis_complete`, `theme_changed`, `consent_resolved`) — confirmed by the developer at the Phase 2 UAT, but the PostHog MCP connection returns `INVALID_API_KEY` and its active project is LootList+ App, so re-wire it before the Phase 3 gate; GSC shows `/` and `/analyze/*` as "Crawled – currently not indexed" with pre-deploy crawl dates — request recrawl of the Phase 2 build and watch `/` specifically; `origin/main` is at `55d2010` (pre-Phase-2) and Phase 2 lives on PR #15 (`growth/phase-2-accuracy-depth`) — merge or push to restore parallel worktree execution; two game-data ids (96264, 96294) flagged for human review in `.planning/WINDOWS.md`
 - **Feedback source today**: owner's personal Discord (uncomfortable) — motivates the community requirement
 
@@ -123,6 +129,12 @@ A player pastes a Warcraft Logs URL and instantly gets **accurate**, actionable
 | One healer-metrics helper feeds both the player card and the raid overview | D-08: two surfaces must never disagree; parity is asserted by test and was confirmed live in production | ✓ Good (Phase 2) |
 | Preview-first deploy plus push + PR before shipping Phase 2 | Regenerated game-data names had the least automated coverage; PR #15 makes the regen diff reviewable (D-12) | ✓ Good (Phase 2) — prod `dpl_5bwk1fJJNuZXkoC5poPGFZQpGy6c` |
 | Defer the formal ASVS security review for Phase 2 (same as Phase 1) | `gsd-secure-phase` still not installed in this profile; per-plan STRIDE registers exist | — Pending (install tooling, run `/gsd-secure-phase 02`) |
+| Server-side geo opt-in for non-consent-region visitors, decided from `x-vercel-ip-country`, fail-closed to the TCF path | `cookieless_mode: "on_reject"` + `__tcfapi`-dependent opt-in dropped all PENDING-consent capture for fresh visitors; a boolean `/api/geo` keeps PII out of the request path and leaves EEA/UK semantics untouched | ✓ Good (Phase 2.1) — capture restored; TCF path confirmed in-browser at UAT |
+| OPS-01 gate can never pass on pre-deploy data: mandatory counted live-traffic check, zero events = FAIL, append-only corrections to past records | Phases 1 and 2 were both signed on event-definition presence while ingestion was ~0; the gate must measure visitors, not code | ✓ Good (Phase 2.1) — Phase 2.1 signed on counted evidence; 02.1-07 redeploy row honestly left unsigned |
+| Record "not performed" rather than infer a pass from unit tests or code review for the EEA/UK behaviour | An LLM cannot obtain an EEA egress; honesty about unobserved behaviour beats a manufactured pass | ✓ Good (Phase 2.1) — closed by a developer-run VPN session at UAT, 2026-09-15 |
+| Sign the Phase 3 OPS-01 gate with two dated re-deferrals (share-rate re-read, real Discord unfurl) rather than hold Phase 4 for the 7-day window | Every countable row was counted; holding would have blocked on a calendar date, not on evidence; the `sign-now-conditional` obligation keeps the re-read binding | ✓ Phase 3 — unfurl and first-hand tone verdict passed in UAT 2026-09-19; re-read due ≥2026-09-23 |
+| Run the ASVS L1 security review orchestrator-side when the `gsd-secure-phase` skill wrapper is missing (as Phase 2.1 did) | The gate blocks advancement; the workflow and template exist in gsd-core, only the skill is absent | ✓ Phase 3 — `03-SECURITY.md` 50/50 closed, 0 open |
+| RPGLogs API Terms and API-docs pages captured with provenance (2026-09-21); approval address identified as `advertising@archon.gg` (§2a Commercial Usage); developer deferred sending the commercial-use approval request on 2026-09-21 | Both canonical pages 403 automated readers — developer captured both in-browser; the client display name still needs to be read from the WCL client-management page before the email can be sent | — Pending (04-01) — the production ad deploy (04-07) stays gated on the reply per D-12; build/preview work (04-03..04-06) proceeds because it earns no money and is therefore not commercial use under Terms §2a until ads go live |
 
 ## Evolution
 
@@ -142,4 +154,4 @@ This document evolves at phase transitions and milestone boundaries.
 4. Update Context with current state
 
 ---
-*Last updated: 2026-09-08 after Phase 2*
+*Last updated: 2026-09-19 after Phase 3*