Session Handoff — AmplifAI Visibility BUILT + LIVE + safety-hardened (2026-07-12)

TL;DR

The GEO lead-magnet website is LIVE at https://visibility.amplifaiyourbusiness.com — built, deployed, live-verified end-to-end (real email landed in Sondra's Gmail), independently safety-reviewed (FIX-FIRST), and all blockers fixed + redeployed in the same session. Remaining: Sondra's 30-second human pass of the bot check, then announce.

ACTIVE MODES (re-invoke in a fresh session before continuing this work)

fable-mode · premium-web-design · conversion-landing-page · amplifai-video-studio-theme · ponytail full (hook-enforced)

What shipped

• Product: paste URL → AI Visibility Score 0-100 (~30s) → 3-problem teaser → email unlocks full finding-by-finding report on-page + branded Resend email → lead in Supabase → CTA to the free Skool community.
• Stack: ONE Cloudflare Worker + static React/Vite assets (same-origin, Music-Studio pattern). Code: PROJECTS/GEO-Agency/lead-magnet-site/app/ (worker/ = gather·score·supa·email·counter·config·index; src/ = App·Result·Turnstile·sections·theme).
• Scoring: Worker gathers evidence itself (homepage/robots/sitemap/llms.txt/headers/JSON-LD, SSRF-guarded) → ONE claude-sonnet-5 structured-outputs call (output_config.format; NOTE: temperature 400s on Sonnet 5 — thinking: disabled used instead) → /geo rubric weights verbatim (25/20/20/15/10/10) → composite computed in code. Findings never leave the server pre-email.
• Bill protection: Turnstile both endpoints (keys in master .env: TURNSTILE_SITE_KEY/SECRET_KEY; widget created by Sondra) + 3 scans/IP/day + 150/day global cap in an atomic Durable Object (GlobalCounter) + 10 unlocks/IP/day + idempotent unlock + 24h URL cache + secret-keyed IP hashes.
• Data: visibility_audits/visibility_leads on Supabase digital-home-sondra (kmnhawosmypxbujmkgno) — free-project limit forced reuse (both free slots = PeptidePal + BookifAI); RLS on, anon REVOKEd. Gotcha: minted sb_secret_ key was rejected by PostgREST on this older project — worker uses legacy service_role.
• Design: navy/gold/cream, Playfair+Manrope, her real live-page footer + Privacy link, eyebrow pill DNA. 1440+390 verified, 0 overflow, 0 console errors (screenshots: lead-magnet-site/design-verify/).
• Quarterly refresh (her requirement): lead-magnet-site/REFRESH-CHECKLIST.md — due 2026-10-11; say "run the AmplifAI Visibility quarterly refresh".

Safety check (last major verdict — embed, don't lose)

Independent app-reviewer agent, adversarial: FIX-FIRST → all blockers fixed + redeployed same session:

1. CRITICAL /api/unlock had no rate limit (email-bomb / Resend-quota-burn from her domain) → 10/IP/day cap + idempotency (unlocked:{reportId}:{emailHash}; one email + one lead per pair EVER; repeats return the report free — probe-verified: 10×200 → 11th 429 → repeat-after-cap 200).
2. CRITICAL global cap was racy KV (eventually consistent — botnet could blow past) → atomic Durable Object reserve/release; slots refunded when Claude-side scoring fails; fresh-scan-through-DO verified (score 43).
3. CRITICAL no privacy policy on an email-capture site → canonical ai.sondraverva.com/privacy linked in footer + report email (verified in live bundle).
4. HIGH IP salt was a public constant (rainbow-table-able) → random IP_HASH_SECRET worker secret.

Reviewer confirmed solid: no secrets in client bundle, XSS closed (React + esc(), both layers), SSRF guards, UUIDv4 report ids never in URLs, no CORS surface, no stack-trace leaks. Deferred (non-blocking): MEDIUM #6 — Resend/Supabase failures only console.error (no owner alert; candidate: Telegram/CommandOS webhook, batch later).

Verified live (evidence, not intention)

• Her own site scored 41/100 (personal_brand; real findings: zero schema, placeholder llms.txt, no OG) — report email landed in her Gmail (from visibility@sondraverva.com, msg 19f5444e38394268).
• Range sanity: example.org 10 · github 48 · anthropic 50 · iana 43. Broken domain → friendly 400, no slot burned. localhost/IP-literals rejected.
• Turnstile: tokenless probes 403 (9/9 after clean version cut + re-verified post-hardening); automated browsers (headless AND headed, incl. checkbox click) cannot pass the widget — by design.
• Supabase: anon insert 401; lead + audit rows verified landing via service key.

Sondra's steps (the only open items)

1. 30-second human test: open https://visibility.amplifaiyourbusiness.com, tick "Verify you are human", scan any site, unlock with an email — the ONE box automation can't check. If the widget misbehaves for real humans, say so → next lever is Turnstile mode/domain settings.
2. Read your own site's report in Gmail — it's a genuine to-do list for amplifaiyourbusiness.com (schema, llms.txt content, OG tags).
3. Announce (Skool/FB) when happy — it's unannounced until you share the link.
4. Swap the funnel CTA anytime in ONE spot: app/worker/config.ts → redeploy (npm run build && npx wrangler deploy).

v2 backlog (decided, not started)

Blog traffic layer on the same domain (sleegeo pattern — plan: PROJECTS/GEO-Agency/blog-strategy.md) · paid deep report using /seo DataForSEO + PDF · Stripe · owner-alert on send failures · CEO-dashboard project card (not yet added to ceo-dashboard/data/projects.json).

State / housekeeping

• Commits (scoped, local): feat(visibility) ×2 + fix(visibility) ×1. Much unrelated uncommitted work from other sessions exists in the workspace — untouched, left alone.
• Session log posted to Notion: https://app.notion.com/p/Session-2026-07-12-amplifai-visibility-live-39b70c6d495b818b8d3de3b059b7ae54 (pre-dates the safety fixes; decisions log carries the delta).
• Records updated: wiki dashboard row (new), open-questions (GEO entry → RESOLVED w/ residuals), decisions-july-2026 (top entry incl. safety verdict), memory project_geo_seo_aeo_stack + MEMORY.md index line.
• A "memory index too big" hook fired — IGNORED per standing rule (only Sondra compacts).
• KV namespace amplifai-visibility-kv (77bd0974…); worker secrets: ANTHROPIC_API_KEY, RESEND_API_KEY, SUPABASE_URL, SUPABASE_SERVICE_KEY, TURNSTILE_SECRET_KEY, IP_HASH_SECRET. Cleanup done: test lead rows purged live; DEV_MODE secret deleted (verified gone).