Session Handoff — Skill Finder widget + buyer tracking: built, safety-fixed, LIVE

Where it started

Sondra continued from the Skill Studio launch handoff. She approved the Haiku-based hybrid Skill Finder, asked cost questions (answered: ~few $/mo, Haiku 4.5), untangled email routing (GHL = system of record; Resend = transactional delivery only), then EXPANDED scope: purchases must also be tracked in GHL (buyer tags + list), and buyers must get a delivery email with download link(s) + install guide (packs = all links together). Then said "you can build it" — full build ran this session. Session ends with her saying she has "a couple things I need to answer on this and have you fix" — her feedback is the next session's work.

Decisions locked + what shipped

• ALL LIVE on https://skills.amplifaiyourbusiness.com (deployed 3x, final deploy verified). Committed to main (commit "feat(skill-studio): Skill Finder widget + buyer tracking LIVE").
• Buyer tracking: Stripe webhook we_1Tpt4CRvzUwDwHkjuSZGZKJi (checkout.session.completed + async_payment_succeeded) -> GHL upsert tags skill-studio-buyer + bought-<slug> (packs: bought-pack-<slug>) + purchase note + branded delivery email. Filters metadata.store === 'skill-studio' (other stores' events broadcast to this endpoint too); delivers only when payment_status === 'paid'; idempotent via KV webhook-seen:<event.id>.

File: c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\app\functions\api\stripe-webhook.js

• Delivery email: from skills@sondraverva.com (Resend free plan = 1 domain; amplifaiyourbusiness.com add returned 403 plan-limit — upgrade or GHL-send is her later call), reply-to srverva@gmail.com, links the access page (packs' access pages already list every member skill download).
• Skill Finder widget (floating, lower-right, all pages except /access): Search tab (client-side over live catalog incl. packs), Ask AI tab (Haiku chat), Custom skill tab (form). Mounted in App.jsx inside silent ErrorBoundary.

File: c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\app\src\components\SkillFinder.jsx

• Custom requests: app\functions\api\custom-request.js -> GHL tag skill-custom-request + description note + notify email to srverva@gmail.com (reply-to = requester). NO price anchor shown anywhere — she quotes personally (her explicit call).
• Haiku chat: app\functions\api\skill-chat.js — claude-haiku-4-5, catalog imported from src/data/skills.js+bundles.js (auto-feeds on every rebuild; rights gate mirrored), cached system prompt, plain-text-only rule + server-side de-markdown, widget linkifies /skills/ + /bundles/ paths. Caps: 8 turns, 500 chars/msg, 400 output tokens, 300/day global + 20/day per-IP in KV, ALL fail closed.
• New generator: c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\app-data\build_delivery_data.py -> writes app\src\data\delivery.js (slug -> name/price/accessUrl/items). Run after build_access_pages.py when skills change. delivery.js holds all access tokens — server-side import ONLY (verified not in client bundle).
• Safety review (app-reviewer agent) on new surfaces: 1 RED (custom-request spammable) + 4 YELLOW -> ALL fixed same session (KV cap on custom-request 30/day fail-closed, chat fail-closed + per-IP cap, webhook idempotency, payment_status guard) + redeployed + re-verified.
• Infra: KV namespace finder-kv id 338d8b0c34bb4e66ad8f263a1279a700 bound as FINDER_KV (prod+preview) on Pages project amplifai-skill-studio; Pages secrets added: STRIPE_WEBHOOK_SECRET, RESEND_API_KEY, ANTHROPIC_API_KEY.
• Verified live: site 200; webhook rejects unsigned (400); custom-request happy path -> GHL contact nze3eGbKOXFNPkyrxlba w/ tag+note + notify email CONFIRMED in her Gmail; chat returns real recommendations w/ correct prices in plain text; widget visually verified via Playwright at 1280x850.
• Dashboard row updated: c:\Users\srver\AIOS-Workspace\aios-starter-kit\Sondra Brain\wiki\dashboard.md (Skill Studio row, line ~55).

Key files for next session

• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\handoffs\skill-finder-buyer-tracking-2026-07-05.md — full technical record of this build; read first
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\app\functions\api\ — the 4 functions (subscribe, stripe-webhook, custom-request, skill-chat)
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\app\src\components\SkillFinder.jsx — widget UI
• c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\handoffs\skill-studio-phase1-build-2026-07-05.md — prior session's store build context
• Plan file: none (built from the approved chat spec)
• Memory files touched: none

Running state

• Background processes: none
• Dev servers / ports: none
• Open worktrees / branches: none — all committed to main

Verification — how to confirm things still work

• curl -s -o /dev/null -w "%{http_code}" https://skills.amplifaiyourbusiness.com/ — expect 200
• curl -s -o /dev/null -w "%{http_code}" -X POST https://skills.amplifaiyourbusiness.com/api/stripe-webhook -d '{}' — expect 400 (unsigned rejected)
• curl -s -X POST https://skills.amplifaiyourbusiness.com/api/skill-chat -H "Content-Type: application/json" -d '{"messages":[{"role":"user","content":"help with emails"}]}' — expect JSON reply recommending Ellie, plain text
• Redeploy: cd "c:\Users\srver\AIOS-Workspace\aios-starter-kit\PROJECTS\Skill Studio\app" && npm run build && npx wrangler pages deploy dist --project-name amplifai-skill-studio --branch main (CLOUDFLARE_API_TOKEN + CLOUDFLARE_ACCOUNT_ID via python scripts\get_env.py)
• Full pipeline when skills change: build_access_pages.py -> build_delivery_data.py -> create_stripe_links.py (idempotent) -> npm run build -> deploy

Deferred + open questions

• Open: Sondra has "a couple things to answer + have fixed" on this build — she requested this handoff before giving that feedback. That feedback is the next session's work; nothing else should preempt it.
• Deferred: her real $17 test buy -> self-refund (now also proves delivery email + buyer tags end-to-end). Do before announcing.
• Deferred: delete GHL test contacts srverva+skillstudio-test@gmail.com (prior session) + srverva+finder-test@gmail.com (this session, id nze3eGbKOXFNPkyrxlba) — hers to delete or explicitly OK.
• Deferred: sender domain — skills@sondraverva.com now; matching @amplifaiyourbusiness.com needs Resend upgrade (~$20/mo) or moving delivery email to GHL. Her call, no urgency.
• Deferred: optional GHL workflow (her UI) on tag skill-custom-request -> prospect confirmation email; optional nurture workflows on buyer tags. Claude offered click-by-click steps, not yet requested.
• Deferred: SOP for "adding a new skill to the store" — offered at session end, unanswered.
• Deferred (carried from prior session): announcement post draft PROJECTS\Skill Studio\announcement-draft-skool.md (she edits + posts); BUYER-COPY-WORKSHEET.html review; Skill Club membership (off until singles prove); CEO Dashboard project card.

Pick up here

Sondra returns with her answers/fix-list on the Skill Finder build — take her items and fix them; everything is live and committed, so changes are edit -> build -> deploy against the paths above.