`memos/fulfillment.md`

59 lines
# Fulfillment runbook — what happens after a checkout completes

**Status:** TEST mode only (Stripe test keys, no real charges). This is the
manual-first playbook for when a Hosted/$19 or Pro/$49 checkout completes —
today in TEST, later live once Steve flips the switch. Provisioning is done
by Steve by hand; nothing auto-provisions.

## The moment of purchase

1. Customer clicks a pricing CTA on `/landing.html` → `/api/checkout` creates a
   Stripe Checkout Session (TEST) for the chosen tier → customer pays on
   Stripe's hosted page.
2. Stripe calls our webhook (`checkout.session.completed`). The server records
   the sale to `data/revenue-ledger.jsonl` (engine: `sell`) and it shows up in
   the dashboard P&L within one refresh.
3. **Nothing else is automatic.** The customer's email + tier sit in the ledger
   entry; Steve fulfills manually from there.

## Manual provisioning — Steve's steps (target: within 24h of purchase)

### Hosted — $19/mo
1. Read the ledger entry (email, tier, Stripe customer id).
2. Create the customer's instance on Kamatera: copy of the AbramsEgo app on its
   own port, fresh Basic Auth credentials, empty data dir (their fleet, not ours).
3. Point a subdomain at it (e.g. `<name>.abramsego.com`) with SSL.
4. Email the customer from steve@designerwallcoverings.com: their URL, their
   login, a 3-line quickstart (how to point collectors at their own pm2/ledger).

### Pro — $49/mo
Everything in Hosted, plus:
5. Enable the revenue engines on their instance (`/api/revenue/record` open to
   their key) and the grounded-chat panel wired to their Ollama or ours.
6. Offer a 30-minute setup call (calendar link in the welcome email).

## What the customer receives

- **Hosted:** a private, Basic-auth-gated dashboard URL watching *their*
  processes, with the cost ledger, canary board, and P&L panels live; a welcome
  email with credentials and quickstart.
- **Pro:** the above + revenue-engine recording, grounded AI chat, and the
  setup call.
- **Self-host (free):** no fulfillment — the repo/docs link is on the landing
  page; they run it themselves.

## Refund path

- Simple rule: **full refund, no questions, within 30 days** — issued by Steve
  in the Stripe dashboard (Payments → refund).
- After refund: tear down the instance (stop pm2 process, remove subdomain),
  append a negative entry to `revenue-ledger.jsonl` so the P&L stays honest.
- Subscription cancels: customer emails us or uses the Stripe customer portal
  (once enabled live); instance stays up until the end of the paid period.

## Rails

- Live keys, real charges, public exposure of `/landing.html`, DNS for customer
  subdomains — all Steve-gated. Until go-live, every "sale" is a TEST-mode
  rehearsal of this exact runbook.