firefrost-operations-manual/BLOCKERS.md

🚨 SOFT LAUNCH BLOCKERS

Target Launch Date: April 15, 2026 (12 days from now)
Social Media Campaign: Started April 2, 2026
Last Updated: April 3, 2026 by Chronicler #56

PROGRESS: 2 of 5 complete ✅ (Website LIVE + Dynamic Servers Page LIVE!)

---

🎯 DEFINITION OF SOFT LAUNCH

Goal: Successfully onboard and manage 10 paying subscribers

Success Criteria:

• Website live with clear value proposition
• Legal protection (Terms of Service, Privacy Policy)
• Payment processing functional (Paymenter + Stripe)
• Subscribe → Discord role → Server access workflow verified
• Unsubscribe flow tested and working
• Can handle payment failures gracefully

---

✅ MUST COMPLETE BEFORE LAUNCH

1. Website Migration - 11ty Static Site ✅ COMPLETE

Time: 12-day estimate from Gemini → 4 hours actual execution
Status: ✅ COMPLETE (April 3, 2026)
Completed By: The Wizard + Chronicler #56

What was delivered:

• ✅ Complete Ghost → 11ty migration
• ✅ Cloudflare Pages deployment with custom domain
• ✅ Dynamic Servers page with real-time status (Cloudflare Workers + Pterodactyl API)
• ✅ Discord-gated IP security model
• ✅ Edge caching (60s) protects Pterodactyl from traffic spikes
• ✅ Zero manual maintenance required (Holly can add servers via Pterodactyl UI)
• ✅ RV-ready architecture (serverless, no SSH needed)
• ✅ DNS cutover complete: firefrostgaming.com LIVE
• ✅ Mobile responsive design
• ✅ Auto-refresh every 60 seconds

Architecture:

• Cloudflare Worker: https://servers-api.michael-b25.workers.dev
• Pterodactyl Service Account: website-api@firefrostgaming.com (read-only)
• Edge caching prevents rate limits (1 API call per minute regardless of traffic)

Gemini's Assessment: "Four hours?! That is absolutely legendary execution. You didn't just build it fast; you built it perfectly."

Result: firefrostgaming.com is PRODUCTION LIVE with real-time server status! 🎉

---

2. Legal Pages - Terms & Privacy ✅ GOOD ENOUGH FOR LAUNCH

Time: Post-launch refinement with LegalCORPS consultation
Status: ✅ SUFFICIENT (Effective April 1, 2026)
Assigned: Will refine post-LegalCORPS Minnesota consultation
Decision: Launch with current pages, refine based on professional legal advice

What's LIVE:

• ✅ Terms of Service page (published April 1, 2026)
• ✅ Privacy Policy page (published April 1, 2026)
• ✅ Both linked in website footer
• ✅ Covers basic requirements for accepting payments

Post-Launch Refinement Plan:

• LegalCORPS Minnesota pro-bono consultation (application submitted)
• Age verification compliance for Ignis Protocol (18+ mature discussion space)
• Professional legal review and recommendations
• Update pages based on attorney guidance

Done when (for soft launch): ✅ COMPLETE - Current pages are sufficient for launch

---

3. Trinity Console Security Hardening

Time: 4-5 hours (realistically 2-3 hours given execution speed)
Status: ⏳ IN PROGRESS
Assigned: Next session
Blocks: Production-ready admin interface

What's Complete (95%):

• ✅ Player Management (search, pagination, Minecraft skins, Fire/Frost badges)
• ✅ Server Matrix (real-time monitoring, 60s caching, force sync, whitelist toggle)
• ✅ Financials & Revenue Analytics (MRR tracking, Fire vs Frost breakdown, ARPU/ARR)
• ✅ Grace Period Dashboard (Task #87 - countdown timers, manual recovery, audit trail)
• ✅ Admin Audit Log (90-day retention, timeline feed, action categorization)
• ✅ Discord Role Audit (bulk mismatch detection, one-click fix)

Critical Gaps (Must Fix Before Launch):

1. ❌ CSRF Protection - SECURITY VULNERABILITY (30 min)

   • Implement csurf middleware + tokens in htmx
   • Prevents malicious sites from tricking admins

2. ❌ Database Transaction Safety - DATA INTEGRITY RISK (45 min)

   • Wrap multi-step operations in BEGIN/COMMIT/ROLLBACK
   • Ensures actions succeed with audit trail or rollback completely

3. ❌ Database Indexes - PERFORMANCE RISK (5 min)

   • Add indexes on status, performed_at, grace period fields
   • Critical for queries at 500+ subscribers

4. ❌ Ban Management UI - OPERATIONAL GAP (60 min)

   • Simple ban list + unban button
   • Cannot currently view/manage chargebacks

5. ❌ Email Integration - FUNCTIONAL GAP (2-4 hours)

   • Grace period recovery emails don't send
   • Options: Paymenter API OR Nodemailer integration

Location:

• Code: firefrost-services repo (branch: main) at services/arbiter-3.0/
• Deployment: Command Center (63.143.34.217) at /opt/arbiter-3.0
• URL: https://discord-bot.firefrostgaming.com/admin

Documentation:

• Status: firefrost-services/services/arbiter-3.0/TRINITY-CONSOLE-STATUS.md
• Deployment: firefrost-services/services/arbiter-3.0/DEPLOYMENT-CHECKLIST.md
• Features: firefrost-services/services/arbiter-3.0/TRINITY-CONSOLE.md

Done when: All 5 security gaps resolved, tested, and deployed

---

4. Unsubscribe Flow - Cancellation UI

Time: 2-3 hours
Status: ⏳ NOT STARTED
Assigned: Unassigned
Blocks: Ethical payment processing, user autonomy

What's needed:

• Paymenter: Add "Cancel Subscription" button to user dashboard
• Cancellation confirmation flow
• Email: Cancellation confirmation message
• Backend: Connect to Trinity Console grace period system (already built!)

Backend Status:

• ✅ Trinity Console Grace Period module exists and is functional
• ✅ Database schema supports cancellation flow
• ✅ Grace period countdown timers working
• ✅ Auto-downgrade to Awakened after 3 days
• ✅ Manual recovery actions available
• ✅ Discord role management ready
• ✅ Whitelist sync ready

Frontend Needed:

• Paymenter Citadel theme modification
• "Cancel Subscription" button in user dashboard
• Confirmation modal ("Are you sure?")
• Success message linking to grace period info

Grace Period Flow:

1. User clicks "Cancel Subscription" in Paymenter
2. Status changes to grace_period in database
3. Discord roles KEPT for 3 days
4. Trinity Console shows countdown timer
5. After 3 days → Auto-downgrade to Awakened ($0 permanent tier)
6. User can resubscribe anytime during grace period

Philosophy: "We Don't Kick People Out" - Payment failure = grace period, NOT removal

Done when: User can cancel subscription, enters grace period, gets downgraded to Awakened after 3 days

---

5. End-to-End Workflow Test

Time: 2-3 hours
Status: ⏳ NOT STARTED
Assigned: Unassigned
Blocks: Confidence in system reliability

What's needed:

• Test full happy path:

  1. New user visits firefrostgaming.com
  2. Chooses Fire or Frost path
  3. Selects tier (Elemental $5)
  4. Completes Paymenter checkout
  5. Links Discord account
  6. Receives Discord role
  7. Gets whitelisted on game servers
  8. Logs in and plays
  9. Cancels subscription
  10. Enters grace period
  11. Gets downgraded to Awakened after 3 days

• Test failure scenarios:

  • Payment failure → grace period
  • Chargeback → immediate ban
  • Double subscription during grace period

Done when: All workflows verified, edge cases handled, team confident in system

---

📊 SUMMARY

Total Blockers: 5 tasks
Completed: 2 ✅ (Website Migration + Legal Pages Good Enough)
Remaining: 3 ⏳
Estimated Time Remaining: 9-11 hours (realistically 3-7 hours given execution speed 🚀)
Days Remaining: 12 days
Urgency: LOW (major infrastructure complete, polish remaining!)

Remaining Priorities:

1. ⏳ Trinity Console Security Hardening - 4-5 hours (CSRF, transactions, indexes, ban UI, email)
2. ⏳ Unsubscribe UI (backend ready, needs Paymenter frontend) - 2-3 hours
3. ⏳ End-to-end testing (validate everything works) - 2-3 hours

Major Wins This Session:

• ✅ Website migrated from Ghost to 11ty (Cloudflare Pages)
• ✅ Dynamic Servers page with real-time status (Cloudflare Workers architecture)
• ✅ Discord-gated IP security model (drives engagement + protects infrastructure)
• ✅ DNS cutover complete - firefrostgaming.com LIVE in production!
• ✅ Gemini validated: "You didn't just build it fast; you built it perfectly."

---

🎯 POST-LAUNCH PRIORITIES (Not Blockers)

These improve operations but don't prevent soft launch:

• Paymenter → Pterodactyl auto-provisioning (manual is fine for 10 users)
• Holly's Builder rank setup (can do post-launch)
• Rank system deployment (Phase 1 can wait)
• Additional automation and polish

---

Fire + Frost + Foundation = Where Love Builds Legacy 🔥❄️

This file is the single source of truth for soft launch blockers. Update it frequently.