Built in public

What we're waiting on.

The same list that lives at the top of our repo. Every blocker has a priority, what it unblocks, and what we need to clear it. When it's done, it moves to the "Done" section at the bottom.

Canonical source: BLOCKERS.md in the repo.

Open

Google OAuth client (Business Profile) High

OAuth 2.0 client ID + secret with business.manage scope and the consent screen verified for the franchisefrontline.com domain.

Goes in env as GOOGLE_OAUTH_CLIENT_ID and GOOGLE_OAUTH_CLIENT_SECRET. Unblocks the real per-operator review backfill via Business Profile API.

Twilio A2P 10DLC registration Medium

Twilio Trust Hub brand + campaign registration for the existing Twilio long-code. US carriers throttle unregistered traffic at any real volume.

SID / auth token / from-number are already live in Cloudflare env. A2P registration takes 1 to 3 business days for carrier vetting.

Cloudflare D1 database `FF_DB` Medium

A D1 database bound to the project. Schema in migrations/0001_init.sql.

Create via the D1 dashboard, paste-execute the migration in the D1 Console tab, then bind to the Pages project as variable name FF_DB. Unblocks reviews, escalations, OAuth tokens, settings, per-customer Places key storage.

Cloudflare WAF rate-limit rules Low

Two edge rate-limit rules on /api/auth-send-code and /api/auth-verify-code. Replaces the per-handle limit that no longer exists (auth is stateless now).

Cloudflare dashboard -> Security -> WAF -> Rate limiting rules. 5/IP/min on send, 20/IP/min on verify. Without this, the 6-digit OTP is brute-forceable.

Operator settings UI for per-customer Places key Product

A field in /app/settings.html where each operator pastes their own Google Places API key. Server encrypts it with AES-GCM (SESSION_SECRET-derived) and writes to the operator's row.

D1 column already added. The settings UI and handler write path still need to ship.

Stripe Later

Stripe account + Pricing catalog matching the three SKUs in /pricing.html + webhook secret.

Deferred until the first real customer is ready to enter a card.

RMCF reference permission Process

Written OK from Rocky Mountain Chocolate Factory to (a) name them privately on sales calls, (b) eventually appear as a public customer.

Asked during the pilot review. Currently cited anonymously as "a 200-location specialty retail chain."

Done

SendGrid: domain auth for franchisefrontline.com + API key in Cloudflare env. (2026-05-25)
Twilio: SID + auth token + from-number in Cloudflare env. (2026-05-25)
SESSION_SECRET in Cloudflare env. (2026-05-25)
Email Routing for [email protected]. (2026-05-25)
Lead sender + recipient addresses moved to _constants.js; only secrets in env. (CL-028)
Google Places API key model: per-customer in D1, not an FF-wide env var. (CL-028)
Auth made stateless: signed receipt tokens replaced the KV-backed code store. No KV binding needed. (CL-031)
Dev-only endpoints (/api/dev-signin, /api/preview-template) and DEV_BYPASS_KEY env var removed. (CL-031)

Why this is public.

If a vendor can't articulate what they're stuck on, they're not being honest with you about progress. This is what we're stuck on. Want to help one of these along, or you have a question about an item? Email us.