# ClearConsent — launch handoff (WordPress.org submission + Freemius setup)

Paste this into a fresh session to pick up the two remaining workstreams. The banner feature is done and
in the repo; what's left is finishing a short build queue, then the .org scrub/screenshots/submit and the
Freemius product setup.

## Orientation
- **Product:** ClearConsent — freemium WordPress cookie-consent + Google Consent Mode v2 plugin. Holds
  tracking scripts until the visitor consents; sends GCM v2 signals; stays caching-safe. Version 1.0.0.
- **Owner:** Jess Nunez. Company: MicroMedia. WP.org username: **jessn**. GitHub: wpjess.
- **Licensing (Path A):** GPLv2-or-later. Free tier on .org; Pro/Agency via Freemius. Ownership held via
  copyright + trademark + Freemius entitlement (GPL can't keep distributed code secret — the moat is
  not-distributing Pro in the free zip, plus trademark + license/updates/support).
- **Repo:** `git@github-clearconsent:wpjess/clearconsent.git` (private). HEAD/origin/main = **ddf1733**,
  in sync. Dist build = 23 files; repo = 44 (the extra are dev/docs/planning/tools/screenshots excluded
  via `.distignore`). Cursor local: `/Users/jess/micromedia-consent/clearconsent/` (synced to repo).
- **Sites (Claude Code has SSH+login to both):** wpclearconsent.com (Pressable) is the marketing/help
  site **and** the current build source; testdomain.com (SpinupWP) is the multisite test site.
- **Roles:** Cursor builds locally + CHANGELOG. Claude Code deploys/tests/fixes on the server + owns the
  git push and planning docs (scripts: cc-sync.sh, cc-changelog.sh, cc-commit-state.sh — note cc-sync.sh
  needs a full-mirror source; cc-commit-state.sh has falsely printed "✅ pushed" on a rejected push, so
  verify pushes). Claude (chat) writes specs/briefs and makes product calls. Server planning docs live at
  docs/planning/handoff.md + journal.txt (transcript catalog) — have Claude Code surface them if needed.

## Tier map (locked)
- **Free:** consent banner (buttons + preferences modal), GCM v2 (honest "consent-gated" wording), geo
  targeting, banner layout toggle (buttons|toggles) + banner logo. Free service limit = 3.
- **Pro:** site scanning, Script Manager, consent logging, custom styling (colors/fonts/dimensions),
  translations.
- **Agency:** white-label, multisite push ("My Sites").

## Non-negotiable invariants (don't let any finalization break these)
- Blocker self-exclusion; output-buffer rewrite stays **consent-independent** (caching-safe) and skips
  managed slugs; Script Manager `data-cc-src="manager"` sentinel preserved.
- No-cache header scoped to scan-mode only; geo endpoint `Cache-Control: no-store` with **no** resolved
  region in cached HTML; geo cache + consent storage scoped per-subsite on subdirectory multisite.
- Consent cookie never `wp`/`wordpress`-prefixed.
- `CLEARCONSENT_DEV_PRO` (staging Pro gate) **never committed**; lives only in wp-config.
- **No AI/tool attribution** anywhere. **Neutral legal stance** everywhere — the plugin is an aid, never
  claims GDPR/compliance ("ClearConsent doesn't determine your legal obligations").

## Build queue to finish BEFORE the scrub/screenshots
These change the UI the screenshots capture and the surfaces the security pass covers, so land + verify
them first. Specs already written (filenames in the last section):
1. **Gauges detection** + **coverage addendum** — adds a `gauges` signature (fixes "Unknown tracker" +
   the configured-never-sticks cookie-family bug) and honest host-managed coverage wording (read
   `$cc_sig['note']`/`note_label` instead of the hardcoded WooCommerce tooltip; no `essential:true`).
2. **Settings cleanup** — remove "Hide banner for administrators" + "Services start turned on"; dissolve
   the Behavior section; move "Require a choice before browsing" to General; new Geo-targeting section.
3. **My Sites polish** — Export/Import reflow + custom confirm modal (interpolates {source}/{count},
   red-bold backup warning); include geo in Advanced export/import.
4. **show_logo Style-tab duplicate (quick fix, recommended):** `show_logo` is registered on BOTH the
   Settings tab (manual render in the Credit-line block — correct) and the Style tab (`add_settings_field`
   ~line 470, next to `banner_layout`). The save fix routed persistence to the Settings block, so the
   Style-tab copy no longer persists. Remove the line-470 `add_settings_field('show_logo', … 'clearconsent-style' …)`
   so the checkbox lives only on the Settings tab.

## Workstream A — WordPress.org submission
Authoritative doc: **clearconsent-presubmission-checklist.md**. Sequence:
1. Finish the build queue above; confirm on a clean install.
2. **Scrub:** remove `MICROMEDIA_DEV_PRO` (dead dup of CLEARCONSENT_DEV_PRO, named after the company) and
   any `CLEARCONSENT_DEV_PRO` references that would ship; verify `.distignore` produces a clean 23-file
   zip (no planning/scaffolding/dev files). Drop the `cc-test-injectors`/`cc-test-localdns` mu-plugins.
3. **Security pass** (expanded for new surfaces): agency push (`ajax_push_settings` — nonce +
   `manage_network_options`), bulk CSV export (admin-post), bulk **import** (highest risk — validate
   extension/MIME/size, guard `fgetcsv`/`json_decode`, sanitize before `update_option`, resolve blog_id),
   per-site export/import, scan/save/script-manager/log-export/debug (nonce + cap + escaping), My Sites
   table output escaping.
4. **readme.txt** — header is final (Stable tag 1.0.0, Requires at least 6.5, Tested up to 7.0, Requires
   PHP 7.4, GPLv2-or-later, Contributors jessn). Run it through the WP readme validator. Body uses honest
   consent-gated GCM language + neutral FAQ; 9 curated screenshot captions installed.
5. **Screenshots** — reshoot the front-end banner + modal so the **Reject** button, the new **logo**, and
   the **category toggles** are visible; keep the curated set of 9, rename in order
   (1 banner, 2 modal, 3 services, 4 GCM, 5 geo, 6 scan, 7 style, 8 logs, 9 my-sites). These go in SVN
   `/assets`, **not** the plugin zip.
6. **Rotate** the test-site admin password (was set to `ShotCap2026x` during screenshotting).
7. **Ownership line** — add a Copyright + Author line; decide Jess-personal vs MicroMedia (see "Needs
   Jess"). Submit the zip at wordpress.org/plugins/developers/add/ as **jessn** (2–4 week review clock).

## Workstream B — Freemius setup (parallel)
Authoritative doc: **clearconsent-freemius-setup-checklist.md**.
- `cc_fs()` global does not exist yet — create the Freemius product, slug **clearconsent**.
- Plans: **pro** + **agency** (not "professional").
- Add Freemius **premium-only markers** so the .org free zip strips Pro/Agency code (pure runtime gating
  would otherwise ship Pro source in the free zip — the whole point is the free zip contains no Pro code).
- Keep the public distribution = .org SVN free build; the private repo keeps full Pro/Agency source. A
  public GitHub mirror, if ever wanted, should be the free build only.

## Legal pages (Jess + attorney)
Drafted: **privacy-policy.md**, **terms-and-conditions.md** (website pages, not legal advice). Jess to
fill placeholders (legal entity, address, email, effective date, domain, jurisdiction — Oregon hinted,
refund terms, free-plugin liability figure, children's age) and get the T&C reviewed by an attorney,
especially the liability/indemnification sections.

## Needs Jess's input / decisions
- **Ownership:** Jess-personal vs MicroMedia for the copyright/Author line; **trademark** via an IP
  attorney (the only GPL-exclusive lever worth pursuing).
- Confirm **banner layout toggle ships Free** (recommended — it's a layout/UX choice like position).
- Approve the **show_logo Style-tab duplicate removal** (recommended).
- Legal placeholders + T&C attorney review.
- Rotate test creds before launch.

## Backlog (post-launch, not blockers)
- Verify pushed config reaches front-end visitors on object-cache hosts (Pressable/Redis) without a
  manual flush; if not, invalidate the target option cache in the push/import path.
- GCM true-advanced mode (Pro fast-follow); geo custom-header field + `clearconsent_visitor_region`
  filter + bundled GeoIP (Pro); IAB TCF v2.3 (deferred).

## Deliverable files already produced (ask Jess to re-share any you need)
Specs: clearconsent-gauges-detection-spec.md, clearconsent-gauges-coverage-addendum.md,
clearconsent-agency-network-spec.md, clearconsent-settings-cleanup-spec.md,
clearconsent-mysites-polish-spec.md, clearconsent-banner-style-spec.md,
clearconsent-banner-logo-fix.md, clearconsent-toggle-css.md, clearconsent-cc-capture-and-logofix.md.
Checklists: clearconsent-presubmission-checklist.md, clearconsent-freemius-setup-checklist.md.
Content/legal: readme.txt, clearconsent-kb-geo-targeting.md, clearconsent-help-center-brief.md,
privacy-policy.md, terms-and-conditions.md.
