OPERATOR HANDOVER

A real foundation. Clear next steps.

The core learning product runs now. External services stay off until configured.

What runs in this build

Original method-selection exercises, alternative-method feedback, progressive hints, mixed recognition, timed sprints, Question Twins and compare-method sessions are operational. Signed-in users get a private persistent history, Error Bank, descriptive analytics, saved questions and data export. The overview provides a compact route into the core learning tools.

This bank includes original template variants and a mapped curriculum. Subject-expert verification and wider specification coverage remain launch requirements. Unseen diagnostics stop when the available unseen questions are exhausted.

AuthenticationSites-managed

Private databaseSites D1

StripeNeeds credentials

AI providerNeeds credentials

Architecture & authentication

This Sites deployment uses the supplied Next.js-compatible Vinext App Router runtime, TypeScript, React, KaTeX and Zod, with Cloudflare D1 and private R2 storage. Sign in with ChatGPT provides a trusted, Site-specific identity. Every personal-data request is scoped on the server; administrators are explicitly allowlisted.

The preferred Supabase stack is not connected. Do not assume that PostgreSQL row-level security or Supabase Authentication is active in this build. A separate migration to native Next.js / Supabase needs a configured Supabase project, provider sessions, PostgreSQL migrations, RLS policies and deployment validation.

The source repository includes the Drizzle schema and generated SQL, integration tests, architecture notes, an environment example and a launch checklist.

Runtime variables

Set these in the Site’s server environment and redeploy. Never paste secret values into the content editor or commit them to Git.

Name	Value / purpose
`APP_URL`	Your deployed HTTPS origin
`AXIOM_ADMIN_IDS`	Comma-separated Site-specific account IDs from /account
`STRIPE_SECRET_KEY`	Restricted Stripe runtime key (server secret)
`STRIPE_WEBHOOK_READY`	false until external signed delivery is tested
`STRIPE_PORTAL_CONFIGURATION`	Stripe customer portal configuration ID
`STRIPE_WEBHOOK_SECRET`	whsec_… from your Stripe webhook endpoint
`STRIPE_PRICE_MONTHLY`	£11.99 GBP recurring monthly price ID
`STRIPE_PRICE_PASS`	£24.99 GBP one-time price ID
`STRIPE_PRICE_PERMANENT`	£60 GBP one-time price ID
`COMMERCE_ENABLED`	true only after webhook and legal setup pass
`OPENAI_API_KEY`	Provider API key (server only)
`AI_MODEL`	A vision-capable Responses API model ID
`AI_UPLOADS_ENABLED`	true only after document-processing privacy review

PAYMENTS & YOUR BANK ACCOUNT

Connect Stripe securely.

Stripe collects payments and sends payouts to your bank. Enter identity and bank details only in Stripe’s own Dashboard. Axiom Methods does not collect your sort code, account number or bank login.

Runtime configuration · test mode

Server keyPending

Three GBP pricesPending

Customer portalPending

Webhook signing secretPending

External webhook delivery verifiedPending

Checkout enabledPending

Set up the legal account and payout bank.
Open Stripe, complete business verification and add your payout account in Settings → Business → Bank accounts. Because you are under 18, a legal guardian must become the account owner before charges and payouts can be enabled.
Open Stripe account setup
Connect the three access plans in a Stripe sandbox.
Create £11.99 GBP recurring monthly, £24.99 GBP one-time and £60 GBP one-time prices. Enable the customer billing portal. The Site needs the server secret key, three price IDs and the signed webhook secret listed above.
Stripe Checkout documentation
Verify the webhook and finish the launch settings.
Use /api/stripe/webhook with the lifecycle, failed-payment, refund, dispute and fraud-warning events documented in the Stripe setup guide. This owner-private Site currently requires sign-in before requests reach the app, so external webhooks need an explicitly configured public Site or a secured public ingress.
Set the credentials in the Site’s server environment. Keep COMMERCE_ENABLED and STRIPE_WEBHOOK_READY false until external signed sandbox delivery, Checkout, portal cancellation and refund have passed. Then use the corresponding live keys and prices. Complete the operator contact, terms and privacy details before charging customers.

Stripe guardian requirement Payout bank instructions

Current state: Stripe is awaiting credentials. No customer payment or bank payout is being simulated.

Connect AI carefully

Obtain a provider API key, configure OPENAI_API_KEY and set AI_MODEL to a compatible vision-capable Responses API model. Set an account spending limit.
Test explanation and answer-plan feedback against the original question solutions. Outputs are structured and runtime-validated; they remain provisional.
Before enabling AI processing, review the provider’s data-processing terms, retention, international transfers and children’s privacy requirements. Requests use store: false; that does not itself guarantee zero provider retention.
Set AI_UPLOADS_ENABLED=true only after that review. Uploads accept PDFs, PNGs and JPGs up to 10 MB each, with a 50 MB private account allowance.
Official past papers can be added to the reference locker. Device storage stays in the browser; private account storage requires applicable permission. Official reference files are excluded from AI. Only independently authored assessments are enabled for AI processing.
Test extraction against readable and unreadable handwriting, criterion fidelity, alternative methods, credit return after failures and marking corrections.

The current integration uses OpenAI’s Responses API behind a server-side module. Replacing the provider requires implementing the same validated extraction, decision and feedback contracts.

Before commercial launch

Finish independent content review, wider question coverage, two-account isolation testing, live authentication tests and Stripe end-to-end sandbox tests. Review accessibility with assistive technology. The included legal pages are drafts, not a completed legal compliance assessment.

Configure the legal operator identity, contact details, support/refund process and retention schedule. Complete a children’s privacy impact assessment, provider agreements and terms review. Do not enable live charges while these remain unresolved.

Later-phase items still requiring implementation include tutor permissions, calibrated marking reliability, a production job queue for higher volume, provider cost telemetry, extra-credit checkout and comprehensive exam coverage. Do not market these as available.