Skip to content

Let the bloggers in the directory sell what the crawlers are taking - #182

Merged
ralyodio merged 2 commits into
mainfrom
partners
Sep 6, 2026
Merged

Let the bloggers in the directory sell what the crawlers are taking#182
ralyodio merged 2 commits into
mainfrom
partners

Conversation

@ralyodio

@ralyodio ralyodio commented Sep 6, 2026

Copy link
Copy Markdown
Contributor

The directory is other people's blogs. traffic_hourly says most of what reads them is machines, and crawl_sales now says what those machines paid. None of that money had any route back to the people who wrote the posts.

/sell is that route.

What a publisher walks through

  1. The pitch at /sell, public, with the ladder and what they need.
  2. Prove they own the site behind a feed we already index. A DNS TXT record or one file under /.well-known, both automated; there is no "email us" path.
  3. Pick topics from the directory's own busiest 40, resolved per request so a topic that appeared this week is claimable this week.
  4. Add a USDC address.
  5. Get paid a share of what crawlers pay.

The rate starts at 20% and climbs 5 points per verified property and per niche to 80%, on the same commissionLadder the public board displays.

Attribution

Only this side knows whose feeds are in the index, so the split lives here: a verified domain is matched against the host of each feed's site_url, and a sale is shared pro-rata by items contributed, each partner at their own rate.

The credit ref carries the partner id, so a settlement delivered twice pays once. The split runs after the sale is booked and can never fail it, because the money has already moved.

Two decisions worth reviewing

  • A missing secret 404s /sell instead of crashing the site. The module will not construct without PARTNER_VERIFY_SECRET, which is right (a guessable verification token pays the wrong person for someone else's writing), but that must not take the directory down on a deploy where the variable was forgotten.
  • The pitch is in OPEN_PATHS. Charging a crawler to read our own recruiting page would be an odd way to run a marketplace. The data itself stays paywalled.

Verified against a local libSQL file, driving the real route handler

  • signed out: the pitch renders with a call to action; the dashboard redirects to /signin?next=/sell
  • apply lands on the dashboard; a property shows its real verification token
  • one verified property plus two topics reads 35%
  • a $20 sale splits to 700 cents; the same sale replayed adds nothing
  • the existing 382 tests still pass, and the build carries /sell/[[...path]]

PARTNER_VERIFY_SECRET is already set on the rssamplifier.com service and stored in the rssamplifier-com--prod vault.

🤖 Generated with Claude Code

https://claude.ai/code/session_0144uEVbZK3jdaQkwcLYTXPE

The directory is other people's blogs. traffic_hourly says most of what reads
them is machines and crawl_sales says what those machines paid, and none of
that money had any route back to the people who wrote the posts.

/sell is that route. Prove you own the site behind a feed we already index
(DNS TXT or one file under /.well-known, both automated), pick topics, add a
USDC address, and take a share. The rate starts at 20% and climbs 5 points per
verified property and per niche to a cap of 80%, on the same ladder the public
board shows, so nobody is quoted two different numbers.

Attribution belongs here because only this side knows whose feeds are in the
index: a verified domain is matched against the host of each feed's site_url,
and a sale is shared pro-rata by items contributed, each at their own rate.
The credit ref carries the partner id, so a settlement delivered twice pays
once. It runs after the sale is booked and can never fail it.

The module owns none of the auth: it asks who is here and we answer from the
rsa_session cookie the rest of the site already uses. Without
PARTNER_VERIFY_SECRET it does not construct, which is right (a guessable
verification token pays the wrong person for someone else's writing) and must
not take the site down, so /sell 404s until the secret is set.

Verified against a local libSQL file, driving the real route handler: signed
out gets the pitch and a redirect to /signin, apply lands on the dashboard, a
property shows its real token, one verified property plus two topics reads
35%, a $20 sale splits to 700 cents and the same sale replayed adds nothing.
The existing 382 tests still pass and the build carries /sell.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0144uEVbZK3jdaQkwcLYTXPE
@socket-security

socket-security Bot commented Sep 6, 2026

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Added@​profullstack/​partners@​0.2.07610010088100

View full report

The repo checks that a timestamped migration is not in the future, and 05:00
had not arrived when the file was written. A good guardrail: a migration
dated ahead sorts before files that genuinely come later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0144uEVbZK3jdaQkwcLYTXPE
@ralyodio
ralyodio merged commit 08a462e into main Sep 6, 2026
3 checks passed
@ralyodio
ralyodio deleted the partners branch September 6, 2026 04:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant