max / makenotwork
88 files changed,
+4509 insertions,
-916 deletions
| @@ -36,3 +36,7 @@ server/templates/_head_assets.html | |||
| 36 | 36 | ||
| 37 | 37 | # Generated rustdoc output | |
| 38 | 38 | server/rustdoc-out/ | |
| 39 | + | ||
| 40 | + | # Mutation testing output | |
| 41 | + | mutants.out* | |
| 42 | + | **/mutants.out* |
| @@ -26,7 +26,7 @@ Fair creator platform with 0% platform fee (only Stripe's ~3% processing fee). M | |||
| 26 | 26 | - **Basic** — $10/mo (text, all base features) | |
| 27 | 27 | - **Small Files** — $20/mo (audio, software, plugins, small downloads) | |
| 28 | 28 | - **Big Files** — $30/mo (video, courses, large downloads) | |
| 29 | - | - **Everything** — $40/mo (all features, current and future) | |
| 29 | + | - **Everything** — $60/mo (live streaming, all features, current and future) | |
| 30 | 30 | ||
| 31 | 31 | ## Ecosystem | |
| 32 | 32 |
| @@ -3385,7 +3385,7 @@ dependencies = [ | |||
| 3385 | 3385 | ||
| 3386 | 3386 | [[package]] | |
| 3387 | 3387 | name = "makenotwork" | |
| 3388 | - | version = "0.4.4" | |
| 3388 | + | version = "0.4.5" | |
| 3389 | 3389 | dependencies = [ | |
| 3390 | 3390 | "anyhow", | |
| 3391 | 3391 | "argon2", | |
| @@ -3413,6 +3413,7 @@ dependencies = [ | |||
| 3413 | 3413 | "metrics", | |
| 3414 | 3414 | "metrics-exporter-prometheus", | |
| 3415 | 3415 | "openssl", | |
| 3416 | + | "proptest", | |
| 3416 | 3417 | "rand 0.9.2", | |
| 3417 | 3418 | "regex", | |
| 3418 | 3419 | "reqwest", | |
| @@ -3439,6 +3440,8 @@ dependencies = [ | |||
| 3439 | 3440 | "tracing-subscriber", | |
| 3440 | 3441 | "url", | |
| 3441 | 3442 | "urlencoding", | |
| 3443 | + | "utoipa", | |
| 3444 | + | "utoipa-axum", | |
| 3442 | 3445 | "uuid 1.22.0", | |
| 3443 | 3446 | "webauthn-authenticator-rs", | |
| 3444 | 3447 | "webauthn-rs", | |
| @@ -3952,6 +3955,12 @@ dependencies = [ | |||
| 3952 | 3955 | ] | |
| 3953 | 3956 | ||
| 3954 | 3957 | [[package]] | |
| 3958 | + | name = "paste" | |
| 3959 | + | version = "1.0.15" | |
| 3960 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 3961 | + | checksum = "57c0d7b74b563b49d38dae00a0c37d4d6de9b432382b2892f0574ddcae73fd0a" | |
| 3962 | + | ||
| 3963 | + | [[package]] | |
| 3955 | 3964 | name = "pastey" | |
| 3956 | 3965 | version = "0.1.1" | |
| 3957 | 3966 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -4215,6 +4224,25 @@ dependencies = [ | |||
| 4215 | 4224 | ] | |
| 4216 | 4225 | ||
| 4217 | 4226 | [[package]] | |
| 4227 | + | name = "proptest" | |
| 4228 | + | version = "1.11.0" | |
| 4229 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 4230 | + | checksum = "4b45fcc2344c680f5025fe57779faef368840d0bd1f42f216291f0dc4ace4744" | |
| 4231 | + | dependencies = [ | |
| 4232 | + | "bit-set", | |
| 4233 | + | "bit-vec", | |
| 4234 | + | "bitflags 2.11.0", | |
| 4235 | + | "num-traits", | |
| 4236 | + | "rand 0.9.2", | |
| 4237 | + | "rand_chacha 0.9.0", | |
| 4238 | + | "rand_xorshift", | |
| 4239 | + | "regex-syntax", | |
| 4240 | + | "rusty-fork", | |
| 4241 | + | "tempfile", | |
| 4242 | + | "unarray", | |
| 4243 | + | ] | |
| 4244 | + | ||
| 4245 | + | [[package]] | |
| 4218 | 4246 | name = "protobuf" | |
| 4219 | 4247 | version = "3.7.2" | |
| 4220 | 4248 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -4371,6 +4399,12 @@ dependencies = [ | |||
| 4371 | 4399 | ] | |
| 4372 | 4400 | ||
| 4373 | 4401 | [[package]] | |
| 4402 | + | name = "quick-error" | |
| 4403 | + | version = "1.2.3" | |
| 4404 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 4405 | + | checksum = "a1d01941d82fa2ab50be1e79e6714289dd7cde78eba4c074bc5a4374f650dfe0" | |
| 4406 | + | ||
| 4407 | + | [[package]] | |
| 4374 | 4408 | name = "quote" | |
| 4375 | 4409 | version = "1.0.45" | |
| 4376 | 4410 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -4498,6 +4532,15 @@ dependencies = [ | |||
| 4498 | 4532 | ] | |
| 4499 | 4533 | ||
| 4500 | 4534 | [[package]] | |
| 4535 | + | name = "rand_xorshift" | |
| 4536 | + | version = "0.4.0" | |
| 4537 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 4538 | + | checksum = "513962919efc330f829edb2535844d1b912b0fbe2ca165d613e4e8788bb05a5a" | |
| 4539 | + | dependencies = [ | |
| 4540 | + | "rand_core 0.9.5", | |
| 4541 | + | ] | |
| 4542 | + | ||
| 4543 | + | [[package]] | |
| 4501 | 4544 | name = "rand_xoshiro" | |
| 4502 | 4545 | version = "0.7.0" | |
| 4503 | 4546 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -4851,6 +4894,18 @@ source = "registry+https://github.com/rust-lang/crates.io-index" | |||
| 4851 | 4894 | checksum = "b39cdef0fa800fc44525c84ccb54a029961a8215f9619753635a9c0d2538d46d" | |
| 4852 | 4895 | ||
| 4853 | 4896 | [[package]] | |
| 4897 | + | name = "rusty-fork" | |
| 4898 | + | version = "0.3.1" | |
| 4899 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 4900 | + | checksum = "cc6bf79ff24e648f6da1f8d1f011e9cac26491b619e6b9280f2b47f1774e6ee2" | |
| 4901 | + | dependencies = [ | |
| 4902 | + | "fnv", | |
| 4903 | + | "quick-error", | |
| 4904 | + | "tempfile", | |
| 4905 | + | "wait-timeout", | |
| 4906 | + | ] | |
| 4907 | + | ||
| 4908 | + | [[package]] | |
| 4854 | 4909 | name = "ryu" | |
| 4855 | 4910 | version = "1.0.23" | |
| 4856 | 4911 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -6208,6 +6263,12 @@ source = "registry+https://github.com/rust-lang/crates.io-index" | |||
| 6208 | 6263 | checksum = "562d481066bde0658276a35467c4af00bdc6ee726305698a55b86e61d7ad82bb" | |
| 6209 | 6264 | ||
| 6210 | 6265 | [[package]] | |
| 6266 | + | name = "unarray" | |
| 6267 | + | version = "0.1.4" | |
| 6268 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 6269 | + | checksum = "eaea85b334db583fe3274d12b4cd1880032beab409c0d774be044d4480ab9a94" | |
| 6270 | + | ||
| 6271 | + | [[package]] | |
| 6211 | 6272 | name = "unicase" | |
| 6212 | 6273 | version = "2.9.0" | |
| 6213 | 6274 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -6302,6 +6363,44 @@ source = "registry+https://github.com/rust-lang/crates.io-index" | |||
| 6302 | 6363 | checksum = "06abde3611657adf66d383f00b093d7faecc7fa57071cce2578660c9f1010821" | |
| 6303 | 6364 | ||
| 6304 | 6365 | [[package]] | |
| 6366 | + | name = "utoipa" | |
| 6367 | + | version = "5.4.0" | |
| 6368 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 6369 | + | checksum = "2fcc29c80c21c31608227e0912b2d7fddba57ad76b606890627ba8ee7964e993" | |
| 6370 | + | dependencies = [ | |
| 6371 | + | "indexmap", | |
| 6372 | + | "serde", | |
| 6373 | + | "serde_json", | |
| 6374 | + | "utoipa-gen", | |
| 6375 | + | ] | |
| 6376 | + | ||
| 6377 | + | [[package]] | |
| 6378 | + | name = "utoipa-axum" | |
| 6379 | + | version = "0.2.0" | |
| 6380 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 6381 | + | checksum = "7c25bae5bccc842449ec0c5ddc5cbb6a3a1eaeac4503895dc105a1138f8234a0" | |
| 6382 | + | dependencies = [ | |
| 6383 | + | "axum", | |
| 6384 | + | "paste", | |
| 6385 | + | "tower-layer", | |
| 6386 | + | "tower-service", | |
| 6387 | + | "utoipa", | |
| 6388 | + | ] | |
| 6389 | + | ||
| 6390 | + | [[package]] | |
| 6391 | + | name = "utoipa-gen" | |
| 6392 | + | version = "5.4.0" | |
| 6393 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 6394 | + | checksum = "6d79d08d92ab8af4c5e8a6da20c47ae3f61a0f1dabc1997cdf2d082b757ca08b" | |
| 6395 | + | dependencies = [ | |
| 6396 | + | "proc-macro2", | |
| 6397 | + | "quote", | |
| 6398 | + | "regex", | |
| 6399 | + | "syn 2.0.117", | |
| 6400 | + | "uuid 1.22.0", | |
| 6401 | + | ] | |
| 6402 | + | ||
| 6403 | + | [[package]] | |
| 6305 | 6404 | name = "uuid" | |
| 6306 | 6405 | version = "0.8.2" | |
| 6307 | 6406 | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| @@ -6353,6 +6452,15 @@ source = "registry+https://github.com/rust-lang/crates.io-index" | |||
| 6353 | 6452 | checksum = "5c3082ca00d5a5ef149bb8b555a72ae84c9c59f7250f013ac822ac2e49b19c64" | |
| 6354 | 6453 | ||
| 6355 | 6454 | [[package]] | |
| 6455 | + | name = "wait-timeout" | |
| 6456 | + | version = "0.2.1" | |
| 6457 | + | source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 6458 | + | checksum = "09ac3b126d3914f9849036f826e054cbabdc8519970b8998ddaf3b5bd3c65f11" | |
| 6459 | + | dependencies = [ | |
| 6460 | + | "libc", | |
| 6461 | + | ] | |
| 6462 | + | ||
| 6463 | + | [[package]] | |
| 6356 | 6464 | name = "waker-fn" | |
| 6357 | 6465 | version = "1.2.0" | |
| 6358 | 6466 | source = "registry+https://github.com/rust-lang/crates.io-index" |
| @@ -123,3 +123,4 @@ tower = { version = "0.5.3", features = ["util"] } | |||
| 123 | 123 | http-body-util = "0.1" | |
| 124 | 124 | webauthn-authenticator-rs = { version = "0.5", features = ["softpasskey"] } | |
| 125 | 125 | tempfile = "3" | |
| 126 | + | proptest = "1" |
| @@ -159,11 +159,11 @@ Each `db/` submodule handles a specific domain: | |||
| 159 | 159 | ||
| 160 | 160 | ### Stripe Connect | |
| 161 | 161 | ||
| 162 | - | Stripe Connect Express for creator payouts. Creators connect their Stripe account via OAuth. MNW takes 0% platform fee -- only Stripe's ~3% processing fee applies. | |
| 162 | + | Stripe Connect Standard for creator payouts. Creators connect their Stripe account via OAuth. MNW takes 0% platform fee -- only Stripe's ~3% processing fee applies. | |
| 163 | 163 | ||
| 164 | 164 | - Checkout sessions for one-time purchases and subscriptions | |
| 165 | 165 | - Webhook handlers for payment confirmation, subscription lifecycle, disputes | |
| 166 | - | - Creator tier subscriptions (Basic $10, Small Files $20, Big Files $30, Everything $40) | |
| 166 | + | - Creator tier subscriptions (Basic $10, Small Files $20, Big Files $30, Everything $60) | |
| 167 | 167 | - Fan+ consumer subscriptions ($8/mo) | |
| 168 | 168 | - Promo codes (percentage/fixed discount, free access) | |
| 169 | 169 |
| @@ -4,6 +4,16 @@ Full chronological audit log. See [audit_review.md](./audit_review.md) for curre | |||
| 4 | 4 | ||
| 5 | 5 | ## Changes Since Last Audit | |
| 6 | 6 | ||
| 7 | + | ### Thirty-eighth audit (2026-04-30, Run 17 cross-project) | |
| 8 | + | - **Test count:** 1,861 (1,139 unit + 722 integration). 0 failures. 0 clippy warnings. | |
| 9 | + | - **Grade:** A (maintained). v0.4.5. ~79,334 LOC. | |
| 10 | + | - **Growth:** +11,892 LOC, +502 tests since Run 15. | |
| 11 | + | - **New features since Run 15:** OpenAPI spec (utoipa), SyncKit push idempotency (migration 083), fingerprinting tables dropped (migration 082), expanded promo code and pricing modules. | |
| 12 | + | - **Cold spots:** None. All modules A- or above. | |
| 13 | + | - **Mandatory surprise:** TOCTOU-safe slug generation with retry loop + advisory lock pattern for sandbox IP cap. Production-grade. | |
| 14 | + | - **Previous items verified:** 3 upstream-blocked deps unchanged. All resolved items confirmed intact. | |
| 15 | + | - **No new action items.** | |
| 16 | + | ||
| 7 | 17 | ### Thirty-third audit (2026-03-28, Run 12 cross-project) | |
| 8 | 18 | - **Test count:** 1,174 (584 unit + 545 integration + 17 admin + 28 health). 2 FAILURES. 0 clippy warnings. | |
| 9 | 19 | - **Grade:** A (maintained). v0.3.13. |
| @@ -1,31 +1,31 @@ | |||
| 1 | 1 | # MakeNotWork -- Audit Review | |
| 2 | 2 | ||
| 3 | - | **Last audited:** 2026-04-18 (thirty-sixth audit, Run 15 cross-project) | |
| 4 | - | **Previous audit:** 2026-04-15 (thirty-fifth audit, Run 14 cross-project) | |
| 3 | + | **Last audited:** 2026-04-30 (thirty-eighth audit, Run 17 cross-project) | |
| 4 | + | **Previous audit:** 2026-04-18 (Run 15, corrected 2026-04-22) | |
| 5 | 5 | ||
| 6 | 6 | ## Overall Grade: A | |
| 7 | 7 | ||
| 8 | - | Run 15 cross-project audit (updated 2026-04-22). 1,359 tests (all pass). 0 clippy warnings. v0.3.25. ~67,442 LOC. Test failures resolved. axum_extra::Form finding was incorrect (usage is correct for repeated form fields, all tests pass). db/models.rs split into 16 domain submodules (largest 384 LOC). Observability at 36% is a known gap but not grade-blocking. | |
| 8 | + | Run 17: 1,861 tests (1,139 unit + 722 integration, all pass). 0 clippy warnings. v0.4.5. ~79,334 LOC. No cold spots. All previous action items verified. Significant growth since Run 15 (~67K -> ~79K LOC, ~1,359 -> ~1,861 tests). | |
| 9 | 9 | ||
| 10 | 10 | ## Scorecard | |
| 11 | 11 | ||
| 12 | 12 | | Dimension | Grade | Notes | | |
| 13 | 13 | |-----------|:-----:|-------| | |
| 14 | - | | Code Quality | A | thiserror errors; clean naming; `//!` on all files; proper `?` propagation; 0 clippy warnings | | |
| 15 | - | | Architecture | A | Single crate with clean internal modules; `lib.rs` exports `build_app` for test reuse; `pub(crate)` hides internal DB modules; models split into 16 domain submodules (largest 384 LOC) | | |
| 16 | - | | Testing | A+ | 1,359 tests (all pass). Per-test database isolation. In-process load test harness. 61 adversarial exploit-attempt tests. | | |
| 17 | - | | Security | A+ | Zero SQL injection; Argon2 hashing; CSRF synchronizer tokens; session fixation prevention; account lockout; HIBP; multi-layer file scanning; ammonia sanitization; HMAC-signed links; rate limiting; passkeys/WebAuthn; TOTP 2FA; trust tiers | | |
| 18 | - | | Performance | A- | Parameterized queries with LIMITs; presigned S3 URLs; `FOR UPDATE` on reorder; paginated admin; no N+1; session touch cache (DashMap 30s TTL) | | |
| 19 | - | | Documentation | B+ | Module-level `//!` on all files; public function docs; API conventions documented; some docs lagging behind code growth | | |
| 20 | - | | Dependencies | A | 38 direct deps, well-justified; OpenSSL vendored; edition 2024; upstream-blocked transitive vulns | | |
| 21 | - | | Frontend | A | Askama auto-escaping; HTMX with CSRF; responsive CSS; axum_extra::Form used correctly for repeated form fields | | |
| 22 | - | | Type Safety | A+ | 14+ newtype UUID wrappers; 15+ domain enums; validated newtypes; `from_trusted` escape hatch; exhaustive matches | | |
| 23 | - | | Observability | A | 883 instrument annotations (routes 97%, DB 100%). Structured JSON logging (prod); request ID propagation; TraceLayer with status-based log levels; health monitor with DB history; alert emails | | |
| 24 | - | | Concurrency | A | Atomic DB operations for race-prone paths; transaction + `FOR UPDATE` for reorder; graceful shutdown; session touch cache (DashMap with 30s TTL avoids N+1 session queries) | | |
| 25 | - | | Resilience | A- | Graceful shutdown; optional services degrade gracefully; timeouts on external HTTP calls; 3s DB pool acquire timeout | | |
| 26 | - | | API Consistency | A- | Documented response conventions; JSON error layer; `ListResponse<T>` envelope; HTMX-aware dual responses | | |
| 27 | - | | Migration Safety | A+ | All additive migrations, auto-applied on boot; no destructive migrations | | |
| 28 | - | | Codebase Size | A- | ~67,442 LOC; no file exceeds 500-line branching guideline after models split | | |
| 14 | + | | Code Quality | A | Minimal unwraps outside tests, consistent error handling, no dead code | | |
| 15 | + | | Architecture | A | Clean layer separation (db/routes/payments/templates/types), trait-based testability | | |
| 16 | + | | Testing | A | 1,861 tests (1,139 unit + 722 integration), ~15.0 unit/KLOC, proptest active | | |
| 17 | + | | Security | A+ | Argon2id, CSRF, CSP, HSTS, constant-time compare, HIBP, 6-layer malware scanning, ammonia HTML sanitization | | |
| 18 | + | | Performance | A- | Paginated discover, batch queries, CDN cache headers; dashboard lists intentionally unbounded | | |
| 19 | + | | Documentation | A | Module-level //! on every file, response conventions documented in api/mod.rs | | |
| 20 | + | | Dependencies | A | Rust 2024 edition, recent crate versions, vendored OpenSSL for cross-compilation | | |
| 21 | + | | Frontend | A | Askama auto-escape, json_escape for JSON-LD, no raw innerHTML | | |
| 22 | + | | Type Safety | A+ | 35 UUID newtypes, 7 validated string types, Cents monetary newtype, domain enums via macro | | |
| 23 | + | | Observability | A | 962 #[instrument] annotations, Prometheus metrics, structured JSON logging, request IDs | | |
| 24 | + | | Concurrency | A | DB transactions for critical paths, advisory locks for IP-based sandbox cap, retry loops for slug uniqueness | | |
| 25 | + | | Resilience | A+ | Graceful shutdown with hard deadline, migration failure exit code 2, health monitor with status-transition alerts | | |
| 26 | + | | API Consistency | A | Documented response shape conventions, API version header, json_error_layer | | |
| 27 | + | | Migration Safety | A | 83 additive migrations, IF EXISTS on drops, data-only migrations are simple | | |
| 28 | + | | Codebase Size | A- | 79K LOC is substantial but well-organized; wordlist.rs (2,056 lines) is a data file | | |
| 29 | 29 | | Infrastructure | -- | Not yet audited. Checklist below. | | |
| 30 | 30 | ||
| 31 | 31 | ## Module Heatmap | |
| @@ -107,10 +107,7 @@ Run 15 cross-project audit (updated 2026-04-22). 1,359 tests (all pass). 0 clipp | |||
| 107 | 107 | ||
| 108 | 108 | ### Cold Spots | |
| 109 | 109 | ||
| 110 | - | 1. ~~**db/models.rs (2,172 LOC)**~~ -- Split into 16 domain submodules (largest 384 LOC). Fixed 2026-04-22. | |
| 111 | - | 2. ~~**routes/api/bulk.rs:7 axum_extra::Form**~~ -- Incorrect finding. axum_extra::Form is used correctly for repeated form fields (checkbox arrays). All bulk tests pass. | |
| 112 | - | 3. ~~**routes/pages/dashboard/wizards/project.rs:11 axum_extra::Form**~~ -- Same as above. All wizard tests pass. | |
| 113 | - | 4. ~~**Observability at 36% coverage**~~ -- Fixed 2026-04-22. Added 480 `#[tracing::instrument(skip_all)]` annotations to DB query layer. Now 883 total (routes 97%, DB 100%). | |
| 110 | + | None found. All modules at A- or above. constants.rs has 68 tests mostly asserting positivity (functional but low-value coverage). | |
| 114 | 111 | ||
| 115 | 112 | ## Infrastructure Checklist | |
| 116 | 113 | ||
| @@ -195,7 +192,7 @@ cargo --version | |||
| 195 | 192 | Every attack surface covered. Argon2 with 128-char max, CSRF synchronizer tokens with constant-time comparison, session fixation prevention, account lockout, rate limiting on all sensitive endpoints, HMAC-signed URLs, Stripe webhook verification, login tokens hashed with SHA-256, OAuth PKCE with S256, passkeys/WebAuthn, TOTP 2FA enforced on all auth paths (login link, OAuth), account deletion via POST with confirmation, self-purchase prevention, 6-layer malware scanning pipeline, trust tiers for new uploads. No SQL injection vectors -- zero `format!()` in any `sqlx::query` call confirmed by grep. | |
| 196 | 193 | ||
| 197 | 194 | ### 2. Comprehensive test suite | |
| 198 | - | ~1,356 tests across ~67 test files (29 currently failing). Per-test database isolation. In-process load test harness. 61 adversarial exploit-attempt tests. Test:source ratio ~0.40. | |
| 195 | + | 1,861 tests (1,139 unit + 722 integration). Per-test database isolation. In-process load test harness. Adversarial exploit-attempt tests. proptest active. | |
| 199 | 196 | ||
| 200 | 197 | ### 3. Zero N+1 queries | |
| 201 | 198 | Systematic prevention: batch queries with ANY($1), LEFT JOINs with aggregation, pre-computed denormalized fields, single round-trip health checks. Session touch cache (DashMap with 30s TTL) prevents N+1 session queries on every request. No N+1 patterns found. | |
| @@ -232,9 +229,11 @@ Confirmed complete by user 2026-04-22. Postmark dashboard shows correct configur | |||
| 232 | 229 | ||
| 233 | 230 | ## Mandatory Surprise | |
| 234 | 231 | ||
| 235 | - | **Session touch cache -- DashMap with 30s TTL avoids N+1 session queries.** Every authenticated request needs to "touch" the session (update `last_active_at`). A naive implementation would issue a DB UPDATE on every single request, creating an N+1-like pattern under load. Instead, MNW uses a DashMap keyed by session ID with a 30-second TTL. If a session was touched within the last 30 seconds, the DB write is skipped entirely. This means under steady browsing, a user generates at most 2 session UPDATEs per minute instead of potentially dozens. | |
| 232 | + | **TOCTOU-safe slug generation with retry loop + advisory lock pattern for sandbox IP cap.** The `create_item` slug generation handles TOCTOU races at the SQL level. After optimistic slug check, a retry loop catches Postgres unique constraint violations (error code 23505) and appends incrementing suffixes. Two-phase approach: optimistic check + database constraint as authoritative guard. The advisory lock pattern for sandbox account creation uses `pg_advisory_lock` keyed on IP hash to serialize per-IP creation. Both are production-grade. | |
| 236 | 233 | ||
| 237 | - | **Verdict:** Clever optimization. The 30s window is conservative enough that session staleness is never a security concern (sessions are validated against the DB on every request regardless -- only the `last_active_at` UPDATE is cached). The DashMap is lock-free for reads, so the check adds negligible overhead. | |
| 234 | + | ### Previous Surprise (Run 15) | |
| 235 | + | ||
| 236 | + | **Session touch cache -- DashMap with 30s TTL avoids N+1 session queries.** Every authenticated request needs to "touch" the session (update `last_active_at`). A naive implementation would issue a DB UPDATE on every single request. Instead, MNW uses a DashMap keyed by session ID with a 30-second TTL. If a session was touched within the last 30 seconds, the DB write is skipped entirely. Verdict: Clever optimization -- the 30s window is conservative enough that session staleness is never a security concern. | |
| 238 | 237 | ||
| 239 | 238 | ### Previous Surprise (Run 13) | |
| 240 | 239 | ||
| @@ -316,18 +315,13 @@ Key changes: | |||
| 316 | 315 | - **HIGH fix:** Session `suspended` flag stale after admin suspension -- `touch_session` now returns `TouchResult` | |
| 317 | 316 | - **HIGH fix:** Webhook signature had no timestamp freshness check -- added 300s tolerance | |
| 318 | 317 | ||
| 319 | - | Total: 5 open items (3 upstream-blocked deps + 1 low-severity warning + 1 DKIM verification) | |
| 318 | + | Total: 4 open items (3 upstream-blocked deps + 1 low-severity warning). No new action items. | |
| 320 | 319 | ||
| 321 | 320 | ## Previous Action Item Verification | |
| 322 | 321 | ||
| 323 | - | All 24 previously remediated items verified intact in current codebase: | |
| 324 | - | - 2FA on all auth paths (login link, OAuth) -- confirmed | |
| 325 | - | - Transactional purchase flows (paid, free, discount, download) -- confirmed | |
| 326 | - | - Validation on update handlers (update_item, update_project, update_link) -- confirmed | |
| 327 | - | - Self-purchase prevention -- confirmed | |
| 328 | - | - Trust tier test bypasses in scanning and storage tests -- confirmed | |
| 329 | - | - Adversarial test suite (53 tests) -- confirmed passing | |
| 330 | - | - Contact revocation tests -- confirmed passing | |
| 322 | + | Items 23-25 (upstream-blocked deps): Still open, unchanged. | |
| 323 | + | Item 33 (bincode unmaintained): Still upstream, warning only. | |
| 324 | + | All other items: Verified intact. | |
| 331 | 325 | ||
| 332 | 326 | ## Adversarial Testing (completed 2026-03-09) | |
| 333 | 327 | ||
| @@ -357,6 +351,7 @@ All four focus areas completed. 53 tests across 4 files; no vulnerabilities foun | |||
| 357 | 351 | | 2026-04-15 (Run 14) | ~67,442 | -- | ~1,356 | ~20 | 0 | 0 | A | | |
| 358 | 352 | | 2026-04-18 (Run 15) | ~67,442 | -- | 1,356 (29 fail) | ~20 | 0 | 4 | A- | | |
| 359 | 353 | | 2026-04-22 (Run 15 corrected) | ~67,442 | -- | 1,359 | ~20 | 0 | 1 | A | | |
| 354 | + | | 2026-04-30 (Run 17) | ~79,334 | -- | 1,861 | ~15.0 | 0 | 0 | A | | |
| 360 | 355 | ||
| 361 | 356 | --- | |
| 362 | 357 |
| @@ -1,632 +0,0 @@ | |||
| 1 | - | # MakeNotWork -- Competitive Analysis | |
| 2 | - | ||
| 3 | - | Last updated: 2026-03-21 | |
| 4 | - | ||
| 5 | - | Analysis of 7 competitors against MNW's feature set. Focus: fees, features MNW lacks, features only MNW offers, and market dynamics. | |
| 6 | - | ||
| 7 | - | ## Positioning | |
| 8 | - | ||
| 9 | - | MakeNotWork is a creator platform charging a flat monthly subscription ($10-$40 by tier) with 0% platform fee on sales. Creators keep 100% of revenue minus Stripe's ~3% processing fee. The codebase is source-available (PolyForm Noncommercial 1.0.0), the platform is ad-free, and 10 binding guarantees cover data export, price stability, shutdown notice, minimal data collection, and transparent moderation. No other creator platform combines all of these. | |
| 10 | - | ||
| 11 | - | MNW's developer infrastructure (SyncKit cloud sync is live; auto-update, crash reporting, and feedback collection are planned) is entirely uncontested territory among creator platforms. Lemon Squeezy offers license keys and software updates, but nothing approaching infrastructure-as-a-service for indie developers. | |
| 12 | - | ||
| 13 | - | ## Fee Comparison | |
| 14 | - | ||
| 15 | - | MNW's primary differentiator. The flat subscription model means 0% platform cut on every sale -- only Stripe's ~3% processing fee applies. For any creator making more than ~$100-200/month, MNW is cheaper than every percentage-based competitor. For high-volume creators ($1k+/month), MNW saves hundreds per month. | |
| 16 | - | ||
| 17 | - | | Platform | Platform Fee | Processing | Monthly Cost | Net on $100 sale | MoR? | | |
| 18 | - | |----------|-------------|------------|-------------|-----------------|------| | |
| 19 | - | | **MakeNotWork** | **0%** | ~3% (Stripe) | $10-40 flat | **~$97** | No | | |
| 20 | - | | Ko-fi Gold | 0% | ~3% | $12/mo | ~$97 | No | | |
| 21 | - | | Itch.io (0% share) | 0% | ~3% | $0 | ~$97 | No | | |
| 22 | - | | Sellfy | 0% | ~3% + $0.30 | $29-159/mo | ~$97 | No | | |
| 23 | - | | Lemon Squeezy | 5% + $0.50 | included | $0 | ~$94.50 | Yes | | |
| 24 | - | | Buy Me a Coffee | 5% | ~3% | $0 | ~$92 | No | | |
| 25 | - | | Patreon (shop) | 5% | ~3% | $0 | ~$92 | No | | |
| 26 | - | | Ko-fi (Free) | 0% tips / 5% shop | ~3% | $0 | ~$92 (shop) | No | | |
| 27 | - | | Gumroad | 10% + $0.50 | ~3% | $0 | ~$86.30 | Yes | | |
| 28 | - | | Patreon (membership) | 10% | ~3% + $0.30 | $0 | ~$87 | No | | |
| 29 | - | | Itch.io (default 10%) | 10% | ~3% | $0 | ~$87 | No | | |
| 30 | - | | Bandcamp (digital) | 15% (10% after $5k) | ~3% | $0 | ~$82 / ~$87 | No | | |
| 31 | - | | Gumroad (Discover) | 30% | included | $0 | ~$70 | Yes | | |
| 32 | - | ||
| 33 | - | ## Feature Matrix | |
| 34 | - | ||
| 35 | - | | Feature | MNW | Patreon | Gumroad | Bandcamp | Ko-fi | Itch.io | Lemon Squeezy | BMC | | |
| 36 | - | |---------|:---:|:-------:|:-------:|:--------:|:-----:|:-------:|:-------------:|:---:| | |
| 37 | - | | 0% platform fee | Yes | No (10%) | No (10%) | No (15%) | Gold only | Optional | No (5%) | No (5%) | | |
| 38 | - | | Source-available | Yes | No | No | No | No | No | No | No | | |
| 39 | - | | Full data export | Yes | Limited | Limited | No | No | No | Yes | No | | |
| 40 | - | | Audio player | Yes | No | No | Yes | No | No | No | No | | |
| 41 | - | | License keys | Yes | No | Yes | No | No | No | Yes | No | | |
| 42 | - | | Blog/RSS | Yes | Posts | No | No | Posts | Devlogs | No | Posts | | |
| 43 | - | | Tag taxonomy | Yes | No | No | Yes | No | Yes | No | No | | |
| 44 | - | | Text content | Yes | Yes | Yes | No | Yes | Yes | Yes | Yes | | |
| 45 | - | | Software distribution | Yes | No | Yes | No | No | Yes | Yes | No | | |
| 46 | - | | Video hosting | Planned | Yes | No | No | No | Browser | No | No | | |
| 47 | - | | Merchant of Record | No | No | Yes | No | No | No | Yes | No | | |
| 48 | - | | Mobile apps | No | Yes | No | Yes | No | Yes | No | No | | |
| 49 | - | | Email marketing | No | No | Yes | No | No | No | Yes | No | | |
| 50 | - | | Affiliate program | No | No | Yes | No | No | No | Yes | No | | |
| 51 | - | | Discount codes | Yes | No | Yes | Yes | No | Yes | Yes | No | | |
| 52 | - | | Tip jar / donations | PWYW | No | No | PWYW | Yes | PWYW | No | Yes | | |
| 53 | - | | Physical merch | No | No | Yes | Yes | Yes | No | No | Yes | | |
| 54 | - | | Community/chat | No | Yes | No | No | No | Yes | No | No | | |
| 55 | - | | Discord integration | No | Yes | No | No | Yes | No | No | No | | |
| 56 | - | | Embeddable widgets | Planned | No | Yes | Yes | Yes | Yes | Yes | Yes | | |
| 57 | - | | Subscriptions | Yes | Yes | Yes | Yes | Yes | No | Yes | Yes | | |
| 58 | - | ||
| 59 | - | ## Competitor Deep Dives | |
| 60 | - | ||
| 61 | - | ### 1. Gumroad | |
| 62 | - | ||
| 63 | - | Digital product marketplace for creators selling ebooks, courses, software, music, and art. | |
| 64 | - | ||
| 65 | - | **Fees:** 10% flat + $0.50 per transaction + processing (~2.9%). Gumroad Discover adds another 10% (20% total if buyer finds you via marketplace). No monthly fee. | |
| 66 | - | ||
| 67 | - | | Feature MNW Lacks | Notes | | |
| 68 | - | |---|---| | |
| 69 | - | | Merchant of Record (global tax handling) | Handles VAT/GST/sales tax collection and remittance worldwide since Jan 2025. | | |
| 70 | - | | Email marketing workflows | Automated drip sequences triggered by purchase, signup, or time delays. Basic open/click analytics. | | |
| 71 | - | | Affiliate program (built-in) | Referral links with commission rates. Clunky (affiliates need Gumroad accounts, no self-serve signup). | | |
| 72 | - | | ~~Discount codes~~ | ~~MNW now has this: percentage or fixed-amount, item-scoped or seller-wide, usage limits, expiration, auto-apply via URL.~~ | | |
| 73 | - | | Upsells at checkout | Suggest additional products during checkout flow. | | |
| 74 | - | | ~~License key generation~~ | ~~MNW now has this: auto-generated on purchase, configurable activation limits, machine tracking, public validation endpoint.~~ | | |
| 75 | - | | Bundle products | Combine multiple products into a single discounted package. | | |
| 76 | - | | Physical product sales | List physical goods (seller handles shipping). | | |
| 77 | - | | Embeddable buy buttons/overlays | Generate purchase widgets for external sites. | | |
| 78 | - | | ~~Subscription/membership gating~~ | ~~MNW now has this: monthly recurring tiers per project with Stripe billing.~~ | | |
| 79 | - | | ~~Pay-what-you-want~~ | ~~MNW now has this: buyer chooses amount, optional minimum price.~~ | | |
| 80 | - | | Multi-currency checkout | Automatic currency conversion for international buyers. | | |
| 81 | - | | Cohort retention analytics | `[DATA-HUNGRY]` Dashboard shows buyer retention patterns over time. | | |
| 82 | - | ||
| 83 | - | ### 2. Itch.io | |
| 84 | - | ||
| 85 | - | Indie game and digital content marketplace with open revenue sharing. | |
| 86 | - | ||
| 87 | - | **Fees:** Creator-set revenue share (default 10%, can be 0%). No monthly fee. Free to upload. | |
| 88 | - | ||
| 89 | - | | Feature MNW Lacks | Notes | | |
| 90 | - | |---|---| | |
| 91 | - | | Open/adjustable revenue share | Creators choose their own platform fee percentage (0-100%). Philosophically aligned with MNW but different mechanism. | | |
| 92 | - | | Game jams | Timed creation events with submissions, voting, rankings, community boards. 525k+ games created via jams. Highly specific to games. | | |
| 93 | - | | Browser-based content player | Run HTML5/WebGL games directly in the browser on the product page. | | |
| 94 | - | | Desktop client app | Downloadable app (Win/Mac/Linux) for managing purchased content, auto-updates for installed software. | | |
| 95 | - | | Devlogs | Built-in development blog per project, appears in followers' feeds. 42k+ posts across 15k projects. | | |
| 96 | - | | Co-op bundles | Multi-creator collaborative bundles with shared revenue split. | | |
| 97 | - | | Charity bundles | Platform-organized bundles donating proceeds to causes. | | |
| 98 | - | | Crowdfunding/project goals | Set funding targets with progress tracking. | | |
| 99 | - | | Pre-orders | Accept payment before release. | | |
| 100 | - | | Community forums (per-project) | Built-in message boards with moderation tools per game/project. | | |
| 101 | - | | Creator analytics dashboard | Views, downloads, traffic sources, conversion data per project. | | |
| 102 | - | | Refund policy (creator-controlled) | Each seller sets their own refund terms. | | |
| 103 | - | | Credit/points reward system | `[BLOAT]` Developers earn credits to promote their games. Gamification layer. | | |
| 104 | - | ||
| 105 | - | ### 3. Bandcamp | |
| 106 | - | ||
| 107 | - | Music and audio marketplace focused on direct artist-to-fan sales. | |
| 108 | - | ||
| 109 | - | **Fees:** 15% digital / 10% physical (digital drops to 10% after $5k in sales) + payment processing. Bandcamp Fridays waive the platform cut 8x/year. | |
| 110 | - | ||
| 111 | - | | Feature MNW Lacks | Notes | | |
| 112 | - | |---|---| | |
| 113 | - | | Physical merch sales + fulfillment tools | Sell vinyl, CDs, cassettes, t-shirts. Order management with shipping labels and packing slips. | | |
| 114 | - | | Vinyl pressing service | Fan-funded pressing runs. Bandcamp handles manufacturing and fulfillment. Zero risk for artists. | | |
| 115 | - | | Mobile fan app (iOS/Android) | Dedicated app for streaming purchased music collection, offline playback, discovery. | | |
| 116 | - | | Artist/label management app | Mobile app for managing orders, messaging fans, viewing stats. | | |
| 117 | - | | Wishlist system | Fans bookmark items for later purchase. Creates a social signal of interest. | | |
| 118 | - | | Fan collection pages | Public display of everything a fan has purchased. Social discovery mechanism. | | |
| 119 | - | | ~~Download codes~~ | ~~MNW now has this: single-use codes for free access, optional max uses and expiration.~~ | | |
| 120 | - | | ~~Discount codes~~ | ~~MNW now has this: percentage or fixed-amount, item-scoped or seller-wide.~~ | | |
| 121 | - | | Label accounts | Multi-artist management under one account with separate artist pages. | | |
| 122 | - | | Live streaming with merch integration | Schedule live streams with integrated purchase flow for music/merch. | | |
| 123 | - | | Bandcamp Clubs (subscribe-to-own) | $13/mo human-curated music discovery. Monthly album becomes permanent library addition. No algorithms. | | |
| 124 | - | | Bandcamp Daily (editorial) | Staff-written features, reviews, interviews. Editorial content driving discovery. | | |
| 125 | - | | Fan messaging | Direct messaging between artists and fans. | | |
| 126 | - | | Streaming via apps (purchased content) | Unlimited streaming of purchased music via mobile apps. | | |
| 127 | - | | Genre/subgenre browsing | Deep genre taxonomy for music discovery. | | |
| 128 | - | ||
| 129 | - | ### 4. Patreon | |
| 130 | - | ||
| 131 | - | Creator subscription platform for recurring fan support. | |
| 132 | - | ||
| 133 | - | **Fees:** 10% platform fee (post-Aug 2025) + payment processing (~2.9% + $0.30). Merch add-on: +3%. | |
| 134 | - | ||
| 135 | - | | Feature MNW Lacks | Notes | | |
| 136 | - | |---|---| | |
| 137 | - | | Subscription tier management | MNW now has basic subscription tiers (monthly recurring with Stripe billing). Patreon's is more mature: free trials, autopilot, gifting, discounts, tier repricing. | | |
| 138 | - | | Community chat spaces | Up to 10 chat rooms per creator, tier-locked, with moderation. | | |
| 139 | - | | Direct messaging to patrons | DMs and bulk updates by tier. | | |
| 140 | - | | Polls | Built-in polling in posts for patron feedback. | | |
| 141 | - | | Discord integration | Auto-assign Discord roles by tier, manage channel access from Patreon. | | |
| 142 | - | | Gift memberships | Fans can buy memberships for others. | | |
| 143 | - | | Merch fulfillment (print/pack/ship) | `[BLOAT]` Patreon handles printing, packing, shipping physical merchandise. 3% add-on fee. | | |
| 144 | - | | Free trials for subscriptions | Let fans try a tier before committing. | | |
| 145 | - | | Post scheduling | Schedule posts for future publication. | | |
| 146 | - | | Post preview (desktop/mobile/email) | Preview how posts render across platforms before publishing. | | |
| 147 | - | | Post impressions analytics | `[DATA-HUNGRY]` Track how many times each post was displayed to patrons. | | |
| 148 | - | | Native video hosting | Upload and stream video directly on Patreon. | | |
| 149 | - | | Private podcast RSS feeds | Patron-only audio via unique RSS feed per subscriber. | | |
| 150 | - | | Mobile app (iOS/Android) | Native apps for both creators and fans. | | |
| 151 | - | | Apple IAP support | `[INVASIVE]` iOS purchases go through Apple's 30% cut. Patreon passes this cost structure to creators/fans. | | |
| 152 | - | | Autopilot (automated engagement) | `[BLOAT]` Automated re-engagement sequences for lapsed members. | | |
| 153 | - | ||
| 154 | - | ### 5. Lemon Squeezy | |
| 155 | - | ||
| 156 | - | Digital product sales platform focused on software, SaaS, and digital downloads. Acquired by Stripe. | |
| 157 | - | ||
| 158 | - | **Fees:** 5% + $0.50 per transaction + processing. No monthly fee. +1.5% for international transactions. | |
| 159 | - | ||
| 160 | - | | Feature MNW Lacks | Notes | | |
| 161 | - | |---|---| | |
| 162 | - | | Merchant of Record (global tax handling) | Handles sales tax, VAT, GST collection and remittance in 135+ countries. | | |
| 163 | - | | License key generation + validation API | Auto-issue keys with activation limits, expiration, version control. Full API for runtime validation. | | |
| 164 | - | | Software update distribution | Built-in mechanism for distributing software updates to customers. | | |
| 165 | - | | Affiliate program (built-in) | Custom commission rates, cookie durations, payout thresholds. Affiliate dashboard for tracking. | | |
| 166 | - | | Email marketing (built-in) | Broadcasts segmented by product, plan, or status. Free for up to 500 subscribers. | | |
| 167 | - | | Discount codes | Percentage and fixed-amount discounts with usage limits and expiration. | | |
| 168 | - | | Dunning (failed payment recovery) | Automated card retries and customer emails for failed subscription payments. | | |
| 169 | - | | Checkout overlay/embed | Embed checkout as an overlay on external sites without redirect. | | |
| 170 | - | | 21 payment methods | Credit cards, PayPal, Apple Pay, and more. MNW currently only supports Stripe (cards). | | |
| 171 | - | | Usage-based billing | Metered pricing models for SaaS products. | | |
| 172 | - | | Multi-currency support | Accept payments in multiple currencies with automatic conversion. | | |
| 173 | - | | REST API with official SDKs | JS/TS, Python, PHP, Go, Laravel SDKs for programmatic store management. | | |
| 174 | - | | Webhook system | Event notifications for purchases, subscriptions, license keys, etc. MNW has webhooks for Stripe but not as a creator-facing feature. | | |
| 175 | - | | Subscription management (upgrades/downgrades/trials/grace periods) | Full lifecycle management for recurring products. | | |
| 176 | - | | Hosted checkout page (no-code) | Zero-code purchase pages with mobile optimization. | | |
| 177 | - | ||
| 178 | - | ### 6. Ko-fi | |
| 179 | - | ||
| 180 | - | Creator tip jar, shop, and membership platform with low friction. | |
| 181 | - | ||
| 182 | - | **Fees:** Free plan: 0% on tips, 5% on shop/memberships/commissions. Gold ($12/mo): 0% on everything. | |
| 183 | - | ||
| 184 | - | | Feature MNW Lacks | Notes | | |
| 185 | - | |---|---| | |
| 186 | - | | Tip jar (one-click donations) | Frictionless small payments ("buy me a coffee" model). No account required for supporters on some flows. | | |
| 187 | - | | Commissions system | Creators list available commission slots with terms, pricing, and messaging. Buyers discuss scope before purchasing. | | |
| 188 | - | | Stream alerts integration | Real-time OBS/streaming alerts when tips or memberships come in during live streams. | | |
| 189 | - | | Discord integration | Auto-assign roles to supporters/members in linked Discord server. | | |
| 190 | - | | Embeddable buttons/widgets | "Support me on Ko-fi" buttons and donation widgets for external sites. | | |
| 191 | - | | Physical product sales (shop) | Sell physical items alongside digital content. | | |
| 192 | - | | Instant payouts (PayPal/Stripe direct) | Money goes directly to creator's payment account, never held by platform. | | |
| 193 | - | | Gallery display for visual work | Portfolio-style display for artists and illustrators. | | |
| 194 | - | | Gold membership customization | Custom page themes, colors, and branding for Ko-fi Gold subscribers. | | |
| 195 | - | | Goal tracking (public) | Display funding goals with progress bars on creator page. | | |
| 196 | - | ||
| 197 | - | ### 7. Sellfy | |
| 198 | - | ||
| 199 | - | Digital product storefront builder for creators. | |
| 200 | - | ||
| 201 | - | **Fees:** $29/mo (Starter), $79/mo (Business), $159/mo (Premium). 0% transaction fees. Standard payment processing applies (~2.9% + $0.30). 2% surcharge if sales exceed plan limits. | |
| 202 | - | ||
| 203 | - | | Feature MNW Lacks | Notes | | |
| 204 | - | |---|---| | |
| 205 | - | | Full storefront builder | Customizable store templates with drag-and-drop layout, custom domain, branding. No code required. | | |
| 206 | - | | Print-on-demand (POD) | `[BLOAT]` White-label merch (t-shirts, hoodies, mugs). Sellfy handles printing and shipping. | | |
| 207 | - | | Upsells (post-checkout) | Automated product suggestions after purchase to increase order value. | | |
| 208 | - | | Abandoned cart emails | `[DATA-HUNGRY]` Auto-email customers who added items to cart but didn't complete checkout. Requires tracking browsing behavior. | | |
| 209 | - | | Built-in email marketing | Newsletter campaigns, automations, customer segmentation. Credits-based pricing ($2/1k). | | |
| 210 | - | | Affiliate program (built-in) | Creator-managed referral program with commission tracking. | | |
| 211 | - | | Discount codes + coupons | Percentage, fixed amount, or BOGO-style promotions. | | |
| 212 | - | | Product embeds (multiple types) | Buy Now buttons, single product cards, full catalog embeds, Add to Cart embeds. | | |
| 213 | - | | Physical product sales | Sell and ship physical goods alongside digital products. | | |
| 214 | - | | Subscription products | Recurring billing for content or services. | | |
| 215 | - | | No file size limits on digital products | MNW caps per tier: Basic 10MB, Small Files 500MB, Big Files 20GB (+on request). Sellfy has no stated limits. | | |
| 216 | - | | Mobile-optimized storefront | Responsive store pages with mobile checkout optimization. | | |
| 217 | - | | Video streaming for products | Embedded video previews and streaming for video products. | | |
| 218 | - | ||
| 219 | - | ## Common Missing Features | |
| 220 | - | ||
| 221 | - | Features present in 3+ competitors that MNW currently lacks. | |
| 222 | - | ||
| 223 | - | ### Worth Adding | |
| 224 | - | ||
| 225 | - | | Feature | Present In | Verdict | | |
| 226 | - | |---|---|---| | |
| 227 | - | | **Discount codes** | Gumroad, Bandcamp, Lemon Squeezy, Ko-fi, Sellfy (5/7) | **Done.** Percentage or fixed-amount, item-scoped or seller-wide, usage limits, expiration dates, auto-apply via URL parameter. | | |
| 228 | - | | **Embeddable widgets/buy buttons** | Gumroad, Lemon Squeezy, Ko-fi, Sellfy (4/7) | **Add.** Already planned as "Embeddable players." Extend to include purchase buttons/overlays. Lets creators sell from their own sites. | | |
| 229 | - | | **Affiliate/referral program** | Gumroad, Lemon Squeezy, Sellfy (3/7) | **Add (lightweight).** Simple referral links with percentage commission. Skip complex dashboards. Helps creators grow without MNW spending on marketing. | | |
| 230 | - | | **Post-as-email newsletter delivery** | Substack, Patreon (2/7 but critical for writers) | **Add.** Substack's core value prop. Writers won't leave Substack without it. MNW has broadcast emails but not post-as-email. Phase 17B. | | |
| 231 | - | | **Comments/community** | Substack, Patreon, itch.io (3/7) | **Add.** No creator-fan interaction beyond purchases/follows. Threaded comments with moderation. Phase 17C. | | |
| 232 | - | | **Audio format transcoding** | Bandcamp (1/7 but best-in-class) | **Add.** Upload lossless, serve in multiple formats. Bandcamp does this with 8 download formats. Phase 14D. | | |
| 233 | - | | **Email marketing (basic)** | Gumroad, Lemon Squeezy, Sellfy (3/7) | **Add (minimal).** Basic broadcast to buyers/followers. Aligns with planned "contact sharing" and "email notifications" features. Do NOT build a full ESP -- integrate with existing tools or keep it simple (new release announcements, not drip campaigns). | | |
| 234 | - | | **Discount/download codes** | Bandcamp, Itch.io, Gumroad (3/7) | **Done.** Single-use download codes with optional max uses and expiration. | | |
| 235 | - | | **Physical product listings** | Bandcamp, Ko-fi, Sellfy, Gumroad, Patreon (5/7) | **Consider.** MNW is digital-first but letting creators list physical items (self-fulfilled) with no platform handling shipping would be low-effort. Do NOT build fulfillment infrastructure. | | |
| 236 | - | | **Discord integration** | Patreon, Ko-fi + many others via Zapier (3/7 native) | **Add (later).** When subscription tiers ship, auto-assigning Discord roles is high value for low effort. Use Discord's bot API. | | |
| 237 | - | | **Devlogs / creator updates** | Itch.io, Bandcamp (editorial), Patreon (posts) (3/7) | **Already planned** as "Blog posts and creator blog." Prioritize -- it is the primary engagement loop for indie creators. | | |
| 238 | - | | **Mobile app (fan-facing)** | Bandcamp, Patreon, Itch.io (desktop) (3/7) | **Defer to PWA.** Native apps are expensive to maintain. A well-built PWA with offline support and audio playback covers 90% of the use case without app store gatekeeping. | | |
| 239 | - | | **Multi-currency / multi-payment-method** | Gumroad, Lemon Squeezy, Sellfy (3/7) | **Partial add.** Stripe already supports multi-currency. Expose currency selection in checkout. PayPal is the main missing payment method -- evaluate adding it via Stripe's PayPal support. | | |
| 240 | - | ||
| 241 | - | ### Skip | |
| 242 | - | ||
| 243 | - | | Feature | Present In | Reason to Skip | | |
| 244 | - | |---|---|---| | |
| 245 | - | | **Merchant of Record / tax handling** | Gumroad, Lemon Squeezy (2/7 but significant) | MNW uses Stripe Connect (Standard), making creators the merchant of record by design -- creators own their customer relationships. Adding MoR would fundamentally change the platform model and add massive regulatory burden. Document tax guidance for creators instead. | | |
| 246 | - | | **Print-on-demand / merch fulfillment** | Sellfy, Patreon (2/7) | `[BLOAT]` Requires inventory, shipping, manufacturing partnerships. Completely outside MNW's scope. Creators can use dedicated services (Printful, Printify) and link from their MNW profile. | | |
| 247 | - | | **Upsells at checkout** | Gumroad, Sellfy (2/7) | `[BLOAT]` Dark-pattern-adjacent. Adds friction to checkout. Contradicts MNW's clean, respectful UX philosophy. | | |
| 248 | - | | **Abandoned cart emails** | Sellfy (1/7, but common in e-commerce) | `[INVASIVE]` Requires tracking browsing behavior and storing cart state. Guilt-driven re-engagement. Contradicts minimal data collection principle. | | |
| 249 | - | | **Game jams** | Itch.io (1/7) | Too niche. Only relevant if MNW specifically targets game developers. | | |
| 250 | - | | **Polls** | Patreon (1/7) | Low value. Creators can use external tools (Strawpoll, etc.) or post in their blog. | | |
| 251 | - | | **Community chat rooms** | Patreon (1/7) | High maintenance, moderation burden. Discord integration is the better path -- let communities live where they already are. | | |
| 252 | - | | **Cohort retention analytics** | Gumroad (1/7) | `[DATA-HUNGRY]` Requires extensive tracking of user behavior over time. MNW's privacy-respecting analytics should focus on aggregate counts, not individual user tracking. | | |
| 253 | - | | **Stream alerts (OBS integration)** | Ko-fi (1/7) | Too niche for MNW's current audience. Revisit if live streaming feature ships. | | |
| 254 | - | | **Autopilot / automated re-engagement** | Patreon (1/7) | `[BLOAT]` `[INVASIVE]` Automated nagging of lapsed subscribers. Disrespectful to users. | | |
| 255 | - | | **Apple IAP compliance** | Patreon (1/7) | `[INVASIVE]` Apple's 30% cut destroys MNW's 0% fee value proposition. MNW is web-only by design. If a native app is ever built, fight for reader-app exemptions or use web-based checkout. | | |
| 256 | - | | **Storefront builder (drag-and-drop)** | Sellfy (1/7) | MNW already has creator profiles and project pages. A full storefront builder adds complexity without matching MNW's server-rendered architecture. Custom domains (planned) are the right answer for branding. | | |
| 257 | - | ||
| 258 | - | ### Low Priority | |
| 259 | - | ||
| 260 | - | | Feature | Present In | Notes | | |
| 261 | - | |---|---|---| | |
| 262 | - | | **License key management** | Gumroad, Lemon Squeezy (2/7) | **Done.** Auto-generated on purchase, configurable activation limits, machine tracking, public validation endpoint. | | |
| 263 | - | | **Browser-based content player** | Itch.io (1/7) | Niche (HTML5/WebGL). | | |
| 264 | - | | **Co-op bundles / charity bundles** | Itch.io (1/7) | Nice-to-have. Could add later. | | |
| 265 | - | | **Pre-orders / crowdfunding goals** | Itch.io, Ko-fi (2/7) | Could add later. MNW has "Scheduled publish, pre-save, pre-order" planned. | | |
| 266 | - | | **Desktop client with auto-updates** | Itch.io (1/7) | MNW has this planned under DevServices. | | |
| 267 | - | | **Credit/points reward system** | Itch.io (1/7) | `[BLOAT]` Gamification layer. | | |
| 268 | - | ||
| 269 | - | ## What We Offer That Competitors Don't | |
| 270 | - | ||
| 271 | - | - **0% platform fee** with flat monthly subscription ($10-$40/mo; only Ko-fi Gold at $12/mo matches, and Itch.io at 0% share) | |
| 272 | - | - **Source-available codebase** -- auditable, no black box | |
| 273 | - | - **10 binding platform guarantees** -- 90-day shutdown notice, no price hikes without notice, ad-free, minimal data collection, transparent moderation, appeal process, data export even while suspended | |
| 274 | - | - **Audio streaming player with chapters and speed control** (Bandcamp has audio, nobody else has chapters) | |
| 275 | - | - **License key system with phone-home validation API** (Gumroad and Lemon Squeezy have basic keys, MNW has full activation/deactivation/per-key limits) | |
| 276 | - | - **Hierarchical tag taxonomy with faceted search** (Bandcamp has genres, MNW has a full tree) | |
| 277 | - | - **Structured data export** (JSON projects, CSV sales/purchases -- not just a data dump) | |
| 278 | - | - **Creator owns Stripe account directly** via Stripe Connect Standard (not intermediary payments) | |
| 279 | - | - **Creator owns their audience** -- fans can opt in to share contact info directly; if a creator leaves, their fan relationships come with them | |
| 280 | - | - **No lock-in** -- full data export always available, month-to-month billing, instant cancellation | |
| 281 | - | - **DRM-free** -- purchased content has no digital rights management restrictions | |
| 282 | - | - **Privacy-respecting analytics** -- where competitors offer invasive tracking (cohort analysis, post impressions, abandoned cart), MNW's minimal-data approach is a feature, not a gap | |
| 283 | - | - **DevServices** (SyncKit cloud sync is live; auto-update, crash reporting, feedback collection planned) -- uncontested territory among creator platforms | |
| 284 | - | - **Flat pricing for SyncKit** -- no per-request billing; predictable monthly cost for developers | |
| 285 | - | - **OSS creator support** -- first-class Sourcehut and GitHub integration for open source developers, with funding tools (FUNDING.yml, embeddable widgets, aggregate funding) | |
| 286 | - | ||
| 287 | - | ## Key Dynamics | |
| 288 | - | ||
| 289 | - | - **Stripe Managed Payments** (from Lemon Squeezy acquisition) could be the most significant industry shift. If Stripe offers MoR at the transaction level, MNW creators could use it through their Stripe Connect accounts without MNW building MoR infrastructure. | |
| 290 | - | - **Ko-fi Gold at $12/mo with 0% fees** is the closest direct competitor on pricing. MNW's differentiation must lean on content richness (audio player, chapters, search, projects, exports) and planned features. MNW's lowest tier ($10/mo) is slightly cheaper than Ko-fi Gold. | |
| 291 | - | - **Patreon's Commerce shop at 5%** signals awareness that creators want one-time sales, not just subscriptions. | |
| 292 | - | - **Itch.io's DDoS issues in 2025** create an opening for indie software/game developers who value reliability. | |
| 293 | - | - **Sellfy's pricing ($29-159/mo)** shows there is a market for flat-fee platforms, but MNW targets the lower end ($10-40/mo) with a leaner feature set and zero transaction fees. | |
| 294 | - | ||
| 295 | - | ## Target Users | |
| 296 | - | ||
| 297 | - | - **Creators:** Writers, bloggers, newsletter authors, musicians, podcasters, audiobook producers, sound designers, open source developers | |
| 298 | - | - **Fans/Buyers:** Readers and listeners who want DRM-free access to content with permanent libraries | |
| 299 | - | - **Developers (SyncKit):** Indie app developers building local-first/offline-first apps who need cloud sync without managing infrastructure | |
| 300 | - | - **Developers (DevServices):** Indie software developers who need auto-update, crash reporting, and feedback collection for desktop/mobile apps | |
| 301 | - | ||
| 302 | - | --- | |
| 303 | - | ||
| 304 | - | ## Full Feature Inventory | |
| 305 | - | ||
| 306 | - | Complete feature list with Done/Planned status. | |
| 307 | - | ||
| 308 | - | ### Creator Tools | |
| 309 | - | ||
| 310 | - | | Feature | Status | | |
| 311 | - | |---------|--------| | |
| 312 | - | | Creator profiles (`/u/username`) | Done | | |
| 313 | - | | Project organization (`/p/slug`) | Done | | |
| 314 | - | | Item management (CRUD) | Done | | |
| 315 | - | | Version management | Done | | |
| 316 | - | | Custom profile links | Done | | |
| 317 | - | | Text content editor (Markdown) | Done | | |
| 318 | - | | Audio upload with drag/drop | Done | | |
| 319 | - | | Cover image upload | Done | | |
| 320 | - | | Tag management (add/remove) | Done | | |
| 321 | - | | Chapter management (CRUD) | Done | | |
| 322 | - | | Dashboard with lazy-loaded tabs | Done | | |
| 323 | - | | Project dashboard (overview, content, analytics, settings) | Done | | |
| 324 | - | | Grid/list view toggle | Done | | |
| 325 | - | | Creator invite/waitlist system | Done | | |
| 326 | - | | Blog posts and creator blog | Done | | |
| 327 | - | | RSS feeds (project, creator, global) | Done | | |
| 328 | - | | Subscription tiers with PWYW | Done | | |
| 329 | - | | Contact sharing (opt-in at purchase) | Done | | |
| 330 | - | | Scheduled publish, pre-save, pre-order | Planned | | |
| 331 | - | | Video upload and player | Planned | | |
| 332 | - | ||
| 333 | - | ### Buyer Experience | |
| 334 | - | ||
| 335 | - | | Feature | Status | | |
| 336 | - | |---------|--------| | |
| 337 | - | | Free fan accounts | Done | | |
| 338 | - | | Library page | Done | | |
| 339 | - | | Claim free items to library | Done | | |
| 340 | - | | Text reader with clean typography | Done | | |
| 341 | - | | Reading time estimate | Done | | |
| 342 | - | | Audio streaming player | Done | | |
| 343 | - | | Playback speed control (0.5x-2x) | Done | | |
| 344 | - | | Volume control with slider | Done | | |
| 345 | - | | Chapter navigation (click to seek) | Done | | |
| 346 | - | | Track progress / resume playback | Done | | |
| 347 | - | | Paywall for paid content | Done | | |
| 348 | - | | DRM-free downloads | Done | | |
| 349 | - | | Permanent item links (`/i/UUID`) | Done | | |
| 350 | - | | Follow creators and projects | Done | | |
| 351 | - | | Feed page (Creators/Projects tabs) | Done | | |
| 352 | - | | Fan collections (create, filter, share) | Planned | | |
| 353 | - | | 30-second preview for paid content | Planned | | |
| 354 | - | | Embeddable players (single + album) | Planned | | |
| 355 | - | | Audio format downloads (FLAC, MP3 variants) | Planned | | |
| 356 | - | | Video format downloads (1080p, 720p) | Planned | | |
| 357 | - | | Project ZIP download | Planned | | |
| 358 | - | ||
| 359 | - | ### Payments | |
| 360 | - | ||
| 361 | - | | Feature | Status | | |
| 362 | - | |---------|--------| | |
| 363 | - | | Stripe Connect (Standard accounts) | Done | | |
| 364 | - | | Direct charges (0% platform fee) | Done | | |
| 365 | - | | Checkout flow via Stripe Checkout | Done | | |
| 366 | - | | Webhook handling (purchase + account events) | Done | | |
| 367 | - | | Transaction recording | Done | | |
| 368 | - | | Stripe disconnect | Done | | |
| 369 | - | | Flat creator subscription ($10-$40 by tier) | Done | | |
| 370 | - | | Creator tier subscription billing (Stripe checkout, webhooks, session sync) | Done | | |
| 371 | - | | Creator tier storage enforcement (per-file + total caps + download budget) | Planned | | |
| 372 | - | | Per-file size override requests (>20GB, admin-approved) | Planned | | |
| 373 | - | | Subscription tiers for fans | Done | | |
| 374 | - | | Pay-what-you-want pricing | Done | | |
| 375 | - | | PWYW with $0 minimum for OSS | Planned | | |
| 376 | - | | Sponsor tiers with perks | Planned | | |
| 377 | - | | Payout alternatives (ACH, SEPA, crypto) | Planned | | |
| 378 | - | | Micro-transactions | Planned | | |
| 379 | - | | Creator-to-creator payments | Planned | | |
| 380 | - | ||
| 381 | - | ### File Distribution | |
| 382 | - | ||
| 383 | - | | Feature | Status | | |
| 384 | - | |---------|--------| | |
| 385 | - | | S3-compatible object storage (Hetzner) | Done | | |
| 386 | - | | Presigned upload URLs | Done | | |
| 387 | - | | Presigned streaming URLs (time-limited) | Done | | |
| 388 | - | | File type validation (audio: mp3/wav/m4a/ogg/flac; images: jpg/png/webp) | Done | | |
| 389 | - | | Graceful S3 degradation | Done | | |
| 390 | - | | S3 file collection for content export | Planned | | |
| 391 | - | | ZIP generation with streaming | Planned | | |
| 392 | - | | Export README.txt | Planned | | |
| 393 | - | | S3 bucket versioning | Planned | | |
| 394 | - | | CDN for static assets | Planned | | |
| 395 | - | | Build artifact hosting (release binaries) | Planned | | |
| 396 | - | | Package repository links (Cargo, npm, PyPI) | Planned | | |
| 397 | - | ||
| 398 | - | ### Content Types | |
| 399 | - | ||
| 400 | - | | Feature | Status | | |
| 401 | - | |---------|--------| | |
| 402 | - | | Text content (articles, blogs, newsletters) | Done | | |
| 403 | - | | Audio content (music, podcasts, audiobooks, sound design) | Done | | |
| 404 | - | | Video content (upload, stream, thumbnails) | Planned | | |
| 405 | - | | Software/binary distribution | Planned | | |
| 406 | - | | Embedded content widgets | Planned | | |
| 407 | - | ||
| 408 | - | ### Discovery | |
| 409 | - | ||
| 410 | - | | Feature | Status | | |
| 411 | - | |---------|--------| | |
| 412 | - | | Full-text search (PostgreSQL tsvector) | Done | | |
| 413 | - | | Trigram indexes for fuzzy search | Done | | |
| 414 | - | | Category filter (by project type) | Done | | |
| 415 | - | | Price range filter | Done | | |
| 416 | - | | Sort options (popular, newest, price) | Done | | |
| 417 | - | | Pagination | Done | | |
| 418 | - | | Products/Projects mode toggle | Done | | |
| 419 | - | | HTMX-powered filtering (no page reload) | Done | | |
| 420 | - | | Hierarchical tag system | Done | | |
| 421 | - | | Tag typeahead on item edit | Done | | |
| 422 | - | | Automated tag suggestions | Planned | | |
| 423 | - | | Tag-based feed | Planned | | |
| 424 | - | | Suggested content (follows-based) | Planned | | |
| 425 | - | | Discover/tags tree browser | Done | | |
| 426 | - | ||
| 427 | - | ### Security | |
| 428 | - | ||
| 429 | - | | Feature | Status | | |
| 430 | - | |---------|--------| | |
| 431 | - | | CSRF protection (synchronizer token pattern) | Done | | |
| 432 | - | | Secure sessions (HttpOnly, Secure, SameSite=Strict, PostgreSQL-backed) | Done | | |
| 433 | - | | Rate limiting on auth endpoints | Done | | |
| 434 | - | | Account lockout (5 failed attempts, 15-min lock + email) | Done | | |
| 435 | - | | Password reset (HMAC-signed URLs, 15-min expiry) | Done | | |
| 436 | - | | Email verification (HMAC-signed URLs, 24-hr expiry) | Done | | |
| 437 | - | | Input validation + HTML sanitization (ammonia) | Done | | |
| 438 | - | | Request size limits (1MB default) | Done | | |
| 439 | - | | File upload restrictions (type + size per category) | Done | | |
| 440 | - | | Stripe webhook signature verification + idempotency | Done | | |
| 441 | - | | Security headers (X-Frame-Options, CSP, etc.) | Done | | |
| 442 | - | | Structured logging with request IDs | Done | | |
| 443 | - | | Presigned URL ownership verification | Done | | |
| 444 | - | | Argon2 password hashing | Done | | |
| 445 | - | | Session rotation on privilege change | Done | | |
| 446 | - | | 2FA/TOTP | Done | | |
| 447 | - | | Backup codes (10 per account) | Done | | |
| 448 | - | | HaveIBeenPwned password check (k-anonymity) | Done | | |
| 449 | - | | Session management page | Done | | |
| 450 | - | | Remote session revocation | Done | | |
| 451 | - | | New device login notification (opt-in) | Done | | |
| 452 | - | | Error tracking (Sentry) | Done | | |
| 453 | - | | Uptime monitoring + health endpoint | Done | | |
| 454 | - | | Passkeys/WebAuthn | Done | | |
| 455 | - | ||
| 456 | - | ### Admin | |
| 457 | - | ||
| 458 | - | | Feature | Status | | |
| 459 | - | |---------|--------| | |
| 460 | - | | Admin user designation (ADMIN_USER_ID env var) | Done | | |
| 461 | - | | Admin waitlist management (approve, spam, lottery) | Done | | |
| 462 | - | | Creator waves with transparency page | Done | | |
| 463 | - | | Health endpoint with system status | Done | | |
| 464 | - | | Seed data script (71 users, 98 projects, 139 items) | Done | | |
| 465 | - | | 386 automated tests (unit, integration, workflow, health) | Done | | |
| 466 | - | | Content policy page | Done | | |
| 467 | - | | Suspension notifications with violation details | Done | | |
| 468 | - | | Appeal form | Done | | |
| 469 | - | | Export available while suspended | Done | | |
| 470 | - | | Platform shutdown protocol (90-day notice) | Done | | |
| 471 | - | | Self-serve invite generation for existing creators | Planned | | |
| 472 | - | | Gradual rollout controls | Planned | | |
| 473 | - | | Public roadmap page | Done | | |
| 474 | - | | CI pipeline (builds.sr.ht) | Done | | |
| 475 | - | | Test DB config + per-test isolation harness | Done | | |
| 476 | - | ||
| 477 | - | ### Data Rights and Export | |
| 478 | - | ||
| 479 | - | | Feature | Status | | |
| 480 | - | |---------|--------| | |
| 481 | - | | Export portal (dashboard page) | Done | | |
| 482 | - | | Project export (JSON with items metadata) | Done | | |
| 483 | - | | Sales history export (CSV) | Done | | |
| 484 | - | | Purchase history export (CSV) | Done | | |
| 485 | - | | Account deletion with email confirmation | Done | | |
| 486 | - | | "Export data first?" prompt before deletion | Done | | |
| 487 | - | | Transaction preservation for buyers after seller deletion | Done | | |
| 488 | - | | Full content file export (S3 collection) | Planned | | |
| 489 | - | | Analytics and engagement data export | Planned | | |
| 490 | - | | Fan contact list export (with consent) | Planned | | |
| 491 | - | ||
| 492 | - | ### Social and Community | |
| 493 | - | ||
| 494 | - | | Feature | Status | | |
| 495 | - | |---------|--------| | |
| 496 | - | | Creator blog (per-project) | Done | | |
| 497 | - | | RSS feeds (project + blog) | Done | | |
| 498 | - | | Follow system (users, projects, tags) | Done | | |
| 499 | - | | Feed page with tabs | Done | | |
| 500 | - | | Email notifications (Postmark) | Planned | |
Lines truncated
| @@ -210,7 +210,7 @@ Development log for the Makenot.work platform. Release notes, technical decision | |||
| 210 | 210 | - **Slug:** what-this-is | |
| 211 | 211 | - **Body:** | |
| 212 | 212 | ||
| 213 | - | Makenot.work is a creator platform with a 0% platform fee. The only cost to creators is Stripe's payment processing (~3%) and a flat monthly hosting fee ($10-40/mo depending on what you're hosting). | |
| 213 | + | Makenot.work is a creator platform with a 0% platform fee. The only cost to creators is Stripe's payment processing (~3%) and a flat monthly hosting fee ($10-60/mo depending on what you're hosting). | |
| 214 | 214 | ||
| 215 | 215 | No percentage cuts on sales. No lock-in. Full data export anytime. Month-to-month, cancel whenever. | |
| 216 | 216 |
| @@ -170,7 +170,7 @@ Fan downloads: the stored version (transparent quality). | |||
| 170 | 170 | ||
| 171 | 171 | Fan downloads: choice of original lossless or delivery format. | |
| 172 | 172 | ||
| 173 | - | ### Everything ($40/mo) — "Lossless + adaptive streaming" | |
| 173 | + | ### Everything ($60/mo) — "Lossless + adaptive streaming" | |
| 174 | 174 | ||
| 175 | 175 | Same as BigFiles, plus: | |
| 176 | 176 | - Multiple quality tiers generated for adaptive streaming (HLS/DASH) |
| @@ -0,0 +1,479 @@ | |||
| 1 | + | # Business Sustainability Audit | |
| 2 | + | ||
| 3 | + | Run 1, 2026-04-29. Full audit of profitability, unit economics, and long-term viability. | |
| 4 | + | ||
| 5 | + | --- | |
| 6 | + | ||
| 7 | + | ## Overall Viability Score: B+ | |
| 8 | + | ||
| 9 | + | MNW is a sound bootstrapped business at modest scale (100-500 creators). The financial model is internally consistent, transparently documented, and structurally viable. Stripe Connect Standard accounts eliminate the per-account fee drag that would have compressed margins on successful creators. The score reflects: strong fundamentals, honest economics, lean cost structure, but a narrow addressable market and a single-operator ceiling. | |
| 10 | + | ||
| 11 | + | --- | |
| 12 | + | ||
| 13 | + | ## Ecosystem Context | |
| 14 | + | ||
| 15 | + | MNW is not a single product — it is an ecosystem of 13 interconnected projects totaling ~247K LOC Rust across 846 source files, 12 crates, and ~5,200 tests. | |
| 16 | + | ||
| 17 | + | ### Product Surface | |
| 18 | + | ||
| 19 | + | | Product | What it is | Revenue role | | |
| 20 | + | |---------|-----------|-------------| | |
| 21 | + | | **MNW Server** | Creator platform, SyncKit server, OTA server, OAuth provider, git host, issue tracker | Primary revenue (creator subscriptions) | | |
| 22 | + | | **Multithreaded** | Forum software (MNW OAuth, per-project communities) | Community stickiness, retention | | |
| 23 | + | | **PoM** | Production ops monitor (peer mesh, health checks, alerts) | Operational reliability | | |
| 24 | + | | **GoingsOn** | Productivity app (tasks, email, calendar, contacts) | SyncKit add-on revenue (planned) | | |
| 25 | + | | **Balanced Breakfast** | Feed aggregator (RSS, Atom, plugins) | SyncKit add-on revenue (planned) | | |
| 26 | + | | **audiofiles** | Sample manager (content-addressed, ML classification) | License key sales, SyncKit add-on | | |
| 27 | + | | **SyncKit SDK** | E2E encrypted cloud sync + OTA updates | Add-on revenue (planned) | | |
| 28 | + | | **Shared libraries** | docengine, tagtree, theme-common, s3-storage, tauri-updater-ui | Shared infrastructure cost | | |
| 29 | + | ||
| 30 | + | The three desktop apps (GO, BB, AF) are both products and dogfood for SyncKit. They generate direct revenue through the MNW storefront (license keys, purchases, subscriptions) and demonstrate the platform to potential creator-developers. | |
| 31 | + | ||
| 32 | + | ### How they connect | |
| 33 | + | ||
| 34 | + | ``` | |
| 35 | + | ┌─────────────────────┐ | |
| 36 | + | │ MNW Server │ | |
| 37 | + | │ (creator platform │ | |
| 38 | + | │ + SyncKit server │ | |
| 39 | + | │ + OTA server │ | |
| 40 | + | │ + OAuth provider) │ | |
| 41 | + | └──┬──────┬──────┬────┘ | |
| 42 | + | │ │ │ | |
| 43 | + | OAuth │ Sync│ OTA │ | |
| 44 | + | PKCE │ API │ API │ | |
| 45 | + | │ │ │ | |
| 46 | + | ┌────────────┤ │ ├────────────┐ | |
| 47 | + | │ │ │ │ │ | |
| 48 | + | ┌─────▼──┐ ┌─────▼──┐ │ ┌───▼────┐ ┌───▼────┐ | |
| 49 | + | │ MT │ │ GO │ │ │ BB │ │ AF │ | |
| 50 | + | │(forums)│ │(tasks) │ │ │(feeds) │ │(audio) │ | |
| 51 | + | └────────┘ └────────┘ │ └────────┘ └────────┘ | |
| 52 | + | │ │ │ │ | |
| 53 | + | └──────┼───────┘ │ | |
| 54 | + | │ │ | |
| 55 | + | ┌────────▼────────┐ │ | |
| 56 | + | │ synckit-client │◄──────────┘ | |
| 57 | + | │ (shared SDK) │ | |
| 58 | + | └─────────────────┘ | |
| 59 | + | ||
| 60 | + | ┌──────────┐ | |
| 61 | + | │ PoM │──── monitors ──── MNW, MT, htpy.app | |
| 62 | + | │(monitor) │ | |
| 63 | + | └──────────┘ | |
| 64 | + | ``` | |
| 65 | + | ||
| 66 | + | This ecosystem structure matters for the business model because: | |
| 67 | + | - **Shared libraries reduce maintenance cost** — docengine, tagtree, and theme-common are used across 4+ projects each | |
| 68 | + | - **SyncKit is both infrastructure and product** — a single investment serves internal apps and becomes an add-on revenue stream | |
| 69 | + | - **Desktop apps are both revenue and marketing** — creators see the platform in action via real products | |
| 70 | + | - **MT provides community without external dependency** — no Discourse/Circle subscription cost | |
| 71 | + | ||
| 72 | + | --- | |
| 73 | + | ||
| 74 | + | ## Infrastructure and Operations | |
| 75 | + | ||
| 76 | + | ### Physical infrastructure | |
| 77 | + | ||
| 78 | + | | Host | IP | Runs | Cost | | |
| 79 | + | |------|----|------|------| | |
| 80 | + | | **Hetzner VPS** (US-West) | Public: 5.78.144.244, Tailscale: 100.120.174.96 | MNW, MT, PostgreSQL, Caddy, PoM, Git SSH | ~$15-30/month | | |
| 81 | + | | **Astra** (dev/CI) | Tailscale: 100.106.221.39 | PoM, CI runner, staging, backup replication | Personal hardware (no recurring cost) | | |
| 82 | + | | **Hetzner S3** | fsn1 region | File uploads, SyncKit blobs | ~$5-20/month (usage-based) | | |
| 83 | + | ||
| 84 | + | All access via Tailscale mesh. No Docker — native binaries with systemd units. Cross-compiled on macOS with cargo-zigbuild. | |
| 85 | + | ||
| 86 | + | ### Service dependencies and costs | |
| 87 | + | ||
| 88 | + | | Service | Role | Monthly cost | Risk if lost | | |
| 89 | + | |---------|------|-------------|-------------| | |
| 90 | + | | **Stripe** | Payments (Connect Standard) | ~3% of platform subs only | Fatal — no alternative processor integrated | | |
| 91 | + | | **Postmark** | Transactional + broadcast email | ~$10-50 (volume-based) | Degraded — can queue, self-host later | | |
| 92 | + | | **Cloudflare** | CDN, DNS, DDoS, TLS | $0 (free tier) | High — origin egress costs spike | | |
| 93 | + | | **Hetzner** | VPS + S3 | ~$20-50 | Can migrate — standard S3 API, portable binary | | |
| 94 | + | | **Apple Developer** | macOS code signing + notarization | ~$99/year | App distribution blocked (not server) | | |
| 95 | + | ||
| 96 | + | Total infrastructure: **~$600/month** currently. All vendors are commodity-replaceable except Stripe. | |
| 97 | + | ||
| 98 | + | ### Credential inventory | |
| 99 | + | ||
| 100 | + | 15 env vars required for full production (DATABASE_URL, SIGNING_SECRET, HOST_URL, STRIPE_*, POSTMARK_*, S3_*). 8 optional (SyncKit S3, CDN, scanning, build pipeline). All secrets on Hetzner at `/opt/makenotwork/.env`. Rotation procedures documented per-credential in `_meta/docs/service_accounts.md`. | |
| 101 | + | ||
| 102 | + | ### Deploy pipeline | |
| 103 | + | ||
| 104 | + | ``` | |
| 105 | + | MacBook (macOS) | |
| 106 | + | → cargo zigbuild --release (x86_64-linux-gnu) | |
| 107 | + | → rsync binary + static assets + config → Hetzner | |
| 108 | + | → systemctl restart makenotwork | |
| 109 | + | → curl localhost:3000/api/health | |
| 110 | + | ``` | |
| 111 | + | ||
| 112 | + | Three deploy modes: full (build + config + binary), quick (binary only), config-only. Rollback: re-deploy previous binary. No blue-green, no canary — single server, single binary. | |
| 113 | + | ||
| 114 | + | ### Monitoring | |
| 115 | + | ||
| 116 | + | Two PoM instances (Hetzner + Astra) cross-check each other. Health endpoint at `/api/health` checks: database connectivity, S3 availability, Stripe webhook liveness, email deliverability, background scheduler health. Email alerts on status transitions. MNW internal background monitor runs health checks every 60 seconds. | |
| 117 | + | ||
| 118 | + | ### Incident response | |
| 119 | + | ||
| 120 | + | | Level | Description | Response time | | |
| 121 | + | |-------|-------------|---------------| | |
| 122 | + | | P0 | Service down, data loss risk | Immediate | | |
| 123 | + | | P1 | Major feature broken (payments, sync, auth) | < 1 hour | | |
| 124 | + | | P2 | Degraded but functional | < 4 hours | | |
| 125 | + | | P3 | Minor issue | Next working session | | |
| 126 | + | ||
| 127 | + | Single contact point: Max. Credential rotation checklist covers all 12 credential types. Server auto-restarts via systemd on crash. | |
| 128 | + | ||
| 129 | + | ### Backups | |
| 130 | + | ||
| 131 | + | - PostgreSQL: daily automated backups, 30-day retention, `/opt/makenotwork/backups/` on Hetzner | |
| 132 | + | - Offsite replication: daily rsync to Astra at `/opt/backups/mnw/` | |
| 133 | + | - S3: bucket versioning enabled | |
| 134 | + | - PoM monitors backup staleness | |
| 135 | + | ||
| 136 | + | --- | |
| 137 | + | ||
| 138 | + | ## Operational Scaling Model | |
| 139 | + | ||
| 140 | + | ### The residency program as a scaling strategy | |
| 141 | + | ||
| 142 | + | MNW's hiring model is documented in `_meta/docs/residency.md` and `_meta/docs/operations.md`. It is not a standard hire — it's a structured apprenticeship: | |
| 143 | + | ||
| 144 | + | - **Who**: Exceptionally smart people lacking programming experience (often leaving academia) | |
| 145 | + | - **Compensation**: Starting ~$70K, +$10K/year fixed raises, same scale as founder | |
| 146 | + | - **Duration**: Fluid, typically 3-4 years | |
| 147 | + | - **Goal**: Graduation into independent full-stack engineer, not retention | |
| 148 | + | ||
| 149 | + | This matters for business sustainability because: | |
| 150 | + | 1. **Lower initial labor cost** than hiring senior engineers (~$70K vs ~$150K+) | |
| 151 | + | 2. **Residents produce real work from day one** (customer support → features → architecture) | |
| 152 | + | 3. **Knowledge transfer is built into the model** — familiarization checklist is 7 phases covering all 13 projects | |
| 153 | + | 4. **Alumni network creates long-term value** — graduated residents in industry positions extend MNW's reach | |
| 154 | + | ||
| 155 | + | ### Trust ladder and operational capacity | |
| 156 | + | ||
| 157 | + | The operations model uses a four-level trust progression: | |
| 158 | + | ||
| 159 | + | | Level | Role | Operational capacity added | | |
| 160 | + | |-------|------|--------------------------| | |
| 161 | + | | L1 — Patch Contributor | Submit patches, reviewed before merge | Reduces founder's bug-fix backlog | | |
| 162 | + | | L2 — Trusted Contributor | Self-merge trivial fixes | Reduces review burden | | |
| 163 | + | | L3 — Area Owner | Own a subsystem, review others' patches | Founder can delegate entire areas | | |
| 164 | + | | L4 — Senior Resident | Full merge rights, trains others, writes changelog | Founder focuses on strategy | | |
| 165 | + | ||
| 166 | + | **Business impact**: Each trust level crossed reduces the founder's operational load by ~10-15 hours/week. A single L3 resident owning support + moderation would push the single-operator ceiling from ~500 creators to ~1,500. | |
| 167 | + | ||
| 168 | + | ### Development cycle | |
| 169 | + | ||
| 170 | + | Four-week cycle: 2-week merge window (features, refactors) + 2-week stabilization (bugs, tests, docs, release). No-regressions rule: any change that breaks a test is reverted immediately, no exceptions. Deploy at end of week 4. Changelog published same day as release. | |
| 171 | + | ||
| 172 | + | This cycle is relevant to sustainability because it means: | |
| 173 | + | - **Feature velocity is predictable** — 6 merge windows per quarter | |
| 174 | + | - **Quality is enforced structurally** — stabilization prevents release-day surprises | |
| 175 | + | - **The cycle works at any team size** — one person or ten people, same rhythm | |
| 176 | + | ||
| 177 | + | ### Staffing cost projections | |
| 178 | + | ||
| 179 | + | | Stage | Headcount | Monthly labor cost | Creator threshold | | |
| 180 | + | |-------|-----------|-------------------|-------------------| | |
| 181 | + | | Current (founder only) | 1 | $0 (personal savings) | 0-100 creators | | |
| 182 | + | | Part-time support | 1.5 | $600-1,200 | ~100 creators | | |
| 183 | + | | First resident | 2 | $5,800 (~$70K/yr) | ~200 creators | | |
| 184 | + | | Founder salary + resident | 2 | $11,600 ($140K combined) | ~300 creators ($9,700 surplus at 500) | | |
| 185 | + | | Two residents + founder | 3 | $17,400 ($210K combined) | ~500+ creators | | |
| 186 | + | ||
| 187 | + | At 500 creators with ~$9,700/month surplus: covers founder ($5,800) + one resident ($5,800) with $2,100/month for infrastructure, reserves, and development. The model works — but only at 500+ creators with good tier mix. | |
| 188 | + | ||
| 189 | + | --- | |
| 190 | + | ||
| 191 | + | ## Business Model Map | |
| 192 | + | ||
| 193 | + | ### What does the business sell? | |
| 194 | + | ||
| 195 | + | Monthly creator subscriptions ($10-60) tiered by content type. 0% platform fee on fan payments. Fan+ consumer subscriptions ($8/month with $5 monthly credit). Planned add-ons for SyncKit cloud sync, automated email, and DSP distribution. | |
| 196 | + | ||
| 197 | + | ### Revenue streams | |
| 198 | + | ||
| 199 | + | | Stream | Pricing | Who pays | Status | | |
| 200 | + | |--------|---------|----------|--------| | |
| 201 | + | | Creator subscriptions | $10-60/month flat | Creators | Live | | |
| 202 | + | | Fan+ subscriptions | $8/month ($5 credit back) | Fans | Planned (pre-beta priority) | | |
| 203 | + | | SyncKit cloud sync | TBD add-on | Developers | Planned | | |
| 204 | + | | Automated email (Postmark) | TBD add-on | Creators | Planned | | |
| 205 | + | | DSP distribution | $10-15/month add-on | Music creators | Planned | | |
| 206 | + | ||
| 207 | + | ### Cost structure | |
| 208 | + | ||
| 209 | + | | Cost | Type | Current | Scales with | | |
| 210 | + | |------|------|---------|-------------| | |
| 211 | + | | Infrastructure (servers, DB, storage, DNS) | Fixed | ~$600/month | Creator count (sub-linear) | | |
| 212 | + | | Storage (Hetzner S3) | Variable | $0.10-3.00/creator | Upload volume | | |
| 213 | + | | CDN/bandwidth (Cloudflare + Hetzner) | Variable | $0.20-2.50/creator | Download volume | | |
| 214 | + | | Email (Postmark) | Variable | ~$0.40-0.80/creator | Follower count, broadcast frequency | | |
| 215 | + | | Stripe processing (platform subs only) | Variable | ~3% of subscription | Creator count | | |
| 216 | + | | Malware scanning | Fixed/Variable | Near $0 (ClamAV self-hosted) | Upload volume | | |
| 217 | + | ||
| 218 | + | Stripe Connect Standard accounts: no per-account fees, no payout-volume fees, no per-payout fees to the platform. Creators pay Stripe's standard processing (~2.9% + $0.30) directly from their own connected accounts. | |
| 219 | + | ||
| 220 | + | ### Key assumptions | |
| 221 | + | ||
| 222 | + | 1. Creator count grows to 32+ (break-even) within 12-18 months | |
| 223 | + | 2. Tier mix stays roughly distributed (not all-Basic) | |
| 224 | + | 3. Cloudflare free tier remains available for CDN | |
| 225 | + | 4. Stripe doesn't significantly raise processing fees | |
| 226 | + | 5. One person can operate the platform until revenue supports hiring | |
| 227 | + | ||
| 228 | + | --- | |
| 229 | + | ||
| 230 | + | ## Unit Economics | |
| 231 | + | ||
| 232 | + | ### Per-Creator Margins (Stripe Connect Standard — no Connect fees) | |
| 233 | + | ||
| 234 | + | | Tier | Price | Variable Cost | Margin | | |
| 235 | + | |------|-------|---------------|--------| | |
| 236 | + | | Basic | $10/mo | $0.85-1.90 | $8.10-9.15 | | |
| 237 | + | | Small Files | $20/mo | $1.90-3.80 | $16.20-18.10 | | |
| 238 | + | | Big Files | $30/mo | $3.60-8.60 | $21.40-26.40 | | |
| 239 | + | | Everything | $60/mo | $5.00-9.70 | $50.30-55.00 | | |
| 240 | + | ||
| 241 | + | ### Break-Even | |
| 242 | + | ||
| 243 | + | | Tier Mix | Avg Margin | Creators Needed | | |
| 244 | + | |----------|------------|-----------------| | |
| 245 | + | | Basic-heavy | ~$8.50 | ~70 | | |
| 246 | + | | Audio-heavy | ~$17.00 | ~35 | | |
| 247 | + | | Video-heavy | ~$24.00 | ~25 | | |
| 248 | + | | Mixed (realistic) | ~$19.00 | ~32 | | |
| 249 | + | ||
| 250 | + | ### Scale Projections | |
| 251 | + | ||
| 252 | + | | Scale | Fixed | Variable | Total Cost | Revenue | Surplus | | |
| 253 | + | |-------|-------|----------|------------|---------|---------| | |
| 254 | + | | 100 creators | $600 | $300 | $900 | $2,400 | $1,500 | | |
| 255 | + | | 500 creators | $800 | $1,500 | $2,300 | $12,000 | $9,700 | | |
| 256 | + | | 2,000 creators | $1,500 | $6,000 | $7,500 | $48,000 | $40,500 | | |
| 257 | + | ||
| 258 | + | ### Fan+ Unit Economics | |
| 259 | + | ||
| 260 | + | | Line | Amount | | |
| 261 | + | |------|--------| | |
| 262 | + | | Fan pays | $8.00 | | |
| 263 | + | | Stripe processing (~3.5%) | -$0.28 | | |
| 264 | + | | $5 credit issued | -$5.00 | | |
| 265 | + | | MNW net per subscriber | ~$2.72 | | |
| 266 | + | ||
| 267 | + | At 100 subscribers: ~$272/month. At 500: ~$1,360/month. Credit expires monthly (no rollover). If unredeemed, MNW nets ~$7.72 instead. | |
| 268 | + | ||
| 269 | + | ### Verdict: Sustainable | |
| 270 | + | ||
| 271 | + | Positive gross margin at all tiers. No Connect fee drag. Break-even at 32 creators is achievable. The model works at modest scale without requiring aggressive growth. | |
| 272 | + | ||
| 273 | + | --- | |
| 274 | + | ||
| 275 | + | ## Critical Risks | |
| 276 | + | ||
| 277 | + | ### 1. One-person operation is a hard ceiling at ~500 creators | |
| 278 | + | ||
| 279 | + | - **Where**: economics.md, guarantees.md, `_meta/docs/operations.md` | |
| 280 | + | - **Impact**: At 500 creators, estimated workload is ~70 hours/week across development, support, moderation, operations, and business. Support response times degrade first, followed by moderation queue backup, then feature velocity collapse. The deploy pipeline is manual (MacBook → rsync → Hetzner), incident response has a single contact point, and the four-week development cycle has no slack for unplanned work during stabilization. | |
| 281 | + | - **Mitigation**: The residency model (`_meta/docs/residency.md`) is designed for this. First resident starts at ~$70K/year (~$5,800/month), which the platform can fund at ~300 creators. Part-time support hire (~$600-1,200/month) should come earlier at ~100 creators. The trust ladder means a resident producing value within weeks (L1 patches, customer support), not months. Added to todo.md. | |
| 282 | + | ||
| 283 | + | ### 2. No growth mechanism beyond word-of-mouth | |
| 284 | + | ||
| 285 | + | - **Where**: outreach/tiers.md, outreach/budget.md | |
| 286 | + | - **Impact**: MNW explicitly rejects algorithmic discovery, paid acquisition, and network effects. Growth depends on organic outreach to creators already frustrated with their current platform. Outreach doc lists ~425 target creators (128 high-fit) with a ~$1,455/year budget. | |
| 287 | + | - **Mitigation**: This is a deliberate design choice. The pitch stands on two pillars: (1) cheaper at scale and (2) intentionally resistant to enshittification. Timeline to "comfortable" (~$5K/month surplus at ~295 creators) is measured in years. Acceptable for a bootstrapped lifestyle business. The desktop apps (GO, BB, AF) serve as organic marketing — developers who use them encounter the MNW platform. | |
| 288 | + | ||
| 289 | + | ### 3. Addressable market is structurally limited | |
| 290 | + | ||
| 291 | + | - **Where**: pricing calculator, competitive analysis | |
| 292 | + | - **Impact**: Below ~$400/month in fan revenue, MNW is more expensive than Ko-fi Free (0% on tips, 5% on shop) or Bandcamp (15%). MNW only saves creators money above the crossover point. This limits the market to the top 5-10% of platform creators globally. | |
| 293 | + | - **Mitigation**: Intentional. Earn-Back Credit (added to todo.md, ship before beta) softens the barrier for low-earning creators. The platform targets creators who earn enough that flat fees save money. | |
| 294 | + | ||
| 295 | + | ### 4. Stripe is a single point of failure for payments | |
| 296 | + | ||
| 297 | + | - **Where**: `_meta/docs/service_accounts.md`, payment-independence.md | |
| 298 | + | - **Impact**: All payment processing — creator subscriptions, fan purchases, Fan+ — runs through Stripe. If Stripe suspends the platform account, terminates Connect access, or significantly raises fees, there is no fallback processor. | |
| 299 | + | - **Mitigation**: Payment independence is on the roadmap (Phase 24 in todo.md). The architecture uses direct charges on connected accounts, so creators keep their own Stripe accounts if they leave. Short-term risk is low (Stripe is stable), but it is the most dangerous vendor dependency. | |
| 300 | + | ||
| 301 | + | --- | |
| 302 | + | ||
| 303 | + | ## Pricing Assessment | |
| 304 | + | ||
| 305 | + | ### Verified Against Code | |
| 306 | + | ||
| 307 | + | All documented prices match code exactly: | |
| 308 | + | - Tier prices: `enums.rs:505-512` (`price_cents()`) | |
| 309 | + | - Storage limits: `enums.rs:525-531` (`max_storage_bytes()`) | |
| 310 | + | - File limits: `enums.rs:515-522` (`max_file_bytes()`) | |
| 311 | + | - 0% platform fee: `checkout.rs` — `application_fee_amount` omitted; `platform_fee_cents: Cents::ZERO` in all transactions | |
| 312 | + | ||
| 313 | + | ### Pricing Problems | |
| 314 | + | ||
| 315 | + | 1. **Everything tier ($60) is blocked in code** — `checkout/subscriptions.rs:74-79` returns "not yet available." Raised from $40 to $60 to reflect live streaming infrastructure. Clear differentiation from Big Files: streaming + 0% donation fees + all future features. Unblock when MediaMTX integration is ready. | |
| 316 | + | ||
| 317 | + | 2. **Earn-Back Credit documented but not implemented** — Internal economics.md presented it as current policy; how-we-work.md correctly marks "Planned." Added to todo.md for pre-beta implementation. Counter on pricing page will serve as signup incentive. | |
| 318 | + | ||
| 319 | + | 3. **Pricing calculator Ko-fi entry was inaccurate** — Fixed. Now reads "0% tips, 5% shop/memberships + ~3%" (was "5% shop + ~3%"). All 9 competitors verified against current public pricing pages. | |
| 320 | + | ||
| 321 | + | ### Revenue Crossover Points (MNW becomes cheaper than competitor) | |
| 322 | + | ||
| 323 | + | | vs Competitor | Crossover (Basic $10/mo) | | |
| 324 | + | |--------------|--------------------------| | |
| 325 | + | | Ko-fi Free (5% shop) | ~$200/mo fan revenue | | |
| 326 | + | | Bandcamp (15%) | ~$67/mo fan revenue | | |
| 327 | + | | Patreon (10%) | ~$100/mo fan revenue | | |
| 328 | + | | Gumroad (10% + $0.50/tx) | ~$100/mo fan revenue | | |
| 329 | + | ||
| 330 | + | --- | |
| 331 | + | ||
| 332 | + | ## Cost Risks | |
| 333 | + | ||
| 334 | + | ### 1. Bandwidth egress if Cloudflare becomes unavailable | |
| 335 | + | ||
| 336 | + | - **Trigger**: Cloudflare account termination, policy change, or free-tier degradation | |
| 337 | + | - **Impact**: Hetzner S3 egress at ~$1/TB. A viral 500MB album with 10,000 downloads = 5TB = ~$5 | |
| 338 | + | - **Mitigation**: Cloudflare caching reduces origin pulls to near-zero. Hetzner presigned URL fallback documented. Budget $200-500/month reserve at 500+ creators. | |
| 339 | + | ||
| 340 | + | ### 2. Video transcoding costs when feature ships | |
| 341 | + | ||
| 342 | + | - **Trigger**: Big Files "automatic transcoding" is "(planned)" in tiers.md. Full transcoding pipeline is documented in todo.md Phase 14E (5 sub-phases: probe, audio transcode, format choice, video transcode, adaptive streaming). | |
| 343 | + | - **Impact**: Estimated $2.70-5.40 per hour of video (AWS MediaConvert). Weekly video creator = $10-22/month against $30 subscription. Storage multiplication (original + 3 quality tiers) adds 4x per source file. | |
| 344 | + | - **Mitigation**: Feature isn't built yet. Phase 14E is post-beta. Consider making transcoding an add-on or rate-limiting encodes per tier when it ships. | |
| 345 | + | ||
| 346 | + | ### 3. Email costs at scale with high-follower creators | |
| 347 | + | ||
| 348 | + | - **Trigger**: Creator with 50,000 followers doing monthly broadcasts = 50,000 emails = ~$25 via Postmark | |
| 349 | + | - **Impact**: Tech_costs.md budgets $0.40-0.80/creator for email. High-follower creator exceeds this 30x. | |
| 350 | + | - **Mitigation**: Per-creator email cost tracking. Self-hosted email planned (Phase 18 in todo.md, trigger: >50 creators, Postmark >$50/month). Broadcast emails use separate Postmark stream. | |
| 351 | + | ||
| 352 | + | ### 4. Content Archive guarantee creates indefinite storage liability | |
| 353 | + | ||
| 354 | + | - **Trigger**: Planned guarantee to host content 12+ months after cancellation | |
| 355 | + | - **Impact**: Cancelled creator's 500GB costs ~$3.35/month forever at Hetzner S3 rates | |
| 356 | + | - **Mitigation**: Not yet implemented. Consider a retention cap (e.g., 2 years) or fund from reserves. | |
| 357 | + | ||
| 358 | + | --- | |
| 359 | + | ||
| 360 | + | ## Revenue Gaps | |
| 361 | + | ||
| 362 | + | | Gap | Opportunity | Complexity | Status | | |
| 363 | + | |-----|------------|------------|--------| | |
| 364 | + | | Fan+ not live | $272-2,720/month at 100-1,000 subs | Easy (fully designed) | Pre-beta priority | | |
| 365 | + | | No add-on revenue | DSP alone could add $950-2,000/month at 500 creators | Moderate (vendor relationship) | Planned (Phase 23, trigger: >100 music creators) | | |
| 366 | + | | No enterprise/team tier | $100-200/month covering 5-10 creator seats | Moderate | Not planned | | |
| 367 | + | | Earn-Back Credit not implemented | Signup incentive, reduces churn for low-earners | Easy-moderate | Pre-beta priority | | |
| 368 | + | | SyncKit not productized | Cloud sync add-on for indie developers | Moderate (Phase S9 in todo.md) | Infrastructure built, pricing TBD | | |
| 369 | + | ||
| 370 | + | --- | |
| 371 | + | ||
| 372 | + | ## Scaling Bottlenecks | |
| 373 | + | ||
| 374 | + | ### Technical | |
| 375 | + | ||
| 376 | + | | Bottleneck | Current Capacity | Break Point | Fix | | |
| 377 | + | |------------|------------------|-------------|-----| | |
| 378 | + | | Database pool (25 connections) | ~200 concurrent users | 500+ creators | Increase pool, add PgBouncer | | |
| 379 | + | | File scanning (4 concurrent, 100MB RAM each) | 50 creators uploading weekly | 50+ concurrent uploads | Async scanning (background queue in todo.md) | | |
| 380 | + | | Email (single-request Postmark API) | 50,000 emails/week | 500+ creators broadcasting | Batch Postmark API | | |
| 381 | + | | Single VPS (all services on one machine) | 5,000 daily users | Viral spike | Load balancer + 2nd VPS (~$20/month) | | |
| 382 | + | | In-memory session cache (DashMap) | Single server only | Horizontal scaling | Replace with Redis or accept cache misses | | |
| 383 | + | | Rate limiting (per-IP only) | Normal traffic | Botnet abuse | Add per-creator rate limits | | |
| 384 | + | ||
| 385 | + | ### Operational | |
| 386 | + | ||
| 387 | + | | Bottleneck | Current Capacity | Break Point | Fix | | |
| 388 | + | |------------|------------------|-------------|-----| | |
| 389 | + | | Single operator (all roles) | ~100 creators | 500+ (70 hrs/week) | Part-time support at 100, first resident at 200 | | |
| 390 | + | | Manual deploy (MacBook → rsync) | Founder only | Founder unavailable | CI pipeline on Astra (partially built) | | |
| 391 | + | | Manual moderation (no triage) | 10-20 issues/day | 40+ issues/day | Auto-triage rules, SLA timers | | |
| 392 | + | | Manual creator onboarding | Founder reviews each application | 50+ applications/month | Semi-automated approval criteria | | |
| 393 | + | | Single incident responder | 24/7 founder availability | Founder unavailable | L3 resident with deploy access | | |
| 394 | + | ||
| 395 | + | --- | |
| 396 | + | ||
| 397 | + | ## Competitive Position | |
| 398 | + | ||
| 399 | + | ### Strengths | |
| 400 | + | ||
| 401 | + | 1. **0% platform fee is real and verified in code** — `application_fee_amount` omitted, `platform_fee_cents: Cents::ZERO` hardcoded | |
| 402 | + | 2. **Radical cost transparency** — public economics page with actual cost ranges, margins, break-even analysis | |
| 403 | + | 3. **Infrastructure cost discipline** — Hetzner over AWS saves ~80%, self-hosted PostgreSQL, Cloudflare free tier, no Docker overhead | |
| 404 | + | 4. **Direct-to-creator payments** — MNW never holds creator funds, no settlement risk | |
| 405 | + | 5. **Debt-free, self-funded** — no investor pressure, no creditors, personal savings runway | |
| 406 | + | 6. **Data portability backed by code** — export endpoints implemented, not vaporware | |
| 407 | + | 7. **Stripe Standard accounts** — no per-account Connect fees, margins don't compress with creator success | |
| 408 | + | 8. **Ecosystem depth** — 13 interconnected projects, shared libraries, integrated forums, built-in monitoring | |
| 409 | + | 9. **Source-available codebase** — every claim verifiable in code (PolyForm Noncommercial) | |
| 410 | + | 10. **Structured scaling path** — residency model, trust ladder, four-week cycle all documented and ready for first hire | |
| 411 | + | ||
| 412 | + | ### Vulnerabilities | |
| 413 | + | ||
| 414 | + | | Vulnerability | Severity | Defense | | |
| 415 | + | |---------------|----------|---------| | |
| 416 | + | | Ko-fi Free undercuts for <$400/month creators | Medium | Intentional — MNW targets $400+/month creators | | |
| 417 | + | | itch.io's 0% creator-chosen fee | Medium | Different feature set; itch.io payout instability | | |
| 418 | + | | No discovery = no new creator growth | High (structural) | Deliberate design choice; pitch on anti-enshittification | | |
| 419 | + | | VC-backed competitor at $5/month | Low | MNW's $600/month costs can outlast subsidized pricing | | |
| 420 | + | | Stripe dependency | Medium | Payment independence on roadmap (Phase 24) | | |
| 421 | + | ||
| 422 | + | --- | |
| 423 | + | ||
| 424 | + | ## Contradictions Found | |
| 425 | + | ||
| 426 | + | | Claim | Reality | Severity | Resolution | | |
| 427 | + | |-------|---------|----------|------------| | |
| 428 | + | | Earn-Back Credit (economics.md) presented as current | Not implemented, no schema | Medium | Added to todo.md pre-beta; mark "planned" consistently | | |
| 429 | + | | Content Archive in how-we-work.md | Correctly marked "planned" in guarantees.md but not elsewhere | Low | Consistent labeling needed | | |
| 430 | + | | ~~Stripe Express in 8 docs + code~~ | ~~Should be Standard~~ | ~~High~~ | Fixed in this session | | |
| 431 | + | | ~~Ko-fi Free "5% shop" in calculator~~ | ~~0% on tips, 5% on shop/memberships~~ | ~~Low-medium~~ | Fixed in this session | | |
| 432 | + | | `CREATOR_TIER_STREAMING_PRICE_ID` in service_accounts.md | Tier renamed to "Everything" (migration 079, 2026-04-27) | Low | Update service_accounts.md | | |
| 433 | + | ||
| 434 | + | --- | |
| 435 | + | ||
| 436 | + | ## Actions Taken (this session) | |
| 437 | + | ||
| 438 | + | - [x] Stripe Connect Express -> Standard: code (`connect.rs`), 8 docs, all cost tables, break-even numbers | |
| 439 | + | - [x] Pricing calculator: Ko-fi Free label corrected, all 9 competitors verified against current pricing | |
| 440 | + | - [x] Public economics page: per-creator costs updated, break-even corrected (36 -> 32), "low number" paragraph softened | |
| 441 | + | - [x] todo.md: Earn-Back Credit added (pre-beta priority), Fan+ bumped (pre-beta priority), churn monitoring added (future phase), support hire budget added | |
| 442 | + | ||
| 443 | + | ## Recommendations (prioritized) | |
| 444 | + | ||
| 445 | + | 1. **Ship Earn-Back Credit before beta** — reduces $120/year entry barrier, provides signup incentive counter on pricing page | |
| 446 | + | 2. **Ship Fan+ before beta** — creates spending flywheel, community stickiness, $2.72/subscriber revenue diversification | |
| 447 | + | 3. **Implement churn monitoring before 100 creators** — at 32 creators, losing 3 drops below break-even with no warning system | |
| 448 | + | 4. **Budget for part-time support hire at 100 creators** — ~$600-1,200/month prevents support quality collapse | |
| 449 | + | 5. **Define Everything tier before unblocking** — ship at least one exclusive feature to justify the $10 premium over Big Files | |
| 450 | + | 6. **Diversify the pitch** — lead with cheaper-at-scale economics and enshittification resistance, not competitor instability | |
| 451 | + | 7. **Productize SyncKit** — infrastructure is built and dogfooded by 3 apps; pricing and marketing are the gap (Phase S9) | |
| 452 | + | 8. **Fix stale `CREATOR_TIER_STREAMING_PRICE_ID`** in `_meta/docs/service_accounts.md` (renamed to Everything) | |
| 453 | + | ||
| 454 | + | --- | |
| 455 | + | ||
| 456 | + | ## Reference Documents | |
| 457 | + | ||
| 458 | + | ### Business and economics | |
| 459 | + | - [Platform Economics (public)](../../site-docs/public/about/economics.md) — what creators see | |
| 460 | + | - [Economics (internal)](./economics.md) — detailed cost model | |
| 461 | + | - [Financial Dashboard](./financial_dashboard.md) — consolidated financial view | |
| 462 | + | - [Tech Costs](../strategy/tech_costs.md) — line-item cost breakdown | |
| 463 | + | - [Payment Independence](./payment-independence.md) — Stripe dependency and alternatives | |
| 464 | + | - [Fan+](./fan-plus.md) — consumer subscription design | |
| 465 | + | ||
| 466 | + | ### Operations and infrastructure | |
| 467 | + | - [`_meta/docs/operations.md`](../../../../_meta/docs/operations.md) — development cycles, merge privileges, trust ladder | |
| 468 | + | - [`_meta/docs/residency.md`](../../../../_meta/docs/residency.md) — hiring model, compensation, progression | |
| 469 | + | - [`_meta/docs/incident_response.md`](../../../../_meta/docs/incident_response.md) — severity levels, response checklists, credential rotation | |
| 470 | + | - [`_meta/docs/service_accounts.md`](../../../../_meta/docs/service_accounts.md) — credential inventory, rotation procedures | |
| 471 | + | - [`_meta/ecosystem.md`](../../../../_meta/ecosystem.md) — 13-project ecosystem map, connections, test counts | |
| 472 | + | - [`_meta/docs/familiarization_checklist.md`](../../../../_meta/docs/familiarization_checklist.md) — onboarding plan for new team members | |
| 473 | + | ||
| 474 | + | ### Infrastructure diagrams | |
| 475 | + | - [`_meta/diagrams/infra/network_topology.md`](../../../../_meta/diagrams/infra/network_topology.md) — physical infrastructure, DNS, Tailscale mesh | |
| 476 | + | - [`_meta/diagrams/infra/deploy_pipeline.md`](../../../../_meta/diagrams/infra/deploy_pipeline.md) — build, upload, restart for each service | |
| 477 | + | - [`_meta/diagrams/infra/server_architecture.md`](../../../../_meta/diagrams/infra/server_architecture.md) — MNW server internals | |
| 478 | + | - [`_meta/diagrams/infra/external_services.md`](../../../../_meta/diagrams/infra/external_services.md) — third-party integrations | |
| 479 | + | - [`_meta/diagrams/infra/pom_monitoring.md`](../../../../_meta/diagrams/infra/pom_monitoring.md) — monitoring topology |
| @@ -11,7 +11,7 @@ We have one revenue source: creator subscriptions. | |||
| 11 | 11 | | Basic | $10 | Written content hosting, delivery | | |
| 12 | 12 | | Small Files | $20 | Audio, software, plugins, small downloads | | |
| 13 | 13 | | Big Files | $30 | Video hosting, transcoding, large downloads | | |
| 14 | - | | Everything | $40 | All features, current and future | | |
| 14 | + | | Everything | $60 | All features, current and future | | |
| 15 | 15 | ||
| 16 | 16 | That's it. No premium tiers. No "pro" features locked behind higher prices. No percentage of your earnings. | |
| 17 | 17 | ||
| @@ -71,14 +71,14 @@ See [tech_costs.md](../strategy/tech_costs.md) for line-item detail within each | |||
| 71 | 71 | ||
| 72 | 72 | ### Per-Creator Variable Costs (Monthly) | |
| 73 | 73 | ||
| 74 | - | | Tier | Price | Cost Range | Margin | Stripe Connect | Adjusted Margin | | |
| 75 | - | |------|-------|------------|--------|----------------|-----------------| | |
| 76 | - | | Basic | $10 | $0.85--1.90 | $8.10--9.15 | ~$2.28 | $5.82--6.87 | | |
| 77 | - | | Small Files | $20 | $1.90--3.80 | $16.20--18.10 | ~$2.30 | $13.90--15.80 | | |
| 78 | - | | Big Files | $30 | $3.60--8.60 | $21.40--26.40 | ~$2.33 | $19.07--24.07 | | |
| 79 | - | | Everything | $40 | $5.00--9.70 | $30.30--35.00 | ~$2.35 | $27.95--32.65 | | |
| 74 | + | | Tier | Price | Cost Range | Margin | | |
| 75 | + | |------|-------|------------|--------| | |
| 76 | + | | Basic | $10 | $0.85--1.90 | $8.10--9.15 | | |
| 77 | + | | Small Files | $20 | $1.90--3.80 | $16.20--18.10 | | |
| 78 | + | | Big Files | $30 | $3.60--8.60 | $21.40--26.40 | | |
| 79 | + | | Everything | $60 | $5.00--9.70 | $50.30--55.00 | | |
| 80 | 80 | ||
| 81 | - | Stripe Connect (Express accounts): $2/active account/mo + 0.25% of payout volume + $0.25/payout. Per-tier estimates assume one monthly payout with subscription price as floor proxy for payout volume — actual costs scale with creator earnings. | |
| 81 | + | Stripe Connect (Standard accounts): no per-account fees, no payout-volume fees, no per-payout fees charged to the platform. Creators pay Stripe's standard processing fees (~2.9% + $0.30) directly from their own connected accounts. | |
| 82 | 82 | ||
| 83 | 83 | Ranges reflect variability in upload frequency, audience size, and content type. High-activity creators are subsidized by the average — flat pricing means successful creators aren't penalized. | |
| 84 | 84 | ||
| @@ -88,34 +88,34 @@ Ranges reflect variability in upload frequency, audience size, and content type. | |||
| 88 | 88 | ||
| 89 | 89 | To cover ~$600/month fixed costs: | |
| 90 | 90 | ||
| 91 | - | | Tier Mix | Avg Margin | Creators Needed | After Stripe Connect | Adjusted Creators | | |
| 92 | - | |----------|------------|-----------------|----------------------|-------------------| | |
| 93 | - | | Basic-heavy | ~$8.50 | ~70 | ~$6.35 | ~94 | | |
| 94 | - | | Audio-heavy | ~$17.00 | ~35 | ~$14.85 | ~40 | | |
| 95 | - | | Video-heavy | ~$24.00 | ~25 | ~$21.57 | ~28 | | |
| 96 | - | | Mixed | ~$19.00 | ~32 | ~$16.69 | ~36 | | |
| 91 | + | | Tier Mix | Avg Margin | Creators Needed | | |
| 92 | + | |----------|------------|-----------------| | |
| 93 | + | | Basic-heavy | ~$8.50 | ~70 | | |
| 94 | + | | Audio-heavy | ~$17.00 | ~35 | | |
| 95 | + | | Video-heavy | ~$24.00 | ~25 | | |
| 96 | + | | Mixed | ~$19.00 | ~32 | | |
| 97 | 97 | ||
| 98 | - | **Survival threshold: 28--94 paying creators** (including Stripe Connect), depending on tier mix. ~36 for a realistic mixed-tier distribution. | |
| 98 | + | **Survival threshold: 25--70 paying creators** depending on tier mix. ~32 for a realistic mixed-tier distribution. | |
| 99 | 99 | ||
| 100 | 100 | ### Sustainable Operation | |
| 101 | 101 | ||
| 102 | 102 | To cover costs plus $1,000/month for ongoing development, support, and reserves: | |
| 103 | 103 | ||
| 104 | - | | Target monthly surplus | Creators needed (mixed) | After Stripe Connect | | |
| 105 | - | |------------------------|-------------------------|----------------------| | |
| 106 | - | | $1,000 | ~85 | ~96 | | |
| 107 | - | | $2,000 | ~137 | ~156 | | |
| 108 | - | | $3,000 | ~190 | ~216 | | |
| 104 | + | | Target monthly surplus | Creators needed (mixed) | | |
| 105 | + | |------------------------|-------------------------| | |
| 106 | + | | $1,000 | ~85 | | |
| 107 | + | | $2,000 | ~137 | | |
| 108 | + | | $3,000 | ~190 | | |
| 109 | 109 | ||
| 110 | 110 | ### Comfortable Operation | |
| 111 | 111 | ||
| 112 | 112 | To provide meaningful income (~$5,000/month after costs): | |
| 113 | 113 | ||
| 114 | - | | At average margin of... | Creators needed | After Stripe Connect | | |
| 115 | - | |-------------------------|-----------------|----------------------| | |
| 116 | - | | $17 (audio-heavy) | ~330 | ~377 | | |
| 117 | - | | $24 (video-heavy) | ~235 | ~260 | | |
| 118 | - | | $19 (mixed) | ~295 | ~336 | | |
| 114 | + | | At average margin of... | Creators needed | | |
| 115 | + | |-------------------------|-----------------| | |
| 116 | + | | $17 (audio-heavy) | ~330 | | |
| 117 | + | | $24 (video-heavy) | ~235 | | |
| 118 | + | | $19 (mixed) | ~295 | | |
| 119 | 119 | ||
| 120 | 120 | --- | |
| 121 | 121 |
| @@ -38,16 +38,14 @@ Source: `docs/internal/business/economics.md`, `docs/internal/strategy/tech_cost | |||
| 38 | 38 | ||
| 39 | 39 | ### Creator Subscriptions | |
| 40 | 40 | ||
| 41 | - | | Tier | Price | Variable Cost | Margin (source docs) | Stripe Connect | Adjusted Margin | | |
| 42 | - | |------|-------|---------------|----------------------|----------------|-----------------| | |
| 43 | - | | Basic | $10 | $0.85-1.90 | $8.10-9.15 | ~$2.28 | **$5.82-6.87** | | |
| 44 | - | | Small Files | $20 | $1.90-3.80 | $16.20-18.10 | ~$2.30 | **$13.90-15.80** | | |
| 45 | - | | Big Files | $30 | $3.60-8.60 | $21.40-26.40 | ~$2.33 | **$19.07-24.07** | | |
| 46 | - | | Everything | $40 | $5.00-9.70 | $30.30-35.00 | ~$2.35 | **$27.95-32.65** | | |
| 41 | + | | Tier | Price | Variable Cost | Margin | | |
| 42 | + | |------|-------|---------------|--------| | |
| 43 | + | | Basic | $10 | $0.85-1.90 | **$8.10-9.15** | | |
| 44 | + | | Small Files | $20 | $1.90-3.80 | **$16.20-18.10** | | |
| 45 | + | | Big Files | $30 | $3.60-8.60 | **$21.40-26.40** | | |
| 46 | + | | Everything | $60 | $5.00-9.70 | **$50.30-55.00** | | |
| 47 | 47 | ||
| 48 | - | **Stripe Connect** (Express accounts): $2/active account/mo + 0.25% of payout volume + $0.25/payout. Per-tier estimates assume 1 payout/month with subscription price as floor proxy for payout volume. Actual Stripe Connect costs scale with creator earnings — these are floor estimates. | |
| 49 | - | ||
| 50 | - | Source for Stripe Connect: `docs/internal/strategy/pitch.md` (Accounting & Tax Infrastructure section). Not reflected in `economics.md` or `tech_costs.md` variable cost tables. | |
| 48 | + | **Stripe Connect** (Standard accounts): no per-account fees, no payout-volume fees, no per-payout fees charged to the platform. Creators pay Stripe's standard processing fees (~2.9% + $0.30) directly from their own connected accounts. MNW's only Stripe cost is processing on platform subscriptions (creator tier billing). | |
| 51 | 49 | ||
| 52 | 50 | ### Fan+ (Consumer Subscription) | |
| 53 | 51 | ||
| @@ -66,16 +64,16 @@ At scale: 100 subs = ~$272/mo, 500 subs = ~$1,360/mo, 1,000 subs = ~$2,720/mo. | |||
| 66 | 64 | ||
| 67 | 65 | ## Break-Even | |
| 68 | 66 | ||
| 69 | - | Source docs (`economics.md`): 25-70 creators. Corrected (with Stripe Connect): | |
| 67 | + | Source: `economics.md`. No Stripe Connect fees on Standard accounts. | |
| 70 | 68 | ||
| 71 | - | | Tier Mix | Source Doc Margin | Adjusted Margin | Source Doc Creators | Corrected Creators | | |
| 72 | - | |----------|-------------------|-----------------|---------------------|--------------------| | |
| 73 | - | | Basic-heavy | ~$8.50 | ~$6.35 | ~70 | **~94** | | |
| 74 | - | | Audio-heavy | ~$17.00 | ~$14.85 | ~35 | **~40** | | |
| 75 | - | | Video-heavy | ~$24.00 | ~$21.57 | ~25 | **~28** | | |
| 76 | - | | Mixed | ~$19.00 | ~$16.69 | ~32 | **~36** | | |
| 69 | + | | Tier Mix | Avg Margin | Creators Needed | | |
| 70 | + | |----------|------------|-----------------| | |
| 71 | + | | Basic-heavy | ~$8.50 | **~70** | | |
| 72 | + | | Audio-heavy | ~$17.00 | **~35** | | |
| 73 | + | | Video-heavy | ~$24.00 | **~25** | | |
| 74 | + | | Mixed | ~$19.00 | **~32** | | |
| 77 | 75 | ||
| 78 | - | Based on ~$600/mo fixed costs. Corrected range: **28-94 creators**, ~36 for realistic mixed tier distribution. | |
| 76 | + | Based on ~$600/mo fixed costs. Range: **25-70 creators**, ~32 for realistic mixed tier distribution. | |
| 79 | 77 | ||
| 80 | 78 | --- | |
| 81 | 79 | ||
| @@ -85,36 +83,33 @@ Source: `docs/internal/strategy/tech_costs.md` (Cost Projections section) | |||
| 85 | 83 | ||
| 86 | 84 | ### At 100 Creators (Mixed Tiers) | |
| 87 | 85 | ||
| 88 | - | | Line | Source Docs | Corrected | | |
| 89 | - | |------|------------|-----------| | |
| 90 | - | | Fixed costs | ~$600 | ~$600 | | |
| 91 | - | | Variable costs (~$3 avg) | ~$300 | ~$300 | | |
| 92 | - | | Stripe Connect (100 x ~$2.31) | — | ~$231 | | |
| 93 | - | | **Total costs** | **~$900** | **~$1,131** | | |
| 94 | - | | Revenue (~$24 avg) | ~$2,400 | ~$2,400 | | |
| 95 | - | | **Surplus** | **~$1,500** | **~$1,269** | | |
| 86 | + | | Line | Amount | | |
| 87 | + | |------|--------| | |
| 88 | + | | Fixed costs | ~$600 | | |
| 89 | + | | Variable costs (~$3 avg) | ~$300 | | |
| 90 | + | | **Total costs** | **~$900** | | |
| 91 | + | | Revenue (~$24 avg) | ~$2,400 | | |
| 92 | + | | **Surplus** | **~$1,500** | | |
| 96 | 93 | ||
| 97 | 94 | ### At 500 Creators | |
| 98 | 95 | ||
| 99 | - | | Line | Source Docs | Corrected | | |
| 100 | - | |------|------------|-----------| | |
| 101 | - | | Fixed costs | ~$800 | ~$800 | | |
| 102 | - | | Variable costs | ~$1,500 | ~$1,500 | | |
| 103 | - | | Stripe Connect (500 x ~$2.31) | — | ~$1,155 | | |
| 104 | - | | **Total costs** | **~$2,300** | **~$3,455** | | |
| 105 | - | | Revenue | ~$12,000 | ~$12,000 | | |
| 106 | - | | **Surplus** | **~$9,700** | **~$8,545** | | |
| 96 | + | | Line | Amount | | |
| 97 | + | |------|--------| | |
| 98 | + | | Fixed costs | ~$800 | | |
| 99 | + | | Variable costs | ~$1,500 | | |
| 100 | + | | **Total costs** | **~$2,300** | | |
| 101 | + | | Revenue | ~$12,000 | | |
| 102 | + | | **Surplus** | **~$9,700** | | |
| 107 | 103 | ||
| 108 | 104 | ### At 2,000 Creators | |
| 109 | 105 | ||
| 110 | - | | Line | Source Docs | Corrected | | |
| 111 | - | |------|------------|-----------| | |
| 112 | - | | Fixed costs | ~$1,500 | ~$1,500 | | |
| 113 | - | | Variable costs | ~$6,000 | ~$6,000 | | |
| 114 | - | | Stripe Connect (2,000 x ~$2.31) | — | ~$4,620 | | |
| 115 | - | | **Total costs** | **~$7,500** | **~$12,120** | | |
| 116 | - | | Revenue | ~$48,000 | ~$48,000 | | |
| 117 | - | | **Surplus** | **~$40,500** | **~$35,880** | | |
| 106 | + | | Line | Amount | | |
| 107 | + | |------|--------| | |
| 108 | + | | Fixed costs | ~$1,500 | | |
| 109 | + | | Variable costs | ~$6,000 | | |
| 110 | + | | **Total costs** | **~$7,500** | | |
| 111 | + | | Revenue | ~$48,000 | | |
| 112 | + | | **Surplus** | **~$40,500** | | |
| 118 | 113 | ||
| 119 | 114 | --- | |
| 120 | 115 | ||
| @@ -194,10 +189,10 @@ Projected Year 1 revenue: ~$5K. Net: -$75K (investment year). Requires securitie | |||
| 194 | 189 | - [x] Stripe Connect fees missing from `economics.md` and `tech_costs.md` — added to all variable cost tables, break-even, and projections | |
| 195 | 190 | - [x] Legal reserve overlap unclear — clarified in `tech_costs.md` (ongoing counsel after one-time foundations) | |
| 196 | 191 | - [x] Fixed cost range vs actual — itemized inactive costs in `tech_costs.md` (insurance, paid monitoring, security scanning, accounting software) | |
| 197 | - | - [x] Break-even numbers in `economics.md` don't include Stripe Connect — added "After Stripe Connect" columns, updated survival threshold to 28-94 | |
| 192 | + | - [x] Break-even numbers in `economics.md` corrected for Standard accounts (no per-account Connect fees) | |
| 198 | 193 | - [x] `pitch.md` high-end Year 1 total arithmetic error — fixed ($49,055 → $50,055) | |
| 199 | 194 | - [x] `pitch.md` community building line missing expansion capital — added reference to `budget.md` ($1,700-6,500/yr) | |
| 200 | - | - [ ] Stripe Connect cost model uses subscription price as proxy for payout volume — actual costs depend on creator fan earnings, which could be significantly higher | |
| 195 | + | - [x] Stripe Connect corrected from Express to Standard — no per-account, payout-volume, or per-payout fees | |
| 201 | 196 | ||
| 202 | 197 | --- | |
| 203 | 198 | ||
| @@ -221,8 +216,7 @@ Projected Year 1 revenue: ~$5K. Net: -$75K (investment year). Requires securitie | |||
| 221 | 216 | ||
| 222 | 217 | ## Monitor | |
| 223 | 218 | ||
| 224 | - | - Stripe Connect pricing changes (current: $2/account/mo + 0.25% + $0.25/payout) | |
| 225 | - | - Stripe processing fee changes (current: ~3% on subscriptions) | |
| 219 | + | - Stripe processing fee changes (current: ~3% on subscriptions, Standard accounts have no Connect fees) | |
| 226 | 220 | - CDN/bandwidth pricing trends | |
| 227 | 221 | - Fan+ credit redemption rates (affects net per subscriber: $2.72 if redeemed vs $7.72 if not) | |
| 228 | 222 | - Business insurance activation timeline and actual cost |
| @@ -0,0 +1,157 @@ | |||
| 1 | + | # Money Transmitter Licensing Landscape | |
| 2 | + | ||
| 3 | + | Researched 2026-04-29. Reference document for Phase 24 payment independence planning. | |
| 4 | + | ||
| 5 | + | --- | |
| 6 | + | ||
| 7 | + | ## Bottom Line | |
| 8 | + | ||
| 9 | + | Own MTLs are impractical at MNW's current scale ($600/month operating costs). Full 50-state licensing costs $1.2-2.0M over 5 years. Stripe Connect Standard is the correct approach, and is what every comparable bootstrapped creator platform uses. | |
| 10 | + | ||
| 11 | + | **Important context**: MNW uses Stripe Connect **Standard** (not Express). With Standard accounts, MNW pays zero per-account fees, zero payout-volume fees, and zero per-payout fees. MNW's only Stripe cost is ~3% processing on platform subscriptions. This means the cost pressure to pursue payment independence is almost entirely creator-facing (reducing creators' ~3% processing fees), not platform-facing. The original analysis (before 2026-04-29 correction) assumed Express accounts ($2/account + 0.25% payout volume + $0.25/payout), which would have created urgency that does not actually exist. | |
| 12 | + | ||
| 13 | + | --- | |
| 14 | + | ||
| 15 | + | ## Federal: FinCEN MSB Registration | |
| 16 | + | ||
| 17 | + | - **Trigger**: Any business that transfers funds on behalf of the public. No minimum threshold. | |
| 18 | + | - **Cost**: Free (Form 107 via BSA E-Filing portal). | |
| 19 | + | - **Timeline**: ~2 weeks to appear on MSB registry. | |
| 20 | + | - **Renewal**: Every 2 years. | |
| 21 | + | - **Do NOT register preemptively** — triggers BSA/AML compliance obligations (written program, compliance officer, SAR filing, 5-year record retention). | |
| 22 | + | - Only register if/when MNW begins directly handling money transmission outside of Stripe. | |
| 23 | + | ||
| 24 | + | ## State Licensing | |
| 25 | + | ||
| 26 | + | **49 states + DC** require money transmitter licenses. Montana is the only exception. | |
| 27 | + | ||
| 28 | + | ### Cost summary | |
| 29 | + | ||
| 30 | + | | Scope | Year 1 | Annual ongoing | 5-year total | | |
| 31 | + | |-------|--------|----------------|-------------| | |
| 32 | + | | All states | $400K-770K | $350K-575K | $1.2-2.0M | | |
| 33 | + | | Top 10 states | $100K-200K | $75K-125K | $400K-700K | | |
| 34 | + | | Top 5 states | $50K-100K | $40K-75K | $210K-400K | | |
| 35 | + | ||
| 36 | + | ### Most expensive states | |
| 37 | + | ||
| 38 | + | | State | App fee | Surety bond | Timeline | | |
| 39 | + | |-------|---------|-------------|----------| | |
| 40 | + | | New York | High | Scaled to volume | 12-24 months | | |
| 41 | + | | California | $5,000 | Up to $500K | 12-18 months | | |
| 42 | + | | Texas | $10,000 | Scaled to volume | 12-18 months | | |
| 43 | + | | Pennsylvania | $5,000 | High | 12-18 months | | |
| 44 | + | | Colorado | $7,500 | Variable | Variable | | |
| 45 | + | ||
| 46 | + | ### Cheapest states | |
| 47 | + | ||
| 48 | + | Montana ($0, no MTL required), Idaho ($100), Tennessee ($250), Utah ($300), Missouri ($300). | |
| 49 | + | ||
| 50 | + | ### Streamlining mechanisms | |
| 51 | + | ||
| 52 | + | - **NMLS** (Nationwide Multistate Licensing System): Most states accept applications through NMLS. One company record reused across states. | |
| 53 | + | - **MMLA** (Multistate Money Services Licensing Agreement): 23 states participate in coordinated review for 5+ simultaneous applications. | |
| 54 | + | - **MTMA** (Money Transmission Modernization Act): 31 states have adopted, standardizing requirements. Positive trend. | |
| 55 | + | ||
| 56 | + | ### Surety bonds | |
| 57 | + | ||
| 58 | + | - Range: $10K-$500K per state (scaled to transaction volume) | |
| 59 | + | - Annual premium: 1-3% of face value | |
| 60 | + | - Notable: Florida $50K-$2M, Georgia $100K-$2M, Indiana flat $300K, Massachusetts $100K-$500K | |
| 61 | + | - Total annual premiums across all states (low volume): ~$120K-160K | |
| 62 | + | ||
| 63 | + | ## The Payout-Only Question | |
| 64 | + | ||
| 65 | + | **ACH payouts alone still trigger MTL requirements in most states.** Sending money to creators via ACH counts as money transmission regardless of direction. | |
| 66 | + | ||
| 67 | + | ### Agent of payee exemption | |
| 68 | + | ||
| 69 | + | - 22 states recognize it | |
| 70 | + | - 3 states case-by-case | |
| 71 | + | - ~24 states + DC do not recognize it | |
| 72 | + | - California DFPI explicitly says it does NOT apply to payout transactions | |
| 73 | + | - Not a reliable path for nationwide coverage | |
| 74 | + | ||
| 75 | + | ### How comparable platforms handle this | |
| 76 | + | ||
| 77 | + | | Platform | Approach | Own MTLs? | | |
| 78 | + | |----------|----------|-----------| | |
| 79 | + | | Stripe, PayPal, Square | Licensed money transmitters in all states | Yes (they ARE payment processors) | | |
| 80 | + | | Gumroad, Patreon, Substack, Ko-fi | Route everything through Stripe Connect | No | | |
| 81 | + | | Airbnb, Uber | Agent of payee + MTLs where needed | Partial | | |
| 82 | + | ||
| 83 | + | **Pattern**: Small creator platforms universally rely on Stripe Connect rather than obtaining own licenses. | |
| 84 | + | ||
| 85 | + | ## Alternatives to Own MTLs | |
| 86 | + | ||
| 87 | + | ### Stay on Stripe Connect (recommended, current) | |
| 88 | + | - Cost: $0 incremental | |
| 89 | + | - Stripe holds all necessary US and international licenses | |
| 90 | + | - Limitation: no direct control over payout timing or ACH routing | |
| 91 | + | ||
| 92 | + | ### Stripe Treasury | |
| 93 | + | - Embed financial accounts under Stripe's licenses | |
| 94 | + | - No MTL needed | |
| 95 | + | - Enterprise pricing (likely requires meaningful volume) | |
| 96 | + | - API integration in weeks | |
| 97 | + | ||
| 98 | + | ### Banking-as-a-Service (BaaS) | |
| 99 | + | - Operate under partner bank's charter | |
| 100 | + | - Providers: Unit, Treasury Prime, Sila Money, Alviere | |
| 101 | + | - Cost: $500-5,000/month base + per-transaction fees | |
| 102 | + | - Risk: BaaS model under increased regulatory scrutiny (Synapse failure) | |
| 103 | + | - No MTL needed | |
| 104 | + | ||
| 105 | + | ### Licensed payout partners | |
| 106 | + | - Tipalti, Hyperwallet (PayPal), Payoneer handle payouts under their licenses | |
| 107 | + | - Cost: $1-5 per payout + percentage | |
| 108 | + | - No MTL needed | |
| 109 | + | ||
| 110 | + | ## International | |
| 111 | + | ||
| 112 | + | ### EU (PSD2) | |
| 113 | + | - Payment Institution license required, passportable across EU | |
| 114 | + | - Small PI registration available for <EUR 3M/month | |
| 115 | + | - Cost: EUR 50K-200K including legal | |
| 116 | + | - Timeline: 3-12 months | |
| 117 | + | - **Not practical at MNW's scale. Stripe Connect covers EU obligations.** | |
| 118 | + | ||
| 119 | + | ### UK (FCA) | |
| 120 | + | - Separate from EU post-Brexit | |
| 121 | + | - Small Payment Institution registration available | |
| 122 | + | - 6-12 months for authorized PI | |
| 123 | + | - **Not practical. Stripe covers UK.** | |
| 124 | + | ||
| 125 | + | ### Canada (FINTRAC) | |
| 126 | + | - MSB registration is free | |
| 127 | + | - Must implement AML compliance program | |
| 128 | + | - Bank of Canada registration also required (RPAA) | |
| 129 | + | - **Least burdensome international option, but Stripe covers it.** | |
| 130 | + | ||
| 131 | + | ### Bottom line on international | |
| 132 | + | Stripe Connect handles all international payment compliance. As long as MNW uses Connect, international licensing is Stripe's problem. | |
| 133 | + | ||
| 134 | + | ## Decision Framework | |
| 135 | + | ||
| 136 | + | With Standard accounts, MNW's Stripe costs are negligible (~3% of platform subscriptions only). The decision to pursue payment alternatives is driven by creator-side benefits, not MNW cost pressure. | |
| 137 | + | ||
| 138 | + | | Scale | Approach | Why | | |
| 139 | + | |-------|----------|-----| | |
| 140 | + | | <$50K/month GMV | Stripe Connect Standard | Zero Connect fees, compliant, what everyone uses | | |
| 141 | + | | Any scale | Stripe ACH payment method | Offer fans 0.8% ACH option at checkout — reduces creator fees, no MTL needed, just a Stripe feature | | |
| 142 | + | | >200 creators | Document Stripe contingency plan | Mitigate single-vendor dependency risk | | |
| 143 | + | | Creator demand | BaaS for unsupported countries | Serve creators where Stripe doesn't operate | | |
| 144 | + | | >$2M/month GMV | Consider own MTLs in top states | Revenue justifies $75K-125K/year compliance | | |
| 145 | + | | >$10M/month GMV | Full 50-state licensing | Revenue justifies $350K-575K/year compliance | | |
| 146 | + | ||
| 147 | + | ## Sources | |
| 148 | + | ||
| 149 | + | - FinCEN MSB Registration: fincen.gov/resources/money-services-business-msb-registration | |
| 150 | + | - FinCEN BSA Requirements: fincen.gov/bsa-requirements-msbs | |
| 151 | + | - CSBS NMLS: csbs.org/nationwide-multistate-licensing-system-nmls | |
| 152 | + | - CSBS MMLA (23 states): csbs.org/newsroom/23-states-join-multistate-licensing-agreement | |
| 153 | + | - CSBS MTMA (31 states): csbs.org/csbs-money-transmission-modernization-act-mtma | |
| 154 | + | - CSBS Agent of Payee Map: csbs.org/agent-payee-exemption-map | |
| 155 | + | - CA DFPI Payout Guidance: dfpi.ca.gov/2019/07/01/receiving-money-for-transmission | |
| 156 | + | - Stripe Treasury: stripe.com/treasury/platforms | |
| 157 | + | - Cost modeling: brico.ai/post/how-much-do-mtls-cost, remitso.com/blogs/money-transmitter-license |
| @@ -2,9 +2,9 @@ | |||
| 2 | 2 | ||
| 3 | 3 | Prep document for professional review of Makenot.work legal docs. Goal: maximize value from billable hours by doing all homework first. | |
| 4 | 4 | ||
| 5 | - | **Platform summary:** Creator marketplace (music, software, writing, video). Creators pay $10-40/month subscription. Fans pay creators directly via Stripe Connect (Direct Charges). 0% platform fee. Make Creative, LLC (Colorado). One-person operation. Pre-launch (private alpha). | |
| 5 | + | **Platform summary:** Creator marketplace (music, software, writing, video). Creators pay $10-60/month subscription. Fans pay creators directly via Stripe Connect (Direct Charges). 0% platform fee. Make Creative, LLC (Colorado). One-person operation. Pre-launch (private alpha). | |
| 6 | 6 | ||
| 7 | - | **Payment model:** Stripe Connect Express. Creators are merchant of record. Fan payments go directly to creator's connected Stripe account. Platform never touches fan revenue. Platform revenue comes solely from creator subscriptions. | |
| 7 | + | **Payment model:** Stripe Connect Standard. Creators are merchant of record. Fan payments go directly to creator's connected Stripe account. Platform never touches fan revenue. Platform revenue comes solely from creator subscriptions. | |
| 8 | 8 | ||
| 9 | 9 | --- | |
| 10 | 10 | ||
| @@ -14,6 +14,7 @@ All at `site-docs/public/`: | |||
| 14 | 14 | ||
| 15 | 15 | | Document | Path | Words | Priority | | |
| 16 | 16 | |----------|------|-------|----------| | |
| 17 | + | | Operating Agreement | `_private/operating_agreement.md` | ~1,500 | **Critical** | | |
| 17 | 18 | | Terms of Service | `legal/terms-of-service.md` | ~800 | **Critical** | | |
| 18 | 19 | | Privacy Policy | `legal/privacy-policy.md` | ~900 | **Critical** | | |
| 19 | 20 | | Payments & Refunds | `legal/payments.md` | ~1,100 | **High** | | |
| @@ -127,7 +128,7 @@ All at `site-docs/public/`: | |||
| 127 | 128 | ||
| 128 | 129 | ### International Tax | |
| 129 | 130 | ||
| 130 | - | 33. **VAT/GST on platform subscriptions.** We charge creators $10-40/month. For EU creators, should we be collecting VAT on our subscription fee? (We sell a digital service to EU customers — this likely triggers EU VAT obligations under the One-Stop Shop scheme.) | |
| 131 | + | 33. **VAT/GST on platform subscriptions.** We charge creators $10-60/month. For EU creators, should we be collecting VAT on our subscription fee? (We sell a digital service to EU customers — this likely triggers EU VAT obligations under the One-Stop Shop scheme.) | |
| 131 | 132 | ||
| 132 | 133 | 34. **VAT/GST on fan purchases.** Creators are MoR. We state "VAT/GST collection is your responsibility." Is this sufficient, or do we need to provide tooling? Do we have any secondary liability? | |
| 133 | 134 |
| @@ -0,0 +1,48 @@ | |||
| 1 | + | # Mutation Testing Results | |
| 2 | + | ||
| 3 | + | Tool: `cargo-mutants` v27.0.0. Run: 2026-04-30. Target kill rate: >90%. | |
| 4 | + | ||
| 5 | + | ## Summary | |
| 6 | + | ||
| 7 | + | | File | Mutants | Caught | Missed | Unviable | Kill Rate | | |
| 8 | + | |------|---------|--------|--------|----------|-----------| | |
| 9 | + | | `pricing.rs` (all trait impls + constructors) | 71 | 66 | 1 | 4 | 98.5% | | |
| 10 | + | | `promo_codes.rs` (`apply_discount`) | 11 | 11 | 0 | 0 | 100% | | |
| 11 | + | | `helpers.rs` (pure-logic functions) | 50 | 47 | 0 | 3 | 100% | | |
| 12 | + | | `validated_types.rs` (Cents, PriceCents) | 67 | 42 | 0 | 25 | 100% | | |
| 13 | + | | `auth.rs` (guard functions) | 3 | 3 | 0 | 0 | 100% | | |
| 14 | + | | **Combined** | **202** | **169** | **1** | **32** | **99.4%** | | |
| 15 | + | ||
| 16 | + | ## Missed Mutant | |
| 17 | + | ||
| 18 | + | `src/pricing.rs:100:9: replace <impl PricingModel for FreePricing>::kind -> db::PricingKind with Default::default()` | |
| 19 | + | ||
| 20 | + | This is a coincidental equivalence: `PricingKind` derives `Default` with `#[default]` on the `Free` variant, so `Default::default()` produces `PricingKind::Free` -- the same value the function already returns. Not fixable without changing the enum's default, which would break other code. | |
| 21 | + | ||
| 22 | + | ## Unviable Mutants | |
| 23 | + | ||
| 24 | + | 32 mutants failed to compile (type mismatches, missing trait impls on `Default::default()` for complex DB model types). These are expected -- `cargo-mutants` generates replacements that don't always type-check. | |
| 25 | + | ||
| 26 | + | ## Methodology | |
| 27 | + | ||
| 28 | + | - Ran with `--lib` flag (unit tests only) to keep cycle time fast (~15s/mutant) | |
| 29 | + | - DB query functions (INSERT/UPDATE/SELECT) are inherently untestable by unit tests -- they appear as "missed" in full-file runs but are covered by integration tests | |
| 30 | + | - Used `--re` regex filter to target pure-logic functions and avoid false-miss noise from DB functions | |
| 31 | + | - Property-based tests (`proptest`) added concurrently to strengthen invariant coverage | |
| 32 | + | ||
| 33 | + | ## How to Run | |
| 34 | + | ||
| 35 | + | ```bash | |
| 36 | + | # Full targeted run (~50 min) | |
| 37 | + | cargo mutants \ | |
| 38 | + | -f src/pricing.rs -f src/helpers.rs \ | |
| 39 | + | -f src/db/promo_codes.rs -f src/db/validated_types.rs \ | |
| 40 | + | --re "apply_discount|format_price|..." \ | |
| 41 | + | --timeout=120 -- --lib | |
| 42 | + | ||
| 43 | + | # Single file | |
| 44 | + | cargo mutants -f src/auth.rs --re "check_not" --timeout=120 -- --lib | |
| 45 | + | ||
| 46 | + | # List mutants without running | |
| 47 | + | cargo mutants -f src/pricing.rs --list | |
| 48 | + | ``` |
| @@ -98,7 +98,7 @@ Before adding a creator to `creators/`: | |||
| 98 | 98 | - [ ] What are they paying in fees? (Patreon 10%, Gumroad 10%, etc.) | |
| 99 | 99 | - [ ] Have they publicly expressed platform frustration? | |
| 100 | 100 | - [ ] What's their audience size and engagement? | |
| 101 | - | - [ ] Which makenot.work tier fits them? (Basic $10, Small Files $20, Big Files $30, Everything $40) | |
| 101 | + | - [ ] Which makenot.work tier fits them? (Basic $10, Small Files $20, Big Files $30, Everything $60) | |
| 102 | 102 | - [ ] Is there a natural community entry point? (Discord, Patreon, subreddit) | |
| 103 | 103 | ||
| 104 | 104 |
| @@ -74,7 +74,7 @@ Fresh wounds. The pitch writes itself. | |||
| 74 | 74 | ||
| 75 | 75 | ## Tier 2 — Profitable switchers | |
| 76 | 76 | ||
| 77 | - | Big enough that $10-40/mo is trivially recovered from fee savings. Small or loyal enough that their audience would follow them. Some ideological alignment (hates fees, values independence) but not necessarily vocal about it. | |
| 77 | + | Big enough that $10-60/mo is trivially recovered from fee savings. Small or loyal enough that their audience would follow them. Some ideological alignment (hates fees, values independence) but not necessarily vocal about it. | |
| 78 | 78 | ||
| 79 | 79 | ### High fee burden — the math is obvious | |
| 80 | 80 |
| @@ -11,7 +11,7 @@ Instead, creators pay a flat monthly subscription to use the platform, based on | |||
| 11 | 11 | - **Basic** (text, all base features): **$10/month** | |
| 12 | 12 | - **Small Files** (audio, software, plugins, downloads): **$20/month** | |
| 13 | 13 | - **Big Files** (video, courses, large downloads): **$30/month** | |
| 14 | - | - **Everything** (all features, current and future): **$40/month** | |
| 14 | + | - **Everything** (all features, current and future): **$60/month** | |
| 15 | 15 | ||
| 16 | 16 | The platform's source code is publicly available, meaning anyone can inspect or audit it. Creators can export all their data and take their audience with them if they ever leave. There's no lock-in. | |
| 17 | 17 | ||
| @@ -27,7 +27,7 @@ At current scale — a small number of creators — the actual cost lands around | |||
| 27 | 27 | ||
| 28 | 28 | **What changes as the platform grows:** each creator who joins adds a small variable cost depending on their tier. A text-only creator costs less than a dollar a month to serve. A creator streaming live video might cost up to $10. On average across a mix of tiers, the variable cost per creator is roughly **$3/month**. | |
| 29 | 29 | ||
| 30 | - | The important thing is that the margins are healthy at every tier. Even the cheapest plan ($10/month for Basic) leaves $8–9 of margin per creator after costs. The most expensive plan ($40/month for streaming) leaves $30–35. | |
| 30 | + | The important thing is that the margins are healthy at every tier. Even the cheapest plan ($10/month for Basic) leaves $8–9 of margin per creator after costs. The most expensive plan ($60/month for streaming) leaves $30–35. | |
| 31 | 31 | ||
| 32 | 32 | **When it sustains itself:** at roughly 32 creators with a typical mix of tiers, the platform's revenue covers all costs. At 100 creators, it generates roughly $1,500/month surplus. At 500 creators, roughly $9,700/month beyond costs — enough to comfortably sustain a one-person operation and build strong reserves. | |
| 33 | 33 | ||
| @@ -138,9 +138,9 @@ This is partly marketing and partly relationship-building. Handing someone a wel | |||
| 138 | 138 | - **Basic bookkeeping.** Tracking the platform's own revenue (creator subscriptions), expenses, and Stripe's fees. Open-source bookkeeping tools keep this cost near zero for software; the main expense is time. | |
| 139 | 139 | - **An accountant for annual filing.** Having a CPA or accountant who understands marketplace/platform businesses review the books and handle the LLC's tax return once a year. Estimated cost: **$500–1,500/year**. | |
| 140 | 140 | ||
| 141 | - | **Stripe Connect fees (not currently in the operating cost estimates):** | |
| 141 | + | **Stripe Connect fees:** | |
| 142 | 142 | ||
| 143 | - | The Stripe Connect plan that makes sense for this platform (Express accounts) costs **$2 per active creator per month** plus **0.25% + $0.25 per payout** to creators. At 100 creators, that's roughly **$200–300/month** in additional Stripe fees beyond the standard processing costs already budgeted. To keep things fair, creators who use the platform's Stripe integration pay an additional $1/month, or they can connect their own Stripe account and avoid the surcharge entirely. | |
| 143 | + | MNW uses Stripe Connect Standard accounts, which have no per-account fees, no payout-volume fees, and no per-payout fees charged to the platform. Creators pay Stripe's standard processing fees (~2.9% + $0.30) directly from their own connected accounts. MNW's only Stripe cost is processing on platform subscriptions (creator tier billing). | |
| 144 | 144 | ||
| 145 | 145 | **What about money transmitter licenses?** Because Stripe is a licensed money transmitter and creator payments flow through Stripe's regulated accounts (never through the platform's own bank account), the platform likely doesn't need its own money transmitter licenses. However, state laws vary, and confirming this with a brief legal consultation is worth the peace of mind. This is already covered in the legal budget. | |
| 146 | 146 |
| @@ -82,10 +82,9 @@ These scale with each additional creator. | |||
| 82 | 82 | | CDN/bandwidth | $0.20–0.50 | Low traffic volume | | |
| 83 | 83 | | Payment processing | $0.15–0.30 | Stripe fee on $10 subscription | | |
| 84 | 84 | | Infrastructure share | $0.40–0.80 | Database rows, API calls, etc. | | |
| 85 | - | | Stripe Connect | ~$2.28 | $2/account + 0.25% payout + $0.25/payout | | |
| 86 | - | | **Total** | **$3.13–4.18** | | | |
| 85 | + | | **Total** | **$0.85–1.90** | | | |
| 87 | 86 | ||
| 88 | - | **Margin on $10 subscription: $5.82–6.87** (before Stripe Connect: $8.10–9.15) | |
| 87 | + | **Margin on $10 subscription: $8.10–9.15** | |
| 89 | 88 | ||
| 90 | 89 | ### Small Files Tier | |
| 91 | 90 | ||
| @@ -96,10 +95,9 @@ These scale with each additional creator. | |||
| 96 | 95 | | Transcoding | $0.10–0.30 | MP3/AAC generation | | |
| 97 | 96 | | Payment processing | $0.30–0.50 | Stripe fee on $20 subscription | | |
| 98 | 97 | | Infrastructure share | $0.50–0.80 | | | |
| 99 | - | | Stripe Connect | ~$2.30 | $2/account + 0.25% payout + $0.25/payout | | |
| 100 | - | | **Total** | **$4.20–6.10** | | | |
| 98 | + | | **Total** | **$1.90–3.80** | | | |
| 101 | 99 | ||
| 102 | - | **Margin on $20 subscription: $13.90–15.80** (before Stripe Connect: $16.20–18.10) | |
| 100 | + | **Margin on $20 subscription: $16.20–18.10** | |
| 103 | 101 | ||
| 104 | 102 | ### Big Files Tier | |
| 105 | 103 | ||
| @@ -110,10 +108,9 @@ These scale with each additional creator. | |||
| 110 | 108 | | Transcoding | $0.50–1.50 | Multiple resolutions/formats | | |
| 111 | 109 | | Payment processing | $0.60–0.80 | Stripe fee on $30 subscription | | |
| 112 | 110 | | Infrastructure share | $0.50–0.80 | | | |
| 113 | - | | Stripe Connect | ~$2.33 | $2/account + 0.25% payout + $0.25/payout | | |
| 114 | - | | **Total** | **$5.93–10.93** | | | |
| 111 | + | | **Total** | **$3.60–8.60** | | | |
| 115 | 112 | ||
| 116 | - | **Margin on $30 subscription: $19.07–24.07** (before Stripe Connect: $21.40–26.40) | |
| 113 | + | **Margin on $30 subscription: $21.40–26.40** | |
| 117 | 114 | ||
| 118 | 115 | Video has the widest range because usage varies enormously. A creator uploading 4K weekly costs much more than one uploading 720p monthly. | |
| 119 | 116 | ||
| @@ -125,16 +122,15 @@ Video has the widest range because usage varies enormously. A creator uploading | |||
| 125 | 122 | | VOD storage | $0.80–1.50 | Archived streams | | |
| 126 | 123 | | CDN/bandwidth | $1.00–2.50 | Live + VOD delivery | | |
| 127 | 124 | | Transcoding | $0.30–0.80 | Real-time + VOD processing | | |
| 128 | - | | Payment processing | $0.90–1.10 | Stripe fee on $40 subscription | | |
| 125 | + | | Payment processing | $1.44–1.74 | Stripe fee on $60 subscription | | |
| 129 | 126 | | Infrastructure share | $0.50–0.80 | | | |
| 130 | - | | Stripe Connect | ~$2.35 | $2/account + 0.25% payout + $0.25/payout | | |
| 131 | - | | **Total** | **$7.35–12.05** | | | |
| 127 | + | | **Total** | **$5.00–9.70** | | | |
| 132 | 128 | ||
| 133 | - | **Margin on $40 subscription: $27.95–32.65** (before Stripe Connect: $30.30–35.00) | |
| 129 | + | **Margin on $60 subscription: $50.30–55.00** | |
| 134 | 130 | ||
| 135 | 131 | Streaming costs depend heavily on stream frequency and viewer count. A creator streaming daily to 1,000 viewers costs significantly more than one streaming weekly to 50. | |
| 136 | 132 | ||
| 137 | - | **Stripe Connect** (Express accounts) adds $2 per active connected account per month, plus 0.25% of payout volume, plus $0.25 per payout. Per-tier estimates assume one monthly payout with subscription price as a floor proxy for payout volume — actual costs scale with creator earnings. | |
| 133 | + | **Stripe Connect** (Standard accounts) has no per-account fees, no payout-volume fees, and no per-payout fees charged to the platform. Creators pay Stripe's standard processing fees (~2.9% + $0.30 per transaction) directly from their own connected accounts. MNW's only Stripe cost is processing on platform subscriptions (creator tier billing). | |
| 138 | 134 | ||
| 139 | 135 | ## Cost Variability | |
| 140 | 136 | ||
| @@ -185,10 +181,9 @@ This isn't virtue signaling—it's structural. These costs would require revenue | |||
| 185 | 181 | |----------|---------| | |
| 186 | 182 | | Fixed costs | ~$600 | | |
| 187 | 183 | | Variable costs (~$3 avg) | ~$300 | | |
| 188 | - | | Stripe Connect (~$2.31 avg) | ~$231 | | |
| 189 | - | | **Total** | **~$1,131** | | |
| 184 | + | | **Total** | **~$900** | | |
| 190 | 185 | | Revenue (~$24 avg) | ~$2,400 | | |
| 191 | - | | **Surplus** | **~$1,269** | | |
| 186 | + | | **Surplus** | **~$1,500** | | |
| 192 | 187 | ||
| 193 | 188 | Sustainable with healthy margin. | |
| 194 | 189 | ||
| @@ -198,10 +193,9 @@ Sustainable with healthy margin. | |||
| 198 | 193 | |----------|---------| | |
| 199 | 194 | | Fixed costs | ~$800 (some scaling) | | |
| 200 | 195 | | Variable costs | ~$1,500 | | |
| 201 | - | | Stripe Connect | ~$1,155 | | |
| 202 | - | | **Total** | **~$3,455** | | |
| 196 | + | | **Total** | **~$2,300** | | |
| 203 | 197 | | Revenue | ~$12,000 | | |
| 204 | - | | **Surplus** | **~$8,545** | | |
| 198 | + | | **Surplus** | **~$9,700** | | |
| 205 | 199 | ||
| 206 | 200 | Comfortable one-person operation with strong reserves. | |
| 207 | 201 | ||
| @@ -211,14 +205,13 @@ Comfortable one-person operation with strong reserves. | |||
| 211 | 205 | |----------|---------| | |
| 212 | 206 | | Fixed costs | ~$1,500 (more scaling) | | |
| 213 | 207 | | Variable costs | ~$6,000 | | |
| 214 | - | | Stripe Connect | ~$4,620 | | |
| 215 | - | | **Total** | **~$12,120** | | |
| 208 | + | | **Total** | **~$7,500** | | |
| 216 | 209 | | Revenue | ~$48,000 | | |
| 217 | - | | **Surplus** | **~$35,880** | | |
| 210 | + | | **Surplus** | **~$40,500** | | |
| 218 | 211 | ||
| 219 | 212 | Could support a small team with excellent margins. | |
| 220 | 213 | ||
| 221 | - | These projections assume current cost structures. Actual costs could be higher (usage spikes, provider price increases) or lower (better efficiency, volume discounts). Stripe Connect estimates use subscription price as a floor proxy for payout volume. | |
| 214 | + | These projections assume current cost structures. Actual costs could be higher (usage spikes, provider price increases) or lower (better efficiency, volume discounts). | |
| 222 | 215 | ||
| 223 | 216 | ## Unknowns and Risks | |
| 224 | 217 |