Notes
# Priority 5: Startup Coach / rajatsir.com / Proof Forge: status (2 Nov 2026, about 22:55 IST)
Worker: STARTUP-COACH. Read-mostly. Nothing deployed, no DNS touched, no account made, no message sent, no secret read or written.
## 1. What is live (checked by curl and DNS lookups, 2 Nov 2026 evening)
| Address | Result | What it is |
|---|---|---|
| https://rajat-agarwal-startup-coach.pages.dev/ | 200, 48.8 KB | The merged one-page site (Startup Coach + Student Success Workshop), built from `C:\ct\rajatsir-site` master `7e5e334` (live JS file `index-8yo1NU3O.js` is the same as the local `dist`). Title "Rajat Sir \| Startup Coach and Student Success Workshop", `lang=en-IN`, viewport meta present, one h1, canonical + OG + JSON-LD present, indexable (no noindex), security headers (CSP, frame deny, nosniff) present. |
| same host: /pricing /terms /privacy /legal-position /offline | 200 each | Own title, description, canonical, one h1. /offline is noindex (correct). |
| same host: robots.txt, sitemap.xml, manifest.webmanifest, sw.js, icons (192, 512, maskable, apple-touch, 32) | 200 each | Manifest JSON valid, all icons resolve. Sitemap and robots name `www.rajatsir.com` (the final address). |
| same host: old URLs (`/about-rajatsir.php` etc.) | 301 to the right section | Redirect map works. |
| same host: /favicon.ico, /refund, /colleges | 404 | Harmless: favicon is declared as SVG/PNG in the page head; the other two paths never existed. |
| https://proof-forge.pages.dev/ | 200, noindex | Proof Forge app (gated by passphrase/access link). `node tools/verify-live.cjs https://proof-forge.pages.dev` says: **OK, live site is exactly release 1.0.0+769aba6, 32 files verified.** The hourly GitHub tamper check (`FChecklist/proof-forge`, workflow verify-live) is green, latest run 2 Nov 06:20 UTC. |
| https://itservices-rajat-agarwal.pages.dev/ (about, contact, privacy, refund, shipping, payframe, paytest) | 200 | The registered Razorpay website. The footer link `/policies/startup-coach/` answers 301 to `/refund/` (fine). |
| https://www.rajatsir.com/ and https://rajatsir.com/ | 200 / 301 | **Still the OLD PHP site** ("Student Success Workshop by Rajat Sir", Apache at BigRock's host `162.241.122.224`, still shows a WhatsApp number). The apex answers 301 to `http://www.rajatsir.com/` (to http, not https). Not the new site until DNS is switched. |
| https://app.rajatsir.com/ , https://startupcoach.rajatsir.com/ | do not resolve | No DNS records exist for either name. Nothing points there yet. |
Not verified (cannot be, without the owner): a real code-by-e-mail sign-in on the live site (Cloudflare's real bot check refuses automation), a real Razorpay payment, Resend delivery of the confirmation e-mails, a real refund.
## 2. Open items, classified
Legend: NOW = AI can do it without anyone; AFTER = AI can do it once the owner supplies a decision or does a step; OWNER = only the owner (logins, money, law).
| # | Item (source) | Class | Note |
|---|---|---|---|
| 1 | rajatsir.com DNS switch from BigRock to the Pages project (runbook step 5) | OWNER | BigRock login. Exact steps in section 5. |
| 2 | Add `https://www.rajatsir.com` and `https://rajatsir.com` to the IT Services pay-frame allow-list, rebuild and deploy that site, in the same sitting as #1 | AFTER (cutover day) | Exact lines in section 5, step 3. Different repo (`C:\ct\itservices-site`) and needs a deploy, so I did not touch it. Until done, booking works only on the pages.dev address. |
| 3 | First live code-by-e-mail sign-in, in a normal browser (runbook step 6) | OWNER | 2 minutes. |
| 4 | Real payment test: footer "Test a payment (Rs 1)", then one Rs 19,999 booking or a refunded test (step 7); watch the first real refund | OWNER | Money. Check ledgers A/B/C and the confirmation e-mail with the Proof Forge link. |
| 5 | `app.rajatsir.com` for Proof Forge: DNS record, custom domain on the `proof-forge` Pages project, `APP_URL=https://app.rajatsir.com` on the coach project, GitHub repo variable `SITE_URL` for the tamper check | OWNER for DNS and the Cloudflare screens, then AFTER for the variable updates | Optional: Proof Forge works on pages.dev today and the access link in the e-mail already points there. |
| 6 | After DNS: submit `https://www.rajatsir.com/sitemap.xml` in Google Search Console; install the PWA on the phone | OWNER | Login. |
| 7 | Decisions in `docs/DECISIONS.md`: M-08 confirm the old "What Investors Want" Rs 15,000 offer is retired; M-09 bring back the six topics as a section?; M-10 show the Gen-B team and Dr Pallavi Agarwal?; M-11 analytics yes/no | OWNER (answers), then AFTER | One-line answers are enough. |
| 8 | Owner questions on wording: "Raise Rs 1 Crore in Investment: Without Funding" (3 places; contradicts itself; the page says "Without Investors" elsewhere); "Rs 1" vs the rupee sign in the footer test link | OWNER (answer), then NOW | Left as the original on purpose (D-13). |
| 9 | Unverified marketing numbers on the live page (Rs 1 lakh crore raised by Indian startups in 2025 about $11 billion; "~8x" growth 2000 to 2025; "under 6 months"; "10 seats a month"; "over Rs 1 lakh crore of funding available") | OWNER (give sources), then AFTER (add a source line) | They come from the owner's deck; nobody has sourced them. |
| 10 | Proof Forge lawyer/CA items: review `privacy.html`, `terms.html`, the refund promise and timelines (audit within 15 working days, pay within 7); GST/tax on a refund; refund timing (suggested: after audit plus a 30-day no-reversal check); who audits; floors (Rs 5 lakh funding, Rs 1 lakh monthly sales, margin 5 to 50%); processor agreements | OWNER | `C:\ct\proof-forge\PROMISE.md`, `AUDIT.md`. |
| 11 | Back up offline the two Proof Forge private keys in `C:\Users\Dell\Documents` (`proof-forge-AUDIT-PRIVATE-KEY.jwk`, `proof-forge-RELEASE-PRIVATE-KEY.jwk`) | OWNER | Lose the audit key and refund claims cannot be opened. Never in git or chat. |
| 12 | Proof Forge: 12-month inactivity clean-up job (the privacy notice promises it; not built) and reminder e-mails (need a scheduler) | AFTER | Needs a decision on the mechanism (a free cron Worker, or the existing GitHub Actions schedule calling a protected endpoint) and the owner's OK, because it deletes customer data. Not small or safe enough to do unasked. |
| 13 | Proof Forge working name "Proof Forge" (owner wanted something better) | OWNER | Renaming touches the signed release, so do it in one batch with any other change. |
| 14 | Sender for the confirmation e-mails is `coaching@veridian-aios.com` through Resend; decide whether to move to a rajatsir.com sender after cutover | OWNER (choice), then AFTER (SPF/DKIM records need the rajatsir.com DNS) | Optional. Check in Resend that the current sender is still verified. |
| 15 | No GitHub remote exists for `C:\ct\rajatsir-site`: the live site's source is on this laptop only | AFTER (boss go: create a private repo) | I made two verified bundles instead (section 4). Commands in section 5, step 0. |
| 16 | `FChecklist/startup-coach-site` (public) is the OLD Coach site, now superseded by the merged site (it is only the rollback target) | OWNER | Decide to archive or keep. Low priority. |
| 17 | After cutover: make the `*.pages.dev` address `noindex` (the canonical already points to www.rajatsir.com) | AFTER (cutover) | A `_headers` rule with a full-URL pattern; needs one deploy to prove. |
## 3. Things found while checking (no action taken)
- The new site's canonical, sitemap, robots and share image (`og.png`) all name `www.rajatsir.com`, which is still the old site. Until cutover, a link shared from pages.dev has no preview image. Expected, fixed by the DNS switch.
- rajatsir.com has **two SPF records** (`v=spf1 +a +mx +ip4:192.185.129.43 +ip4:162.241.122.224 +include:webhostbox.net ~all` and `v=spf1 a mx include:webhostbox.net ~all`). Two SPF records is invalid and makes SPF fail for mail from that domain. Keep only the first when the zone is moved. There is no DMARC record. The new site does not send from rajatsir.com, so nothing breaks today.
- Building the site on this laptop without `VITE_TURNSTILE_SITEKEY` bakes in Cloudflare's always-pass test key. A build meant for deploy must be made with the real site key (runbook "Done" step 3), or the live "E-mail me the code" button fails.
- Seven pages of the live old site (home, about, services, rajatsir-new, blog, testimonials and one more) were scanned for bank, UPI and PayPal text: none found (not exhaustive).
## 4. What I changed
Repo `C:\ct\rajatsir-site` (git, local only), new branch **`chore/coach-site-polish-2026-11-02`**, three small commits on top of master `7e5e334`, easy to revert one by one:
| Commit | What |
|---|---|
| `fb87469` | Each page linked the web app manifest twice (the plugin adds one, `index.html` had one). Removed the extra one. New test "every page links the web app manifest exactly once" in `tests/dist.test.ts`. |
| `f0623e1` | Plain grammar fixes, one word each (recorded as D-13 in `docs/DECISIONS.md`): "Frameworks that work", "How to Successfully Generate Funds", "Getting a Job", "successful startups", "your students want", second "Program 1" to "Program 2". |
| `1483936` | `docs/CHANGELOG.md` (whole history, newest first). |
Tests (cheap, in a scratch copy of the repo so the real `dist` of the live build was not overwritten, under the heavy-job lock, free RAM above 1.2 GB):
- Full build (client, server bundle, pre-render of 8 pages) passes.
- `bun test tests/dist.test.ts tests/redirects.test.ts tests/validate.test.ts`: **42 pass, 0 fail** on the new build.
- Seen to fail: the same new test run against the existing old `dist` gives **fail, Expected 1, Received 2**.
- Built pages checked by hand: 1 manifest link on all 8 pages (was 2); all six new phrases present, all five old phrases gone.
- Not run: Playwright browser tests, Lighthouse, mutation check, the Function tests (heavy; none of them touches what changed).
**Not pushed:** there is no remote for this repo (and no `FChecklist/rajatsir-site` on GitHub). Instead, a full-history bundle was written and verified (`git bundle verify` ok, 3.2 MB):
- `C:\ct\test-sites\handover\2026-11-02\backup\rajatsir-site-2026-11-02.bundle`
- `C:\Users\Dell\Documents\backups\rajatsir-site-2026-11-02.bundle`
Restore with `git clone <bundle> rajatsir-site` then `git checkout chore/coach-site-polish-2026-11-02`. Both copies are on this laptop; only a GitHub push makes it off-laptop.
**Not deployed.** Nothing in Proof Forge or the IT Services repo was changed.
## 5. Exact owner-only steps (and the boss steps that go with them)
**Step 0 (boss or owner, 1 minute, optional but advised): get the source off this laptop.** GitHub answered 200 from here today, directly and through the WARP proxy.
```
gh repo create FChecklist/rajatsir-site --private --source C:\ct\rajatsir-site --remote origin
git -C C:\ct\rajatsir-site push -u origin master chore/coach-site-polish-2026-11-02
```
(If github.com times out again: `git -C C:\ct\rajatsir-site -c http.proxy=socks5h://127.0.0.1:40000 push -u origin master chore/coach-site-polish-2026-11-02`. Private, per the 13 Oct repo-visibility rule.)
**Step 1 (boss, when the owner says go): ship the polish branch to pages.dev.** Merge the branch (`git merge --ff-only chore/coach-site-polish-2026-11-02` on master), then follow `docs/DEPLOY-RUNBOOK.md` "Done" step 3 exactly: `VITE_TURNSTILE_SITEKEY=<the rajatsir-one-page widget's site key> bun run build`, all tests, `wrangler pages deploy dist --project-name rajat-agarwal-startup-coach --branch main` (wrangler 3 at `C:\ct\tools\wrangler3`). Rollback target stays deployment `5efe8d96-f85a-4cd1-bb92-5a5178b26f06`; note the current live deployment is `ec5f990a`.
**Step 2 (owner, logins: BigRock and Cloudflare): the DNS switch. Pick ONE.**
*Option A, recommended (Cloudflare runs the DNS, free):*
1. Cloudflare dashboard, Add a site, `rajatsir.com`, Free plan. Let it scan, then compare with the list below and add anything missing. **Do not skip the mail records.** Mail records stay "DNS only" (grey cloud).
2. Records that exist today at BigRock (read from public DNS on 2 Nov 2026; copy DKIM exactly from BigRock's zone editor, do not retype):
| Name | Type | Value |
|---|---|---|
| rajatsir.com | A | 162.241.122.224 (old site; will be replaced by the Pages record, see 4) |
| www | CNAME | rajatsir.com (will be replaced, see 4) |
| rajatsir.com | MX | priority 0, `mail.rajatsir.com` |
| mail | A | 162.241.122.224 |
| ftp, cpanel, webmail | same host | 162.241.122.224 (CNAME or A) |
| rajatsir.com | TXT | `v=spf1 +a +mx +ip4:192.185.129.43 +ip4:162.241.122.224 +include:webhostbox.net ~all` (keep this one; drop the shorter duplicate) |
| default._domainkey | TXT | DKIM key `v=DKIM1; k=rsa; p=MIIBIjANBgkq...` (long; copy from BigRock) |
3. At BigRock, change the domain's nameservers from `ns1.md-ht-3.bigrockservers.com` and `ns2.md-ht-3.bigrockservers.com` to the two names Cloudflare shows after step 1 (they are unique to the zone, so they cannot be written here in advance).
4. Cloudflare, Workers & Pages, project `rajat-agarwal-startup-coach`, Custom domains, add `rajatsir.com` and `www.rajatsir.com` (Cloudflare creates the records and removes the old A/CNAME).
5. Optional: project `proof-forge`, Custom domains, add `app.rajatsir.com`.
6. Keep the BigRock hosting untouched for a week as the rollback.
*Option B (keep BigRock DNS):* first add `www.rajatsir.com` as a custom domain on the Pages project, then at BigRock replace the `www` CNAME target `rajatsir.com` with `rajat-agarwal-startup-coach.pages.dev`, and set BigRock "domain forwarding" for `rajatsir.com` to `https://www.rajatsir.com` (BigRock cannot CNAME the bare domain). For `app`: CNAME `app` to `proof-forge.pages.dev` after adding the custom domain in the `proof-forge` project.
**Step 3 (boss, same sitting as step 2; needs a deploy, so only on the owner's word): IT Services pay-frame allow-list.** In `C:\ct\itservices-site\build.py`:
- line 219, the JavaScript list `var ALLOWED = [...]`: add `"https://www.rajatsir.com", "https://rajatsir.com"` after the existing `"https://rajat-agarwal-startup-coach.pages.dev"`;
- the `_headers` template (about lines 262 to 276), the `frame-ancestors` line that lists the games and the coach site: add `https://www.rajatsir.com https://rajatsir.com`.
Rebuild and deploy that site. Do not touch `functions/_lib.js` `SITE_CODES` or `functions/_facts.js`: the coach functions send a fixed site name (`rajat-agarwal-startup-coach.pages.dev`, code COA), not the visitor's address, and the checkout origin check compares with the request's own origin, so rajatsir.com works without more edits. Optional: if `app.rajatsir.com` is used, set `APP_URL=https://app.rajatsir.com` on the coach Pages project.
**Step 4 (owner, 2 minutes each, normal browser, after step 2 and 3):**
1. Open https://www.rajatsir.com, "Book your seat", type your e-mail, "E-mail me the code". Check the e-mail arrives (code and link) and either signs you in and shows the pay form. If no e-mail: check Resend's dashboard and that the sender `coaching@veridian-aios.com` is still verified.
2. Footer "Test a payment (Rs 1)", then one real booking (or a refunded test). Check the confirmation e-mail with the Proof Forge link and the three ledgers. Watch the first real refund.
3. Google Search Console: add `www.rajatsir.com`, submit `https://www.rajatsir.com/sitemap.xml`. Check `https://www.rajatsir.com/about-rajatsir.php` lands on `/#about`.
**Step 5 (owner, any time): answers I need** for section 2 rows 7, 8, 9, 13, 14, and the lawyer/CA list in row 10. One line each is enough; I can then do the wording and source lines in one batch.