Signed webhook (HMAC verify when secret set), CSRF-exempt route. Paid checkout creates customer+order+run (stripe_event_id unique => duplicate webhooks start one run) and dispatches. 5 tests. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
- Docker dev stack: app (php-fpm+nginx+vite via supervisor), reverb, queue, scheduler, mariadb 11.4, redis 7 — env-driven ports/UID (HOST_UID=1000). - Laravel 13.8 + Livewire 3.8 (pinned v3 per R2), Tailwind v4, Reverb, Echo, phpseclib, wire-elements/modal. - .env wired to service names; DE default locale (R16); browser Reverb host env-driven; self-hosted-fonts-ready vite.config (R14). - Entrypoint bootstraps vendor/node_modules on fresh checkout; bin/clupilot helper (UID/port env-driven) + shell aliases. - Reviewed with Codex (R15): 7 findings fixed, 1 verified false-positive. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
nexxo