Clearline · Internal

Open Considerations

Not the backlog (things to build) and not the style guide (conventions to follow).

This is for decisions made deliberately, on purpose, with a known tradeoff — logged here so the reasoning doesn't get lost, and so there's a clear trigger for when to revisit, instead of either forgetting about it or re-litigating it from scratch later.

Vercel preview deployments are publicly reachable, no Vercel login required

Decided

Decision · 2026-08-19

Vercel Authentication ("Require Log In") is off, project-wide. Any preview deployment — demo.theclearline.io and any other branch's preview URL — is reachable by anyone, no Vercel account needed.

Why

This was the free way to make demo.theclearline.io publicly usable as a real staging site. The paid alternative — Vercel Pro + Advanced Deployment Protection, $150/month — adds a per-domain exceptions list, letting demo.theclearline.io stay public while other preview branches stay gated behind a Vercel login. Not worth paying for yet: nothing behind any preview deployment ever touches real customer data (Preview is permanently wired to clearline-dev, never clearline-prod), so the worst case today is someone finding a branch with fake test data on it.

Revisit when

Working on a feature branch that's competitively sensitive or embargoed — something not meant to be discoverable before it's announced. Vercel's preview URLs are built from the branch name (e.g. clearline-app-git-<branch>-...), not a random hash, so a descriptively-named branch is somewhat guessable if its name leaks anywhere — a PR title, a Slack message. That's the trigger to pay for the exception rather than try to rename branches to obscure them.

District agreement needs a disclosure covering AI-assisted document review

Pending

Status

Not yet added anywhere real — flagged so it isn't forgotten before the first paying customer signs.

Why

The AI requirements-check feature captures, per document: the AI's raw extracted values, its verdict, and — when an admin overrides a flagged or uncertain result — the admin's own note on why. That data is used to refine and few-shot-tune Clearline's own compliance-checking logic over time, across districts. It is not used to train Anthropic's underlying model (standard commercial API terms — Anthropic doesn't train on customer data by default), and it's specifically about improving Clearline's judgment on a district's own submitted documents, not the model itself. The district agreement should say something to that effect: what's collected, what it's used for, and what it's explicitly not used for.

Revisit when

Before onboarding the first real paying district. This needs actual legal drafting — a lawyer, or at minimum careful review — not just this paragraph copy-pasted into an agreement.