feat(billing): fetch authoritative Stripe subscription state

[seonghobae]

Buyer/reliability outcome

Refs #488. This Draft stacked slice establishes a bounded authoritative Stripe Subscription read boundary before webhook evidence can influence durable lifecycle or entitlement state. A signed webhook remains authenticated evidence and a reconciliation trigger; it is not proof that its embedded subscription snapshot is current.

Exact current stack

• protected develop: df0fa17bd5035af6455c889022c540b4f439e3d6;
• exact parent/base: feat(billing): persist verified Stripe webhook events #521 feat/stripe-webhook-event-ledger-488@3f63e97cc730cd3874f3d78baf6ecadf50c38623;
• exact contributor head: e4f75a48c248b4c6cf8cc9f97d75803a58415b75;
• fresh parent→child comparison: ahead 18, behind 0, exact parent as merge base, 9 changed paths, +911/-6;
• state: Draft and mechanically mergeable.

The current head is a non-destructive two-parent reconciliation of predecessor child ad92d99138fe76d4dbef0dc673932bb9891957e7 with the exact current event-ledger parent. The effective diff preserves the parent’s composed app/toast route, OpenCode/changelog/orchestrator registrations, Checkout attempt/reconciliation/provider regressions, webhook verifier/event ledger, accessibility coverage, and exact owned-production coverage. CHANGELOG.md adds exactly five subscription-reader lines with zero parent deletions.

Any parent, contributor-head, or protected-base movement invalidates ancestry- and head-specific evidence until freshly reconciled.

Implemented bounded trust boundary

server/stripe_subscription_provider.mjs:

• validates positive safe-integer tenant authority, bounded sub_... identity, bounded server-owned secret, and transport/timeout contracts before network access;
• performs one hard-coded HTTPS Stripe Subscription GET with redirect rejection and a 15-second budget;
• enforces a 256 KiB declared-and-streamed response ceiling, JSON media type, fatal UTF-8 decoding, and bounded normalized fields before parsing provider data into evidence;
• rejects malformed or contradictory snapshots, unsafe timestamps, expanded objects where identifiers are required, unknown statuses, unbounded item collections, missing tenant metadata, and cross-tenant metadata;
• distinguishes provider 404 from transient/unavailable failure without exposing provider text; and
• returns a frozen normalized snapshot of provider facts only, never a local entitlement decision.

server/billing.mjs propagates orgId on both Checkout Session metadata and subscription_data.metadata so later authoritative reads can verify exact tenant binding. SDK-style and direct form-encoded regressions enforce the same contract.

Causal failure repair

Predecessor Server Tests run 32086012041, unit-and-api job 95558580836, failed because the stale child monolith returned 404 for protected /toast-state.css. The current repair starts from the exact parent tree and overlays only the nine subscription-reader paths, so it inherits the parent’s composed app entry and restores the shipped static accessibility asset without weakening the smoke test.

The exact semantic package/coverage merge retains all current parent suites and adds:

• server/stripe_subscription_provider.mjs to owned production instrumentation;
• stripe-subscription-provider.test.mjs; and
• stripe-subscription-metadata-propagation.test.mjs

to both canonical unit and c8 coverage execution.

Current exact-head evidence

Fresh repository-native workflows for exact contributor head e4f75a48c248b4c6cf8cc9f97d75803a58415b75 are queued and therefore non-passing:

• Server Tests 32273546163;
• Dependency Review 32273545097; and
• OSV Scanner 32273545835.

No submitted review or review thread exists on the current head, and no qualifying independent current-head approval exists. Queued, pending, skipped-required, cancelled, absent, neutral, failed, stale, predecessor, synthetic, status-only, author-only, or model-only evidence is non-passing.

Scope and merge boundary

This slice does not persist authoritative subscription observations, implement monotonic/out-of-order reconciliation, mutate plan state, or grant/revoke entitlement. #526 owns the append-only normalized observation child and must be reconciled to this exact parent. This PR must not integrate independently of #521/#520/#516/#511/#507/#505.

After the prerequisite stack reaches protected develop, reconcile this bounded semantic diff onto the resulting live head and rerun every then-applicable exact-head CI, browser E2E, statement/branch/function/line coverage, docstring, SAST, security, dependency, supply-chain, package/provenance, migration/recovery, resolved-thread, and qualifying independent-approval gate required by live policy.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}