feat(billing): derive monotonic Stripe entitlement policy

[seonghobae]

Buyer/data-integrity objective

Refs #488. This Draft stacked slice derives deterministic entitlement candidates from already-authoritative Stripe Subscription and Invoice evidence. Provider lifecycle status alone is never sufficient paid-access authority: an active Subscription can grant or extend paid access only when its exact latest_invoice is independently observed as paid for the same Subscription and its current period remains future.

Exact current stack

• protected develop: df0fa17bd5035af6455c889022c540b4f439e3d6;
• exact parent/base: feat(billing): project current authoritative subscription observations #527 feat/stripe-subscription-current-projection-488@a8a66035ceaa1abbee2f20873adbc0353c8217d7;
• exact contributor head: 9da3f3663a80cf20aa9562132eb3d1b7f5fcb1d0;
• fresh parent→child comparison: ahead 12, behind 0, exact parent as merge base, exactly eight changed paths, +979/-3;
• state: Draft and mechanically mergeable.

The current head is a non-destructive two-parent reconciliation of predecessor child 71d184adc236b1199b8629e901b543eebc44182f with exact current #527. The effective delta is limited to CHANGELOG.md, policy doctoring, package.json, server/stripe_entitlement_policy.mjs, the coverage contract, and three focused policy suites including the duplicate-claim regression. CHANGELOG.md adds exactly six entitlement-policy lines with zero parent deletions.

The semantic package/coverage merge preserves the parent’s composed app/toast route, OpenCode/changelog tests, contextual-orchestrator attribution/routing regressions, Checkout attempt/reconciliation/provider tests, webhook trust/event-ledger coverage, provider-read/observation/projection coverage, and accessibility suites while adding only entitlement-policy production/test registrations.

Any parent or contributor-head movement invalidates this ancestry statement until freshly reconciled.

Policy contract

• trialing: grants only through a future authoritative trialEndSec; exact/past expiry fails closed;
• active: grants or extends only with exact matching authoritative paid-Invoice evidence and a future currentPeriodEndSec; missing, mismatched, open, void, uncollectible, or otherwise non-paid evidence never creates or lengthens access;
• past_due: never provisions or extends; an already-paid unexpired prior claim may remain only through its existing validity window;
• unpaid, paused, canceled, incomplete, and incomplete_expired: deny or revoke the affected Subscription claim;
• older Subscription observations are ignored when a claim already records newer accepted evidence;
• equal observation identity may later be enriched with matching authoritative Invoice evidence without inventing a newer Subscription read;
• organization aggregation evaluates each Subscription independently, so one canceled Subscription cannot erase another independent unexpired claim; and
• duplicate current claims for one Subscription identity fail closed instead of silently selecting contradictory authority.

Outputs are immutable candidates. This slice performs no database mutation, writes no orgs.plan, grants no session capability, and is not itself a production authorization path.

Causal failure repair

Predecessor Server Tests run 32086408812, unit-and-api job 95559754722, passed the complete unit suite—including all entitlement-policy suites—but failed API smoke because stale application composition returned 404 for protected /toast-state.css. The predecessor cloud-e2e job was green. Current head starts from exact current #527’s composed application tree and overlays only the eight entitlement-policy paths, preserving the shipped static accessibility asset instead of weakening the smoke contract.

tests/unit/coverage-script-contract.test.mjs now proves the inherited server/application_routes.mjs, orchestrator attribution, provider reader, observation ledger, current projection, and new entitlement policy all remain instrumented; it also locks all three entitlement suites into normal unit CI and canonical c8 execution.

Current exact-head evidence

Fresh repository-native workflows for exact contributor head 9da3f3663a80cf20aa9562132eb3d1b7f5fcb1d0 are queued and therefore non-passing:

• Server Tests 32275677574;
• Dependency Review 32275677501; and
• OSV Scanner 32275678237.

The current review inventory contains no submitted review and no review thread, so there is no qualifying independent current-head approval. Queued, pending, skipped-required, cancelled, absent, neutral-required, failed, stale, predecessor, synthetic, status-only, author-only, or model-only evidence is non-passing.

Remaining boundary and merge gate

This does not complete #488. Authoritative Invoice/payment retrieval and normalized persistence, transactional claim/audit storage, reversible grant/revoke application, operator recovery, out-of-order reconciliation, authorization/API integration, migration/restart/concurrency acceptance, and release evidence remain prerequisite work.

Remain Draft. Do not integrate independently of #527 and its prerequisite stack. After the stack reaches protected develop, reconcile this bounded semantic delta to the resulting live head and regenerate every then-applicable exact-head deterministic/browser/statement/branch/function/line coverage/docstring/SAST/security/dependency/supply-chain/package/provenance/migration/recovery/review gate under live policy.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 8af732ab-fbd0-4f22-b568-b51149a5d714

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Review failed

An error occurred during the review process. Please try again later.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}