Repository navigation
Test annual dues: persisted Checkout and automatic payer membership activation #742
Description
Officer impact: In the isolated test flow, a verified fictional account can choose approved annual dues, accept a clearly synthetic waiver, use Stripe test Checkout, and become a current test member automatically after verified provider payment. No manual membership-approval queue, live charge or production membership is introduced.
Officer documentation: Update the member-screen/test-dues guide, officer entrypoint and maps, and authoritative architecture/security/release scope. Separate source/emulator proof, actual Stripe sandbox proof, staging deployment and real-money/production approval.
Deployment evidence: None at creation for dues. The preceding #739 member flow has native staging proof; dues provider integration is a new outcome. Stripe sandbox connection is pending owner account identification; no secret is requested in chat.
Outcome
Build one coherent test-only annual dues purchase/automatic payer-activation flow, consuming the already merged dues checkout/payment and membership-authority contracts. Keep paid races, merchandise, subscriptions, imports, external payment instructions and real payments out. Family invitation enrollment remains a separate child; a family purchase can establish one paid family root/payer without asserting that other accounts are already associated.
Settled product values
- Individual2500/family3000 integer USD cents, one-time full calendar year in America/Los_Angeles, no automatic renewal, grace, prorating or future-year purchase.
- Current verified identity + accepted waiver + confirmed paid term activates without another officer membership approval.
- This implementation uses a synthetic test waiver only. Final privacy/retention/waiver/guardian and live-payment exception policies remain unapproved and are not inferred from tests.
Invariants and failure cases
- Exact staging or fully isolated demo emulator environment only; native Auth/AppCheck/caller/default tenant and current enabled/verified Auth metadata guard mutations. Live keys/events/production targets fail closed.
- Server owns plan/year/cents/currency/term/consent/account binding. No browser/redirect/email/profile-role/unchecked Stripe field proves payment.
- Persist an immutable order/expected payment and caller command before Stripe creation; one unresolved purchase per account prevents new request IDs or concurrent plan changes creating extra charge opportunities. Persist one provider idempotency key and exact parameters; never blindly recreate after its safe retry horizon.
- Durable signed webhook receipts and verified same-account/test-realm provider observations bind the exact Session/PaymentIntent/amount/currency/metadata/order. Duplicate/out-of-order/unpaid/async-failed/expired/mismatched events cannot falsely activate or regress paid state.
- Confirmed payment, immutable term/evidence, canonical current-member projection and audit commit together. A paid order is retained even if account/term/suspension/revision state prevents activation; no silent loss or automatic unsuspension/refund/extension at year rollover.
- Status and authenticated reconciliation recover webhook-before-return, uncertain creation/binding, committed-lost-response and missed callbacks without new charges. Reconciliation never fabricates a Stripe event.
- Refund/dispute observations retain evidence and stop unsupported automatic grants; no real club refund policy or refund issuance is selected. No custom mail, raw payload/customer data, Checkout URL, token or secret logging/persistence in diagnostics.
- Shared family payment is recorded once with an opaque Family ID; a bare ID does not authorize another UID or create multiple payment records.
- Browser/admin clients cannot directly read/write financial/receipt/audit/lock collections. Existing accounts/records remain compatible; no roster migration.
Acceptance
- Exact approved prices and LA calendar boundaries tested, including rollover/leap year and no current-term duplicate purchase.
- Persist-first idempotent prepare/resume/reconcile path and automatic verified-payment membership activation execute end to end in synthetic tests and native Firestore emulator concurrency tests.
- Native handlers enforce Auth/AppCheck/default tenant/current account; signed raw-body webhook rejects invalid signatures/live or wrong-account data.
- Negative/retry cases cover unpaid/mismatch/async success-failure/expiration/cancel-return/reversal duplicates, forged fields, stale/conflicting commands, concurrent request IDs, failed writes, lost responses, suspension/account loss and delayed old-year payment.
- Responsive test-only UI displays server offers/consent/own status, resumes the saved server order, handles uncertainty/session changes, and never treats a return URL as paid.
- Financial Rules denials, redacted errors/logging, relevant full checks, officer walkthrough and exact-head Opus5.5 medium/max approval plus CI are complete.
- Actual Stripe sandbox/hosted claims are made only after separately connected provider evidence; missing setup leaves checkout disabled. Live mode stays unavailable.
Dependencies and scope
#739/#741 member screen release and native Auth/AppCheck qualification; merged membershipAuthority/membershipDuesCheckout/membershipDuesPayment contracts and quality gates. #114 is historically CLOSED and is not evidence of a working checkout; this focused child carries the new runtime work. Current provider connection/policy/production release remains separate. No sealed #731 fixture/harness reuse. Create/assign/claim this child only after the current staging correction is qualified.
Source delivery and remaining hosted acceptance — October 16
PR743 merged as 5d8f8886c0af916442ea01e007f01c32c9d0acc8, with tree identical to reviewed fec9127ff2727b83a675064e9e6fc050189da0f6. Genuine Opus5.5 medium full-source approval plus fresh final-delta approval explicitly APPROVED the full final40character head; zero permission denials/model fallback. Exact final PRCI38993899576 all6jobs/every step green. Delegated approval receipt. Existing administrator capability used, no fabricated GitHub reviewer approval or protection change. MainCI38994183475 also passed all6jobs/every step on the exact merge. Native Node22:8061pass (the63 journal cases run separately); Rules484pass. Current main and identical reviewed/merged tree were rechecked.
Officer impact: one test-only saved annual purchase can activate the payer automatically in the canonical membership used by free events. No additional officer approval. New-year renewal and prepared-order recovery controls are corrected. A failed-card PaymentIntent with an expired Session remains conservatively locked for specialist reconciliation; no blind replacement charge.
Officer documentation: docs/officers/TEST_DUES.md, MEMBER_SCREEN.md, README.md, SYSTEM_MAPS.md, OFFICER_START_HERE.md, authoritative root checkpoints and docs/TEST_DUES_ENGINEERING.md. No-terminal backup-officer walkthrough leaves release/provider/fixtures/recovery with the specialist, not the officer.
Deployment evidence: member/free-event staging remains qualified at Functionv7/source799565e and Hostingd08a6a3 under closed739 (62assets,10member+4layoutnativechecks, exactcleanup). No dues Function/webhook/Hosting/Stripe configuration, IAM/dependency/Rules allowance, real payment or production action. All new dues flags/entrypoints are unconnected and disabled. Local8040backend/1517frontend/lint plus final nativeCI supply source/emulator proof, not native Stripe payment or hosted dues identity proof.
#742 stays OPEN for:
- Club-owned Stripe sandbox account name/dashboard link (asked owner; no keys/passwords/payment details in chat).
- Separately reviewed fixed-target dues bundle, minimum test Secret Manager/IAM/runtime and native webhook configuration.
- Exact-native Auth/AppCheck/caller/current-account/marker and raw-signature/account/test-realm denials, real sandbox paid/unpaid/retry/reconciliation evidence.
- Matching hosted phone/desktop Checkout/resume/return, canonical automatic membership and free-event admission; update the current Community membership-card availability copy when the dues feature is actually enabled; only fresh fictional fixtures, exact-owned fenced cleanup and recovery receipt. No sealed731 reuse.
Family invitations/other-account enrollment, final waiver/privacy/retention/guardian decisions, and any live-money/production release remain separate. Online payer source is not the completed real-member launch.
Earlier core hosted checkpoint — October 17
Club sandbox, both isolated dues v1 Functions and matching Hosting at71f59e2 are connected. Actual $25/$30 payments, automatic payer activation, free-event admission/cancellation, unpaid cancel/resume, duplicate delivery, ordinary browser Auth/AppCheck, phone/offline recovery and email/marker denials passed; four disposable users/event removed, payment evidence retained. Full dated evidence and qualification limits. Officer documentation PR745 mergedb8b26ac after genuine Opus5.5medium, exact PRCI39046463461 and merge-mainCI39046752680, all6jobs/every step green. No application redeployment or real-money/production change in the documentation follow-up.
At that core checkpoint, the issue remained open for independent native failure/recovery qualification explicitly listed in that receipt, including caller/current-Auth/tenant and provider mismatch paths, unknown/lost create/commit outcomes, missed callbacks and async/reversal/old-year cases. Existing unit/emulator coverage is not substituted for those native claims. Use new owned fixtures; never recreate this run or sealed731.
Completed bounded native recovery qualification — October 17
The existing test-only, card-only/default-tenant staging outcome is complete. PR746 merged ba44e70 with the identical Opus-reviewed tree4242e530. Genuine Opus5.5 medium full review and zero-denial native-Git provenance addendum approved exact a52fc95. Exact PRCI39073801397 and merged-mainCI39074226191 passed all6jobs/every step. Existing administrator merge authority was used under Dave's delegated rule, without a fake reviewer or protection change.
The dated native matrix, cleanup and qualification limits records current-Auth/caller denial, races and uncertain/discarded-result recovery, missed-callback reconciliation, mismatch/realm guards, actual refund holds, disabled-account and injected old-year payment retention, actual decline and real expiration. Signed synthetic async/out-of-order callbacks and clock/TTL/response faults are explicitly labelled; source/emulator-only cases are not passed off as native.
Officer impact: interrupted payments retain the original purchase and evidence; held or expired failed-card purchases need specialist reconciliation, without another charge. Officer documentation: new native receipt, TEST_DUES/officer entrypoints and matching root/specialist checkpoints. Optional #747 tracks clearer saved-checkout recovery wording.
Deployment evidence: post-merge native verifier confirms existing duesv1 archives99,003bytes/c31a22ed and application71f59e2; original keyless authority/secret references/other Functions retained. Public marker and native Chrome sandbox endpoint readback match. The isolated webhook disable/restore lease lasted70,768ms and ended enabled with original eight events/API2023-10-16. All10fresh Sessions are complete/expired;8Auth identities/26disposable records removed,32allowed paths absent and33financial hashes unchanged. Event/audit/unresolved evidence retained; no earlier deleted or sealed731 fixture reuse. No application deployment, production, real money, IAM/Rules or secret-version change.
Closing this child does not complete the real-member launch. Family invitations, approved final policies, live payments/production and unsupported-capability qualification (full disputes, real async methods, foreign tenants, restricted-key permissions) remain separate. The current failed-card expiry lock is safe and specialist-only, not complete self-service recovery.
Activity
daliu commentedon Oct 17, 2026
CLAIMED by /root on codex/test-dues-activation from merged/staging-qualified d08a6a3. Dependencies #739/#741 complete. Scope is test-only persisted checkout, verified payment activation, isolated handlers/UI and tests; no production, live payments, policy approval or family invitation enrollment. Club Stripe sandbox account identification is pending; provider calls/deployment remain disabled until separately connected.
daliu commentedon Oct 17, 2026
Officer impact: Test-only $25 individual/$30 family annual payer checkout and automatic membership are merged source. No extra officer approval follows verified identity, synthetic consent and confirmed test dues. Family invitation enrollment and real payments remain separate.
Officer documentation: TEST_DUES, MEMBER_SCREEN, officer entrypoints/maps and authoritative root/engineering checkpoints updated. No-terminal review leaves provider, release, fresh fictional fixtures and recovery with the specialist.
Deployment evidence: PR743 merged5d8f8886c0af916442ea01e007f01c32c9d0acc8, tree04735c8e235c720de12bf611ba0c1fb68a7ab2c1 identical to reviewedfec9127. Genuine Opus5.5medium explicitly APPROVED full final head;32hashes/currentbase/head and exact PRCI38993899576/mainCI38994183475 all6jobs/every step verified. Main nativeNode22:8061pass; separate journal job covers63; Rules484pass; local8040backend/1517frontend and lintpass. No fake reviewer or protection change; existing administrator merge under Dave's conditional delegation is recorded in the PR receipt.
Staging remains member Functionv7/Hostingd08a6a3 with the qualified archive digest,62assets and10member+4layout genuine checks/cleanup under closed739. Final public marker and original ignored62filebuild readback match. No dues Function/webhook/Hosting/provider/secretIAM, real-money or production release. #742 staysOPEN for club sandbox identification, isolated test release and genuine hosted checkout/security/recovery/cleanup qualification, including current availability copy before enabling the feature. No keys/passwords/payment details belong in chat.
daliu commentedon Oct 17, 2026
Officer impact: the isolated dues release path is prepared in PR744; the review screen is still unavailable. Officers handle no terminal, credential or payment record.
Officer documentation: docs/officers/TEST_DUES.md, SYSTEM_MAPS.md, README.md; OFFICER_START_HERE.md; docs/TEST_DUES_RELEASE.md and engineering/root checkpoints.
Deployment evidence: read-only native inspection on October17 found only communityActions v7 and profile Functions v2/v1, unchanged. Secret Manager returns SERVICE_DISABLED. No dues Function/secret/IAM/webhook/Hosting/provider mutation and no real payment occurred.
Continuing #742 hosted acceptance at PR744/head09af698ef907438299041c696e64fc372a7a92f6. It adds deterministic isolated dues packaging, exact staging/secret/runtime/invoker/archive checks, default-off backend-first Hosting, preservation of existing services, restricted sandbox-key support and flag-matched card copy. Local87 release/profile/Hosting tests,30adapter and30screen tests, Functions lint and preserved frontend lint baseline passed. Genuine Opus5.5medium review and exact-head fullCI are running; neither is claimed approved yet.
The club Stripe OAuth sign-in is open in the owner's Chrome and awaiting private password/MFA entry. A dedicated club sandbox/account, privately stored restricted test key/endpoint signing secret and native provider qualification remain required. No passwords, codes or keys belong in chat/issues. #742 stays OPEN: actual hosted Checkout, raw-body signatures, retry/reconciliation, automatic membership/free-event admission, phone/desktop and fresh-owned cleanup have not yet been proved. Real payments, legal policy and family invitations remain separate.
daliu commentedon Oct 17, 2026
Officer impact: isolated sandbox dues release preparation is merged; the test screen is still unavailable until the club sandbox is connected and natively qualified. No officer terminal or credential handling.
Officer documentation: updated officer dues guide/maps/index and OFFICER_START_HERE.md; docs/TEST_DUES_RELEASE.md carries specialist prerequisites, private setup, exact release/verification, recovery and no-terminal handoff.
Deployment evidence: no dues/provider/IAM/secret/Hosting mutation. Final read-only native verification from exact green main confirms communityActionsv7/source799565e4e8992b3bbf45809f339c276b0b1eb39c,101536-byte archive461754cbb4c59dbce1e5b9935d642467169abe0d0fda727369232bacb0688836 and unchanged profiles. Public staging marker remains d08a6a3 with the same community hash and no dues bundle.
PR744 merged as
71f59e26753b87f398b243cce5e995a44fcc538b; tree2a786fad33f5f32b557df279317544f17ef18ea9is identical to reviewed6cf7cbb281f7713e4ce05c84829f6dd2a24c6a20. Genuine Opus5.5medium full-source/final-delta approval and root-bound head/file hashes are recorded in the delegated approval receipt. Exact finalPRCI39015312687 and exact merge-mainCI39015563777 both passed all6jobs/every step. Local88release/profile/Hosting+30adapter+30screen tests and lints passed. No fabricated GitHub review or protection change; existing administrator merge authority used as authorized.Remaining owner action: finish the fresh club Google/Stripe password/MFA sign-in open in Chrome. The earlier idle session expired and was restarted; the current club password screen is ready. Never post passwords/codes/API keys. No sandbox account has yet been identified, no credential was handled and no native hosted checkout was attempted.
#742 remains OPEN for club-owned dedicated sandbox/account confirmation; private restricted test-key/webhook-signing-secret setup; minimum staging Secret Manager/runtime grants; backend-first release; actual raw-body signature/Auth/AppCheck/account/marker denials; Stripe Checkout/unpaid/cancel/retry/reconciliation/automatic canonical membership/free-event/phone-desktop proof and fresh-owned cleanup. Real payments, policies and family invitations remain separate. No sealed731 reuse.
daliu commentedon Oct 17, 2026
Officer impact: using the requested RUN (MPRC) Chrome profile gets past the prior Google password blocker. Stripe then displays “Finish creating your account” for the club Google login, with RUN MPRC and United States prefilled. It has not opened an existing Stripe dashboard or identified a sandbox.
Officer documentation: no procedure/source changed; this is a provider identity handoff, recorded here and in the dated Obsidian conversation.
Deployment evidence: none added. PR744 remains merged at71f59e26753b87f398b243cce5e995a44fcc538b; native GitHub read confirms it is still current main. Existing genuine Opus5.5medium approvals and exact PR/main6-job/every-step CI receipts remain the code approval. No new code, provider/secret/IAM/webhook configuration, deployment, credential entry/reveal or real payment.
Owner action is now different from the old password/MFA handoff: complete the final Stripe account-creation/terms action personally in the RUN (MPRC) Chrome window, or identify the existing club Stripe login. The Create account button was not clicked. Browser safety rules reserve financial-account creation/terms for the owner; code review is not that consent. Normal club Google sign-in shared only the expected name/profile/email with Stripe.
#742 stays OPEN. Dedicated sandbox/account selection, private restricted test-key and endpoint secret, minimum staging resources, actual hosted Checkout/signature/Auth/AppCheck/retry/reconciliation/activation/free-event/phone-desktop proof and fresh-owned cleanup remain pending. Real payments and sealed731 remain separate. Screenshot and bounded receipt retained privately in the existing task artifact directory; no new worktree/environment/fixtures created.
daliu commentedon Oct 17, 2026
The club sandbox is connected and the core hosted flow works in staging. #742 stays OPEN for the native failure-path checks below. Real payments and production remain separate.
Officer impact: $25 individual/$30 family test Checkout activates its verified fictional payer automatically; the existing current-member gate then admits free-event signup after separate event consent. No officer membership approval is required.
Officer documentation: PR745 updates the officer entrypoint, test-dues/member guides, maps, root checkpoints and specialist evidence. New
docs/TEST_DUES_HOSTED_EVIDENCE.mdexplicitly distinguishes native core proof from unexecuted fault cases. Genuine Opus5.5 medium approved exact heada8d0736f2e4545dabe8b4507db11640a46289dbe; CI39046463461 all6jobs/every step passed. Merged asb8b26ac413485fb5561d6804a908b493bbafa619with identical tree; no runtime redeploy in that documentation PR.Deployment evidence:
71f59e26753b87f398b243cce5e995a44fcc538bretains its separate genuine Opus approval and exact PR/main all6CIjobs/every-step receipts.c31a22edab34872dd10c3d3a44e12fdccf933dcb5659fb4db9ca99229d6c908b, 99,003bytes. Dedicated keyless runtime/six-permission role/pinned secret versions verified; existing communityv7/profilev2/v1 unchanged.The existing full source/unit/emulator checks cover caller/default-tenant/current Auth loss, account/realm/cents/currency mismatch, concurrent preparation, unknown creation/binding outcomes, committed lost responses, missed callbacks, delayed old-year payment, async success/failure and reversal holds. This native core run does not independently qualify those cases. Next work uses fresh uniquely owned fixtures and bounded failure/recovery cases; do not recreate the deleted run or substitute synthetic success for native provider evidence. Restricted-key permissions and asynchronous payment-method UI were not qualified. Family invitations, final legal/retention/guardian policy and live-money/production approval remain separate.
Cleanup safety correction: Opus rejected a retry gap in the first cleanup helper before use. The corrected helper passed six regression/negative checks and exact-file Opus approval, then completed native fenced cleanup. No rejected cleanup executed. Private receipts are bounded and contain no credential values, Checkout URLs or raw payment/customer payloads.
Exact merged-main CI39046752680 also completed on b8b26ac: all six jobs and every step passed. Current staging marker remains71f59e2; no application redeployment accompanied the documentation merge.
daliu commentedon Oct 17, 2026
The bounded native failure/recovery qualification is complete for the existing test-only, card-only, default-tenant staging flow. #742 can close on that scope; this is not a real-member or real-money launch.
Officer impact: interrupted purchases recover their original Session/payment evidence. Missed callbacks and restored accounts can finish activation. Refunds hold membership; old-year/failed/unpaid purchases cannot silently create another charge or extend a term.
Officer documentation: PR746 merged as
ba44e70c3ca0ea17cc1bc95f3f2fa71a3e303cbc, identical to reviewed tree4242e530771a98332141f5498d4d919fa233a15b. The dated native matrix and limits and officer guide distinguish genuine Stripe Events/payments from signed synthetic callbacks and deliberate response/clock/TTL injection. Genuine Opus5.5 medium full review plus zero-denial native-Git provenance addendum approved exact heada52fc95a2609dbb0cadc42f1e0b28416dd53371d; approval receipt. Exact PRCI39073801397 and merged-mainCI39074226191: all six jobs/every step success, no skips.Deployment evidence: website marker remains application71f59e2. Both isolated dues Functions remain ACTIVEv1; final post-merge downloaded archives match99,003bytes/SHA256c31a22ed each. Original keyless authority/secret references/other Functions remain unchanged. The exact sandbox webhook was disabled/restored within a70,768ms lease, then native restore mode and Chrome readback confirmed the original enabled eight-event/API configuration. No application deployment, Rules/IAM/secret-version change, production test or live payment.
Native checks include caller/current-Auth rejection with cached JWTs; one-purchase races; committed discarded-response and uncertain-create recovery; closed retry horizon; account/realm/amount/currency/nonce mismatches; real paid missed-callback reconciliation; one actual sandbox refund with same-ID retry and sticky suspension; disabled-account payment retention/restoration; explicitly backdated old-year payment retention; actual insufficient-funds decline and real Session expiration. Native project configuration has tenants disabled. Generated async/out-of-order envelopes always re-read real Stripe state; actual asynchronous payment-method UI is not claimed.
All ten fresh Sessions are closed: three complete/seven expired, one per normal order plus three deliberate mismatch Sessions. All eleven selected real Events have zero pending webhooks; Events produced while disabled were explicitly not claimed as delivered. Eight exact fictional Auth identities and26disposable records are absent; all32allowed disposable paths checked absent. Thirty-three financial hashes are unchanged. Audit/event evidence, including three intentional pending mismatch receipts, is retained. No old hosted or sealed731 fixture was recreated.
Sixteen focused helper guard checks passed. Rejected helper revisions were not executed. Two transient test-URL diagnostic outputs were disclosed; the affected saved AX receipt was scrubbed, both Sessions are closed, and saved JSON/text receipt scanning is clean.
Optional follow-up #747 covers clearer wording when an expired failed-card Checkout cannot reopen. The current safe lock still requires specialist reconciliation. Family enrollment, final club/legal policies, full dispute/async/tenant capability, restricted-key qualification and production/live-money approval remain separate.