Repository navigation
PAY-003 — Build idempotent asynchronous Stripe event processing #106
Description
Outcome
Build the complete Stripe event-ingestion and canonical reduction subsystem: verified ingress, durable inbox/deduplication, strict versioned ownership and money binding, asynchronous payment lifecycle, reservation/inventory/outbox integration, reprocessable quarantine, TTL/dead-letter operations, reconciliation, and provider test-mode evidence.
Why this is a tracker
Webhook ingress, canonical payment state, reservations, refunds/disputes, operations, and external Stripe delivery cannot be one reviewable change. Assign only atomic children.
Children
- PAY-003A — Harden Stripe webhook ingress and monotonic event reduction #101 — PAY-003A: source merged as
87bd1210575882cdd06214bcb98ed38ce00f71c2; post-merge CI passed; Firebase not deployed - PROMO-001 — Disable unmodeled Stripe price adjustments #102 — PROMO-001 companion guard: source merged as
2e3228acc7be649e0b154b450f7bac362e8dfb83; promotion/tax/shipping adjustment tests passed; provider inventory and protected three-Function release remain blocked-owner - PAY-003B — integrate strict schemas and canonical payment/reservation/outbox reducers
- PAY-003C — add retry/quarantine worker, TTL/dead-letter alerts, and Stripe test-mode delivery rehearsal
System acceptance
- Event replay and distinct duplicate/out-of-order events produce one valid business outcome.
- Unpaid completion never fulfills; delayed success/failure is correct.
- Environment, mode, metadata schema, local reference, Session/PaymentIntent/Charge, amount, currency, discount/tax/shipping policy, and predecessor state are validated.
- Registration and merchandise reservations, refunds, disputes, emails, and audit are idempotent.
- Permanent anomalies are reprocessable and alerted; transient failures return retryable failure.
- Emulator integration and signed Stripe test-mode delivery pass before deployment.
Dependencies
#101/#102 are legacy-compatible source safety slices, not deployment or launch evidence. Full completion also depends on CONFIG-001, PAY-001, PAY-002, RACE-001, MERCH-001, PAY-005, OBS-001, and TEST-001.
Claim rule
Do not claim this tracker. Claim exactly one dependency-ready child, assign it, and post the repository-standard timestamped CLAIMED marker before editing.
Activity
daliu commentedon Jul 17, 2026
Atomic child #337 PAY-003A1 is assigned and timestamp-claimed on codex/issue-337-fulfilled-payment-review from exact main f9a3f3c. It only preserves fulfilled state while adding the existing fixed review flag for valid signed failed/expired Checkout evidence when paymentStatus is not paid. PAY-003B/C, migration, provider configuration, deployment, and live behavior remain open.
daliu commentedon Jul 17, 2026
PAY-003A1 child #337 is now ready PR #338 at exact independently approved head 274de5c. It preserves fulfilled state and adds the existing fixed review flag only when signed failed/expired unpaid evidence arrives and the existing payment compatibility marker does not say paid. PAY-003B/C and all deployment/provider/live work remain open.
daliu commentedon Jul 17, 2026
PAY-003A1 / #337 is complete as source/test containment. PR #338 merged as exact main
4e962c8909503a225bb128607dc34da49a54f729; PR CI29557045221and exact-main CI29557149720passed all five jobs. Exact-main deployments are[]; no Firebase, Stripe/provider, website, production-data, migration, or live action occurred. PAY-003 remains open for the canonical reducer, provider-version inventory, reconciliation, outbox/alerting, and historical-data decisions. Completion evidence: #337 (comment)PAY-003B1: pure side-effect outbox delivery-state contract (#364) (#365)
PAY-003C1: add commerce attempt-failure disposition classifier (#377) (…
PAY-003B2: add commerce event-inbox deduplication and ordering classi…
daliu commentedon Aug 1, 2026
Coordination update from completed #503: PR #509 merged the public race/Shop page-only one-attempt marker as
d712c4a2a3a0c7125fac1f2872696315fb22ed38; PR #511 merged the final backup-officer documentation correction asa9094e85811ed31aa1e43da75559e596e16118ae. Exact-main CI 30709191322 passed all five jobs. The website was not published, Firebase was not deployed, Stripe/provider state and production data were not changed, and no checkout/payment/live behavior was verified.This closes only immediate browser-repeat containment. It does not provide server idempotency, verified provider receipt, durable event processing, payment proof, retry/quarantine, or reconciliation. Reload/tab/device/script/direct-caller bypass and same-screen stale-result risk remain. This tracker and PAY-002C/D therefore remain open and unchanged.
13 remaining items
daliu commentedon Aug 1, 2026
PAY-003A8 child #572 CLAIMED by /root at 2026-08-01T22:27:29Z on exact released base
511d117972e2fcd951abc1c91f3e111e158acaee, branchcodex/issue-572-nondispute-event-created. Exact scope is limited to the Event-created admission/ledger projection hunk infunctions/stripeWebhook.js, a separately named test matrix infunctions/stripeWebhook.test.js, and one named source-only section inSTRIPE_COMMERCE_DESIGN.md. Refund Charge-created evidence, provider/version decisions, migration, deployment, and live work remain excluded. Durable details: #572.daliu commentedon Aug 1, 2026
PAY-003A8 COMPLETE / CLOSED / CLAIM RELEASED
Child #572 merged through PR #576 as exact main e4e0f87. Merge tree a5a2290754a487b6ae5a6d03e3d19e90d4cdd856 and patch SHA-256 14ac30fdd98afc6a370f7e13d7da4210a08d5e08d1be30e4016b5d3510704dc0 match the reviewed candidate. PR CI 30722333482 and exact-main CI 30722459454 each passed all five required jobs. GitHub deployments for exact main are 0; no website, runmprc.com, Firebase, provider, production-data, payment/refund/dispute, or live verification claim is made. Officer impact/documentation: None — server-only admission boundary. The child claim is released; PAY-003A9 remains separate residual work.
daliu commentedon Aug 1, 2026
PAY-003A9 child #578 CLAIMED by /root at 2026-08-01T23:07:47Z on exact released base e4e0f87, branch codex/issue-578-refund-charge-created. Scope is exactly the embedded refund Charge-created admission/refund paidAt fallback hunk in functions/stripeWebhook.js, a separately named PAY-003A9 matrix in functions/stripeWebhook.test.js, and one source-only PAY-003A9 section in STRIPE_COMMERCE_DESIGN.md. Target/binding/money/state algorithms, schema, migration, provider/version, deployment, production, and live work remain excluded. Durable details: #578.
daliu commentedon Aug 1, 2026
PAY-003A9 #578 CLAIM RELEASED WITHOUT EDITS. No tracked file, commit, push, or remote branch exists for the child; its three path/hunk claims are free and the issue is back to status:ready. Work paused only because a newly published live React Router open-redirect/XSS supply finding outranks this latent source-only child. #578 remains the next specified PAY-003 residual after the live dependency boundary.
daliu commentedon Aug 1, 2026
PAY-003A9 #578 RECLAIMED at 2026-08-01T23:13:39Z on exact released main 4c7cdd0 after disjoint #575/#577 completed and released. The live React Router P0 is confirmed but blocked by active #571 ownership of a required migration test file, so #578 is the highest eligible P0. Original three-file scope/exclusions remain exact; no edit preceded this reclaim.
daliu commentedon Aug 1, 2026
PAY-003A9 / #578 COMPLETE, CLOSED, AND CLAIM RELEASED. PR #580 merged reviewed head
1664ab02d5ff6014dfef7de950a9038f2f01abbdas exact main0d19d2e8209ab9c19b21aeee04e5fe6ef72c356f; tree2fac1e664edf1e71afce82435b31567db478f1da; patch SHA-25609c6678a35b4b214b7bcaf838b9ca38a0158872e3c0784369d9e83253149548f. PR CI30723526163and exact-main CI30723624269passed all five jobs. Deployments are[]; no site, Firebase, Stripe/provider, production-data, payment/refund/dispute, or live claim. All #578 paths/hunks are released. Residual PAY-003 work listed in the child remains with #106.daliu commentedon Aug 2, 2026
PAY-003A10 child #584 is CLAIMED by
/rootat2026-08-02T00:12:28Zon exact released base4b2e144deaaa79439a5f47dd50028405ad018eb5, branchcodex/issue-584-refund-chronology.Scope is exactly the pre-target refund Charge/Event chronology condition in
functions/stripeWebhook.js, one separately named test block/helpers infunctions/stripeWebhook.test.js, and one named source-only section inSTRIPE_COMMERCE_DESIGN.md. It excludes clock skew/freshness, Checkout/Dispute embedded time, provider/API-version/history work, PAY-003B/C, deployment/provider/data/refund/payment/live work, active #571/#504, and draft #462. Durable details: #584.daliu commentedon Aug 2, 2026
PAY-003A10 child #584 is COMPLETE / CLOSED / CLAIM RELEASED.
Merged PR #585 as exact main
1c85ec08c274ad9077118d4daf3a6ac9dad118bd; reviewed and merged treeb95ae19166d642d3ad0dd2885087214a560a063f. PR CI30725425596and exact-main CI30725513165each passed all five required jobs. Final release evidence: #584 (comment)Delivered source-only boundary: after valid refund Event and Charge timestamps,
Charge.created > Event.createdbecomes target-freeneeds_review:invalid_charge_event_chronology. Equality and an earlier Charge time remain admitted. Existing processed Events are not changed or repaired.Deployment truth: no website publication,
runmprc.comverification, GitHub deployment, protected release workflow, Firebase deployment/readback, Stripe/provider action, production-data change, migration, payment/refund/dispute action, or live verification. The exact-main Netlify attempt stopped unpublished; the published site remains bounded #473 deploy6a6dc9ea588b0c0008036312.Officer impact: None — server-only evidence ordering.
Officer documentation: None — no officer procedure or available action changed; engineering truth is in
STRIPE_COMMERCE_DESIGN.md.#106 remains open for clock freshness/skew, Checkout Session and Dispute embedded-time decisions, provider/API-version proof, retrieval/history repair, PAY-003B/C, reconciliation, alerts, protected release, and live verification.
daliu commentedon Aug 2, 2026
CHILD CLAIMED — PAY-003A11 / #586 at
2026-08-02T00:49:44Zon exact released base1c85ec08c274ad9077118d4daf3a6ac9dad118bd.Atomic outcome: successful Checkout transitions that must fill missing
paidAtwill persist the already admitted outer Event time rather than webhook receipt/server time, while preserving existing financial times and operational clocks. Exact scope is onlyfunctions/stripeWebhook.js, one named test block/helpers infunctions/stripeWebhook.test.js, and one source-only design section. No deployment, provider call, production data, payment/refund/dispute action, or live claim. #584 is released; active #571/#504 and draft #462 are disjoint. The child claim remains active until exact-main verification and explicit release.daliu commentedon Aug 2, 2026
CHILD COMPLETE / CLOSED / CLAIM RELEASED — PAY-003A11 / #586.
PR #587 merged exact reviewed head
3f93a9af6eeb1c4b1965fbb2ed99265ebb0444e5as exact main51723b487ec67bb74620c97e47449ae1319f0daa; reviewed and merged tree65ce5004636699a0b7f56ee1a787bcf9107fcdc1is identical. PR CI30726546061and exact-main CI30726642299passed all five jobs. Release marker: #586 (comment)Outcome: all three successful Checkout branch families now fill missing
paidAtfrom the already admitted outer Event evidence rather than webhook receipt time. Existing values, replay, outcomes, operational clocks, and history remain unchanged. No Firebase/Stripe deployment or configuration, production data, payment/refund/dispute action, or live proof occurred. Netlify preview was non-production; the exact-main production attempt failed unpublished; the published site remains the bounded #473 revision.Residual PAY-003 work remains open exactly as listed in #586 and this tracker. The child claim, three file paths, and payment-time projection outcome are explicitly RELEASED.
daliu commentedon Aug 2, 2026
PAY-003A12 child #588 is COMPLETE / CLOSED / CLAIM RELEASED.
PR #589 merged exact reviewed head
0645e3977e87797c5b69848339801d42e75b5426as exact main56332507f394f419616acfa6320f1bfbb16c60b5; reviewed and merged treedd970cd2994ffeafa52b603ea3094ca8224552cfis identical. Exact-head CI30727364335and exact-main CI30727456137passed all five required jobs. Exact-main GitHub deployments are[].This closes only structural Checkout Session-created admission. Invalid or missing embedded time now becomes target-free fixed review before target/binding/money/state work. Session/Event chronology remains deliberately unchanged for PAY-003A13. No website publication,
runmprc.comverification, Firebase deployment, Stripe/provider action, production-data action, payment/refund/dispute, or live proof occurred. The exact-main Netlify attempt failed unpublished; the published site remains the bounded #473 revision. All three #588 file claims are released.daliu commentedon Aug 2, 2026
PAY-003A13 / #590 COMPLETE, CLOSED, AND CLAIM RELEASED.
PR #591 merged reviewed head
8929be85a8276a02a2222c5b64e53d3723799ec4as exact main38600a13aeaf57fa1c4d5571efa72af09ea983a1; identical tree8a000d30283e1b6e876b703dbf25a27182cd11bf. Exact-main CI30728441536passed all five jobs.The source now durably quarantines newly delivered supported Checkout Events whose embedded Session
createdis later than the outer Eventcreated, before target work. Equality and earlier chronology remain valid; exact replay and outer Event-derived ledger/paidAttime remain authoritative.Deployment truth: source/tests/merge only. GitHub deployments are empty. The exact-main Netlify attempt errored without publication. The live site remains bounded #473 source
9ad6837756cdd409d296009fde5082eeeae5c059. No Firebase deployment, Stripe/provider action, production-data change, payment/refund/dispute, or live behavior verification occurred.All #590 claims are released. Remaining #106 residuals must be separately scoped, claimed, tested, reviewed, and delivered.
daliu commentedon Aug 2, 2026
PAY-003A14 child #592 is COMPLETE / CLOSED / CLAIM RELEASED.
102209dd99b331797f139dde7e209de75ea73a63.6a6eaec63bf01e0008c85ec4failed with deployment skipped;runmprc.comremains on source9ad6837756cdd409d296009fde5082eeeae5c059.daliu commentedon Aug 2, 2026
PAY-003A15 child #594 CLAIMED by
/rootat2026-08-02T02:53:33Zon exact released base102209dd99b331797f139dde7e209de75ea73a63, branchcodex/issue-594-dispute-chronology.Scope is exactly the pre-target Dispute/Event chronology comparison, named signed synthetic tests plus required A7/A10/A13/A14 compatibility reconciliation, and one source-only design section. All deployment/provider/data/live work and other #106 residuals remain excluded. #592 is released; active #571/#504 and draft #462 are disjoint.
daliu commentedon Aug 2, 2026
PAY-003A15 / #594 is COMPLETE/CLOSED/CLAIM RELEASED through PR #595.
Exact main:
3ac4acee407220f34ef5ced1f43efe69279dfa09; exact-main CI30730603255passed all five jobs; GitHub deployments are[]. New supported Dispute Events now durably quarantine embeddedDispute.created > Event.createdbefore target work, while equality/earlier chronology and processed replay remain compatible.This is merged source/test evidence, not live provider/backend proof. Netlify's exact-main production attempt failed without publication, the live site remains on older #473 source, Firebase was not deployed/read back, and no Stripe/provider/data/payment/refund/dispute action occurred. #106 remains open for freshness/skew policy, endpoint/API-version and provider-history proof, PAY-003B/C, reconciliation, alerts, protected release, and live verification.
Completion evidence: #594