You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Supported charge.dispute.created, charge.dispute.updated, and charge.dispute.closed Events now require usable embedded Dispute.created evidence before any target or provider-binding work. Missing or hostile evidence is durably recorded as target-free needs_review:invalid_dispute_created.
Officer impact: None — this server-only evidence gate changes no officer screen, task, field, permission, approval, topology, incident step, or recovery action.
Officer documentation: None — no officer procedure describes embedded Stripe timestamp admission, and no officer-visible or operational workflow changes.
Deployment evidence: Source and signed synthetic tests verified on this PR candidate. Code is not yet merged. The website was not published and runmprc.com was not verified for this change. Firebase was not deployed or read back. Stripe and other outside providers were not configured or acted on. No production data changed. No checkout, payment, refund, or dispute activity was performed. Live production behavior was not verified.
Invariant and order
Accept only primitive safe-integer Dispute creation seconds from 0 through 253402300799, inclusive.
Persist the valid outer Event time as the ledger stripeCreatedAt; never coerce, convert, persist, return, or log rejected embedded evidence.
Do not resolve targets/fallbacks, read or write bindings, read or mutate business records, or evaluate money/predecessor state after an invalid embedded time.
Keep structurally valid embedded Dispute times later than their outer Event compatible. Dispute/Event chronology is not part of this child.
Changes
Add one Dispute-only admission predicate using the existing non-coercing timestamp validator.
Give supported synthetic Dispute fixtures a valid default while preserving explicit adversarial overrides.
Add 138 focused tests spanning three lifecycles, both business domains, 14 invalid forms, Proxy defense, precedence, routes/fallbacks, binding and business isolation, missing targets, replay, inclusive boundaries, no-chronology behavior, and non-Dispute compatibility.
Reconcile only the stale PAY-003A9/A12 negative Dispute compatibility controls.
Add the PAY-003A14 source-only design and historical boundary notes.
Firestore Rules emulator: 418 passed against demo-rules-test
Commerce journal emulator: 63 passed against demo-pay002b2-test
Frontend lint baseline: passed
Direct diagnostic production build: compiled
Workflow YAML parse and git diff --check: passed
Dependency audit baseline unchanged: root 59 total / 4 production; Functions 8; no critical findings; no dependency changes
Three independent read-only reviews returned GO for runtime/security, adversarial-test, and documentation/provider/officer boundaries. Self-review found no authorization, App Check, PII/logging, idempotency, replay, impossible-transition, migration, production-fallback, or scope issue.
Compatibility and migration
There is no schema, Rules, index, package, workflow, API, provider-configuration, migration, backfill, or historical reprocessing change. Previously processed ledgers remain authoritative. Existing records and bindings are not inspected or repaired.
Worktree is clean and the exact remote head matches the reviewed candidate.
Three independent read-only reviews and self-review found no remaining issue.
Officer impact: none.
Officer documentation: None — no officer procedure changes.
Deployment evidence: the candidate source and synthetic checks are verified; this preview is non-production and no production website, runmprc.com, Firebase, provider, data, checkout/payment/refund/dispute, or live-behavior claim is made.
PR #593 is merged as exact main 102209dd99b331797f139dde7e209de75ea73a63; tree 3917905e176632739b3e28e5addbee75abbbe2aa and patch SHA-256 3baa80a3f1b3e4afb89ec4207e30ba3e2f3f8070b96406b02202d17a03a3e4ad match the reviewed candidate.
PR CI 30729260291 and post-main CI 30729355134 passed all five jobs. Preview 6a6eae04d87096000879f96d was ready/non-production/noindex. Production attempt 6a6eaec63bf01e0008c85ec4 failed before deployment; the live site remains on source 9ad6837756cdd409d296009fde5082eeeae5c059.
Officer impact: none.
Officer documentation: None — no officer procedure changed.
Deployment evidence: source/test/merge verified; website publication for this release, Firebase deployment/readback, provider configuration/action, production-data change, checkout/payment/refund/dispute activity, and live behavior are all unverified/not performed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #592. Child of #106.
Outcome
Supported
charge.dispute.created,charge.dispute.updated, andcharge.dispute.closedEvents now require usable embeddedDispute.createdevidence before any target or provider-binding work. Missing or hostile evidence is durably recorded as target-freeneeds_review:invalid_dispute_created.Officer impact: None — this server-only evidence gate changes no officer screen, task, field, permission, approval, topology, incident step, or recovery action.
Officer documentation: None — no officer procedure describes embedded Stripe timestamp admission, and no officer-visible or operational workflow changes.
Deployment evidence: Source and signed synthetic tests verified on this PR candidate. Code is not yet merged. The website was not published and
runmprc.comwas not verified for this change. Firebase was not deployed or read back. Stripe and other outside providers were not configured or acted on. No production data changed. No checkout, payment, refund, or dispute activity was performed. Live production behavior was not verified.Invariant and order
0through253402300799, inclusive.stripeCreatedAt; never coerce, convert, persist, return, or log rejected embedded evidence.Changes
Verification
Exact base:
38600a13aeaf57fa1c4d5571efa72af09ea983a1Reviewed head:
3fa9cbcde06c2314b35716bbb47e312dddb0369dTree:
3917905e176632739b3e28e5addbee75abbbe2aaPatch SHA-256:
3baa80a3f1b3e4afb89ec4207e30ba3e2f3f8070b96406b02202d17a03a3e4addemo-rules-testdemo-pay002b2-testgit diff --check: passedThree independent read-only reviews returned GO for runtime/security, adversarial-test, and documentation/provider/officer boundaries. Self-review found no authorization, App Check, PII/logging, idempotency, replay, impossible-transition, migration, production-fallback, or scope issue.
Compatibility and migration
There is no schema, Rules, index, package, workflow, API, provider-configuration, migration, backfill, or historical reprocessing change. Previously processed ledgers remain authoritative. Existing records and bindings are not inspected or repaired.