Record blocked production commercial audit

docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md

@@ -0,0 +1,74 @@
+# Self-Hosted Commercial Transition Production Audit Blocked Record
+
+- Date: `2026-07-14`
+- Gate: `self-hosted-commercial-transition-coherence`
+- Result: `blocked`
+- Proof posture: read-only production observation
+
+## Scope And Safety
+
+The production license runtime and Stripe commercial state were inspected
+without changing application files, deployment configuration, Stripe objects,
+subscriptions, or customer records. The Stripe audit performed only HTTP GET
+requests. Secret values remained inside the production host process and were
+not printed, copied into the workspace, or recorded in this evidence.
+
+The executed proof used:
+
+1. `bash ./scripts/validate_license_runtime_config.sh`
+2. the committed `pulse-pro:scripts/validate_stripe_catalog.py` streamed to the
+   production license host through the repo-pinned SSH helper
+
+The SSH helper first required a canonical trust fix: DNS resolution returned
+the Tailscale FQDN while the repository intentionally pins the logical
+`pulse-license` host identity. `pulse-pro` commit `d5f73b1` adds the explicit
+`HostKeyAlias=pulse-license` binding while retaining batch mode, strict host-key
+checking, the checked-in ED25519 pin, and no global known-host fallback.
+
+## Observed Facts
+
+1. Production runtime-file validation passed. The remote secrets file,
+   entrypoint, and binary were present and syntactically valid, and the
+   entrypoint's validation-only path exited successfully.
+2. The production Stripe audit resolved all 25 governed price objects.
+3. The production runtime environment did not provide a valid
+   `STRIPE_BILLING_PORTAL_CONFIGURATION_ID`. The auditor therefore did not
+   retrieve or certify a billing portal configuration.
+4. Both public Relay prices still resolve to a Stripe product description that
+   describes remote access, mobile, push, and a custom URL but does not state
+   the governed one-owner-operated-environment boundary.
+5. Both public Pro prices still resolve to a Stripe product description that
+   describes the earlier AI/auto-fix, history, RBAC, audit, and SAML framing but
+   does not state the current Patrol job, the one-owner-operated-environment
+   boundary, or that Pro includes Relay and Pulse Mobile.
+6. The two legacy v1 recurring prices remain inactive. The auditor reported
+   these as the already-governed non-blocking legacy warnings.
+7. No production customer, invoice, subscription, payment method, or license
+   record was read during this proof.
+
+## Inference
+
+The successful validation-only startup alongside the missing portal
+configuration indicates that the deployed entrypoint/config contract has not
+yet converged on the repo-owned fail-closed portal requirement. This is an
+inference from observed behavior; the remote file contents were not copied or
+inspected.
+
+## Blocking Verdict
+
+The read-only production audit is now exercised, but it failed expected state.
+The gate must remain blocked. Passing local tests and resolving all price IDs do
+not compensate for a missing governed portal configuration or public Stripe
+product descriptions that contradict the canonical offer.
+
+## Required Unblock Steps
+
+1. Under a separately approved deployment/configuration change, deploy the
+   fail-closed runtime contract and configure the explicit governed Stripe
+   Customer Portal configuration.
+2. Under a separately approved Stripe catalog change, align the public Relay
+   and Pro product descriptions with the canonical offer and Pro bundle.
+3. Re-run the same GET-only production audit and require zero blocking errors.
+4. Separately complete the Stripe test-mode transition/event-reconciliation
+   matrix and the real Relay/license-version-floor exercise. This production
+   catalog observation does not replace either end-to-end proof.

docs/release-control/v6/internal/status.json

@@ -4900,7 +4900,7 @@
       "status": "partial",
       "completion": {
         "state": "bounded-residual",
-        "summary": "The approved Community / Relay / Pro contract is now projected into local public/account copy, support and legal policy, atomic license-server entitlement state, quoted Relay/Pro and cadence transition sagas, and runtime downgrade preservation. Local Go, copy-model, and desktop/phone browser proof is green. Self-service remains unreleased until the governed Stripe test-mode event/reconciliation matrix, Relay version-floor proof, and production read-only catalog/portal audit satisfy the commercial transition gate.",
+        "summary": "The approved Community / Relay / Pro contract is now projected into local public/account copy, support and legal policy, atomic license-server entitlement state, quoted Relay/Pro and cadence transition sagas, and runtime downgrade preservation. Local Go, copy-model, and desktop/phone browser proof is green. The 2026-07-14 production GET-only audit ran but failed on a missing governed portal configuration and stale public Stripe product descriptions. Self-service remains unreleased until those failures are remediated and re-audited, and the governed Stripe test-mode event/reconciliation matrix plus Relay version-floor proof satisfy the commercial transition gate.",
         "tracking": [
           {
             "kind": "lane-followup",
@@ -4972,7 +4972,7 @@
       "status": "partial",
       "completion": {
         "state": "bounded-residual",
-        "summary": "The local commercial projection now changes Stripe catalog identity, tier, cadence, features, continuity epoch, license version, transition history, and revocation outbox atomically, with a quote-bound transition authority for self-hosted plan and cadence changes. Cloud remains unavailable and MSP remains an assisted preview. External Stripe event/reconciliation and Relay version-floor proof remain governed release residuals.",
+        "summary": "The local commercial projection now changes Stripe catalog identity, tier, cadence, features, continuity epoch, license version, transition history, and revocation outbox atomically, with a quote-bound transition authority for self-hosted plan and cadence changes. Cloud remains unavailable and MSP remains an assisted preview. The production read-only catalog/portal audit is exercised but failed expected state; external Stripe event/reconciliation, Relay version-floor proof, and a passing production re-audit remain governed release residuals.",
         "tracking": [
           {
             "kind": "release-gate",
@@ -8027,6 +8027,11 @@
           "path": "docs/release-control/v6/internal/records/commercial-offer-lifecycle-contract-2026-07-14.md",
           "kind": "file"
         },
+        {
+          "repo": "pulse",
+          "path": "docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md",
+          "kind": "file"
+        },
         {
           "repo": "pulse",
           "path": "internal/api/contract_test.go",

docs/release-control/v6/internal/subsystems/cloud-paid.md

@@ -1348,11 +1348,20 @@ or local completion steps, schedule-release retries repair the local quote, and
 the authoritative backfill can reopen a terminal inbox event through the
 cursor-aware retry path. The implementation is not yet a released self-
 service capability: the governed external Stripe transition matrix, event-
-order/reconciliation exercise, Relay version-floor proof, and production
-catalog/portal audit remain required by
+order/reconciliation exercise, Relay version-floor proof, and a passing
+production catalog/portal audit remain required by
 `self-hosted-commercial-transition-coherence`. Cloud remains unavailable and
 MSP remains an assisted preview.
 
+The 2026-07-14 GET-only production catalog/portal audit was exercised and
+failed expected state: all 25 governed prices resolved, but the runtime did not
+provide a governed billing-portal configuration identifier and the public
+Relay/Pro Stripe products retained pre-contract descriptions. No Stripe object
+or customer record was mutated or inspected. The dated blocked record is
+`docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md`;
+the gate stays blocked until separately approved remediation is deployed and
+the same read-only audit passes.
+
 The Relay side now fails closed on missing feed authority, drains the feed
 before serving, exposes feed staleness through readiness, and tears down stale
 already-connected v6 sessions while clearing their reconnect tokens. Customer