From f2ac5f63f862029ed618bee065a642f4819ef88a Mon Sep 17 00:00:00 2001 From: rcourtman Date: Tue, 14 Jul 2026 20:52:31 +0100 Subject: [PATCH] Record blocked production commercial audit --- ...nce-production-audit-blocked-2026-07-14.md | 74 +++++++++++++++++++ docs/release-control/v6/internal/status.json | 9 ++- .../v6/internal/subsystems/cloud-paid.md | 13 +++- 3 files changed, 92 insertions(+), 4 deletions(-) create mode 100644 docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md diff --git a/docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md b/docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md new file mode 100644 index 000000000..f66cd3725 --- /dev/null +++ b/docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md @@ -0,0 +1,74 @@ +# Self-Hosted Commercial Transition Production Audit Blocked Record + +- Date: `2026-07-14` +- Gate: `self-hosted-commercial-transition-coherence` +- Result: `blocked` +- Proof posture: read-only production observation + +## Scope And Safety + +The production license runtime and Stripe commercial state were inspected +without changing application files, deployment configuration, Stripe objects, +subscriptions, or customer records. The Stripe audit performed only HTTP GET +requests. Secret values remained inside the production host process and were +not printed, copied into the workspace, or recorded in this evidence. + +The executed proof used: + +1. `bash ./scripts/validate_license_runtime_config.sh` +2. the committed `pulse-pro:scripts/validate_stripe_catalog.py` streamed to the + production license host through the repo-pinned SSH helper + +The SSH helper first required a canonical trust fix: DNS resolution returned +the Tailscale FQDN while the repository intentionally pins the logical +`pulse-license` host identity. `pulse-pro` commit `d5f73b1` adds the explicit +`HostKeyAlias=pulse-license` binding while retaining batch mode, strict host-key +checking, the checked-in ED25519 pin, and no global known-host fallback. + +## Observed Facts + +1. Production runtime-file validation passed. The remote secrets file, + entrypoint, and binary were present and syntactically valid, and the + entrypoint's validation-only path exited successfully. +2. The production Stripe audit resolved all 25 governed price objects. +3. The production runtime environment did not provide a valid + `STRIPE_BILLING_PORTAL_CONFIGURATION_ID`. The auditor therefore did not + retrieve or certify a billing portal configuration. +4. Both public Relay prices still resolve to a Stripe product description that + describes remote access, mobile, push, and a custom URL but does not state + the governed one-owner-operated-environment boundary. +5. Both public Pro prices still resolve to a Stripe product description that + describes the earlier AI/auto-fix, history, RBAC, audit, and SAML framing but + does not state the current Patrol job, the one-owner-operated-environment + boundary, or that Pro includes Relay and Pulse Mobile. +6. The two legacy v1 recurring prices remain inactive. The auditor reported + these as the already-governed non-blocking legacy warnings. +7. No production customer, invoice, subscription, payment method, or license + record was read during this proof. + +## Inference + +The successful validation-only startup alongside the missing portal +configuration indicates that the deployed entrypoint/config contract has not +yet converged on the repo-owned fail-closed portal requirement. This is an +inference from observed behavior; the remote file contents were not copied or +inspected. + +## Blocking Verdict + +The read-only production audit is now exercised, but it failed expected state. +The gate must remain blocked. Passing local tests and resolving all price IDs do +not compensate for a missing governed portal configuration or public Stripe +product descriptions that contradict the canonical offer. + +## Required Unblock Steps + +1. Under a separately approved deployment/configuration change, deploy the + fail-closed runtime contract and configure the explicit governed Stripe + Customer Portal configuration. +2. Under a separately approved Stripe catalog change, align the public Relay + and Pro product descriptions with the canonical offer and Pro bundle. +3. Re-run the same GET-only production audit and require zero blocking errors. +4. Separately complete the Stripe test-mode transition/event-reconciliation + matrix and the real Relay/license-version-floor exercise. This production + catalog observation does not replace either end-to-end proof. diff --git a/docs/release-control/v6/internal/status.json b/docs/release-control/v6/internal/status.json index e02339bf9..2793c05ac 100644 --- a/docs/release-control/v6/internal/status.json +++ b/docs/release-control/v6/internal/status.json @@ -4900,7 +4900,7 @@ "status": "partial", "completion": { "state": "bounded-residual", - "summary": "The approved Community / Relay / Pro contract is now projected into local public/account copy, support and legal policy, atomic license-server entitlement state, quoted Relay/Pro and cadence transition sagas, and runtime downgrade preservation. Local Go, copy-model, and desktop/phone browser proof is green. Self-service remains unreleased until the governed Stripe test-mode event/reconciliation matrix, Relay version-floor proof, and production read-only catalog/portal audit satisfy the commercial transition gate.", + "summary": "The approved Community / Relay / Pro contract is now projected into local public/account copy, support and legal policy, atomic license-server entitlement state, quoted Relay/Pro and cadence transition sagas, and runtime downgrade preservation. Local Go, copy-model, and desktop/phone browser proof is green. The 2026-07-14 production GET-only audit ran but failed on a missing governed portal configuration and stale public Stripe product descriptions. Self-service remains unreleased until those failures are remediated and re-audited, and the governed Stripe test-mode event/reconciliation matrix plus Relay version-floor proof satisfy the commercial transition gate.", "tracking": [ { "kind": "lane-followup", @@ -4972,7 +4972,7 @@ "status": "partial", "completion": { "state": "bounded-residual", - "summary": "The local commercial projection now changes Stripe catalog identity, tier, cadence, features, continuity epoch, license version, transition history, and revocation outbox atomically, with a quote-bound transition authority for self-hosted plan and cadence changes. Cloud remains unavailable and MSP remains an assisted preview. External Stripe event/reconciliation and Relay version-floor proof remain governed release residuals.", + "summary": "The local commercial projection now changes Stripe catalog identity, tier, cadence, features, continuity epoch, license version, transition history, and revocation outbox atomically, with a quote-bound transition authority for self-hosted plan and cadence changes. Cloud remains unavailable and MSP remains an assisted preview. The production read-only catalog/portal audit is exercised but failed expected state; external Stripe event/reconciliation, Relay version-floor proof, and a passing production re-audit remain governed release residuals.", "tracking": [ { "kind": "release-gate", @@ -8027,6 +8027,11 @@ "path": "docs/release-control/v6/internal/records/commercial-offer-lifecycle-contract-2026-07-14.md", "kind": "file" }, + { + "repo": "pulse", + "path": "docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md", + "kind": "file" + }, { "repo": "pulse", "path": "internal/api/contract_test.go", diff --git a/docs/release-control/v6/internal/subsystems/cloud-paid.md b/docs/release-control/v6/internal/subsystems/cloud-paid.md index 67b130fc9..822952d56 100644 --- a/docs/release-control/v6/internal/subsystems/cloud-paid.md +++ b/docs/release-control/v6/internal/subsystems/cloud-paid.md @@ -1348,11 +1348,20 @@ or local completion steps, schedule-release retries repair the local quote, and the authoritative backfill can reopen a terminal inbox event through the cursor-aware retry path. The implementation is not yet a released self- service capability: the governed external Stripe transition matrix, event- -order/reconciliation exercise, Relay version-floor proof, and production -catalog/portal audit remain required by +order/reconciliation exercise, Relay version-floor proof, and a passing +production catalog/portal audit remain required by `self-hosted-commercial-transition-coherence`. Cloud remains unavailable and MSP remains an assisted preview. +The 2026-07-14 GET-only production catalog/portal audit was exercised and +failed expected state: all 25 governed prices resolved, but the runtime did not +provide a governed billing-portal configuration identifier and the public +Relay/Pro Stripe products retained pre-contract descriptions. No Stripe object +or customer record was mutated or inspected. The dated blocked record is +`docs/release-control/v6/internal/records/self-hosted-commercial-transition-coherence-production-audit-blocked-2026-07-14.md`; +the gate stays blocked until separately approved remediation is deployed and +the same read-only audit passes. + The Relay side now fails closed on missing feed authority, drains the feed before serving, exposes feed staleness through readiness, and tears down stale already-connected v6 sessions while clearing their reconnect tokens. Customer