[gustavomarques00]

Summary

• Implement central Stripe runtime policy in @devflow/billing-core.
• Restrict live Stripe operations to verified Vercel Production (VERCEL=1 + VERCEL_ENV=production).
• Permit safe Preview startup without Production database credentials.
• Preserve strict Production environment validation for boot.

Problem

• NODE_ENV=production alone did not distinguish Vercel Production from Preview.
• Stripe paths could be initialized in Preview based on inadequate environment assumptions.
• Startup validation required Production DB credentials even for Preview deployments.

Changes

• Stripe central guard (stripeRuntimePolicy) wired through adapters and WhatsApp Stripe client.
• Checkout and Billing Portal protection (canonical + legacy routes).
• Webhook and metered billing protection via guarded Stripe client.
• Environment-aware startup validation (instrumentation + validateProductionServerEnv).
• Deterministic regression tests for env policy and Stripe Preview denial.

Validation

Local (deterministic)

• 16 environment policy tests: PASS
• 37 billing-core tests: PASS
• 38 WhatsApp billing/Stripe tests: PASS
• ESLint on changed files: PASS
• Sanitized Preview-marker build (VERCEL=1, VERCEL_ENV=preview, no DB/Stripe secrets): PASS (Windows host; not hermetic network proof)

Remote

• Feature branch pushed at 61357c19
• Vercel Preview devflow-whatsapp deployment 8zuVKZt3w2N6oX1HVmLF35J1K6Kz: Ready / build PASS
• Preview landing page smoke: loaded without visible 500 / no redirect to Production observed

Local tests ≠ remote runtime proof for authenticated or mutating flows.

Security properties

• No Production database credentials required in Preview.
• No staging (STAGING_*) database fallback in application code.
• Live Stripe restricted by verified environment classification.
• Unknown Vercel environments do not gain Production privileges.

Limitations

• Authenticated flows not tested remotely (login/signup/checkout/portal/webhooks).
• No real Stripe transactions executed.
• No production database queries performed.
• Build Ready is not proof of complete runtime safety.
• Old Previews may retain previous configuration snapshots.
• Neon STAGING_* vars may still exist in Preview env but are unused by this SHA.
• Shared billing-core consumers (e.g. Financeiro) inherit the Stripe policy when built from this SHA.

Before merge

• Review and confirm SKIP_ENV_VALIDATION is not set in Vercel Production for WhatsApp (pre-existing emergency escape). — Verified 2026-11-03: operator search in project devflow-whatsapp Environment Variables (Project + Shared, filter All Environments) returned No Results Found for SKIP_ENV_VALIDATION. Does not prove absence outside those dashboard surfaces.
• Inspect required CI checks and wait for green / documented skips. — Verified 2026-11-03: GitHub Actions Check Runs SUCCESS (lint, test, test-whatsapp, test-financeiro, test-applyflow, build, quality, a11y, boundary, routing-governance). Documented exception: Vercel – devflow Commit Status remains FAILURE (stale; see Release Exception). Not treated as required repo check (branch protection 404; repo rulesets empty).
• Review Production boot validation behavior after merge (still fail-closed without required secrets). — Deferred: post-merge verification only.
• Review impact on shared billing-core consumers. — Verified on HEAD 61357c19: policy wired through adapters; Financeiro inherits when built from this SHA; regression tests added; no material incompatibility identified in prior security gate on this SHA.
• Confirm no accidental Production deployment from the feature branch (Production Branches remain main / ApplyFlow production). — Pending live Vercel Production Branch reconfirmation (CLI/API unavailable in this session). Docs state ApplyFlow Production Branch = production; historical baseline for other projects is main.

Release Exception — PR265-VERCEL-DEVFLOW-STALE-STATUS

Exception ID: PR265-VERCEL-DEVFLOW-STALE-STATUS
Recorded: 2026-11-03
Commit: 61357c192a8ed8f9812994d534411f87d6d6e5e3
Scope: Portal Preview deployment status only.

Original deployment: BLdxPRvkuATSz2KV9MZcX1q56H3F — failed during the Next.js/Turbopack Google Font resolution step with restored build cache.

Successful redeployment: 6lyEQez12 (Vercel UI identifier, operator-confirmed) — manual no-cache Preview redeployment of the same branch and SHA; Ready, 91/91 static pages generated.

GitHub status: Vercel – devflow remains failure, referencing the original failed deployment.

Vercel support clarification: Manual redeployments do not automatically update the GitHub Commit Status published for the original Git-triggered deployment.

Compensating evidence: GitHub Actions checks passed; the three other Vercel project contexts succeeded; the Portal Preview build and deployment completed successfully without modifying source code.

Security review: Stripe Live runtime isolation and shared billing-core impact were reviewed. SKIP_ENV_VALIDATION was not found in the WhatsApp project's Project or Shared environment variable listings.

Residual limitations:

• This exception does not change the failed GitHub status.
• The original failed deployment remains part of the audit trail.
• A successful Preview build does not prove complete Production runtime correctness.
• Organization-level ruleset applicability was not fully verified.
• Future Git-triggered Portal builds may still encounter the font-resolution failure.

Disposition: Accepted for human review only. Merge requires a separate release decision and explicit authorization.

Exception closure: A later officially published successful Vercel status for this SHA, or an authorized superseding SHA with passing Portal checks, resolves the stale-status exception.

Release policy

This PR must not be merged automatically.

Production deployment requires separate authorization and post-merge verification.

Draft status is intentional to prevent premature merge during review.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
devflow	Error		Oct 30, 2026 5:51pm UTC
devflow-applyflow	Ready	Preview	Oct 30, 2026 5:51pm UTC
devflow-financeiro	Ready	Preview	Oct 30, 2026 5:51pm UTC
devflow-whatsapp	Ready	Preview	Oct 30, 2026 5:51pm UTC

[gustavomarques00]

Owner Release Acknowledgment

Owner: Gustavo Marques de Lima
Date: 2026-11-03
PR: #265
SHA: 61357c192a8ed8f9812994d534411f87d6d6e5e3

The repository owner has explicitly approved continuing the release preparation process for this exact commit.

This acknowledgment:

• Confirms owner acceptance of the documented stale Vercel status exception for release evaluation.
• Does not represent an independent GitHub code review.
• Does not override required approvals, branch protection or organization rulesets.
• Does not authorize bypassing failing required checks.
• Does not authorize merging at this stage.
• Does not imply that Production runtime has been validated.

Final merge execution remains subject to operational readiness verification and separate explicit authorization.