{
  "sourceRevision": "f3596a42898462ce6d45a56fd87e21fcf052b449",
  "retained": ".context/nouakchott-resume-validation/runtime-post-b176/executions/f3596a42898462ce6d45a56fd87e21fcf052b449/all/run/public-retention/skill-e2e-plan-ceo-finding-count/plan-ceo-review-1789541686775-P6UQ5y",
  "seed": "Please review this plan thoroughly in HOLD SCOPE mode. As you go, write your plan-mode plan to /tmp/g-0rk78u4r/gstack-paid-shard-LuFS2F/tmp/gstack-e2e-plan-ceo-J7x9F3/gstack-test-plan-ceo.md (use Edit/Write to that exact path).\nProceed directly to the requested CEO review; skip the optional /office-hours prerequisite.\nFinish after this CEO review; I will handle subsequent reviews manually.\n\n# Plan: Payment Processing Integration\n\n## Existing contracts retained\nThe approved motivation is to move payment orchestration out of the prior\nlibrary-adapter handler into application-owned code while retaining the\nexisting payment and receipt product behavior. The shared dispatcher remains\navailable; the proposed bypass below is still an architectural choice to review.\nThe existing ingress middleware verifies the Stripe signature against the\nraw request body and rejects invalid signatures before invoking handlers.\nThe existing ingress forwards only `payment_intent.succeeded` events to\nthis handler; other Stripe event types are acknowledged without invoking it.\nThe existing payload adapter exposes `event.data.object.metadata.user_id`\nas `request.params.userId`. This params object is the parsed body-data map,\nnot URL query/path parameters; all users share one webhook URL.\nThe adapter acknowledges missing, nil, or empty user_id metadata with\nHTTP 200 and an event-correlated warning before invoking this handler.\nFor every nonempty external string it performs no SQL-format validation.\nThe adapter forwards that external string unchanged. It does not cast,\nescape, or SQL-sanitize it; a valid signature does not make it safe for SQL.\nUser IDs are opaque TEXT values, including punctuation and Unicode. The\nlookup has no integer/UUID cast or ID-format restriction; every nonempty\nstring is a valid identifier representation.\nAn existing ingress ownership guard checks the PaymentIntent ID against\nits stored opaque user-ID binding before invoking the handler. A mismatch\nis acknowledged with HTTP 200 and an event-correlated warning. This is an\nidentity comparison, not SQL-format validation; the adapter still forwards\nthe original string unchanged.\nThe existing webhook event guard deduplicates deliveries by Stripe event ID,\nand an existing per-user lock serializes payment updates.\nThe event guard acquires the existing per-user lock before checking the\ncommitted completion marker, and rechecks after any lock wait. It holds\nthat lock through the handler and completion bookkeeping; an overlapping\ncompleted duplicate does not invoke the handler.\nThe new handler runs inside those unchanged guards; this plan does not\nreplace signature verification, event deduplication, or update locking.\nThe existing user update assigns payment_status=paid and the payment intent\nID; it does not increment a balance or counter. Repeating the same payment\nintent assigns the same values, independently of the event-ID guard.\nThe existing lookup-result guard acknowledges unknown/deleted users with\nHTTP 200, logs the event, and stops before user updates or email fan-out.\nThe retained recipient-policy helper treats a nil or empty email address as\nskipped_missing_address: payment processing continues normally, and no mail\nclient call is attempted. It persists an event/user/PaymentIntent-correlated\nskip record, emits a structured warning, and increments the existing counter.\nThe existing notification runbook already covers that skip result: correct\nthe account address, then retry only its recorded notification using the\nsame PaymentIntent idempotency key. It never replays the payment for this case.\nThat recipient policy does not catch failures from sends to nonempty addresses;\nthe shared mail client still rethrows those exceptions to this handler.\nAccount deletion uses the same per-user lock. The handler holds it from\nlookup through update and inline email, so deletion either precedes lookup\n(the existing unknown/deleted-user path) or follows the handler; it cannot\nremove the user between lookup and update.\nThe ingress wrapper already logs event IDs, outcomes, and durations, with\nalerts for failed webhook processing. Those controls remain in place.\nThe existing DB and mail clients attach the adapter user ID and event ID\nto outcome traces, including update success and email delivery success or\nfailure. These shared clients rethrow exceptions unchanged; tracing does\nnot rescue email errors or change the inline email call below.\nThe shared mail client also publishes its delivery failure rate to the\nexisting dashboard and tested on-call alert, including caught exceptions.\nThe existing incident runbook uses the correlated DB and mail outcomes to\ndistinguish committed payments from failed notifications. It directs on-call\nto check provider status and retry only the failed notification through the\nexisting notification retry procedure, never replay the payment blindly.\nDB lookup/update exceptions propagate to that ingress wrapper, which logs\nthe failure and returns HTTP 500 so Stripe retries the event. The existing\nevent-ID dedup guard records completion only after the database transaction\ncommits; failed or rolled-back database attempts remain retryable.\nThe deployment already has a handler feature flag and a documented, tested\nrollback to the prior handler; this change uses that existing rollout path.\nThat documented manual rollout checklist already requires a staging\npayment-event replay for this handler and verification of the user update,\nemail delivery, and correlated outcome trace before enabling it broadly.\nThis is manual deployment verification, not automated handler regression\ncoverage; no new automated tests are planned in the Tests section below.\nThe existing notification contract sends one payment receipt per PaymentIntent,\nincluding a summary of the user orders. With zero orders it still sends one\nreceipt with an empty order summary; the order loop is data loading, never\none email or payment update per order. These product semantics are retained.\nThe shared mail client already derives a provider idempotency key from that\nPaymentIntent ID. The provider durably suppresses duplicate successful sends\nfor the same key across process crashes, webhook retries, and manual retries.\nBefore rethrowing a failed or timed-out send, that client durably records the\nnotification attempt for the existing retry procedure. The dashboard and\non-call alert already monitor failed-notification age and backlog after an\noutage clears, as well as failure rate; the runbook retries those records.\nThe existing mail-client deadline is one second, enforced by cancellation\nof the provider request with no inline retries. It raises MailTimeout on\nexpiry. The retained DB/ingress deadlines bound their combined work to two\nseconds, leaving headroom inside the existing ten-second webhook deadline.\nNeither deadlines nor retry records catch the mail exception for this handler;\nthe shared client still rethrows it to the inline caller described below.\nEvery existing event-correlated outcome trace includes the active handler\nidentity (prior or new), so rollout attribution is already available.\nIf a separate handler class is retained, its already-approved name is\n`Webhooks::StripePaymentWebhookHandler` in the application-owned namespace,\nnever the Stripe library namespace. This naming choice is settled; whether\nto add a separate implementation or reuse WebhookDispatcher remains open.\n\n## Architecture\nWe're adding a new `StripePaymentWebhookHandler` class that will handle Stripe webhooks.\nThis bypasses the existing `WebhookDispatcher` module — we want a clean\nnamespace separation.\n\n## Database access\nThe new endpoint reads `request.params.userId` directly into a raw SQL\nfragment for the lookup query.\n\n## Webhook fan-out\nOn payment success we update the user record AND fire a notification email.\nBoth happen inline; no error handling on the email leg.\n\n## Tests\nNone planned. We'll rely on the existing integration suite catching regressions.\n\n## Performance\nEach webhook lookup hits the database for the user, then fetches each\norder in a loop.",
  "savedPlan": "# Plan: Payment Processing Integration — CEO Review (HOLD SCOPE)\n\nReviewed by /plan-ceo-review on 2026-09-16. Branch: main. Base: main. Platform: unknown (no remote).\nSource plan: PLAN.md (commit 2aaa8e9). Session: 3496206-1789541674-b00cf7c7.\nMode: HOLD SCOPE (explicit user instruction; no mode question asked).\n\n## Context\n\nMove Stripe `payment_intent.succeeded` orchestration out of the prior library-adapter\nhandler into application-owned code, keeping the existing payment and receipt product\nbehavior. The plan adds one handler class, a user lookup, a user update, an inline\nreceipt email, and per-order data loading. It sits inside retained ingress guards\n(signature, event-type filter, ownership, event-ID dedup, per-user lock, unknown-user\nstop, feature flag with tested rollback).\n\n## Original plan (verbatim, PLAN.md:105-123)\n\n### Architecture\nWe're adding a new `StripePaymentWebhookHandler` class that will handle Stripe webhooks.\nThis bypasses the existing `WebhookDispatcher` module — we want a clean namespace separation.\n\n### Database access\nThe new endpoint reads `request.params.userId` directly into a raw SQL fragment for the lookup query.\n\n### Webhook fan-out\nOn payment success we update the user record AND fire a notification email.\nBoth happen inline; no error handling on the email leg.\n\n### Tests\nNone planned. We'll rely on the existing integration suite catching regressions.\n\n### Performance\nEach webhook lookup hits the database for the user, then fetches each order in a loop.\n\nThe \"Existing contracts retained\" section (PLAN.md:7-103) is treated as the source of\ntruth for retained behavior and is not repeated here.\n\n## Pre-review system audit\n\n- Repo: two files (CLAUDE.md, PLAN.md), one commit, no stash, no TODO/FIXME, no TODOS.md,\n  no architecture docs, no design doc, no CEO handoff note. No prior learnings (LEARNINGS: 0).\n- No retrospective signal: single commit, nothing reverted or refactored.\n- Frontend/UI scope: none. DESIGN_SCOPE not set; Section 11 will be skipped as no-UI.\n- Landscape (WebSearch fallback; Aside absent): Layer 1 consensus = verify signature on raw\n  body, dedup by event.id before business work, commit then 200, replay real events in tests.\n  Layer 2 search agrees. Layer 3: the plan inherits all of this from the retained ingress;\n  the new risk is concentrated in the four new pieces (bypass, raw SQL, unhandled email, N+1).\n\n## Step 0 evidence\n\n### 0A Premise Challenge\n1. Right problem? Yes: owning payment orchestration in application code is a sound\n   maintainability move. The framing \"clean namespace separation\" is already satisfied by\n   the approved `Webhooks::` class name; it does not by itself justify bypassing the dispatcher.\n2. Outcome: same user-visible payment + receipt behavior, code the team owns. The plan\n   reaches it directly; no proxy problem.\n3. Do nothing: prior handler keeps working. Pain is maintainability, not an outage. That\n   means correctness regressions introduced by this move are pure downside; the bar is\n   \"no behavior change,\" which is exactly what HOLD SCOPE protects.\n\n### 0B Existing Code Leverage\n| Sub-problem | Existing code | Plan reuses? |\n|---|---|---|\n| Routing events to handlers | `WebhookDispatcher` | NO (bypassed) — open row D1 |\n| Signature, event-type filter, ownership, dedup, per-user lock, unknown-user stop | ingress guards | yes (unchanged) |\n| User lookup | existing DB client (parameterized) | partial — raw SQL fragment proposed, row D2 |\n| Email send, idempotency key, failure record, dashboards | shared mail client | yes, but exception rethrown to a handler with no rescue — row D3 |\n| Rollout | feature flag + tested rollback + manual staging checklist | yes |\n| Regression coverage | \"existing integration suite\" — plan itself says no automated handler coverage exists | NO — row D4 |\n| Order data for receipt | per-order fetch loop | rebuilds an N+1 where one query serves — row D5 |\n\n### 0C Dream State\n```\n  CURRENT STATE                    THIS PLAN                       12-MONTH IDEAL\n  library-adapter handler   --->   app-owned handler class   --->  one dispatcher, N app-owned\n  behind dispatcher + guards       bypassing dispatcher;           handlers registered with it;\n                                   raw SQL; unhandled email;       parameterized lookups; email\n                                   no automated tests              failures never 500 a committed\n                                                                   payment; replay tests per event\n```\nDirection: toward the ideal on ownership; away from it on routing (two paths), safety\n(raw SQL), and reliability (mail outage becomes webhook failure). Each of those is a\nrepair, not an expansion, so each gets its own decision row below.\n\n### 0E Mode\nHOLD SCOPE, explicit user instruction (\"review this plan thoroughly in HOLD SCOPE mode\").\nSteps 2-3 skipped; no question log. Planned changes: ~1 new class + route wiring + lookup +\nhandler body; estimate 2-4 files. Under the 8-file / 2-class complexity threshold.\n\n### 0G HOLD SCOPE checks\n1. Complexity: 1 new class, 2-4 files. Under threshold; no challenge on moving parts.\n2. Minimum change: the handler body itself is the minimum. Nothing in the written plan is\n   deferrable without blocking the goal; no defer/keep questions raised.\n3. Invariants stated by the plan that the written sections violate or leave ambiguous:\n   - \"a valid signature does not make it safe for SQL\" + \"opaque TEXT including punctuation\"\n     vs. raw SQL fragment (D2).\n   - \"combined DB/ingress work bounded to two seconds\" vs. unbounded per-order loop (D5).\n   - \"committed payments vs failed notifications are distinguished by runbook\" vs. an\n     unhandled MailTimeout turning a committed payment into HTTP 500 + Stripe retry (D3).\n   - \"new handler runs inside those unchanged guards\" vs. bypassing the module that may\n     host them (D1).\n   - \"well-tested code is non-negotiable\" vs. \"None planned\" (D4).\n   Repairs needed to meet stated invariants are in scope under HOLD SCOPE; each still\n   requires explicit approval before the plan changes.\n\n## Decision ledger\n\n| ID and owner | Contract and evidence | Current | Proposed | Status | Exact approval and scope |\n|---|---|---|---|---|---|\n| D1 (user; architecture) | Plan says bypass `WebhookDispatcher` for namespace separation (PLAN.md:105-108) while stating \"whether to add a separate implementation or reuse WebhookDispatcher remains open\" (PLAN.md:102-103) and \"runs inside those unchanged guards\" (PLAN.md:38-39). Unknown: whether any guard or the feature flag lives in the dispatcher. | New class, bypasses dispatcher | A) register the approved class with the dispatcher; B) bypass as written, with explicit guard/flag wiring proof; C) no new class, extend dispatcher's existing handler | unresolved | — |\n| D2 (user; data access) | Raw SQL fragment from `request.params.userId` (PLAN.md:110-112). Plan: IDs are opaque TEXT with punctuation/Unicode, adapter does not escape (PLAN.md:21-26). | Raw SQL string interpolation | A) parameterized query / ORM finder; B) keep raw fragment | unresolved | — |\n| D3 (user; failure handling) | Inline email, no error handling (PLAN.md:114-116). Mail client rethrows MailTimeout/errors after durably recording the attempt (PLAN.md:85-97). Dedup completion is recorded after DB commit (PLAN.md:70-73); order of completion bookkeeping vs. handler exception is unspecified. | Exception propagates → HTTP 500 → Stripe retries a committed payment | A) rescue mail errors after commit, log correlated warning, return success; B) keep propagate; C) move send to existing retry procedure only | unresolved | — |\n| D4 (user; tests) | \"None planned\" (PLAN.md:118-119). Plan itself: \"no automated handler regression coverage\" (PLAN.md:79-80). | Manual staging replay only | A) automated handler tests for happy/nil/empty/error paths; B) keep none | unresolved | — |\n| D5 (user; performance) | Per-order fetch loop (PLAN.md:121-123) inside a 2-second DB/ingress budget (PLAN.md:94-95). | N+1 loop | A) single batched order query; B) keep loop | unresolved | — |\n\n## NOT in scope\n(none yet)\n\n## currentDecision — D1: Register with WebhookDispatcher or bypass it?\n\nHeader: Architecture\nQuestion: D1 — Should `Webhooks::StripePaymentWebhookHandler` register with the existing\n`WebhookDispatcher`, or bypass it as the plan proposes?\n\nELI10: Today one front door (the dispatcher) receives every Stripe event and sends it to the\nright handler, with the security and dedup checks wrapped around that door. The plan builds a\nsecond door for payments so the code lives in its own namespace. Two doors means two places to\nwire the feature flag, two places to prove the guards run, and two routing paths to keep in sync.\nThe namespace goal is already met by the approved class name, which works behind either door.\n\nStakes if wrong: a guard or the flag that only wraps the dispatcher path silently does not wrap\nthe new path; a duplicate delivery or a forged-ownership event reaches SQL; rollback via the\nflag does not actually route traffic back.\n\nRecommendation: A because namespace separation is a naming decision, not a routing one, and\none routing path keeps every retained guard provably in front of the new code.\n\nNote: options differ in kind, not coverage — no completeness score.\n\nCommitment | Source/approval or pending | Current | A | B | C\n---|---|---|---|---|---\nClass name `Webhooks::StripePaymentWebhookHandler` | approved (PLAN.md:100-102) | new class | same | same | no new class\nRouting path | pending (D1) | bypass | dispatcher | separate route | dispatcher (existing handler)\nGuards + flag wiring | approved retained (PLAN.md:38-39, 74-75) | asserted | inherited | must be re-wired and proven | inherited\nFiles touched (est.) | pending | 2-4 | 2-3 | 3-5 | 1-2\n\nA) Register the new class with WebhookDispatcher (recommended)\n   Summary: keep one routing path; the dispatcher maps `payment_intent.succeeded` to the new\n   class behind the existing feature flag. Effort S (human ~half day / CC ~10 min). Risk low.\n   Pros: every retained guard and the flag stay in front of the handler by construction;\n   smallest diff; rollback path unchanged. Cons: the dispatcher module still owns routing,\n   so \"clean separation\" is namespace-only; one registration line lives outside `Webhooks::`.\n   Reuse: dispatcher, all guards, flag. Verification: existing dispatcher routing tests plus\n   whatever D4 decides.\n\nB) Bypass the dispatcher as written, with explicit guard and flag wiring\n   Summary: separate route wired directly into the ingress, with a written proof (per guard)\n   that signature, event filter, ownership, dedup, per-user lock and flag wrap it. Effort M\n   (human ~1-2 days / CC ~30 min). Risk medium-high. Pros: full routing independence from the\n   dispatcher; nothing in the old module to touch. Cons: second routing path to maintain;\n   any guard hosted by the dispatcher must be duplicated or lifted; flag rollback must be\n   verified for both paths. Reuse: guards only if they are ingress-level (unverified).\n   Verification: must add wiring proof to the manual checklist.\n\nC) No new class; move orchestration into the dispatcher's existing payment handler\n   Summary: rewrite the existing library-adapter handler body in place as application-owned\n   code, dropping the separate class. Effort S (human ~half day / CC ~10 min). Risk low-medium.\n   Pros: smallest surface; one file. Cons: discards the approved class name; feature-flag\n   rollback to \"prior handler\" no longer has a distinct prior handler to route to, weakening\n   the tested rollback. Reuse: everything. Verification: same as A.\n\nNet: A trades a purist notion of separation for a provable guard chain and an unchanged\nrollback; B buys independence at the cost of re-proving every guard; C shrinks the diff but\nundermines the flag-based rollback the plan relies on.\n",
  "call": {
    "sessionId": "0afacbe7-f286-4d91-9e01-f4b51767f68e",
    "toolUseId": "toolu_01LbJoBo9KBKrGBE71yVH6pB",
    "questions": [
      {
        "question": "D1 — Should `Webhooks::StripePaymentWebhookHandler` register with the existing `WebhookDispatcher`, or bypass it as the plan proposes?\nProject/branch/task: main, Payment Processing Integration plan, HOLD SCOPE CEO review.\nELI10: Today one front door (the dispatcher) receives every Stripe event and routes it, with the security and dedup checks wrapped around that door. The plan builds a second door for payments so the code lives in its own namespace. Two doors means two places to wire the feature flag and two places to prove the guards run. The namespace goal is already met by the approved class name, which works behind either door.\nStakes if we pick wrong: a guard or the flag that only wraps the dispatcher path silently misses the new path; a duplicate or forged-ownership event reaches SQL; flag rollback does not actually route traffic back.\nRecommendation: A because namespace separation is a naming decision, not a routing one, and one routing path keeps every retained guard provably in front of the new code.\nNote: options differ in kind, not coverage — no completeness score.\nNet: A trades a purist notion of separation for a provable guard chain and an unchanged rollback; B buys independence at the cost of re-proving every guard; C shrinks the diff but undermines the flag-based rollback the plan relies on.",
        "header": "Architecture",
        "multiSelect": false,
        "options": [
          {
            "label": "A) Register with dispatcher (recommended)",
            "description": "Dispatcher maps payment_intent.succeeded to the new class behind the existing flag. Effort S (human ~half day / CC ~10 min), risk low.\n✅ Every retained guard and the feature flag stay in front of the handler by construction\n✅ Smallest diff and the tested rollback path is completely unchanged\n❌ Routing still lives in the dispatcher module, so separation is namespace-only"
          },
          {
            "label": "B) Bypass dispatcher, prove wiring",
            "description": "Separate route wired into ingress with a per-guard proof that signature, filter, ownership, dedup, lock and flag wrap it. Effort M (human ~1-2 days / CC ~30 min), risk medium-high.\n✅ Full routing independence; nothing in the old dispatcher module gets touched\n✅ Matches the plan text as written, no re-litigation of the architecture section\n❌ Second routing path to maintain; any guard hosted by the dispatcher must be duplicated or lifted"
          },
          {
            "label": "C) No new class, extend existing handler",
            "description": "Rewrite the dispatcher's existing payment handler body in place as app-owned code. Effort S (human ~half day / CC ~10 min), risk low-medium.\n✅ Smallest surface area: one file, everything reused\n✅ No new routing or registration to reason about at all\n❌ Discards the approved class name and leaves no distinct prior handler for the flag rollback to route to"
          }
        ]
      }
    ],
    "answered": true,
    "failed": false,
    "answers": {
      "D1 — Should `Webhooks::StripePaymentWebhookHandler` register with the existing `WebhookDispatcher`, or bypass it as the plan proposes?\nProject/branch/task: main, Payment Processing Integration plan, HOLD SCOPE CEO review.\nELI10: Today one front door (the dispatcher) receives every Stripe event and routes it, with the security and dedup checks wrapped around that door. The plan builds a second door for payments so the code lives in its own namespace. Two doors means two places to wire the feature flag and two places to prove the guards run. The namespace goal is already met by the approved class name, which works behind either door.\nStakes if we pick wrong: a guard or the flag that only wraps the dispatcher path silently misses the new path; a duplicate or forged-ownership event reaches SQL; flag rollback does not actually route traffic back.\nRecommendation: A because namespace separation is a naming decision, not a routing one, and one routing path keeps every retained guard provably in front of the new code.\nNote: options differ in kind, not coverage — no completeness score.\nNet: A trades a purist notion of separation for a provable guard chain and an unchanged rollback; B buys independence at the cost of re-proving every guard; C shrinks the diff but undermines the flag-based rollback the plan relies on.": "A) Register with dispatcher (recommended)"
    },
    "unansweredQuestionIndices": [],
    "answeredAt": "2026-09-16T06:58:38.833Z"
  },
  "sourceSha256": "8890fe86e7731c8bb71ea1d3d7f754c336e8cfcdeb30e3dc3fae8c0344097d5b",
  "savedSha256": "37728ff7d27d99eb56a4170ec3a36bb8af6c385ae298626057b6874219d758b2",
  "publicSha256": "fd468cf0816e53a28487a8eb7cac3fb3e1bb1d9605931df44ca6006590ee4692",
  "historicalPaidFailureUnchanged": true
}