Checkout
The browser submits an allowlisted plan key, never an amount, price identifier, or unit grant. One nonterminal Checkout attempt can exist per workspace and plan.
Venue Authority trust center
Billing and entitlement controls
Only a verified Stripe event can create paid capacity.
Fulfillment
A redirect grants nothing. Signed Stripe events reconcile the customer, session, plan, amount, purchase, and credit ledger before capacity becomes available.
Metering
One valid authenticated resolver or canonical facility request consumes one prepaid unit, including a fail-closed rejection. Exact request replay returns stored work without a second debit.