← Documentation home

Canonical Markdown source · Oct 20, 2018

Supporter checkout release review — August 22, 2026

ops/supporter-checkout-release-review-2026-08-22.md · 92 lines · SHA-256 9091cc2645df

This is a review packet, not approval and not payment evidence.

Decision requested

Approve or reject activation of Meta Museum's one-time supporter Checkout flow,

operated by Sun & Rain Works.

`6b4a1a1d5b37b8a61a78030a3206ed1f1c3e9032e4d8e02b3f2e03cb42a36ecc`

  • Release digest:
  • Activation flag: `SUPPORT_CHECKOUT_ENABLED=true`
  • Default after deployment: disabled
  • Production credential: the existing server-only restricted live Stripe key
  • Current production state: supporter checkout inactive

The August 22 support-page redesign changed the release-bound page and shared

styles. The digest below supersedes the earlier review candidate and has not

been approved; the production activation flag must remain disabled.

The digest is SHA-256 over newline-separated, path-sorted

`relative-path:file-sha256` rows for the eleven files listed below, with one final

newline. Text files are normalized to LF before their file digests are computed,

so the approval candidate is stable across Windows and Linux checkouts.

Offer reviewed

public interface. The server refuses values below USD 5, above USD 500, or

non-whole-dollar amounts.

and infrastructure. It provides a payment receipt and continued public work,

not goods, governance rights, private access, or promised output.

artwork-image rights and is not represented as tax deductible.

  • One-time support only; no recurring payment or subscription.
  • The visitor chooses a whole-dollar amount from USD 5, 10, 25, or 50 in the
  • Support funds public research, editorial review, rights-aware presentation,
  • Support does not purchase editorial influence, private collection access, or
  • Stripe processes payment details; Meta Museum must not receive card numbers.

Technical and evidence boundary

server credential begins with `rk_live_`.

`support`, revision `1`, on both the Checkout Session and PaymentIntent.

status, USD currency, bounded whole-dollar amount, and exact offer metadata.

separate from settlement, processor fees, refunds, disputes, and net

contribution.

permanently excluded from verified revenue.

  • Production refuses checkout unless the explicit feature flag is true and the
  • Checkout uses Stripe-hosted one-time payment mode and records offer ID
  • The return page retrieves the Checkout Session from Stripe and checks paid
  • A redirect alone is never payment proof. A provider-confirmed payment remains
  • Webhook aggregation remains the financial evidence path. Test-mode events are

Release hashes

`677a06473450b717e3c9300d5fd3391d68e29f93ec8da815a910d8f6c142ce5d`

`a5a549230558ffdd57d258aeefbd45bf56331bfc7fffb921137fa547265e75af`

`9a999d3ba78aae7577a9d917b9c85e3b651c53d71322d9c5f6de74e09ae598b2`

`466b5b569ec36d7b40a9cd0bd13f12cda440a9de0b98aceefd59181b8695c69d`

`f8c49698765928c3eda886109380b0b7b4e0df671810c6618a942138f96872d3`

`1b2b0020d4c02b9f4cc657865227c6bd909f84a85b29f3781d29c9d1b84f812d`

`9c9d7e6e59f4fa85b07db3fff2b1f6a73c2ac06d71ec32458c6eb4155da22e82`

`f5075979c7a72e14d14e995b5fec8e069f4c007532ef8edc20cb91bf8ed6f0b0`

`6e383d98f8e02acd8fa492cfc7d00724350f064b4f59d9eda08deba87b2081b6`

`f339fcb5ed39a0fd26c4b310826a545ac18f38df27cfe830a22540dc2df82924`

`29bf62ce689c3fe60c52c30ea306e3c31150b079d0cf903bd1e5821e7737586e`

  • `app/api/stripe/checkout/route.ts`:
  • `app/globals.css`:
  • `app/privacy/page.tsx`:
  • `app/support/page.tsx`:
  • `app/support/success/page.tsx`:
  • `app/terms/page.tsx`:
  • `src/services/public-analytics.ts`:
  • `src/services/revenue-offers.ts`:
  • `src/services/stripe-checkout.ts`:
  • `src/services/stripe-revenue-evidence.ts`:
  • `src/services/stripe-webhook-store.ts`:

Activation and verification

  1. Deploy with `SUPPORT_CHECKOUT_ENABLED` absent or false.
  1. Obtain attributable human approval of the exact digest above.
  1. Set `SUPPORT_CHECKOUT_ENABLED=true` only in Vercel Production and deploy.
  1. Run `pnpm revenue:conversion:probe -- --check`; all four offers must pass.
  1. Confirm the hosted Stripe page visibly shows one-time terms, amount, merchant,

and payment-provider policies. Creating a Checkout Session is not revenue.

  1. Count a genuine external payment only after live webhook evidence includes

payment, settlement, and observed fee data. Deduct refunds and disputes.

Approval authorizes activation of this exact release only. It does not authorize

a test purchase to be called income, any outreach, refunds, recurring billing,

tax claims, or unrelated financial commitments.