Build with a clear contract.

Ordinary external software partners remain in scope; arbitrary payment-provider onboarding is excluded. This draft does not establish production availability. Website provider-hostname and environment acceptance remain pending.

The fee invoice provider contract separates optional preCreditMinor, postCreditMinor and appliedBalanceMinor fields from cash and excludes private financial receipts. No new partner billing adjustment API is advertised. The full goal remains unfinished; public application intake stays disconnected and disabled.

Hosted bank acceptance remains pending. Local verification does not establish full launch readiness; the complete Software goal remains unfinished and public application intake stays disconnected and disabled.

Software reports owned SQL/browser checks and isolated local Supabase Auth, Storage, PostgREST and CarSoft API acceptance with temporary resources removed. This is not hosted or real bank acceptance. Software remains local and unreleased, the complete goal remains unfinished, and public application intake stays disconnected and disabled.

Native sign-out exposes failure and retry states. Software reports owned admin/security fixtures, logout races and six fresh real sandbox merchant SDK checks. These checks do not establish hosted customer or bank acceptance, physically isolated sandbox acceptance or full launch readiness; those remain unfinished. Public application intake stays disconnected and disabled.

These contracts do not establish production availability or full launch readiness. The overall Software goal remains unfinished; public application intake stays disconnected and disabled.

Software reports owned pagination, private authorization, screening refresh and responsive fixture checks. Broader legacy root billing and recovery mutations, hosted provider acceptance and physically isolated sandbox acceptance remain pending. The overall goal is unfinished; public application intake stays disconnected and disabled.

Rotation and revocation bind the expected version; deletion attestation is evidenced and versioned. Software reports owned native browser/customer/tracking checks and a rotation/logout race check. These results do not establish full launch readiness. The overall Software goal remains unfinished; public application intake stays disconnected and disabled.

Software reports owned fixture and logout-race verification, including denial of later replay. These checks do not establish full production readiness. Broader legacy root mutations and full launch remain unfinished; Software and public application intake stay gated and unreleased.

Approved registry method selection, exact charge customer/method/type binding and requested provider receipt IDs constrain payment readback. Reported SQL, unit and owned HTTP fixture checks do not establish updated real hosted Stripe or bank acceptance. Root configuration method controls, physically isolated sandbox acceptance and broader launch work remain pending. Software and public application intake remain gated and unreleased.

Bounded automatic provider readback, exact signed setup callbacks and expiry preserve the original setup evidence. These local contracts do not establish real hosted Stripe or bank acceptance, physically isolated sandbox acceptance or full launch readiness; those remain pending. Software and public application intake remain gated and unreleased.

Native owner password/MFA invitations freeze the customer, app, limit and expiration. Browser fragment capability, explicit terms acceptance, one-use provider setup, exact readback and encrypted app-bound methods support local setup and revocation; setup does not charge. Owned protocol fixtures do not prove real hosted card/bank acceptance, approved bank selection, automatic pending verification or reviewed uncertain-setup recovery. These remain unfinished. Software and public intake remain gated and unreleased.

It cannot mutate providers or reopen APIs. Native root receipt review binds password/session MFA, intent version and exact original merchant/customer/amount/invoice evidence before recording the native ledger once. Unresolved effects are investigated, never replaced. Charge/refund readback retains original customer/method binding. Pending setup expiry holds uncertain effects for review and does not expire active connections. Owned fixtures do not prove hosted Stripe or physically isolated sandbox delivery; hosted customer setup, external processors and full financial acceptance remain unfinished. Software and intake stay gated and unreleased.

Signed callbacks plus exact provider readback do not activate access; fresh dealership admin/password/MFA approval is required. Lost registration/probe responses require review, never blind recreation. SDK transport permits one HTTP attempt, including closed connections. Owned protocol fixtures are not real hosted Stripe delivery acceptance. Physically isolated HTTPS sandbox delivery, hosted customer setup, external processors and full financial acceptance remain pending; Software and intake remain gated and unreleased.

Native factor/proof writers coordinate with review. Review alone grants no merchant access; endpoint registration, delivery, activation and external merchant/customer acceptance remain unfinished. Public intake stays disabled and Software remains unreleased.

Staged read-only Stripe merchant verification is visible for platform review. Pending setup grants no payment access. Separate endpoint registration/delivery, activation, hosted customer setup and full launch remain unfinished; public intake stays disabled.

These controls do not provision an isolated sandbox or complete merchant onboarding. Full launch and production activation remain unfinished; public Website intake stays disabled.

Disconnect and refund rejection retain password-only protection. This scoped local verification does not complete merchant/customer onboarding or the full Software launch. Partner access and Website intake remain gated and unreleased.

Native-admin forms and owned provider protocol fixtures have separate local verification. Hosted Auth configuration, email/CAPTCHA and complete marketplace launch remain pending; portal and public intake remain gated and unreleased.

Domain proof approves no app or dealership access. The gated local portal now includes team invitation, ownership and credential-sharing controls; incoming acceptance still requires separate platform review. Hosted email/CAPTCHA, reviewed lost-factor recovery, merchant onboarding/full API-to-ledger, finance adjustments/contact replacement, usable isolated sandbox and full launch remain unfinished. Authenticator replacement is still under implementation and has no accepted-readiness claim.

Agreed period-end or immediate-prorated cutoff governs access and final fees; existing payments reconcile and owed invoices remain payable. Active owner/admin/billing members retain billing history access. Cleanup preserves the original cutoff plus 30-day deletion deadline. Four actual Stripe sandbox partner-fee scenarios passed with synthetic customers; email delivery and production activation remain separate unfinished acceptance requirements. Installed merchant-adapter SDK tests also passed wrong-account/mode/customer refusal, a saved-method charge fully refunded with a bound refund, and a stable hosted link subsequently expired. Full hosted merchant/customer onboarding, API-to-native-ledger acceptance, completed hosted checkout, external processors and production acceptance remain unfinished. Overdue billing never automatically suspends or cancels a partner. Local platform-admin sensitive reviews require the current password and a verified authenticator session. Reviewed versioned tax replacements preserve prior rates on queued invoices and accepted pricing. Email retry uses the same immutable message/key within 23 hours; older uncertain outcomes require a verified read-only provider receipt, never invented delivery. Software release and live notification acceptance remain outstanding.

Signed native Stripe events use bounded raw signature input and persisted provider invoice ownership, then fetch current payment state. Duplicate/out-of-order events and lease recovery cannot create or send invoices through reconciliation. Cancellation/termination/credits/refunds/disputes, admin MFA, hosted developer portal and actual Stripe sandbox acceptance remain unfinished. Hosted scheduling activation, deployment capacity and release approval are outstanding; no production activation is claimed.

Review-required amounts may be stale and are not fresh payment evidence. Invoice workers, manual overdue decisions and a durable existing-admin-address email queue are locally verified; email provider acceptance does not prove inbox delivery. Monthly scheduling, signed Stripe billing events, credits/cancellation/disputes, actual provider sandbox acceptance and Software activation remain unfinished. No automatic suspension, Connect or fund distribution.

Only a current owner with recent TOTP MFA can consent to invoices at their provider-verified email; the server captures email and reviewed organization name. Exact UUID receipts, seven-day expiry and current owner/email/epoch checks bind manual platform review. Customer setup is separate and requires activation, a dedicated CarSoft partner customer and stable idempotency. It creates no invoice, payment method, charge or API access and never reuses dealership subscription customers. Actual Stripe sandbox acceptance, monthly invoice orchestration, payment reconciliation integration, credits/cancellation and overdue notifications remain unfinished; no automated billing readiness is claimed.

Immutable completed UTC-month records bind exact terms, usage and calculations; monetary totals are exact strings. Only successful production app API requests count; OAuth/developer calls, failures and sandbox requests are excluded. Installation-day evidence begins with the ledger, without invented history. Revenue statements require the exact commercial window and currency; versioned corrections precede freezing and separately reviewed adjustments follow. Local Stripe issuance/reconciliation core has isolated protocol tests; customer provisioning, orchestration, signed webhooks, cancellation/credits, overdue notifications and actual Stripe sandbox acceptance remain incomplete. Production billing is not activated.

Only current organization owners with recent TOTP MFA can accept or decline exact fingerprints. Offers expire after 14 days; one accepted agreement per UTC calendar month, with subsequent prices effective on a future month’s first day. Accepted terms cannot be rewritten. Acceptance creates no invoice, charge or API access. CarSoft fees will use its current Stripe account; partners collect their own fees. Overdue invoices require William’s manual decision. Automated metering, invoices, collection, reconciliation and notifications remain under implementation; production billing is not activated.

Seven-day requests bind current client version, member epochs and exact fingerprints; one pending per client/recipient and 50 per organization. No raw secret is accepted, recovered or delivered. Share through a secure external channel only after approval. Offboarding any current holder retires the shared client. Approval creates no OAuth or dealership grant. Hosted portal, sandbox, full financial/billing and provider lifecycle acceptance remain incomplete. Not deployed.

They cannot create owners or claim platform review; platform bootstrap invitations remain separate. Tokens are shown once and only hashes stored. Exact retries return original metadata without exposing or replacing tokens. Acceptance checks live issuer identity, role and epoch; offboarding retires pending invitations. No email is sent automatically. Hosted team portal, provider enrollment/recovery/lifecycle, sandboxes, payments, billing and full launch acceptance remain unfinished. Not deployed.

Seven-day expiry, member epochs and immutable fingerprints bind the decision. Approval revokes outgoing membership and retires affected credentials while preserving other known holders and dealership consent. No credentials, installations or funds are created. Hosted provider lifecycle/recovery, sandboxes, payments, billing and full launch acceptance remain unfinished. Not deployed.

A UUID request receipt recovers the original unpublished app; changed reuse conflicts and organizations are limited to 100 apps. Initial submissions require explicit baseRevisionId: null, manual exact-candidate review, domain proof and evidence. Atomic first revision approval creates no credentials or installations. Hosted signup/login/recovery, MFA/team self-service, isolated sandboxes and renewal alerts remain incomplete. Not deployed.

UUID request receipts return original-client metadata on retries, never another secret. Current-secret custody governs offboarding; reissuance needs fresh dealership OAuth and cannot expand consent. Hosted identity/recovery, owner/team self-service, sandbox and provider acceptance remain unfinished. Not deployed.

Immutable app updates and platform-reviewed one-use invitations do not establish hosted signup/login/recovery, MFA/team self-service, initial app registration, automatic credential offboarding rotation or sandbox readiness. Not deployed.

One-hour challenges, 30-day proofs and expiry/withdrawal gates require fresh dealer authorization after reproof. Enrollment/MFA/team recovery, isolated sandboxes and renewal alerts remain incomplete. Not deployed.

Private authenticated JPEG downloads recheck access and strip metadata. Uploads, other attachments, protected real-storage acceptance and full launch readiness remain incomplete. Not deployed.

Large queued jobs, attachments, complete developer onboarding, billing and provider acceptance remain incomplete. Not deployed.

Includes customer invoices, payment cancellation and subscription management. Admin revision consent and credential rotation are locally implemented; developer self-service and production readiness remain incomplete.

Not deployed; financial adapters and invoice/developer/export/billing interfaces remain incomplete.