# Pricing Signup Three-Plan Happy-Path Verification Report

Date: 2026-03-15

## Preflight

- `STRIPE_SOLO_PRICE_ID`, `STRIPE_TEAM_MONTHLY_PRICE_ID`, and `STRIPE_FOUNDER_PRICE_ID` are mapped in `apps/api/src/routers/stripe.ts`.
- `stripe` CLI is available (`stripe version 1.37.3`) and authenticated.
- Local frontend is running on `5173`; API process is already listening on `8080`.

## Automated Verification Completed

Commands run successfully:

```bash
cd apps/main && pnpm exec vitest run src/lib/billing.test.ts src/hooks/auth.signup.test.ts src/components/PendingSignupCheckout.test.tsx src/pages/signup.test.tsx src/pages/signup-v2.test.tsx --mode dev --passWithNoTests
pnpm --filter @xtablo/main typecheck
```

Coverage from these checks:
- Signup defaults to `solo` and supports selecting `team` and `founder` in both signup UIs.
- Billing intent contract is now explicit (`solo|team|founder`) with plan satisfaction helpers.
- Pending checkout recovery component supports all three plans and handles already-satisfied or invalid pending states.
- Signup auth path resolves billing intent with default `solo`.

## Live Stripe Happy Paths

Retry with Stripe CLI:
- Started listener: `stripe listen --forward-to http://127.0.0.1:8080/api/v1/stripe-webhook`
- Triggered checkout fixture: `stripe trigger checkout.session.completed`
- Result: all forwarded webhook requests returned `400` from API webhook endpoint.

Observed evidence:
- Listener reported `Ready` and emitted Stripe events.
- Forward logs showed repeated `400` responses for events including:
  - `product.created`
  - `price.created`
  - `checkout.session.completed`
  - `payment_intent.created`
  - `payment_intent.succeeded`
- Direct probe confirms webhook route is reachable, but signature-sensitive:
  - `POST /api/v1/stripe-webhook` with fake header returns `{"error":"Unable to extract timestamp and signatures from header"}`.

Conclusion for live flow retry:
- Stripe CLI path is now working, but webhook processing is failing server-side during forwarded events (likely webhook secret mismatch or environment mismatch on the API instance currently running at `8080`).
- Browser checkout happy paths cannot be marked passing until webhook `400` issue is resolved and end-to-end redirects are exercised.

| plan | checkout reached | payment completed | success redirect | interval expected | interval observed | result | evidence |
|------|------------------|-------------------|------------------|-------------------|-------------------|--------|----------|
| solo | not run | not run | not run | month | not run | blocked | webhook forward returns 400 |
| team | not run | not run | not run | month | not run | blocked | webhook forward returns 400 |
| founder | not run | not run | not run | year | not run | blocked | webhook forward returns 400 |

## Summary

- Code-level and component-level verification is green for the 3-plan signup wiring.
- Live Stripe card-entry happy-path verification is blocked by webhook `400` failures on the current local API endpoint (`:8080`) and still requires browser payment execution once webhook processing is healthy.
