Command

PePersonal JEJust Electrolyte RTRelease Timer TtTacTile CSClearSource AtAthletic

TacTile›Launch TacTile›Backend & Infrastructure›Billing & Payments·18 in this wave

Approve: Billing & PaymentsTo do · blocker Apply requireTier middleware to all Pro-only routesTo do Wire UI feature gates with the Gate componentTo do Add billing route testsDone Confirm pricing-page numbers match Stripe productsTo do Confirm STRIPE_WEBHOOK_SIGNING_SECRET set in prodDone Test Stripe test vs live key separationDone Decide: remove in-app checkout links, or get Apple's external-purchase entitlementTo do Implement the upgrade-path decision on iOS and AndroidTo do Build the Android subscription and billing surfaceTo do Pre-downgrade confirmation modalDone Billing tests: pin the survivors #694 lists under "Not covered", and the Stripe cancel in account deletionDone Show current subscription state in /settings/subscriptionDone Build invoice history pageTo do Wire dunning email on invoice.payment_failedDone Annual vs monthly pricing toggleTo do Tighten Stripe replay tolerance from 300s to 60sDone Dunning email says custom domains "may be paused" after several days, but billing suspends them on the first failed invoiceTo do

Wave

Billing & Payments

Depends on Auth and Backend API. Revenue path — the paywall blocker lives here.

TacTile › Launch TacTile › Backend & Infrastructure › Billing & Payments

8/18 done10 open1 open blocker

Selected taskclear

Decide: remove in-app checkout links, or get Apple's external-purchase entitlement

To doOwner · Vivt_a82cd502

Unlocks 2Implement the upgrade-path decision on iOS and Android Approve: Billing & Payments

Show the prompt

You are Viv, the agent for the TacTile lane of Command.

Open the lane and work there:

```bash
cd ~/Command/tactile && claude
```

Read that lane's CLAUDE.md and lane.json before you touch anything — they
carry your identity, your scope, and the hazards specific to this lane.
Read state from the hub (https://internal.tactile.to) or ask. Never guess at it.

## The task

**Decide: remove in-app checkout links, or get Apple's external-purchase entitlement** · to do

Where it sits: TacTile › Launch TacTile › Backend &amp; Infrastructure › Billing & Payments

## Unlocks 2

- Implement the upgrade-path decision on iOS and Android
- Approve: Billing & Payments

## The brief on file

[2026-10-09 · Viv] KEEP_OPEN, skeptic. v1.0 is done and fail-closed: #673 eccb8e28 and #677 453247b5 are ancestors of main and StorefrontPolicy.swift yields linkOut only for USA. But this task's own build is the three-region path, and main has no EU case, flag or EEA list (git grep EEA/isEU in Features/Settings: none; PurchaseSurface is linkOut/informational only). Two Matthew calls remain: Apple EU fee terms (acquisition + store services + 5% CTC), and keep-vs-strip, since BUSINESS-CONTEXT.md:115 (no Stripe CTAs) contradicts :127 (US link-out), pending on t_9112c947. Re-scoping to a post-launch EU task is his call, not a triage close.

[2026-10-08 · Viv] STAYS OPEN. Triage said decided and built; two parts do not hold. Correction: #673 (eccb8e28) and #677 (453247b5) are both MERGED on origin/main, so the 6 Oct line 'NOT merged yet' is stale. Done for v1.0: StorefrontPolicy.swift fails closed (only USA = link-out, else informational), StorefrontGateTests in the project, BUSINESS-CONTEXT.md:126-127 records US-only v1.0 and EU later. Still open: (1) the three-region build as written: main has no EU case, flag or EEA list (PurchaseSurface is only linkOut/informational). (2) Matthew's calls: keep-vs-strip is still pending in t_9112c947 (8 Oct) since BUSINESS-CONTEXT.md carries two contradictory rows; the Apple EU fee-terms call (acquisition + store services fee + 5% CTC) is money. Not launch-blocking. Re-scoping to a post-launch EU task is his call.

[2026-10-06 · Viv] #673 merged eccb8e28 (iOS: stale "Apple-compliant" billing comments and the non-US panel copy, which now reads "Your plan is managed on the web."; the US gate isUSStorefront is untouched). #677 (purchase UI only on a confirmed US storefront; unknown and nil fail closed) is NOT merged yet and is still an open draft. Still open because: the three-region (US / EU / rest-of-world) build is not done (origin/main has only the US / not-US branch and no EU storefront gate), and the EU branch still waits on Matthew's Apple EU fee-terms call. Nothing is deployed.

[1 Oct 2026 — Viv: draft PR https://github.com/TacTile-dev/TacTile/pull/673 leaves the US gate (isUSStorefront) untouched — still correct per BUSINESS-CONTEXT.md — and rewrites the non-US panel to "Your plan is managed on the web." so it no longer implies a purchase path. The three-region build is NOT done: origin/main (938b9a6c) has only the US / not-US branch and no EU storefront gate, and the EU branch stays behind a flag pending your fee-terms call.]

Viv — build the three-region upgrade path. Matthew's decision 2026-07-28: link out to the web like ChatGPT and others do, never Apple IAP. RESEARCHED 2026-07-28 — the earlier "this will be rejected" assessment was WRONG and is corrected below.

CURRENT RULES, verified by research not memory:

US STOREFRONT — external links are FULLY ALLOWED. Since May 2025, following the Epic v. Apple injunction, Apple's guidelines state there is no prohibition on buttons, external links, or calls to action on the US storefront, and NO entitlement is required. Commission is currently 0% pending district-court approval of a rate; the Ninth Circuit said Apple may charge only what is "genuinely and reasonably necessary" for coordinating linked-out purchases. So the existing isUSStorefront gate (SubscriptionViewModel.swift:266-270, SubscriptionView.swift:170) is CORRECT AND CURRENT. Do not remove it.

EU — allowed under the DMA, but on different terms. Developers may communicate and promote offers to destinations of their choice, with actionable links, no URL limitations, redirects and intermediate landing pages permitted. BUT it carries Apple's EU business terms: an initial acquisition fee, a store services fee, and the Core Technology Commission (5% as of January 2026, replacing the old per-install Core Technology Fee). CRITICAL CONSTRAINT, which TacTile already satisfies: an EU app cannot offer BOTH Apple IAP and external payments — since TacTile has no IAP at all, this is fine.

REST OF WORLD — still restricted under the older rules. The safe path is what the app already does outside the US: a plain web-management link with no purchase call-to-action.

WHAT TO BUILD: the code today branches two ways (US / not-US). It needs THREE — US, EU, and rest-of-world. US and EU both get a real upgrade CTA linking to Stripe checkout; rest-of-world gets an informational "manage your plan on the web" link with no purchase framing. Use StoreKit Storefront.current (already wired) to determine region.

NEEDS MATTHEW BEFORE THE EU BRANCH SHIPS: enabling the EU path means accepting Apple's EU business terms and their fee structure. That is a money decision, not an engineering one. Build US and rest-of-world first; leave the EU branch behind a flag until he confirms.

Also make sure the compare-matrix footnote ("Plan changes are completed on the web") stays — it is exactly the right tone and reads well in all three regions.

Files: apps/ios/TacTileConnect/Features/Settings/{ViewModels/SubscriptionViewModel.swift, Pages/SubscriptionView.swift, Services/BillingService.swift}. Android has parallel Google Play rules — handle separately, do not assume they match.

## How to work this

- Do the work, don't just plan it. If the fix is obvious and safe, make it.
- Surface anything needing Matthew's sign-off instead of deciding it yourself.
- Short replies. Lead with the answer, then stop.
- Finish by saying what changed, what you verified, and what you'd do next.

To doIn progressDoneBlockedPick a wave on the left · tap a task to expand it

Lanes

Billing & Payments

Decide: remove in-app checkout links, or get Apple's external-purchase entitlement