Skip to content
PETROVA

TOLL is the estate's only payment rail: apps sell capabilities through TOLL and never call Polar directly

rank: decision outranks: []

Section titled “rank: decision outranks: []”

TOLL is the estate’s only payment rail: apps sell capabilities through TOLL and never call Polar directly

Section titled “TOLL is the estate’s only payment rail: apps sell capabilities through TOLL and never call Polar directly”

Date: 2026-10-24 Status: closed Supersedes: none Superseded-by: none — current MR-compliance: MR-4, MR-7, MR-9

Context

Section titled “Context”

RS-DL-004 (devarno-cloud/plays:specs/RS-DL-004.md, signed off by FLIGHT on 2026-10-24, frontmatter sign-off) asks for this ruling as requirement R-01. Four findings from the spec, each read on 2026-10-24, drive it.

F2: the estate has two payment paths, and no decision picks one. Six apps integrate Polar directly: smo1-io (polar-go v0.12.0 client, per eva-hq/eva:prompts/launch-to-revenue/parameters/smo1-io.xml), skyflow-hq (core-api.POLAR_* blockers, gates G-69-2 and G-69-10 in skyflow-blue/skyflow-hq:.petrova/gates.yaml), choco-hq, rocky-hq, kahn-hq and tektree. Three go through TOLL: chronicle, nestr and sparki. mary-wiki docs/runbooks/operator-did-a-payment-land.md already calls TOLL “the money spine”, yet no decision makes it the only rail.

F1: the split is the operator queue. 142 uncleared ruling:/config: refs wait on the operator across 9 repos. 76 of them (54%) are payment-rail configuration repeated per app. 16 are legal copy repeated across 8 apps. Each direct-Polar app carries its own live-mode flip.

F3: a shared Polar org already breaks paid-but-no-access. null0-toll/toll#141 (MULTI-CONSUMER-1) fixes a defect that appears once two consumers share one Polar org: the customer pays and gets no access. It has been open since 2026-10-15. A second path that bypasses TOLL cannot be covered by that fix.

F8: no commercial facts exist anywhere. Legal entity, address, company number, VAT status, processor list, refund policy and support contact are held nowhere. nestr ships COMPANY LEGAL NAME placeholders, choco’s legal pages are empty and tektree’s are drafts. Revenue, cost and readiness are never joined.

TOLL’s own production cutover is already gated separately: null0-toll/toll:docs/decisions/2026-10-14-p3-production-polar-via-a-separate-gate.md.

Decision

Section titled “Decision”

TOLL is the estate’s only payment rail. An app sells a capability by registering as a TOLL consumer and a product row. It never calls Polar directly: no Polar client, no Polar webhook endpoint, no POLAR_* secret in the app. Polar stays the merchant of record, behind TOLL.

Migration order: smo1-io, then choco-hq, then skyflow-hq, then tektree, then rocky-hq, then kahn-hq. chronicle, nestr and sparki are already on the rail.

Estate commercial facts live once, in estate/commercial-facts.yaml in petrova-codes (RS-DL-004 R-02). Apps point at it; they do not carry their own legal copy.

Alternatives considered

Section titled “Alternatives considered”
  • Keep per-app Polar, document the pattern. Rejected. It leaves six live-mode flips, the F3 defect surface, and an operator queue that stays at 76 payment refs.
  • Let each app choose its rail. Rejected. It is today’s state, and it is what produced F1 and F2.
  • Move all nine apps to a different processor. Rejected. TOLL runs Polar as its processor (null0-toll/toll:docs/decisions/2026-10-14-p3-production-polar-via-a-separate-gate.md) and Polar is the merchant of record (RS-DL-004 R-01); a switch buys nothing here.

Consequences

Section titled “Consequences”

For code:

  • Each direct-Polar app’s Polar client and webhook are removed under RS-DL-004 R-10, in the order above, each with a TOLL consumer test in null0-toll/toll:tests/consumers/<app>.test.ts. The live switch per app is a separate, operator-gated act.
  • estate/commercial-facts.yaml and its schema land under R-02 (Task 2).

For docs:

  • Per-app config:POLAR_* gate blockers are re-pointed at the TOLL P3 gate under R-09, after the code move, not before.
  • The hub gate G-1-1 in petrova/.petrova/gates.yaml asserts this doc’s countersign (R-08).

For in-flight phases: RS-DL-004 phases A to D. MULTI-CONSUMER-1 (null0-toll/toll#141) must land before a second consumer goes live (R-03).

For invariants: none. This is a payment-path ruling, not a numbered invariant (MR-9).

What this decision does NOT do:

  • It does not flip any app or TOLL to live mode.
  • It does not set or change any price or product.
  • It does not remove any app’s Polar code today; R-10 does, per app.
  • It does not choose a legal entity or fill any commercial fact.
  • It does not change TOLL’s P3 cutover gate.

References

Section titled “References”
  • devarno-cloud/plays:specs/RS-DL-004.md (F1, F2, F3, F8; R-01, R-02, R-08, R-09, R-10)
  • null0-toll/toll:docs/decisions/2026-10-14-p3-production-polar-via-a-separate-gate.md (TOLL P3)
  • null0-toll/toll#141 (MULTI-CONSUMER-1)
  • mary-wiki:docs/runbooks/operator-did-a-payment-land.md (“the money spine”)

Sign-off

Section titled “Sign-off”
  • Subagent: Claude Sonnet 5.5 (RS-DL-004 Task 1 implementer, 2026-10-24) (drafted from RS-DL-004 R-01; findings F1, F2, F3, F8 read on 2026-10-24)
  • Human countersign — the single-rail rule, the migration order, and the commercial-facts home

Countersigned by human:flight@arno.host on 2026-10-24 — box ticked in commit 7f0cc5f8, authored by the human, merged in 514b793e (#600): the single-rail rule, the migration order (smo1-io first) and the commercial-facts home accepted as drafted. Gate G-1-1 now reads met; G-1-2 waits on the commercial facts. Status flipped open→closed on 2026-10-24 by an agent as scribe (MR-7).