MC 106881 — Stripe Webhook Fail-Closed Closure

MC #106881 — Stripe Webhook Fail-Closed Closure

Outcome

Azure PR 326 completed successfully. Exact reviewed source commit 94ba3da9ef2c03fbf9ed876598e41011b028383d merged to canonical main as 4a212f44bcf6eeffd85b8d1d1c4435ec7bc89df5 after Azure build 1025 and its blocking policy passed.

Fail-closed contract

The Stripe webhook route now rejects unauthenticated or unverifiable input before body parsing, database access, or plan-tier side effects:

• missing or blank Stripe-Signature → HTTP 400, SIGNATURE_MISSING
• present signature with missing or blank STRIPE_WEBHOOK_SECRET → HTTP 503, WEBHOOK_NOT_CONFIGURED
• invalid signature with configured secret → HTTP 400, SIGNATURE_INVALID
• genuine Stripe-SDK-signed event → HTTP 200 plus persisted stripe_webhook_events audit row

Both Gradle test tasks receive a synthetic test-only Stripe secret. The missing-secret test removes and restores it for its own scope through the shared test utility.

Verification

• Azure build 1025: all eight jobs succeeded.
• Stripe webhook classes: 26/26 Passed — 6 fail-closed, 1 genuine happy path, 15 HTTP integration, 4 P2.
• Full unit suite: 1,903 tests with exactly five inherited baseline failures and zero unreviewed failures.
• Full integration suite: 2,191 tests with 87 inherited baseline failures and zero unreviewed failures; no baseline growth.
• D8 mutation proof: deliberately inverting T7 is caught as a new blocking failure.
• Detekt executed without build cache; Trivy and Gitleaks passed; Kover XML was non-empty.
• Independent Redžo review: PASS, P0=0, P1=0.

Operational follow-up

MC #106977 separately tracks alerting when fail-closed is entered, Stripe Events-API reconciliation/backfill, and empty-vs-unset secret distinguishability. It was intentionally not a merge blocker. The unrelated web Docker next build memory exhaustion is tracked under MC #104886; no deployment is claimed by this closure.

Durable evidence

• /Users/makinja/system/evidence/106881/pr-326-completed.json
• /Users/makinja/system/evidence/106881/pr-326-final-premerge-gate.json
• /Users/makinja/system/evidence/106881/build-1025-stripe-test-results.json
• /Users/makinja/system/evidence/106881/build-1025-kover-artifact-proof.txt
• /Users/makinja/system/evidence/106881/final-independent-redzo-review-94ba3da9.json
• /Users/makinja/system/evidence/106881/d8-empirical-carveout-proof-2026-08-10.txt