feat(phase7): server-trusted entitlement resolver foundation and usage spec

[spandreou]

Summary

This draft PR introduces the ShiftOryx Phase 7 Subscriptions, Entitlements & Daily Usage Foundation.

Key Components

1. Pure Server-Trusted Entitlement Resolver (functions/src/entitlements/entitlementResolver.js):
   • Pure function resolveTenantEntitlements({ tenant, subscription, now })
   • Normalizes plans (STARTER, PROFESSIONAL, ENTERPRISE, PILOT_FREE), statuses, and limits
   • Fail-closed security on expired dates, suspended status, missing records, or unknown plans
   • Evaluates custom limit overrides and feature entitlement flags
2. Unit Test Suite (scripts/test-entitlements.mjs):
   • 10 targeted test cases covering all boundary scenarios
   • Run via npm run test:entitlements
3. Comprehensive Phase 7 Specification (docs/PHASE_7_ENTITLEMENTS_AND_USAGE_SPEC.md):
   • Entitlement Threat Model (zero client trust, tenant admin boundaries)
   • Authoritative Data Model for subscriptions and idempotent daily usage counters
   • Firestore Security Rules review and proposed zero-write rules

Production Safety Invariants

• No Stripe or external billing integration enabled.
• No Firestore production data mutated.
• No production Firestore security rules modified yet.
• Kept on an isolated branch (antigravity/phase7-entitlements-foundation) as Draft PR.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
shiftoryx	Ready	Preview	Sep 4, 2026 11:03pm UTC