git:20260713.2f8c42f to git:20260723.6e5370b

58 added, 119 removed. Audit A to A.

---

name: stripe-pay

- description: Execute a governed Stripe Shared Payment Token spend by delegating to the canonical spend flow with the stripe-spt runtime path selected.

+ description: Execute a governed stripe-spt payment by delegating to the canonical spend authority and finality lane.

runx:

category: payments

---

# Stripe Pay

- Execute a governed outbound payment through Stripe Shared Payment Tokens.

- This is a branded catalog skill over the canonical `spend` family. It exists

- because Stripe is the surface operators recognize, while runx still owns the

- authority, gate, finality, and receipt semantics. The skill selects runtime path

- `stripe-spt`, passes only scoped references to the rail runner, and seals the

- canonical spend receipt with Stripe evidence attached.

- ## What this skill does

- `stripe-pay` turns a payment-required signal into a Stripe SPT-backed governed

- spend: quote, reserve, approval when required, scoped token settlement evidence,

- recovery posture, and receipt-before-success.

- It does not accept Stripe secret keys, webhook secrets, PANs, card data, or raw

- unrestricted provider tokens as agent-visible input or output. It does not

- bypass the canonical spend reservation or treat a Stripe event as final without

- a sealed runx receipt.

+ This is the discoverable stripe-spt facade over `spend`. It selects the

+ `stripe-spt` runner and forwards the original bounded inputs. It does not

+ define another quote, reservation, approval, effect, recovery, or receipt model.

- ## When to use this skill

+ Use this name when the operator has already selected Stripe Shared Payment

+ Tokens as the rail and wants the canonical spend workflow without also choosing

+ a runner. Use `spend` directly when rail selection is still part of the job, or

+ when one workflow must compare several rails. Do not use this facade to create

+ Stripe customers, collect card details, manage subscriptions, or process an

+ unbounded charge.

- - A paid action should settle through a configured Stripe SPT profile.

- - The operator wants a Stripe-branded catalog surface while keeping canonical

- spend receipts.

- - A Stripe test-mode or hosted connector path is configured and must be

- exercised through runx authority.

- - The agent needs a receipt binding Stripe evidence to quote, reservation,

- approval, idempotency, and redaction decisions.

+ ## Contract

- ## When not to use this skill

+ The caller supplies a structured payment signal, a complete typed parent

+ payment `AuthorityTerm`, a configured rail profile, and a stable idempotency

+ seed. A reference alone is not authority. The payment signal and parent term

+ must agree on amount ceiling, currency, rail, realm, counterparty, and operation.

- - To settle through x402, MPP, CDP, or mock fixtures. Use the matching branded

- skill or `spend` with the selected runtime path.

- - To charge another agent for a runx-hosted service. Use `charge`.

- - To issue a refund. Use `refund` or a future Stripe-branded refund facade.

- - To run Stripe just because a secret key exists. The runtime path must be

- selected by signal and policy.

- - To expose or request raw Stripe secrets from the agent. Return `needs_agent`

- when only raw material is available.

+ `payment_admission` is optional at this facade and is passed unchanged

+ to the canonical rail boundary when present. Local execution is limited to explicit test profiles. Live Stripe credential custody and bounded provider admission remain outside the skill input; raw API keys, webhook secrets, PANs, and unrestricted tokens are refused.

- ## Procedure

+ ## Execution

- 1. Validate that the payment signal and policy select runtime path `stripe-spt`.

- If another path is requested, stop with `needs_agent`.

- 2. Validate `parent_payment_authority` and `rail_profile_ref`. The authority

- must cover the amount, currency, counterparty, operation, realm, and

- `stripe-spt` channel.

- 3. Delegate to `spend` runner/runtime path `stripe-spt` with the original

- signal, parent authority, Stripe profile reference, policy, approval context,

- and idempotency seed.

- 4. Require quote and reservation before the Stripe rail runner receives any

- spend capability.

- 5. Pause at the spend approval gate when required. A denied or missing approval

- prevents Stripe fulfillment.

- 6. Fulfill through the scoped Stripe SPT rail runner. The local runner supports

- explicit test profiles without credentials. Live settlement requires a

- hosted payment provider that owns credential custody; the graph passes only

- references and capability bindings and refuses local live profiles.

- 7. Record Stripe evidence as provider event refs, charge/payment-intent refs,

- scoped token refs, hashes, and redaction notes. Never emit raw API keys,

- webhook secrets, card data, or unrestricted token material.

- 8. If Stripe state is ambiguous, return `escalated` with recovery hints and

- preserve the same idempotency key.

- 9. Return success only after the canonical spend receipt seals with Stripe

- evidence attached.

+ 1. Delegate to `spend:stripe-spt`.

+ 2. Let native `payment.quote` derive the exact requested authority from the

+ real parent term.

+ 3. Let native `payment.reserve` mint and prove one digest-bound child

+ capability for `act_fulfill`.

+ 4. Stop at the canonical approval gate until the decision is approved.

+ 5. Execute the stripe-spt provider path under the payment effect boundary.

+ 6. Seal provider evidence and recovery state before reporting success.

- ## Edge cases and stop conditions

+ The facade never chooses another rail, retries under a new key, accepts raw

+ funding credentials, or treats HTTP/provider acceptance as final settlement.

+ Missing authority, profile, admission identity when required, approval, subset

+ proof, supervisor evidence, or terminal rail proof stops before success.

- - **Non-Stripe path:** return `needs_agent`; this facade must not silently route

- to another runtime path.

- - **Missing hosted/local Stripe profile:** return `needs_agent`; do not ask the

- agent to paste raw secrets.

- - **Local live profile:** refuse and route to a hosted payment provider; the

- external-adapter boundary intentionally does not inherit ambient secrets.

- - **Amount or counterparty drift:** stop when Stripe-side state differs from the

- reserved quote.

- - **Approval missing or denied:** do not call Stripe.

- - **Raw card or provider secret in input:** refuse or redact and return

- `needs_agent`.

- - **Ambiguous provider state:** return `escalated` and require recovery before

- retry.

- - **Unsealed receipt:** return `escalated`; Stripe evidence without a runx seal

- is not a completed governed spend.

+ ### Recovery

- ## Output schema

+ Retry with the same `idempotency_seed` and unchanged payment signal. The

+ canonical spend lane uses the reservation and provider evidence to distinguish

+ an unattempted payment from an acknowledged or fulfilled one; never invent a

+ new seed merely because the caller timed out. If provider finality cannot be

+ read back, the result remains recoverable or indeterminate rather than

+ `fulfilled`.

- ```yaml

- decision: sealed | denied | needs_agent | escalated

- canonical_skill: runx/spend

- runtime_path: stripe-spt

- payment_execution:

- payment_quote_packet: object

- payment_reservation_packet: object

- payment_approval: object

- effect_evidence_packet:

- rail_result: object

- rail_proof:

- stripe_charge_ref: string | null

- payment_intent_ref: string | null

- provider_event_ref: string | null

- shared_payment_token_ref: string | null

- admission_token_digest: string | null

- redactions: [string]

- recovery_hint: object | null

- sealed_receipt_ref: string | null

- open_questions: [string]

- ```

+ An explicit `:test` rail profile exercises deterministic local Stripe-SPT

+ semantics without claiming a live Stripe charge. A live profile must cross the

+ configured provider boundary and return stable provider evidence before this

+ skill can report provider finality.

- ## Worked example

+ ## Inputs

- A paid data endpoint returns a `1.25 USD` payment signal and policy selects

- `stripe-spt`. The parent grant allows a single payment commit for that amount,

- counterparty, and operation. `stripe-pay` delegates to `spend:stripe-spt`,

- reserves a child authority, records approval, fulfills through the Stripe SPT

- runtime path using scoped credential references, redacts provider secret

- material, and returns `decision: sealed` only after the receipt binds the Stripe

- charge/event refs to the spend proof.

+ - `payment_signal` (required): stripe-spt challenge with positive minor-unit

+ amount, currency, counterparty, and operation.

+ - `parent_payment_authority` (required): complete bounded payment AuthorityTerm.

+ - `rail_profile_ref` (required): configured stripe-spt profile reference.

+ - `idempotency_seed` (required): stable caller-owned reservation seed.

+ - `payment_admission`: bounded hosted admission and settlement identity.

+ - `realm`: optional narrowing that must match the signal and parent term.

- If the Stripe runner reports an indeterminate provider state, the skill returns

- `escalated` with the idempotency key and recovery hint. It does not create a new

- payment attempt under a new key.

+ The result is the canonical `spend` receipt chain, including quote,

+ reservation, approval, rail evidence, and payment-effect finality proof.

- ## Inputs

+ ## Example

- - `payment_signal` (required): payment-required signal or challenge.

- - `parent_payment_authority` (required): parent payment authority term or

- authority reference.

- - `rail_profile_ref` (required): configured Stripe SPT runtime-path profile

- reference.

- - `realm` (optional): authority realm such as `local`, `test`, or `prod`.

- - `spend_policy` (optional): policy limits and approval thresholds.

- - `approval_context` (optional): prior approval evidence.

- - `idempotency_seed` (optional): stable idempotency material.

+ A paid search endpoint returns a USD 1.25 Stripe-SPT challenge. The caller

+ provides a parent authority term capped at USD 1.25 for that merchant and

+ operation, plus `idempotency_seed: search-request-4821`. This facade delegates

+ the exact signal to `spend:stripe-spt`, pauses at the spend approval, and only

+ returns fulfilled after the rail evidence matches the admitted amount,

+ currency, counterparty, and movement id.