Gate B4: lib/billing.ts publicly promises 7/90/365-day retention with no enforcement anywhere #44

Open
opened 2026-08-23 17:33:09 -04:00 by logan · 0 comments
Owner

Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - Gate B condition B4. Blocks charging any customer.

Server/drb-frontend/lib/billing.ts lines 88 / 103 / 120 set retentionDays: 7 / 90 / 365 on the Community / Pro / Enterprise plans, and the FAQ states retention as plain fact with no caveat. There is no TTL and no deletion sweep anywhere in drb-c2-core. Confirmed independently by the CISO (#39), the CMO (#41), and SAAS_PLAN.md §2.3 (B6, still open).

The FAQ is also internally inconsistent: the adjacent answer does disclose that billing is unstubbed, while the retention answer does not.

Two acceptable resolutions, either closes this:

  1. Build the retention sweep and enforce it, or
  2. Remove the retention claim from lib/billing.ts and the FAQ until it exists.

Option 2 is cheaper and is the recommended path - a promised control that does not exist becomes a contract-vs-reality gap the moment anyone pays.

Owner: CTO. Date: 2026-09-30.
Related: BUSINESS_MODEL.md §8 item 9, SAAS_PLAN.md B6, minutes #42 Decision 4 (A1) and Gate B.

Board minutes #42 (2026-08-23) - Ratify BUSINESS_MODEL.md. - **Gate B condition B4. Blocks charging any customer.** `Server/drb-frontend/lib/billing.ts` lines 88 / 103 / 120 set `retentionDays: 7 / 90 / 365` on the Community / Pro / Enterprise plans, and the FAQ states retention as plain fact with no caveat. There is **no TTL and no deletion sweep** anywhere in `drb-c2-core`. Confirmed independently by the CISO (#39), the CMO (#41), and `SAAS_PLAN.md` §2.3 (B6, still open). The FAQ is also internally inconsistent: the adjacent answer *does* disclose that billing is unstubbed, while the retention answer does not. **Two acceptable resolutions, either closes this:** 1. Build the retention sweep and enforce it, or 2. Remove the retention claim from `lib/billing.ts` **and** the FAQ until it exists. Option 2 is cheaper and is the recommended path - a promised control that does not exist becomes a contract-vs-reality gap the moment anyone pays. Owner: CTO. Date: **2026-09-30**. Related: `BUSINESS_MODEL.md` §8 item 9, `SAAS_PLAN.md` B6, minutes #42 Decision 4 (A1) and Gate B.
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: logan/server-26#44