@ssheleg/sheleg-dev 0.13.2 → 0.13.4

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## v0.13.4 — FW03 credential boundaries
+
+- Supply a copyable, locally tested Stripe mode assertion before client construction.
+- Refuse explicit Google service-account JSON and OAuth client-secret assignments in
+  non-production or undeclared runs, while preserving public metadata assignments.
+- Correct Google Testing advice for basic identity scopes and Workspace controls.
+- Replace a Google access-token log with a value-free event. Document ambient ADC,
+  skills-only hooks and CAPI coverage limits. No provider operation was performed.
+- Validate explicit repository paths inside skill Markdown without treating consumer
+  project paths as repository claims.
+
+## v0.13.3 — a lightweight tag cannot publish a release
+
+- **The release refuses a lightweight tag.** `release.yml` gains one step, right after
+  checkout and before any gate: `git cat-file -t` on the tag must print `tag`; a `commit`
+  fails the job with the remedy (`git tag -a <tag> -m '<release>'` at the same commit)
+  before anything is published. `git describe` and `git submodule status` see annotated
+  tags only, and the 2026-10-09 family wave cut four lightweight member tags that the
+  umbrella then read as each member's previous release. The step is identical across the
+  family (umbrella plan 2026-10-10, T5 / REQ-6). Published tags are not re-cut.
+- No skill, reference or installer change.
+
 ## v0.13.2 — setup follows host capabilities
 
 Error tracking no longer assumes every non-Claude host lacks MCP or that setup

package/README.md

@@ -159,7 +159,7 @@ person has signed the category off **for this session**:
 | Category | What it stops |
 |---|---|
 | `live-key` | a live-shaped `sk_live_…` / `rk_live_…` reaching a command |
-| `credential` | exporting a credential whose provider issues no test value — `HELEKET_API_KEY` — in a run that declares `test`, or declares nothing |
+| `credential` | explicitly assigning `HELEKET_API_KEY`, `GOOGLE_CREDENTIALS` or `GOOGLE_CLIENT_SECRET` in a run that declares `test`, or declares nothing |
 | `refund` | `stripe refunds create`, a POST to a `…/v1/refunds` URL, or a `create_refund` tool |
 | `payout` | `stripe payouts\|transfers create`, a POST to `…/v1/payouts`, `…/v1/transfers` or Heleket's `…/v1/payout` |
 | `dispute` | `stripe disputes close`, or `…/v1/disputes/…/close` — closing one accepts the loss |
@@ -167,6 +167,18 @@ person has signed the category off **for this session**:
 | `self-authorisation` | a command that sets this gate's own switch. Never authorisable |
 | `skip-billing` | `SKIP_BILLING=true` in a run declaring production — the free-money path. Never authorisable |
 
+The Google names identify service-account JSON and an OAuth client secret. A Google
+OAuth app in Testing still uses real credentials and can access permitted real data.
+Public client IDs, project IDs, pixel IDs and ADC configuration paths are not treated
+as secrets by name. This command-text guard does not inspect inherited credentials,
+files or ambient ADC; skills-only installations do not activate it.
+
+Stripe clients can copy the pure boot assertion from
+[`assert-stripe-env.mjs`](plugins/sheleg-dev/skills/stripe-billing/scripts/assert-stripe-env.mjs).
+It compares `STRIPE_PRODUCT_MODE` with a secret/restricted key prefix before client
+construction and fails on unknown formats. It does not prove credential validity
+or grant permission for a provider operation.
+
 **Authorising one.** The authorised person exports the category — or `all` — in the
 shell that starts the session, and starts a new one:
 

package/SECURITY.md

@@ -17,12 +17,11 @@ documents name that does not exist here.
 
 ## What ships, and what of it executes
 
-`git ls-files plugins` returns **61 files: 35 markdown, one plugin manifest, three
-files of the manual gate, and 22 files of money fixtures.** Two of the seven skills now
-ship code you can run — the assertion packs under `fixtures/` — and that is a change
-from every release before v0.7.0, so it is stated here rather than left to be noticed.
-They run only when you invoke them, read only the JSON fixtures beside them, and open
-no socket; the greps below prove all three.
+`git ls-files plugins` returns **62 files: 35 markdown, one plugin manifest, three
+files of the manual gate, 22 files of money fixtures, and one Stripe mode assertion.**
+The fixture runners read their adjacent JSON only when invoked. The new Stripe
+assertion is a pure function: caller-supplied mode and key in, mode or error code out;
+no I/O, network or logging. Neither runs during installation.
 
 | Component | Count | Runtime behavior |
 |---|---|---|
@@ -32,6 +31,7 @@ no socket; the greps below prove all three.
 | `plugins/sheleg-dev/hooks/hooks.json` | 1 | Hook manifest read by Claude Code. Declares one `PreToolUse` hook and no `if` filter. |
 | `plugins/sheleg-dev/hooks/money-gate.js` | 1 | Runs on a tool call, when the plugin is enabled. Requires `path` and its own decision module — nothing else. Reads stdin, writes one JSON line, exits 0 on every path. |
 | `plugins/sheleg-dev/hooks/lib/moneygate.js` | 1 | Pure. Payload and environment in, verdict out. No `require` at all, no filesystem, no clock. |
+| `plugins/sheleg-dev/skills/stripe-billing/scripts/assert-stripe-env.mjs` | 1 | Copyable boot assertion. Compares the declared mode with a secret/restricted key prefix. No I/O or logging; does not authenticate a credential. |
 | `bin/sheleg-dev.js` — the npm installer | 1 | Runs only when you invoke it. Node built-ins only: `fs`, `path`, `os`. |
 | `install.sh` — the shell installer | 1 | **Not in the tarball** — `files` ships `bin/` and `plugins/`, so this one reaches you only through a clone. Runs when you invoke it. Shell tools only: `cd`, `pwd`, `dirname`, `basename`, `mkdir`, `rm`, `cp`, `echo`, plus `sed` and `head` to read the plugin registry it refuses to shadow. It is the destructive channel: `rm -rf` per skill, then `cp -R`. |
 | `plugins/sheleg-dev/skills/*/fixtures/*.json` — webhook payloads | 16 | Data. Placeholder ids only; no key, token, signing secret or real customer id. |
@@ -39,7 +39,7 @@ no socket; the greps below prove all three.
 | `plugins/sheleg-dev/skills/*/fixtures/manifest.json` and its `README.md` | 4 | Text. The invariant-to-fixture-to-document map, which `test/validate.py` reads. |
 
 The published tarball is `bin/` and `plugins/` plus `README.md`, `CHANGELOG.md`,
-`SECURITY.md`, `LICENSE` and `package.json` — 67 files, listed by
+`SECURITY.md`, `LICENSE` and `package.json` — 68 files, listed by
 `npm pack --dry-run`. `install.sh`, `test/`, `docs/` and `CONTRIBUTING.md` are **not**
 in it; `test/validate.py` now refuses a path these shipped documents name that the
 tarball does not carry, because resolving in a clone is the wrong question for a
@@ -54,8 +54,7 @@ in it can do is print nothing. It reads `process.env` for one variable pair
 declaration a run already carries, and it never writes to any file. `README.md` →
 *The manual gate* is its single home.
 
-**There are no npm lifecycle scripts.** `package.json` declares exactly one
-script, `test`. Installing this package, or reaching it through `npx`, runs
+**There are no npm lifecycle scripts.** `package.json` declares development and test scripts only; none are install lifecycle hooks. Installing this package, or reaching it through `npx`, runs
 nothing but the CLI you typed.
 
 ## What the installers read and write
@@ -92,8 +91,10 @@ installer deletes your edits and the node installer does not.
 ## Credentials
 
 **This pack handles payment credentials as a subject and never as a value.** It
-reads no credential, stores none, transmits none, logs none. It is markdown; it
-could not.
+stores and transmits no credential and logs no credential value. Its hook examines
+command text, including explicit credential assignments; the copyable Stripe
+assertion accepts a caller-supplied key to check its mode prefix. Neither reads a
+secret store. Knowledge examples describe credentials without shipping real ones.
 
 What it contains is credential *names*, inside example code you adapt —
 `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `HELEKET_API_KEY`,
@@ -177,11 +178,11 @@ git clone https://github.com/ssheleg/sheleg-dev && cd sheleg-dev
 # self-describing documents name -- this file included.
 python3 test/validate.py
 
-# The shipped payload: 61 files.
+# The shipped payload: 62 files.
 git ls-files plugins
 
-# 26 lines: the plugin manifest, the three files of the manual gate, and the 22
-# files of money fixtures. Everything else in the payload is markdown.
+# 27 lines: the plugin manifest, the three files of the manual gate, and the 22
+# files of money fixtures, plus the Stripe mode assertion. Everything else is markdown.
 git ls-files plugins | grep -v '\.md$'
 
 # Every require the gate makes: two lines, both in the hook -- `path`, and its own
@@ -212,7 +213,7 @@ node test/installer_test.js
 grep -rnE "child_process|\bfetch\(|require\('(http|https|net|dns|tls)'\)|spawn\(|execFile|writeFileSync|appendFileSync|unlinkSync|process\.env\." \
   plugins/sheleg-dev/skills/*/fixtures/*.mjs
 
-# The entire I/O surface of the only two executable files: twelve lines. Three
+# The I/O surface of the two installers: twelve lines. Three
 # built-in requires, the copy/mkdir/remove calls, homedir, install.sh's
 # rm -rf + cp -R, and one comment naming rm -rf. No process, no socket, no
 # network — the plugin-registry read that decides the shadow refusal is
@@ -222,6 +223,6 @@ grep -nE "require|child_process|exec|spawn|fetch|socket|rm -rf|cp -R|copyFileSyn
 # Live-key shapes across the skill payload: one line, and it is a placeholder.
 grep -rnE "sk_live_[A-Za-z0-9]|rk_live_[A-Za-z0-9]|whsec_[A-Za-z0-9]{8}|BEGIN [A-Z ]*PRIVATE KEY" plugins
 
-# What npm publishes, and nothing else: 67 files.
+# What npm publishes, and nothing else: 68 files.
 npm pack --dry-run
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ssheleg/sheleg-dev",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "description": "Seven integration skills for the layer a product reaches once it has users: Stripe subscription billing and cancellation retention, crypto payments, ad and conversion tracking under Consent Mode v2, Google sign-in and the wider Google auth surface, error tracking, and Core Web Vitals. This package is the installer CLI.",
   "bin": {
     "sheleg-dev": "bin/sheleg-dev.js"

package/plugins/sheleg-dev/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "sheleg-dev",
   "displayName": "Sheleg Dev",
   "description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
-  "version": "0.13.2",
+  "version": "0.13.4",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/sheleg-dev/hooks/lib/moneygate.js

@@ -267,7 +267,18 @@ const READERS = new Set([
  * environment into the key, so `STRIPE_SECRET_KEY=sk_test_…` is correct and common. The
  * live half is caught by its shape (`LIVE_KEY`), not by the variable's name.
  */
+// These named Google values are secrets, not client IDs or ADC configuration paths.
+// Their authority comes from scopes/IAM and grants, never a test/live key prefix.
+// Source and bounds: google-auth/references/adc-and-service-accounts.md and
+// oauth2-web-server.md, Credential boundary sections (FW03).
 const NO_TEST_VARIANT = new Map([
+  ['GOOGLE_CREDENTIALS',
+    'Google service-account credential JSON carries authority from IAM, not a test-key ' +
+    'prefix. Use a credential-free mock for offline tests; an isolated test project is ' +
+    'still a real provider operation, with separately restricted principal and resources.'],
+  ['GOOGLE_CLIENT_SECRET',
+    'Google OAuth client secrets have no declared test/live key prefix. OAuth Testing ' +
+    'status limits app access; it is not a fake credential or proof that user data is synthetic.'],
   ['HELEKET_API_KEY',
     'Heleket issues one key per merchant, it is also the webhook signing secret, and it ' +
     'carries no test/live marker — so there is no test value this can hold ' +
@@ -487,13 +498,12 @@ function decide(payload, env) {
       if (allowedFor('credential', e, runEnv)) break;
       if (runEnv === 'production') {
         return deny('credential',
-          `this command exports ${name} — a live merchant credential`, why, runEnv);
+          `this command exports ${name} — a provider credential`, why, runEnv);
       }
       return deny('credential',
         `this command exports ${name} in a run declaring ${runEnv || 'nothing at all'}`,
-        `${why} SD-02's boot assertion refuses the same pair as ` +
-        'HELEKET_ENV_TEST_HOLDS_LIVE_CREDENTIAL, but it runs inside the application — a shell ' +
-        'that merely holds the key never reaches it.', runEnv);
+        `${why} This shell assignment is checked before the application starts; ` +
+        'the gate does not inspect credential values or infer a safe provider environment.', runEnv);
     }
   }
 

package/plugins/sheleg-dev/skills/ad-tracking/references/meta-linkedin.md

@@ -264,3 +264,20 @@ or use `lintrk` from the code path that actually completed the action.
 
 ---
 
+
+## Credential boundary for the server adapter
+
+The shipped `sendCapi` example and dedup fixtures specify event payloads; they do not
+provision an access token or implement network authentication. Public pixel IDs belong
+in browser configuration; provider access tokens belong only in the server's named
+secret store. Before supplying a real token, bind the adapter to a separately identified
+account/dataset and approved operation. Offline fixtures use the supplied emitter and
+no provider token. A payload fixture passing is not credential isolation or successful
+Meta delivery. This pack currently has no CAPI token-name rule in its shell gate.
+
+Meta's [official Node SDK](https://github.com/facebook/facebook-nodejs-business-sdk/blob/main/README.md)
+describes access tokens as opaque and requires one for the server client (checked
+2026-10-13). Do not infer test/live authority from a guessed prefix. The current Meta
+Test Events documentation could not be retrieved in this pass (HTTP 429); the exact
+provider test-token/permission contract remains unverified, so no claim that a test-event
+marker restricts the token is made here.

package/plugins/sheleg-dev/skills/google-auth/SKILL.md

@@ -235,7 +235,8 @@ client.on('tokens', (tokens) => {
   if (tokens.refresh_token) {
     // Store refresh_token — only sent on first auth
   }
-  console.log(tokens.access_token);
+  // Record an event name only; token values never enter logs.
+  console.info("google_auth_tokens_refreshed");
 });
 ```
 

package/plugins/sheleg-dev/skills/google-auth/references/adc-and-service-accounts.md

@@ -459,3 +459,21 @@ decoded = id_token.verify_token(
 | `GOOGLE_CLOUD_PROJECT` | Default project ID |
 | `GCLOUD_PROJECT` | Alias for project ID |
 | `HTTPS_PROXY` / `https_proxy` | Proxy for HTTPS requests |
+
+## Credential boundary: real authority versus offline mocks
+
+Checked 2026-10-13 against [Google's ADC documentation](https://docs.cloud.google.com/docs/authentication/application-default-credentials).
+`GOOGLE_CREDENTIALS` in the JSON-loading examples carries a service-account private key.
+It has no sandbox marker comparable to Stripe's mode prefix. A local or staging process
+can still access real resources through its IAM grants: isolate the project, principal
+and permissions before a real-provider test. Offline fixtures should inject an in-memory
+auth adapter and no credentials.
+
+The pack's Claude plugin gate refuses explicit shell assignments to `GOOGLE_CREDENTIALS`
+in a test/undeclared run; a real-provider run uses the existing operator-authorised
+credential category. A name in a grep pattern and `GOOGLE_CLOUD_PROJECT` are metadata,
+not secret assignments. `GOOGLE_APPLICATION_CREDENTIALS` is deliberately not classified
+as a secret by its name: it can point to either a key or keyless federation configuration.
+Allowing that path does not prove its target safe. Verify the resolved principal and
+source without reading a secret into logs; ambient ADC, metadata identities, files and
+inherited environment are outside this lexical assignment check.

package/plugins/sheleg-dev/skills/google-auth/references/oauth2-web-server.md

@@ -684,3 +684,19 @@ Common scopes:
 - `https://www.googleapis.com/auth/drive.readonly` — Read-only Drive
 - `https://www.googleapis.com/auth/calendar.readonly` — Read-only Calendar
 - `https://www.googleapis.com/auth/cloud-platform` — Full GCP access
+
+## Credential boundary: OAuth Testing is not a fake credential
+
+Checked 2026-10-13 against [Google's OAuth app-state documentation](https://developers.google.com/identity/protocols/oauth2/production-readiness/overview).
+The consent screen's Testing state governs access and token lifetime; it does not turn
+a user's data or a client secret into synthetic fixtures. Use separate clients, test
+accounts and least scopes for provider tests; an offline mock needs no Google secret.
+The plugin gate refuses explicit `GOOGLE_CLIENT_SECRET` shell assignments in a test or
+undeclared run. Existing operator authorisation is required for its real-provider path.
+This does not classify inherited credentials, files or refresh/access tokens; those
+still require the application's credential boundary. Errors and logs carry event names
+or stable codes only, never a token value.
+
+`GOOGLE_CLIENT_ID` is public metadata. The `google-signin` GIS ID-token flow does not use
+a client secret at all; do not add one to make a test pass. See the `google-signin` skill
+for its nonce, audience, origin and session checks.

package/plugins/sheleg-dev/skills/google-signin/SKILL.md

@@ -110,8 +110,11 @@ attacker's account.
 
 ## Setup (GCP)
 
-1. Cloud Console → APIs & Services → OAuth consent screen (External;
-   publish it — in "Testing" only allowlisted users can sign in).
+1. Cloud Console → APIs & Services → OAuth consent screen: choose the audience.
+   External Testing normally limits access to test users, but basic identity
+   scopes (`openid`, `email`, `profile`) are exempt. Workspace policy can still
+   block access; publishing alone is not the remedy. See the dated setup note
+   in [the full guide](references/full-guide.md).
 2. Credentials → Create OAuth client ID → **Web application** →
    **Authorized JavaScript origins** = every origin the button renders on,
    incl. `http://localhost:<port>` for dev (scheme+host+port, no path, no
@@ -148,7 +151,7 @@ attacker's account.
 | Button never renders | GSI async race (add retry loop), empty client ID, or CSP blocks `accounts.google.com` |
 | "Token used too early/expired" | Server clock skew → sync NTP |
 | Audience mismatch | Frontend/backend client IDs differ → single env source of truth |
-| `access_denied` on consent | Consent screen still in Testing → publish the app |
+| `access_denied` on consent | Check requested scopes, audience and Workspace policy. Testing allowlisting applies beyond basic identity scopes; investigate before changing publishing status |
 | Works locally, breaks in prod | Prod origin missing in GCP, or `Secure` cookie served over plain HTTP |
 | One Tap missing / FedCM console warnings | FedCM is mandatory since Aug 2025 and the opt-out is gone (checked 2026-08-06). Load `gsi/client` from Google and keep it current — a vendored or pinned copy is the real break. The rendered button flow is unaffected; code branching on the old `isNotDisplayed()` moment callbacks is not |
 

package/plugins/sheleg-dev/skills/google-signin/references/full-guide.md

@@ -219,8 +219,12 @@ cookie** — out of reach of JS/XSS, never sent cross-site.
 1. <https://console.cloud.google.com/> → create/pick a project.
 2. **APIs & Services → OAuth consent screen**: user type **External**, fill
    app name / support email / developer email. Scopes: none needed beyond the
-   defaults (GIS only uses `openid email profile`). Publish the app (while
-   "Testing", only allowlisted test users can sign in).
+   defaults (GIS only uses `openid email profile`). External apps in Testing
+   normally require allowlisted users, but apps requesting only these basic
+   identity scopes are exempt. Workspace administrators can still block the app.
+   Choose publishing and verification status for the intended audience and actual
+   scopes, not as a blanket fix for a sign-in error. Checked 2026-10-13 against
+   [Google OAuth app states](https://developers.google.com/identity/protocols/oauth2/production-readiness/overview).
 3. **APIs & Services → Credentials → Create credentials → OAuth client ID**:
    - Application type: **Web application**.
    - **Authorized JavaScript origins**: every origin the button renders on —
@@ -373,7 +377,7 @@ shape that flow never sends.
 | `[GSI_LOGGER] The given origin is not allowed for the given client ID` | Current origin missing from **Authorized JavaScript origins** (check port and `www.` exactly). Changes take minutes to propagate |
 | `Invalid Google token: Token used too early/expired` | Server clock skew → sync NTP |
 | `Wrong recipient / audience mismatch` | Frontend and backend use different client IDs — single env source of truth |
-| 403 `access_denied` at consent | OAuth consent screen still in **Testing** and the user isn't a test user → publish the app |
+| 403 `access_denied` at consent | Check requested scopes, user type and Workspace controls. For an External Testing app requesting more than basic identity scopes, confirm the user is allowlisted. Publishing does not override administrator policy |
 | Works locally, fails in prod | Prod origin not in Authorized origins; or cookie has `Secure` on plain HTTP (Prowl dev: `PROWL_INSECURE_COOKIES=1`) |
 | One Tap doesn't show / FedCM warnings | Third-party-cookie phase-out: GIS auto-migrates to FedCM; keep `gsi/client` unmodified and current — the rendered button flow is unaffected |
 | User "lost password" but signed up via Google | Expected: Google-only accounts have empty password hash. Recovery = sign in with Google using the same email |

package/plugins/sheleg-dev/skills/stripe-billing/SKILL.md

@@ -85,12 +85,14 @@ customers. See [`references/price-integrity.md`](references/price-integrity.md).
 ## The client
 
 ```ts
+// Copy the linked assert-stripe-env.mjs beside this client (see price-integrity.md).
+import { assertStripeEnv } from "./assert-stripe-env.mjs";
 let client: Stripe | null = null;
 
 export function getStripe(): Stripe {
   if (!client) {
     const key = process.env.STRIPE_SECRET_KEY;
-    if (!key) throw new Error("STRIPE_SECRET_KEY is not set");
+    assertStripeEnv(process.env.STRIPE_PRODUCT_MODE, key);
     // Pin checked 2026-08-30 — 2026-08-26.dahlia was already newer. Confirm
     // against Stripe's changelog before pinning; this line goes stale monthly.
     client = new Stripe(key, { apiVersion: "2026-07-29.dahlia", maxNetworkRetries: 2 });

package/plugins/sheleg-dev/skills/stripe-billing/references/price-integrity.md

@@ -78,6 +78,31 @@ throw new Error(
 Left raw, that error reads as "somebody deleted the product" and sends people to
 the Dashboard for an hour.
 
+### Assert the credential mode before constructing the client
+
+Copy [assert-stripe-env.mjs](../scripts/assert-stripe-env.mjs) beside your client,
+and call `assertStripeEnv(process.env.STRIPE_PRODUCT_MODE, process.env.STRIPE_SECRET_KEY)`
+before `new Stripe`. The function is shipped executable code, not a second prose
+implementation. Supply the secret through your project's secret runner; the following
+values describe the configuration contract, not credentials to paste:
+
+```dotenv
+STRIPE_PRODUCT_MODE=test
+STRIPE_SECRET_KEY="<injected-at-runtime>"
+```
+
+`STRIPE_ENV_TEST_HOLDS_LIVE_CREDENTIAL` and
+`STRIPE_ENV_LIVE_HOLDS_TEST_CREDENTIAL` refuse opposite mode mismatches. Missing or
+unknown modes/keys fail closed. This bounded assertion recognises account secret and
+restricted keys (`sk_`/`rk_` with test/live mode); organization and other unrecognised
+keys need an explicit mode contract, not inferred safety. It never logs or returns the
+key. Agreement proves neither authenticity, account ownership nor permissions.
+Webhook signing secrets have a separate endpoint binding and are not classified here.
+
+Source checked 2026-10-13: [Stripe API keys](https://docs.stripe.com/keys), key types
+and sandbox versus live mode. The executable regression covers both supported key
+classes, both mismatches, absent mode/key and unsupported shapes without provider calls.
+
 ## One source for every displayed number
 
 Every surface that shows money reads from **one** module: the pricing page, the

package/plugins/sheleg-dev/skills/stripe-billing/references/testing-and-local-dev.md

@@ -244,7 +244,7 @@ Before the first real charge, on staging, with a real key in test mode:
 - [ ] webhook endpoint registered for live mode, subscribed to exactly the events you handle
 - [ ] `STRIPE_WEBHOOK_SECRET` is the **live endpoint's** secret, not `stripe listen`'s
 - [ ] the live key is a restricted key with only the permissions the app uses
-- [ ] `STRIPE_PRODUCT_MODE` and the key are both live, and something asserts they agree
+- [ ] `STRIPE_PRODUCT_MODE` and the key are both live; call `assertStripeEnv` from [price-integrity.md](price-integrity.md#assert-the-credential-mode-before-constructing-the-client) before constructing the client
 - [ ] the price conformance job is scheduled and its findings reach a human
 - [ ] the reconciliation job is scheduled
 - [ ] alerts exist for: signature failures, handler 5xx, endpoint disabled by Stripe

package/plugins/sheleg-dev/skills/stripe-billing/scripts/assert-stripe-env.mjs

@@ -0,0 +1,17 @@
+/** Copy beside the Stripe client and call before constructing it. No I/O or logging.
+ * Prefix agreement is not credential authenticity or permission validation.
+ */
+export function assertStripeEnv(mode, key) {
+  if (!['test', 'production'].includes(mode)) throw new Error('STRIPE_ENV_INVALID');
+  if (typeof key !== 'string' || !key) throw new Error('STRIPE_KEY_MISSING');
+  const match = /^(?:sk|rk)_(test|live)_[A-Za-z0-9]+$/.exec(key);
+  // Organization/unknown keys do not encode a mode this assertion can prove.
+  if (!match) throw new Error('STRIPE_KEY_MODE_UNVERIFIED');
+  if (mode === 'test' && match[1] === 'live') {
+    throw new Error('STRIPE_ENV_TEST_HOLDS_LIVE_CREDENTIAL');
+  }
+  if (mode === 'production' && match[1] === 'test') {
+    throw new Error('STRIPE_ENV_LIVE_HOLDS_TEST_CREDENTIAL');
+  }
+  return mode;
+}