@topy-ai/maggie 0.7.38 → 0.7.41

package/bundled-contracts/maggiedash/execution-board.json

@@ -54,7 +54,7 @@
       "plan": ["Compare SQL tables with DATA-MODEL.md", "Add missing tenant/location/policy fields or document intentional simplifications", "Run migration twice and inspect constraints/indexes", "Add rollback and backup evidence instructions"],
       "implementation": ["schema/maggie-booking-install.sql", "scripts/validate-booking-schema.mjs"],
       "tests": ["npm run booking:schema:validate", "node scripts/validate-booking-schema.mjs --database-url <disposable-db> --confirm", "temporary PostgreSQL migration twice", "rolled-back overlapping allocation regression"],
-      "docs": ["docs/maggiedash-booking/DATA-MODEL.md", "docs/maggiedash-booking/DELIVERY-PLAN.md", "docs/maggiedash-booking/PROGRESS.md"],
+      "docs": ["docs/maggiedash-booking/DATA-MODEL.md", "docs/maggiedash-booking/CURRENT-STATE.md", "docs/maggiedash-booking/PROGRESS.md"],
       "acceptance": ["Migration is repeatable", "Tenant scope and active allocation overlap constraints are enforced", "Schema evidence is sanitized and reproducible"]
     },
     {
@@ -79,7 +79,7 @@
       "status": "passed",
       "plan": ["Define request validation and safe error mapping", "Implement read DTO builders", "Implement mutation command dispatch with transaction hooks", "Keep host database/credentials injected"],
       "implementation": ["backend/booking/service.mjs", "backend/booking/dto.mjs", "backend/booking/request.mjs", "backend/booking/route-handler.mjs"],
-      "tests": ["reference host endpoint conformance", "booking service validator including canonical list-object responses", "booking route-handler validator across all 40 routes", "safe error and redaction tests", "project authorization fixtures"],
+      "tests": ["reference host endpoint conformance", "booking service validator including canonical list-object responses", "booking route-handler validator across all 47 routes", "safe error and redaction tests", "project authorization fixtures"],
       "docs": ["docs/maggiedash-booking/HOST-ADAPTER.md", "backend/README.md"],
       "acceptance": ["Host routes return canonical DTOs", "No SQL/provider/raw credentials cross the boundary", "All failures use the versioned safe error shape"]
     },
@@ -182,8 +182,8 @@
       "dependsOn": ["BK-020", "BK-021", "BK-024", "BK-026"],
       "status": "needs-evidence",
       "plan": ["Implement PostgreSQL host worker adapter", "Acquire advisory/distributed lock", "Run availability, holds, payments, and notification jobs", "Emit safe metrics and alerts with rollback controls"],
-      "implementation": ["backend/booking/worker-contract.d.ts", "backend/booking/postgres-worker-adapter.mjs", "backend/booking/postgres-worker-repository.mjs", "backend/booking/health.mjs", "backend/booking/runtime.mjs", "backend/booking/run-booking-jobs.mjs", "contracts/booking-ops-evidence-v1.json", "scripts/validate-booking-ops-evidence.mjs", ".github/workflows/booking-ops-evidence.yml", "schema/maggie-booking-install.sql", "ops/systemd/*", "ops/cron/*"],
-      "tests": ["npm run booking:worker-adapter:test", "npm run booking:postgres-repository:test", "npm run booking:health:test", "npm run booking:ops:evidence:test", "npm run booking:ops:evidence:regression:test", "python3 -m unittest tools.tests.test_maggie_booking", "maggie booking ops-validate --evidence <sanitized-ops-evidence>", "maggie booking ops-validate --require-host --evidence <host-ops-evidence>", "npm run booking:schema:validate -- --database-url <disposable-db> --confirm", "npm run booking:postgres-repository:integration -- --database-url <disposable-or-staging-url> --confirm", "npm run booking:postgres-backup-restore:integration -- --source-database-url <source> --restore-database-url <empty-target> --pg-bin-dir <matching-postgres-bin-dir> --confirm", "reference-host rollback write-guard test", "worker dry-run with correlation ID and health report", "production fixture-store guard", "host alert routing integration pending", "lock/retry/dead-letter tests"],
+      "implementation": ["backend/booking/worker-contract.d.ts", "backend/booking/postgres-worker-adapter.mjs", "backend/booking/postgres-worker-repository.mjs", "backend/booking/health.mjs", "backend/booking/runtime.mjs", "backend/booking/run-booking-jobs.mjs", "contracts/booking-ops-evidence-v1.json", "scripts/validate-booking-ops-evidence.mjs", ".github/workflows/booking-ops-evidence.yml", "schema/maggie-booking-install.sql", "ops/systemd/*", "ops/cron/*", "tools/clis/maggie_booking.py"],
+      "tests": ["npm run booking:worker-adapter:test", "npm run booking:postgres-repository:test", "npm run booking:health:test", "npm run booking:ops:evidence:test", "npm run booking:ops:evidence:regression:test", "python3 -m unittest tools.tests.test_maggie_booking", "maggie booking worker-schedule --project <host> --scheduler systemd --confirm", "maggie booking ops-validate --evidence <sanitized-ops-evidence>", "maggie booking ops-validate --require-host --evidence <host-ops-evidence>", "npm run booking:schema:validate -- --database-url <disposable-db> --confirm", "npm run booking:postgres-repository:integration -- --database-url <disposable-or-staging-url> --confirm", "npm run booking:postgres-backup-restore:integration -- --source-database-url <source> --restore-database-url <empty-target> --pg-bin-dir <matching-postgres-bin-dir> --confirm", "reference-host rollback write-guard test", "worker dry-run with correlation ID and health report", "production fixture-store guard", "host alert routing integration pending", "lock/retry/dead-letter tests"],
       "docs": ["docs/maggiedash-booking/RUNTIME-OPERATIONS.md", "ops/README.md"],
       "acceptance": ["Workers never point production at fixture JSON", "Jobs are idempotent and observable", "Rollback disables new writes without deleting history"]
     },
@@ -198,7 +198,7 @@
       "implementation": ["scripts/capture-booking-runtime-evidence.mjs", "scripts/validate-booking-runtime-plan.mjs", "scripts/validate-booking-runtime-evidence.mjs", "scripts/capture-booking-browser-evidence.mjs", "scripts/validate-booking-browser-evidence.mjs", ".github/workflows/booking-runtime-evidence.yml", ".github/workflows/booking-browser-evidence.yml"],
       "tests": ["maggie booking runtime-validate", "npm run booking:runtime:plan:test", "runtime evidence validator", "browser evidence validator including console/request/layoutErrors", "real host runtime plan run", "real host Playwright run"],
       "docs": ["docs/maggiedash-booking/QA-TEST-PLAN.md", "docs/maggiedash-booking/PROGRESS.md"],
-      "acceptance": ["All 40 manager endpoints have 2xx evidence", "All 15 manager screens pass at 3 viewports", "No console errors, failed requests, overflow, or login leakage"]
+      "acceptance": ["All 47 manager endpoints have 2xx evidence", "All 15 manager screens pass at 3 viewports", "No console errors, failed requests, overflow, or login leakage"]
     },
     {
       "id": "BK-032",
@@ -210,7 +210,7 @@
       "plan": ["Run full repository and installed-project gates", "Run migration backup/restore and canary checks", "Update README, contracts, docs, and progress with evidence", "Create regression tests for every discovered defect"],
       "implementation": ["tools/clis/maggie_booking.py release-gate", "tools/tests/test_maggie_booking.py", "README files", "docs/maggiedash-booking/PROGRESS.md"],
       "tests": ["npm test", "python skill/link tests", "release gate with required runtime, browser, ops, and board evidence", "release gate missing-artifact structured blocked regression", "browser artifact parity and layoutErrors rejection", "canary and rollback rehearsal"],
-      "docs": ["docs/maggiedash-booking/README.md", "docs/maggiedash-booking/DELIVERY-PLAN.md", "docs/maggiedash-booking/PROGRESS.md"],
+      "docs": ["docs/maggiedash-booking/README.md", "docs/maggiedash-booking/CURRENT-STATE.md", "docs/maggiedash-booking/PROGRESS.md"],
       "acceptance": ["No required task remains planned/blocked", "Release evidence comes from the real host boundary", "Docs describe the shipped behavior and remaining explicit limitations"]
     },
     {
@@ -223,7 +223,7 @@
       "plan": ["Separate public customer traffic from manager session routes", "Define redacted catalogue, availability, hold, checkout, payment-return, and cancellation DTOs", "Define allowlisted notification intents and fail-closed tenant binding", "Document host-owned origin, rate-limit, bot, persistence, and provider responsibilities"],
       "implementation": ["contracts/booking-customer-surface-v1.json", "backend/booking/customer-flow.mjs", "backend/booking/customer-route-handler.mjs", "fixtures/booking-customer-flow.v1.json", "scripts/validate-booking-customer-flow.mjs"],
       "tests": ["npm run booking:customer-flow:test", "npm test", "public DTO redaction", "noindex/no-store headers", "mutation idempotency", "missing tenant rejection"],
-      "docs": ["docs/maggiedash-booking/PRD.md", "docs/maggiedash-booking/DELIVERY-PLAN.md", "docs/maggiedash-booking/HOST-ADAPTER.md", "docs/maggiedash-booking/PROGRESS.md", "MaggieDash/README.md", "MaggieDash/backend/README.md"],
+      "docs": ["docs/maggiedash-booking/PRD.md", "docs/maggiedash-booking/CURRENT-STATE.md", "docs/maggiedash-booking/HOST-ADAPTER.md", "docs/maggiedash-booking/PROGRESS.md", "MaggieDash/README.md", "MaggieDash/backend/README.md"],
       "acceptance": ["Public customer routes have a versioned contract separate from manager routes", "Customer DTOs exclude tenant, customer, provider, and credential internals", "A payment redirect cannot advance payment truth", "Host tenant binding and public request controls fail closed"]
     },
     {
@@ -315,7 +315,7 @@
       "implementation": ["contracts/maggiedash/booking-host-adapter-v1.json", "tools/clis/maggie_booking.py", "tools/tests/test_maggie_booking.py", "docs/maggiedash-booking/SKILLS-AND-CLI.md"],
       "tests": ["python3 -m unittest tools.tests.test_maggie_booking -v", "maggie booking contract", "maggie booking tasks validate", "maggie booking inspect --project <installed-projection>", "python3 -m py_compile"],
       "docs": ["docs/maggiedash-booking/SKILLS-AND-CLI.md", "docs/maggiedash-booking/PROGRESS.md"],
-      "acceptance": ["The compact contract maps all 40 manager endpoints and nine customer methods", "Installed inspect fails when service types or validator are missing", "Release gate includes the service contract checks", "A regression test prevents service surface drift"]
+      "acceptance": ["The compact contract maps all 47 manager endpoints and eleven customer methods", "Installed inspect fails when service types or validator are missing", "Release gate includes the service contract checks", "A regression test prevents service surface drift"]
     },
     {
       "id": "BK-041",
@@ -715,12 +715,14 @@
         "docs/maggiedash-booking/PROGRESS.md",
         "skills/maggie-booking/SKILL.md"
       ],
-      "acceptance": [
-        "The manager overview shows Stripe connection status without rendering secret values",
-        "The operator can copy the current host webhook URL and see test/live mode",
-        "An unconfigured Stripe account gets actionable secret-store and webhook guidance",
-        "Central and ORA Booking UI builds remain valid"
-      ]
+  "acceptance": [
+    "The manager overview shows Stripe connection status without rendering secret values",
+    "The operator can copy the current host webhook URL and see test/live mode",
+    "An unconfigured Stripe account gets actionable secret-store and webhook guidance",
+    "Secret presence reports pending until server-side verification explicitly confirms Stripe charges and payouts",
+    "A verified account remains connected across requests only while the server-secret fingerprint is unchanged",
+    "Central and ORA Booking UI builds remain valid"
+  ]
     },
     {
       "id": "BK-065",
@@ -752,11 +754,12 @@
         "docs/maggiedash-booking/PROGRESS.md",
         "skills/maggie-booking/SKILL.md"
       ],
-      "acceptance": [
-        "A short token is reported as invalid and causes setup to require configuration",
-        "Only one Stripe key is reported as degraded with a paired-key next step",
-        "Secret values never appear in the JSON result or test output"
-      ]
+  "acceptance": [
+    "A short token is reported as invalid and causes setup to require configuration",
+    "Only one Stripe key is reported as degraded with a paired-key next step",
+    "Secret values never appear in the JSON result or test output",
+    "Replacing a Stripe secret invalidates the previous connected state"
+  ]
     },
     {
       "id": "BK-066",
@@ -1218,7 +1221,7 @@
       "acceptance": [
         "A blank host can create its first location without a fixture ID",
         "Location writes validate timezone, scope, permission, uniqueness, and idempotent replay",
-        "The central and ORA location screen, 40-route contract, reference host, and configuration gates pass"
+        "The central and ORA location screen, 47-route contract, reference host, and configuration gates pass"
       ]
     },
     {
@@ -1230,7 +1233,7 @@
       "status": "passed",
       "plan": [
         "Add the location capability and two location endpoint IDs to the public installer contract",
-        "Align service-method mappings and the CLI detailed-contract count with MaggieDash's 40-route contract",
+        "Align service-method mappings and the CLI detailed-contract count with MaggieDash's 47-route contract",
         "Add regression coverage so future route additions cannot leave the installer contract stale"
       ],
       "implementation": [
@@ -1252,7 +1255,7 @@
         "docs/maggiedash-booking/README.md"
       ],
       "acceptance": [
-        "The ai-cmo-skills installer contract declares all 40 manager endpoints",
+        "The ai-cmo-skills installer contract declares all 47 manager endpoints",
         "The location capability and list/update service methods are present",
         "The public CLI and MaggieDash contract validators agree without host secrets or database access"
       ]
@@ -1291,7 +1294,7 @@
       "acceptance": [
         "The default public source declares an Astro host bootstrap under hostBootstrap.astro",
         "A fresh Astro project can install Booking without a local MaggieDash checkout",
-        "The released source contains the same 40-route contract and worker/schema artifacts as the validated local source"
+        "The released source contains the same 47-route contract and worker/schema artifacts as the validated local source"
       ]
     },
     {
@@ -1326,8 +1329,8 @@
         "docs/maggiedash-booking/EXECUTION-BOARD.json"
       ],
       "acceptance": [
-        "The npm CLI validates the current 40-route Booking contract from bundled-contracts",
-        "The npm CLI can validate Stripe and the packaged 69-task execution board",
+        "The npm CLI validates the current 47-route Booking contract from bundled-contracts",
+        "The npm CLI can validate Stripe and the packaged 87-task execution board",
         "Source-checkout and npm-package path layouts both remain supported"
       ]
     },
@@ -1369,7 +1372,7 @@
         "Notification list results are tenant-scoped and omit raw recipient email/provider payloads",
         "Only an authorized owner/manager can replay a dead-letter notification",
         "Replay requires reason and idempotency, resets delivery state, and records event plus audit evidence",
-        "Central, installer contract, package bundle, ORA mirror, and build evidence agree on 40 manager routes"
+        "Central, installer contract, package bundle, ORA mirror, and build evidence agree on 47 manager routes"
       ]
     },
     {
@@ -1882,6 +1885,503 @@
         "Resend delivery continues to use the existing secret-safe outbox and dead-letter recovery path",
         "Preview and provider send paths never expose API keys, recipient email addresses, or raw customer tokens"
       ]
+    },
+    {
+      "id": "BK-093",
+      "epic": "configuration",
+      "title": "Expose complete Booking defaults in manager Settings",
+      "repository": "both",
+      "dependsOn": ["BK-023", "BK-092"],
+      "status": "passed",
+      "plan": [
+        "Reuse the existing audited settings endpoint rather than introducing a second configuration store",
+        "Expose venue currency, booking-enabled state, and payment capture policy alongside timezone",
+        "Keep provider credentials and Stripe/Resend secrets outside the dashboard and browser bundle",
+        "Synchronize the central workspace, ORA installed mirror, and UI regression markers"
+      ],
+      "implementation": [
+        "MaggieDash/booking/src/booking.tsx",
+        "MaggieDash/scripts/validate-booking-ui.mjs",
+        "ORA/_maggie/booking/booking.tsx",
+        "ORA/maggiedash/scripts/validate-booking-ui.mjs"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "central and ORA Booking UI validators",
+        "central and ORA reference-host settings regression validators",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "MaggieDash/README.md",
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/ORAWELLNESS-INTEGRATION-AUDIT.md",
+        "docs/maggiedash-booking/TASKS.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/EXECUTION-BOARD.json"
+      ],
+      "acceptance": [
+        "Settings loads existing currency, booking-enabled, and capture-policy values",
+        "Saving settings sends all four supported defaults through the existing idempotent audited endpoint",
+        "Disabling new bookings keeps history readable while the backend rejects new holds and bookings",
+        "No provider credentials are accepted or rendered by the new controls",
+        "Central and ORA installed workspace validators enforce the new settings surface"
+      ]
+    },
+    {
+      "id": "BK-094",
+      "epic": "catalogue and monetization",
+      "title": "Add tenant-scoped treatment package catalogue",
+      "repository": "both",
+      "dependsOn": ["BK-023", "BK-093"],
+      "status": "passed",
+      "plan": [
+        "Add tenant-scoped package and package-item tables with price, currency, optional expiry, active state, and included service-variant quantities",
+        "Expose idempotent/audited manager read and write routes and reject cross-tenant or inactive service-variant references",
+        "Add the Packages manager screen and deterministic reference-host fixture without exposing customer balances or payment secrets",
+        "Synchronize central MaggieDash, the ORA installed mirror, the detailed/compact contracts, validators, and booking docs"
+      ],
+      "implementation": [
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/backend/booking/postgres-core-repository.mjs",
+        "MaggieDash/backend/booking/service.mjs",
+        "MaggieDash/backend/booking/route-handler.mjs",
+        "MaggieDash/backend/booking/reference-host.mjs",
+        "MaggieDash/booking/src/booking.tsx",
+        "MaggieDash/contracts/booking-host-adapter-v1.json",
+        "MaggieDash/contracts/booking-access-v1.json",
+        "ai-cmo-skills/contracts/maggiedash/booking-host-adapter-v1.json",
+        "ORA installed Booking mirror"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "central and ORA schema, service, route, reference-host, and UI validators",
+        "central and ORA contract checks and Astro build",
+        "ai-cmo-skills Booking Python tests and bundled contract validation",
+        "git diff --check"
+      ],
+      "docs": [
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/HOST-ADAPTER.md",
+        "docs/maggiedash-booking/ORAWELLNESS-INTEGRATION-AUDIT.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/TASKS.md",
+        "docs/maggiedash-booking/EXECUTION-BOARD.json"
+      ],
+      "acceptance": [
+        "A manager can list and idempotently create/update a package within the current tenant",
+        "Package items can reference only active service variants in the same tenant and quantities are positive integers",
+        "All package mutations emit an audit event and the UI supports search plus edit without provider credentials",
+        "Central and ORA mirrors plus compact/detailed contracts agree on the two package endpoints",
+        "The docs explicitly keep Stripe package purchase and package refund settlement outside this catalogue task"
+      ]
+    },
+    {
+      "id": "BK-095",
+      "epic": "catalogue and monetization",
+      "title": "Add customer package balances and redemption",
+      "repository": "both",
+      "dependsOn": ["BK-094", "BK-087"],
+      "status": "passed",
+      "plan": [
+        "Add tenant-scoped customer package entitlement, per-variant balance, and redemption-ledger tables",
+        "Expose idempotent audited manager grant and balance-read routes with customer and tenant scope",
+        "Lock entitlement rows during manager booking creation, redeem matching treatment visits atomically, enforce expiry/exhaustion, and return the package settlement",
+        "Add the Packages balance panel, reference-host regression, synchronized ORA mirror, compact/detailed contracts, validators, and docs"
+      ],
+      "implementation": [
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/backend/booking/postgres-core-repository.mjs",
+        "MaggieDash/backend/booking/service.mjs",
+        "MaggieDash/backend/booking/route-handler.mjs",
+        "MaggieDash/backend/booking/reference-host.mjs",
+        "MaggieDash/booking/src/booking.tsx",
+        "MaggieDash/contracts/booking-host-adapter-v1.json",
+        "ai-cmo-skills/contracts/maggiedash/booking-host-adapter-v1.json",
+        "ORA installed Booking mirror"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "reference-host grant, balance, expiry, and redemption regression",
+        "central and ORA schema, service, route, contract, and UI validators",
+        "ai-cmo-skills Booking Python tests and bundled contract validation"
+      ],
+      "docs": [
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/HOST-ADAPTER.md",
+        "docs/maggiedash-booking/ORAWELLNESS-INTEGRATION-AUDIT.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/TASKS.md"
+      ],
+      "acceptance": [
+        "A manager can grant an active package to an existing customer within the current tenant and read remaining quantities",
+        "Expired and exhausted entitlements cannot be redeemed",
+        "Manager booking creation locks and decrements matching package quantities in the same transaction, records a redemption, and zero-prices covered segments",
+        "Reference host, central/ORA mirrors, and compact/detailed contracts agree on the two entitlement routes",
+        "The docs distinguish implemented manual entitlement/redemption from future Stripe package purchase and refund settlement"
+      ]
+    },
+    {
+      "id": "BK-096",
+      "epic": "catalogue and monetization",
+      "title": "Add customer package checkout and refund settlement",
+      "repository": "both",
+      "dependsOn": [
+        "BK-095",
+        "BK-087"
+      ],
+      "status": "passed",
+      "plan": [
+        "Add a separate package purchase and refund aggregate with idempotency, provider references, and entitlement linkage",
+        "Expose public package checkout and payment-return routes with safe DTOs and a customer purchase form",
+        "Reconcile package provider status through Stripe metadata/webhooks and transactionally fulfill customer package balances",
+        "Expose manager package purchase listing and guarded refund actions, blocking refunds after redeemed visits",
+        "Synchronize central/ORA sources, compact/detailed/bundled contracts, validators, docs, and regression fixtures"
+      ],
+      "implementation": [
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/backend/booking/postgres-payment-adapter.mjs",
+        "MaggieDash/backend/booking/payment-webhook.mjs",
+        "MaggieDash/backend/booking/customer-flow.mjs",
+        "MaggieDash/backend/booking/customer-route-handler.mjs",
+        "MaggieDash/backend/booking/customer-reference-host.mjs",
+        "MaggieDash/backend/booking/reference-host.mjs",
+        "MaggieDash/backend/booking/route-handler.mjs",
+        "MaggieDash/booking/src/customer.tsx",
+        "MaggieDash/booking/src/booking.tsx",
+        "MaggieDash/adapters/astro/host/src/lib/maggie/booking.ts",
+        "ai-cmo-skills/contracts/maggiedash/booking-host-adapter-v1.json",
+        "ORA installed Booking mirror"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "central and ORA package checkout, payment-return, schema, webhook, reference-host, and UI validators",
+        "ai-cmo-skills Booking Python tests and bundled contract validation",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/HOST-ADAPTER.md",
+        "docs/maggiedash-booking/ORAWELLNESS-INTEGRATION-AUDIT.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/TASKS.md",
+        "docs/maggiedash-booking/EXECUTION-BOARD.json"
+      ],
+      "acceptance": [
+        "A public customer can start an idempotent package checkout and recover its pending or confirmed state with a token-bound return URL",
+        "A verified Stripe package event updates the separate purchase aggregate and creates one customer entitlement with the package balances",
+        "A manager can list package purchases and request a provider refund while a redeemed purchase is rejected",
+        "Central, ORA, and ai-cmo-skills contracts agree on 47 manager endpoints and 11 public customer methods",
+        "Local regression gates pass; real database migration, Stripe webhook, Resend delivery, and authenticated staging evidence remain explicit host gates"
+      ]
+    },
+    {
+      "id": "BK-097",
+      "epic": "notifications and monetization",
+      "title": "Add package lifecycle Resend notifications",
+      "repository": "both",
+      "dependsOn": [
+        "BK-096",
+        "BK-092"
+      ],
+      "status": "passed",
+      "plan": [
+        "Add package purchase confirmation and refund events to the allowlisted email-template contract",
+        "Queue idempotent tenant-scoped notifications linked to package purchases after verified Stripe state transitions",
+        "Resolve package recipient, name, amount, and expiry at worker delivery time without booking-only manage links",
+        "Synchronize the PostgreSQL schema, repositories, generic host worker, ORA worker, validators, and docs"
+      ],
+      "implementation": [
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/backend/booking/email-templates.mjs",
+        "MaggieDash/backend/booking/notifications.mjs",
+        "MaggieDash/backend/booking/postgres-worker-repository.mjs",
+        "MaggieDash/adapters/astro/host/src/lib/maggie/booking.ts",
+        "MaggieDash/adapters/astro/host/scripts/maggie-booking-worker.mjs",
+        "ORA installed Booking mirror"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "package template render and notification outbox regression",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/DATA-MODEL.md",
+        "docs/maggiedash-booking/ORAWELLNESS-INTEGRATION-AUDIT.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/TASKS.md"
+      ],
+      "acceptance": [
+        "A verified succeeded package purchase queues one confirmation notification with package_purchase_id",
+        "A verified package refund queues one refund notification and remains idempotent on replay",
+        "Stored notifications contain only recipient_hash, never the recipient address",
+        "Generic and ORA workers can render package events without appointment manage links",
+        "Real Stripe webhook, Resend delivery, and authenticated staging evidence remain explicit host gates"
+      ]
+    },
+    {
+      "id": "BK-098",
+      "epic": "customer-surface and monetization",
+      "title": "Add public customer package redemption",
+      "repository": "both",
+      "dependsOn": ["BK-095", "BK-096"],
+      "status": "passed",
+      "plan": [
+        "Carry a confirmed package entitlement into the public booking page without exposing customer credentials",
+        "Bind the entitlement to the tenant customer record and persist it on the booking hold",
+        "Lock the entitlement and item balances while converting the hold, writing the redemption ledger, and updating exhausted status",
+        "Expose a safe package summary and a deterministic reference-host regression across central and ORA mirrors"
+      ],
+      "implementation": [
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/backend/booking/customer-flow.mjs",
+        "MaggieDash/backend/booking/postgres-customer-adapter.mjs",
+        "MaggieDash/backend/booking/postgres-core-repository.mjs",
+        "MaggieDash/backend/booking/customer-reference-host.mjs",
+        "MaggieDash/backend/booking/reference-host.mjs",
+        "MaggieDash/booking/src/customer.tsx",
+        "ORA installed Booking mirror"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "public reference-host package hold/checkout regression",
+        "customer DTO/UI and PostgreSQL adapter syntax gates",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/DATA-FLOW.md",
+        "docs/maggiedash-booking/DATA-MODEL.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/TASKS.md"
+      ],
+      "acceptance": [
+        "A confirmed package return can open the public booking page with an opaque entitlement identifier",
+        "The server rejects cross-customer, expired, inactive, currency-mismatched, and insufficient-credit redemption",
+        "A fully covered public booking is confirmed at zero price and has one auditable redemption per treatment",
+        "Hold and checkout idempotency remain safe and central/ORA mirrors stay synchronized",
+        "Memberships, gift cards, recurring appointments, and automatic no-show charging remain explicitly out of scope"
+      ]
+    },
+    {
+      "id": "BK-099",
+      "epic": "customer-surface and monetization",
+      "title": "Restore package credits on cancellation",
+      "repository": "both",
+      "dependsOn": ["BK-095", "BK-098"],
+      "status": "passed",
+      "plan": [
+        "Add an additive package-redemption reversal state without deleting the original ledger row",
+        "Restore each active per-variant credit in the same transaction as a successful cancellation",
+        "Keep completed and no-show package visits consumed and leave an audit/event trail",
+        "Synchronize the deterministic manager/customer hosts, ORA mirror, schema, and docs"
+      ],
+      "implementation": [
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/backend/booking/postgres-core-repository.mjs",
+        "MaggieDash/backend/booking/reference-host.mjs",
+        "MaggieDash/backend/booking/customer-reference-host.mjs",
+        "ORA installed Booking mirror"
+      ],
+  "tests": [
+    "MaggieDash npm test",
+    "manager and public customer reference-host cancellation-credit regressions",
+    "disposable PostgreSQL integration including package-credit restoration",
+    "schema validation and PostgreSQL query syntax checks",
+        "ORA contract check and Astro build",
+        "ai-cmo task validation and git diff --check"
+      ],
+      "docs": [
+        "docs/maggiedash-booking/README.md",
+        "docs/maggiedash-booking/DATA-FLOW.md",
+        "docs/maggiedash-booking/DATA-MODEL.md",
+        "docs/maggiedash-booking/USER-JOURNEYS.md",
+        "docs/maggiedash-booking/PROGRESS.md",
+        "docs/maggiedash-booking/TASKS.md"
+      ],
+      "acceptance": [
+        "An eligible manager or customer cancellation restores each active package redemption exactly once",
+        "The redemption row is marked reversed with reason/time/actor and the entitlement status is recalculated safely",
+        "Inconsistent balances fail closed and the transaction cannot partially restore credit",
+        "Completed and no-show bookings do not restore credits",
+        "Real database migration and authenticated staging evidence remain explicit host gates"
+      ]
+    },
+    {
+      "id": "BK-100",
+      "epic": "payments and first-run setup",
+      "title": "Allow secure dashboard-managed Stripe connection",
+      "repository": "both",
+      "dependsOn": ["BK-064", "BK-065"],
+      "status": "passed",
+      "plan": [
+        "Accept a Stripe secret key and webhook secret only from an owner or manager over the authenticated Booking endpoint",
+        "Verify the credentials with Stripe before persistence and retain deployment secret precedence",
+        "Seal dashboard-managed credentials with AES-256-GCM using a key derived from BOOKING_TOKEN_SECRET",
+        "Synchronize the generic Astro host, ORA mirror, schema, UI, CLI checklist, and integration documentation"
+      ],
+      "implementation": [
+        "MaggieDash/adapters/astro/host/src/lib/maggie/booking.ts",
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "MaggieDash/booking/src/booking.tsx",
+        "ORA src/lib/maggie/booking.ts and _maggie/booking/booking.tsx",
+        "ORA maggiedash schema mirrors",
+        "ai-cmo-skills/tools/clis/maggie_booking.py"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "MaggieDash Astro host bootstrap and schema validators",
+        "ORA contract check and Astro build",
+        "ai-cmo-skills Booking unit tests, packaged inspect/setup, and task validation",
+        "git diff --check"
+      ],
+      "docs": [
+        "MaggieDash/docs/STRIPE-INTEGRATION.md",
+        "MaggieDash/backend/booking/README.md",
+        "ai-cmo-skills/docs/maggiedash-booking/README.md",
+        "ai-cmo-skills/docs/maggiedash-booking/HOST-ADAPTER.md",
+        "ai-cmo-skills/docs/maggiedash-booking/SKILLS-AND-CLI.md",
+        "ai-cmo-skills/docs/maggiedash-booking/PROGRESS.md",
+        "ORA docs/maggie-booking-integration.md"
+      ],
+      "acceptance": [
+        "A signed-in owner or manager can submit both Stripe credentials from Booking Overview and receive only a redacted verification result",
+        "Invalid credentials are rejected before storage and finance/staff cannot add provider credentials",
+        "Dashboard credentials are encrypted at rest, never returned or logged, and are loaded by payments/webhooks/workers after restart",
+        "Deployment STRIPE_SECRET_KEY remains authoritative and rejects dashboard override attempts",
+        "Production migration, live Stripe verification, and scheduler enablement remain explicit host evidence gates"
+      ]
+    },
+    {
+      "id": "BK-101",
+      "epic": "access-control",
+      "title": "Complete server-enforced Booking capability permissions",
+      "repository": "both",
+      "dependsOn": ["BK-089", "BK-100"],
+      "status": "passed",
+      "plan": [
+        "Reconcile the access permission registry with every manager route capability",
+        "Allow explicitly granted staff capabilities while retaining safe role defaults for legacy rows",
+        "Synchronize generic Astro, ORA, reference-host, contract, CLI, and documentation surfaces",
+        "Add regression coverage for scoped customer, location, waitlist, and notification reads"
+      ],
+      "implementation": [
+        "MaggieDash/backend/booking/route-handler.mjs",
+        "MaggieDash/adapters/astro/host/src/pages/api/maggie/booking/access.json.ts",
+        "MaggieDash/backend/booking/reference-host.mjs",
+        "MaggieDash/contracts/booking-access-v1.json",
+        "ORA installed Booking mirror",
+        "ai-cmo-skills/tools/clis/maggie_booking.py"
+      ],
+      "tests": [
+        "MaggieDash npm test",
+        "Booking access contract validator",
+        "scoped staff route-handler regression",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "MaggieDash/docs/BOOKING-HOST-ADAPTER.md",
+        "ai-cmo-skills/docs/maggiedash-booking/HOST-ADAPTER.md",
+        "ai-cmo-skills/docs/maggiedash-booking/PROGRESS.md",
+        "ORA docs/maggie-booking-integration.md"
+      ],
+      "acceptance": [
+        "The administrator permission list exactly matches the route capability registry",
+        "A staff or finance account without permissions receives only its safe role defaults",
+        "An explicitly granted staff capability is honored by the server for the corresponding read route",
+        "Central and ORA mirrors return the same permission registry",
+        "Production migration and authenticated staging evidence remain explicit host gates"
+      ]
+    },
+    {
+      "id": "BK-102",
+      "epic": "payments",
+      "title": "Persist provider customer identity for real Stripe payments",
+      "repository": "both",
+      "dependsOn": ["BK-025", "BK-100"],
+      "status": "passed",
+      "plan": [
+        "Add a tenant-scoped provider customer reference to the Booking customer schema",
+        "Resolve or idempotently create Stripe Customer objects at the host boundary",
+        "Use the resolved provider ID for Checkout, PaymentIntent, and SetupIntent requests",
+        "Mirror the adapter, schema, validator, and docs in ORA without exposing credentials"
+      ],
+      "implementation": [
+        "MaggieDash/backend/booking/stripe-adapter.mjs",
+        "MaggieDash/adapters/astro/host/src/lib/maggie/booking.ts",
+        "MaggieDash/schema/maggie-booking-install.sql",
+        "ORA installed Booking mirror",
+        "MaggieDash/scripts/validate-stripe-adapter.mjs"
+      ],
+      "tests": [
+        "MaggieDash Stripe adapter validator",
+        "ORA Stripe adapter validator",
+        "MaggieDash npm test",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "MaggieDash/docs/STRIPE-INTEGRATION.md",
+        "ai-cmo-skills/docs/maggiedash-booking/PROGRESS.md",
+        "ORA docs/maggie-booking-integration.md"
+      ],
+      "acceptance": [
+        "A local Booking customer UUID is never sent to Stripe as a cus_* reference",
+        "Concurrent retries use a stable Stripe idempotency key and persist the returned provider customer ID",
+        "Provider customer references remain tenant-scoped and are not exposed in public DTOs",
+        "Central and ORA adapter/schema/validator surfaces remain behaviorally aligned",
+        "Live Stripe verification and production migration remain explicit host evidence gates"
+      ]
+    },
+    {
+      "id": "BK-103",
+      "epic": "payments",
+      "title": "Add consented Stripe no-show fee charging",
+      "repository": "both",
+      "dependsOn": ["BK-088", "BK-102"],
+      "status": "passed",
+      "plan": [
+        "Use a policy-derived fee and require explicit manager or finance confirmation",
+        "Charge only through Stripe off-session PaymentIntent with a saved consented payment method",
+        "Persist an adjustment payment attempt, audit/event evidence, and idempotent replay state",
+        "Notify the customer through the existing Resend outbox and mirror the flow in ORA"
+      ],
+      "implementation": [
+        "MaggieDash/backend/booking/postgres-payment-adapter.mjs",
+        "MaggieDash/backend/booking/stripe-adapter.mjs",
+        "MaggieDash/backend/booking/route-handler.mjs",
+        "MaggieDash/adapters/astro/host/src/lib/maggie/booking.ts",
+        "MaggieDash/booking/src/booking.tsx",
+        "MaggieDash/booking/src/customer.tsx",
+        "ORA installed Booking mirror",
+        "ai-cmo-skills/contracts/maggiedash/booking-host-adapter-v1.json"
+      ],
+      "tests": [
+        "Stripe adapter saved-payment and off-session conformance",
+        "manager route/reference-host contract coverage",
+        "MaggieDash npm test",
+        "ORA contract check and Astro build",
+        "git diff --check"
+      ],
+      "docs": [
+        "MaggieDash/docs/STRIPE-INTEGRATION.md",
+        "MaggieDash/docs/BOOKING-HOST-ADAPTER.md",
+        "ai-cmo-skills/docs/maggiedash-booking/HOST-ADAPTER.md",
+        "ai-cmo-skills/docs/maggiedash-booking/PROGRESS.md",
+        "ORA docs/maggie-booking-integration.md"
+      ],
+      "acceptance": [
+        "No-show transition remains review-only until a separate explicit charge action is confirmed",
+        "The charge is rejected without a saved provider payment method, customer consent, or verified off-session capability",
+        "Successful/pending/failed provider outcomes are persisted as adjustment attempts with idempotent replay and audit evidence",
+        "Resend notification is queued only after a successful no-show fee charge",
+        "Production schema migration, Stripe verification, webhook setup, and worker scheduling remain explicit host gates"
+      ]
     }
   ]
 }