Implementation Status — Product Contract Features

Reading guide

Status snapshot at the cited commit, not a live dashboard. The feature table records whether product contracts were implemented and verified at the time of review.

Read the file's baseline SHA and compare with current CI or more recent evidence before citing a current completion claim.

Status labels: EXISTING_AND_REUSABLE (code exists and can be adopted as-is for the product surface) · NEEDS_HARDENING (exists but known gaps block productization) · PARTIALLY_IMPLEMENTED (subset exists) · NOT_IMPLEMENTED · NOT_VERIFIED (exists but no executed evidence at the current SHA is cited).

Base: cb0270be lineage, inspected at HEAD ad360cf. Execution evidence quoted for experiments/auto-protection is from its own IMPLEMENTATION-STATUS.md (run 2026-11-04 on 8ace0d4, loopback only) — a code-level audit document, not a re-run in this task. Nothing below is a production readiness claim.

Status table — 12 core features

#	Feature	Status	Evidence in repo	Honest gaps
1	Protection Specification	EXISTING_AND_REUSABLE (PoC-grade)	experiments/auto-protection/spec/ — schema v1, 13-invariant closed registry, validator, from-analysis/from-requirements generators; 18/18 unit tests + 9/9 adversarial spec legs BLOCKED (per auto-protection status doc)	Loopback PoC; approval lifecycle is a convention (draft flag + REQUIRES_APPROVAL markers), no signed/persisted approval; no product UI or API.
2	Protection Plan	EXISTING_AND_REUSABLE (PoC-grade)	experiments/auto-protection/planner/ — deterministic rules → AUTO/AGENT/MANUAL_REVIEW, spec_sha256 binding, capability catalog; 18/18 tests	Plan JSON unsigned (hash-detectable, not self-verifying — recorded honest limit); not exposed as a service.
3	Protection exec — Track A	EXISTING_AND_REUSABLE (PoC-grade)	analyzer/ (61/61 tests), partitioner/ (81/81), track-a/ (29/29 + e2e 93/93 PASS on loopback)	Partitioner safe subset is narrow (SUPPORTED-SCOPE); analyzer is single-module; runtime isolation is node:vm+fork — not container-grade; no multi-tenant hosted path.
4	Protection exec — Track B	EXISTING_AND_REUSABLE (PoC-grade)	track-b/ — guides, run.mjs harness, scenario-adskip-item, e2e 25/25 PASS	Agent-facing docs + CLI only; no platform service; adoption depends on the seller's agent following the lifecycle.
5	License issuance & lifecycle	EXISTING_AND_REUSABLE	licenses table (001_init.sql), issue at checkout inside atomic batch, seller CRUD (endpoints_impl.rs), verify (verify_impl.rs), FE pages fe/pages/licenses/*	Legacy device model (activations_json, device_id) is records-only; buyer self-service (view own licenses) NOT_IMPLEMENTED; expiry is check-time, no sweeper.
6	Entitlement protocol (hosted)	NEEDS_HARDENING	be-cloudflare/src/license_security.rs + license-crypto/ crate — activate/capability/execute/status, fail-closed guard, D1 nonce/capability/binding stores (014), feature gate LICENSE_SECURITY_ENABLED	Feature-gated OFF by default; executes only built-in premium_convert; no aud/tenant_id/kid claims (audit p5-sdk-contract-audit.md); usage writes best-effort; Axum be/ has no parity routes.
7	BYOS enforcement SDK	EXISTING_AND_REUSABLE (with integration notes)	sdk/license/{server,web,nuxt} — 47/26/15 tests per sdk/license/README.md; store adapters memory+sqlite; Nuxt requireLicense; PoC-compat test pins wire contract	Default activatePath=/api/license/activate ≠ Worker /api/v1/licenses/activate (documented blocker); iss default devpay ≠ Worker devpay-lic; Worker-issued entitlements won't pass SDK defaults — interop requires explicit config, contract-versioning decision needed.
8	Durable usage	PARTIALLY_IMPLEMENTED	license_usage + security_events tables written by hosted execute/guard; transaction_ledger for money; ledger/verify endpoint	Usage write is post-execute best-effort (not transactional); runtime metering is single-process in-memory (SUPPORTED-SCOPE item 5); no usage-read API for sellers; no durable outbox consumer (see #9).
9	Payment sync	NEEDS_HARDENING	checkout_impl.rs atomic batch + idempotency; toss_impl.rs TEST adapter (pending → checkout/confirm → webhooks/toss reconcile → finalize_paid); payment_provider.rs TEST-key/live-key gates	Toss is TEST-keys-only, PAYMENT_LIVE_ENABLED=false; confirm_pending/needs_review recovery is manual (no scheduled reconcile job observed); outbox deliver_event is a stub returning false — no real consumer (events dead-letter after retries); Portone branch is 503 PAYMENT_PROVIDER_UNAVAILABLE.
10	Refund & revocation	EXISTING_AND_REUSABLE	refund_impl.rs — refund_attempts lifecycle (attempted/succeeded/failed/needs_review), partial cap, full-refund license/fulfillment compensation, GET refund-attempts view; orders.refunded_krw	needs_review resolution path is manual; PG-refund-failed compensation leaves license revocation to the caller (design comment); mock provider refunds are accounting-only by nature.
11	Independent verification & evidence	EXISTING_AND_REUSABLE (harness); NOT_VERIFIED (product surface)	evidence/ pipeline (record/validate/cross-track, claim-gates), red-team/ 47-leg battery (47/47 BLOCKED at recorded SHA), fe/e2e/ Playwright specs, results/ audit docs	Evidence covers the PoC components, not the deployed app; no evidence binding the license-security Worker endpoints to the SDK at this SHA beyond the p5 audit (which found blockers); CI wasm-build job exists but no D1-route automated suite per docs/agent/00-beta-rc-baseline.md.
12	Seller console + ops	PARTIALLY_IMPLEMENTED	fe/pages/ — dashboard, products, orders, licenses, subscriptions, settlements, settings, projects, onboarding; fe/pages/admin/ + /api/v1/admin/* (users, sellers, verifications, audit, overview)	Console is the legacy store model — no UI for protection spec/plan, no license-security surfaces (activate/capability/execute/status), no usage/security-event viewers; buyer-facing account/self-service console NOT_IMPLEMENTED.

Cross-cutting gaps (must not be smoothed over)

• The two license planes are not yet one product. Legacy licenses plane (checkout-issued, verify, seller CRUD) and the license-security plane (PoP activate → entitlement → capability → execute) share the licenses table as the status/product anchor but have different device models (activations_json vs license_bindings), different auth (device_id display vs jkt PoP), and the FE only speaks the legacy one.
• be/ (Axum) parity is absent for the security plane — all PoP endpoints are Worker-only (be-cloudflare). Local Axum dev cannot exercise them.
• Interop contract is DevPay-specific — jkt double-hash, htu semantics, payload jwk, custom h body hash: mutual PoC↔Worker interop confirmed, RFC 9449 interoperability absent (p5 audit). A versioned-contract decision is required before external SDK consumers.
• Nothing hosted is deployed for the new plane — LICENSE_SECURITY_ENABLED is simply absent from wrangler.toml (no binding, no commented config); the endpoints 404 in current environments. NOT_VERIFIED for any staging/prod behavior.
• Metering/billing plane absent — see pricing-metering-model.md §3 for what is and is not observable.

Sources

experiments/auto-protection/IMPLEMENTATION-STATUS.md (executed PoC evidence, 8ace0d4) · UNIFIED-ARCHITECTURE.md §6 honest limits · experiments/secure-browser-licensing/docs/p5-sdk-contract-audit.md + server-feature-flags.md · be-cloudflare/migrations/001–014 · be-cloudflare/src/{lib,license_security,checkout_impl,toss_impl, refund_impl,events_impl,settle_impl,payment_provider,verify_impl}.rs · sdk/license/README.md · docs/agent/00-beta-rc-baseline.md · docs/implementation-status.md (v4.0/v5.0 staging/prod evidence, older baseline).