feat(stripe-projects): integrate plugin 0.39.1 → 0.40.0

[cursor]

Why

Stripe Projects plugin 0.40.0 is live. Main still pins 0.39.1. The catalog wire renamed every service field provider_id to provider with the same prvdr_… values. Stackless must model that key and bless fixtures before doctor and hermetic drift gates stay green.

Scope

• ServiceDetail.provider in catalog.rs (no serde alias for the old key)
• Hermetic CATALOG_ENVELOPE strings under stackless-integrations
• Journal catalog identity compare uses service.provider
• STRIPE_PROJECTS_PINNED → 0.40.0
• Blessed plugin-version.txt, catalog.json, command-surface.txt via mise run stripe-refresh

Out of scope: new integrations (zero catalog ref adds/removes), TRAVERSAL changes (no new top-level commands), creation-response data.service.provider_id, EXCL domains/containers/plan tiers, new --on substrates.

Tradeoffs

Renamed the Rust field to match the wire instead of keeping provider_id with a serde rename. Creation-response JSON still uses provider_id and stays on that path.

Blast Radius

Anyone parsing catalog fixtures or ServiceDetail must use provider. Doctor warns until the plugin is at 0.40.0. Runtime add/list recovery is unchanged.

Verification

• mise run stripe-refresh blessed v0.40.0 with empty drift_report
• Semantic catalog compare vs live capture equal after normalizing last_updated/source
• mise run check green
• cargo nextest run -p stackless-stripe-projects -p stackless-integrations -p stackless --all-features → 338 passed, 2 skipped
• mise run catalog-orphans → 90 deployables owned (72 registered, 5 substrate-only, 13 excl)

Fixture changelog

• Version pin 0.39.1 → 0.40.0
• Catalog 199 services unchanged by reference; every service key provider_id → provider
• allowed_updates / updateable_to order-only noise
• Command surface: version header/banner only; TRAVERSAL blocks unchanged

Skips

• New integrations: no actionable catalog deltas
• billing update already in TRAVERSAL
• Live discover / provisional OUTPUT_FIELDS: not needed this bump
• Babysit: deferred to morning review

  

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
stackless	Ready	Preview	Sep 26, 2026 10:16am UTC

[cursor]

Thermos review

No medium, high, or critical findings on 5fd19d4 vs main 46d34e1.

Security/correctness and code-quality passes agree. This is a lockstep Stripe Projects 0.39.1 → 0.40.0 catalog-wire rename (ServiceDetail.provider_id → provider, same prvdr_… values) plus fixture/pin bless. Creation-response data.service.provider_id and journal persist stay on that path, as intended.

Checked and ruled out:

• Fail-closed deserialize without a provider_id alias (doctor pin is 0.40.0)
• Journal recover identity compare (remote.provider vs service.provider)
• No leftover hermetic CATALOG_ENVELOPE provider_id keys
• Catalog 199/199 same IDs; no add/remove; list-order noise only; herenow copy-only description
• required_parent_services / #108 paid-parent path untouched
• TRAVERSAL argv unchanged (header/banner only)

Hermetic: stackless-stripe-projects 76/76; integration config_matches_catalog 73/73.

No prior automation threads on this PR.

  

_{Sent by Cursor Automation: Find vulnerabilities}