refactor: payment webhook retry + coupon stacking + proration + orders_meta migration
92
risk score
Block release
Do not deploy. Escalate to the on-call engineer and file a Jira blocker for the touched surface before any merge.
▸Risk score 92/100 is at incident level (recurring incidents on high-incident surface).
▸Escalating to incident queue; deployment is blocked immediately.
▸A blocker will be filed in Jira and an incident note posted to Notion.
Incident memory
How this change scores against your production history — 8 past incident(s) on the touched surface.
Subscriptions & Billing
21 changed lines in this PR
Checkout Flow
24 changed lines in this PR
Data Migrations
9 changed lines in this PR
Payments Gateway
18 changed lines in this PR
High-incident surface: 8 past incidents mapped to the touched modules.
Files touched by past incidents: Change edits 3 file(s) implicated in INC-288, INC-248, INC-231 — high regression risk in the exact failure surface.
How Rakshak understands this change
AI reasoning layer · confidence HIGH · model Qwen/Qwen3-Next-80B-A3B-Thinking
This PR introduces multiple high-risk changes across billing and payment systems. It relaxes Stripe webhook signature checks while reworking retry logic, which could allow unauthorized or duplicate payment events given prior incidents of duplicate charges due to idempotency failures. Coupon stacking now allows multiple coupons without usage-cap validation, risking over-discounts or system errors similar to past checkout failures. Proration logic changes may miscalculate billing periods, potentially causing double billing as seen in previous incidents. Additionally, a massive 18M-row database migration is performed in a single transaction without testing, risking data corruption or system downtime during deployment. These changes collectively impact 90% of checkout sessions and critical billing systems.
Failure hypotheses
▸Relaxing Stripe webhook signature checks in src/payments/webhooks/stripe.ts could allow malicious or duplicate events to be processed, leading to duplicate charges (as in INC-231) due to improper idempotency handling during retries.
▸Removing coupon usage-cap validation in src/checkout/coupons/apply.ts may cause negative order totals or system errors during checkout, similar to INC-248's coupon race conditions, affecting 90% of users.
▸Proration logic changes in src/billing/proration/calculate.ts may miscalculate billing periods, causing double billing or incorrect charges (as in INC-288) due to untested period boundary calculations.
▸The 18M-row orders_meta migration in src/db/migrations/0014_add_orders_meta.sql could cause database lock contention or data corruption during deployment, as it lacks migration tests and runs in a single transaction.
Release risk score
Weighted from 9 evidence categories
Blast radius
What this change can reach
Modules affected
4
Subscriptions & Billing, Checkout Flow, Data Migrations, Payments Gateway
Services reached
6
billing, web, core, payments, worker, api
Estimated users exposed
90%
90% of checkout sessions
Changed files
5
72 lines of diff
Blast radius map
Severity-weighted dependency graph · 90% of checkout sessions
Risk factors
Every point of the score is traceable to an observation
Traceability · No linked issue
lowNo Jira issue is referenced from the PR description.
Scope · Focused change set
low5 files changed — contained diff.
Test coverage · Tests included
low1 test file(s) included in the change.
Signal · High-risk intent keyword
highDescription contains "migration" — treat as elevated risk.
Blast radius · Wide service fan-out
highReaches 6 services: billing, web, core, payments, worker, api.
Incident history · Files touched by past incidents
highChange edits 3 file(s) implicated in INC-288, INC-248, INC-231 — high regression risk in the exact failure surface.
Test coverage · Low-coverage modules changed
highSubscriptions & Billing below 60% coverage.
Blast radius · Critical modules touched
highTouches Subscriptions & Billing, Checkout Flow, Data Migrations, Payments Gateway — 90% of checkout sessions.
Incident history · High-incident surface
critical8 past incidents mapped to the touched modules.
Schema · Database migration present
criticalSchema migration detected — irreversible once applied; requires phased rollout.
Affected modules
Coverage, incident history and change load per module
| Module | Service | Files | Δ lines | Coverage | Incidents | Severity |
|---|---|---|---|---|---|---|
Subscriptions & Billing billing | billing | 1 | 21 | 58% | 2 prior | critical |
Checkout Flow checkout | web | 2 | 24 | 71% | 2 prior | critical |
Payments Gateway payments | payments | 1 | 18 | 62% | 3 prior | critical |
Data Migrations data-migrations | core | 1 | 9 | — | 1 prior | high |
Evidence chain
How Rakshak AI reached its decision
SWYTCHCODE_VERIFYSwytchcode CLI queried 3 open PR(s)
`swytchcode exec github.pull.get` returned 3 recent open PRs for Muneerali199/Draftdeckai
◉Aug 9, 09:57 AMGITHUB_INGESTPR #1471 ingested
5 files, 72 lines changed by Muneerali199 → main
◆Aug 9, 09:57 AMJIRA_LINKNo linked issues
PR description references no Jira issue — traceability is weak.
▲Aug 9, 09:57 AMNOTION_KNOWLEDGEProject knowledge loaded
0 architecture notes · 11 incident records · 12 prior release reports consulted.
▣Aug 9, 09:57 AMIMPACT_MAPBlast radius mapped
Subscriptions & Billing (critical) · Checkout Flow (critical) · Data Migrations (high) · Payments Gateway (critical) — reaches 90% of checkout sessions.
◉Aug 9, 09:57 AMAI_REASONAI layer: how Rakshak understands the change
This PR introduces multiple high-risk changes across billing and payment systems. It relaxes Stripe webhook signature checks while reworking retry logic, which could allow unauthorized or duplicate payment events given prior incidents of duplicate charges due to idempotency failures. Coupon stacking now allows multiple coupons without usage-cap validation, risking over-discounts or system errors similar to past checkout failures. Proration logic changes may miscalculate billing periods, potentially causing double billing as seen in previous incidents. Additionally, a massive 18M-row database migration is performed in a single transaction without testing, risking data corruption or system downtime during deployment. These changes collectively impact 90% of checkout sessions and critical billing systems. • INC-231 was caused by idempotency key issues during webhook retries; this PR modifies retry routing and relaxes signature checks, increasing risk of duplicate charges. • INC-248 involved coupon-related checkout failures; removing usage-cap validation in coupon stacking could reintroduce similar issues or cause new financial discrepancies. • INC-288 was a proration double-billing incident; the new proration logic has no tests and changes period boundaries, risking similar calculation errors. • Backfilling 18M rows in one transaction without tests is a known high-risk operation that can cause database performance issues or data loss.
◉Aug 9, 09:58 AMRISK_SCORERisk scored 92/100 — critical
Focused change set · 5 files changed — contained diff. — Critical modules touched · Touches Subscriptions & Billing, Checkout Flow, Data Migrations, Payments Gateway — 90% of checkout sessions. — Wide service fan-out · Reaches 6 services: billing, web, core, payments, worker, api. — High-incident surface · 8 past incidents mapped to the touched modules. — Files touched by past incidents · Change edits 3 file(s) implicated in INC-288, INC-248, INC-231 — high regression risk in the exact failure surface. — Low-coverage modules changed · Subscriptions & Billing below 60% coverage. — Tests included · 1 test file(s) included in the change. — Database migration present · Schema migration detected — irreversible once applied; requires phased rollout. — High-risk intent keyword · Description contains "migration" — treat as elevated risk.
◉Aug 9, 09:58 AMDECISIONDecision: BLOCK
Risk score 92/100 is at incident level (recurring incidents on high-incident surface). Escalating to incident queue; deployment is blocked immediately. A blocker will be filed in Jira and an incident note posted to Notion.
◉Aug 9, 09:58 AM
Change surface
5 files in the diff
Failure points
Where this change is most likely to break
Subscriptions & Billing: 21 changed lines, 2 prior incident(s)
Checkout Flow: 24 changed lines, 2 prior incident(s)
Data Migrations: 9 changed lines, 1 prior incident(s)
Payments Gateway: 18 changed lines, 3 prior incident(s)
Migration lock / irreversible DDL on large tables
Dependency security
CVE lookup on changed dependencies via osv.dev
No known advisories on changed dependencies
Missing coverage
Modules below the 60% test bar
Subscriptions & Billing (58% coverage)
Agent trace
Swytchcode orchestration run
rakshak pipeline · run #9
01okgithub.github.fetch_pr
02okjira.jira.search
03oknotion.notion.knowledge
04okswytchcode.blast-radius
05okswytchcode.osv.scan
06okswytchcode.llm.reason
07okswytchcode.risk-engine
08okswytchcode.decision-engine
— decided block
Analyzed Aug 9, 09:57 AM · updated 13d ago