Billing And Ledger designed
Billing is a money domain, not a UI calculation. The ledger is the source of truth; balances are derived, corrections are appended, and payment-provider facts enter through verified boundaries.
Billing Flow
Invariants
| Invariant | Meaning |
|---|---|
| Ledger immutable | Never update or delete ledger entries; corrections are new entries |
| Balance derived | No direct balance column; compute from ledger facts |
| Provider boundary | Stripe events require raw-body signature verification and idempotency |
| Policy-driven | Deposit limits, refund windows, billing window, and thresholds come from policy |
| Usage attributable | GPUaaS and app runtime charges must point to tenant/project/allocation/app context |
| Auditable | Refunds, credits, admin actions, and exceptions require audit/evidence |
Usage Metering Sequence
Product Boundary
User billing pages explain balance, usage, deposits, refunds, and payment method handoff. They do not calculate money locally or invent provider policy.
Canonical sources