remove: retire Circle paid API product

[SuPuHe]

Summary

Retire the active Circle/x402 paid-API product from OneShot. This removes the paid API routes, seller/proxy deployment, Gateway funding and signing UI, adapters, generated contracts, runtime configuration, and user-facing documentation while preserving direct Arc payments and recovery.

Scope and acceptance criteria

• Removed active paid-API routes, seller/proxy files, Circle/x402 adapters, Gateway UI, configs, tests, demos, and generated API artifacts.
• Preserved Privy authentication, external-wallet selection, Team Report/direct USER_WALLET payments, direct Arc receipt verification, and worker-owned direct Arc settlement.
• Preserved historical database migrations and existing records; no DELETE/DROP or blind retry was added.
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.

Invariant notes:

The retired paid-API rail is no longer active. The remaining direct payment state machine keeps CAS claiming, UNKNOWN fail-closed behavior, read-only reconciliation, and at-most-once settlement. Historical paid_api_requests migrations remain for schema compatibility.

Validation

Commands and results:

pnpm test: PASS ? 76 files / 1032 tests
pnpm test:browser: PASS ? 8/8
pnpm typecheck: PASS
pnpm lint: PASS
pnpm format:check: PASS
pnpm check:generated: PASS
 git diff --cached --check: PASS
PostgreSQL-gated tests: not run locally; no container runtime available

Independent review evidence

Gate A ? exact candidate tree before push

• Base commit SHA: 91a7744

• Candidate tree SHA: dcb30812ad9e69cb668c36d3e616297db1584442

• Candidate commit SHA: bea51e1

• Reviewer tool: free-pi-cli

• Reviewer model: not exposed by platform

• Verdict: VERDICT: PASS

• Findings or residual risks: PostgreSQL-gated tests were unavailable; legacy READY/PENDING paid-API outbox rows must be checked before deployment because the retired path is no longer routed by its old adapter.

• The reviewed tree equals the committed tree.

Gate B ? exact remote PR head

• Pull request URL/number: pending creation

• Remote head commit SHA: pending CI

• Remote head tree SHA: pending CI

• Reviewer tool: free-pi-cli

• Reviewer model: pending

• Verdict: pending

• Findings or residual risks: pending

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: PostgreSQL-gated tests need CI execution. Before production rollout, verify there are no READY intents with PENDING submit_settlement rows in the historical paid-API table.
• Rollback or recovery plan: revert this branch commit and redeploy the prior application image; database migrations are unchanged and require no rollback.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	8e98cd8	Sep 13 2026, 02:58 AM