Defensive publication — public prior art. This repository exists to place a specific billing-spine mechanism into the public record, in enabling detail, dated 2026-07-03, so that it remains free for everyone to practice and cannot be monopolized by a later patent.
Author: Gustavo Assuncao, PhD · Publisher: Gus IT LLC (Florida, USA) · Contact: gus@gusit.de
Dual-licensed:
• AGPL-3.0-or-later (the open-source license for the reference source)
• Commercial license available from Gus IT LLC (gus@gusit.de)
The DISCLOSURE (DEFENSIVE-PUBLICATION.md and the docs/) is published as prior art
and dedicated to the public. The SOURCE under src/ is licensed as above.
A subscription platform has to stop paying to serve a customer whose payment has failed — dunning enforcement. The two common ways to do it are both bad:
- Notify the vendor (flip a flag, emit a webhook, trust downstream to stop): enforcement is asynchronous and trust-based, so live compute keeps spending real money until something reconciles.
- Tear the tenant down (delete namespaces, revoke credentials): stops spend, but recovery on payment is a slow, brittle full reprovision, and the delete races destructively against in-flight work.
This repository discloses a third design that is strictly better for the common case (temporary payment failure):
Flip a status row. Enforce it at the point of spend.
Every product registers exactly six frozen, idempotent, never-throw verbs — provision, suspend, resume, park, purge, exportData — and inherits the whole spine. Lifecycle lives as a single status column on entitlement and seat rows (the billing write plane). Every metered surface reads that column in-process, at its own runtime gate, immediately before it can incur provider cost, and refuses when status != 'active' (the spend read plane). Dunning at threshold is therefore an O(1) status-row flip: no teardown, no wallet touched, no provider call. Enforcement is delegated to the gates, which fail closed.
The result — proven by the runnable reference harness — is suspension that is:
- Instantaneous — one row update, regardless of how many spend surfaces exist.
- Atomic with the money guard — the gate that would spend is the gate that refuses; there is no window to leak spend.
- Exactly reversible — recovery is the inverse write; resource ids are unchanged, so there is no reprovisioning.
- Race-free against in-flight spend — any operation either passed its gate before the flip (already authorized) or reads the flip and refuses.
- Non-destructive — suspend/resume/park never delete; only
purgedestroys, fail-closed, and it retains the money ledger.
Lifecycle-verb contracts (Kill Bill, AWS Marketplace) and desired-state reconciliation (Kubernetes operators) are known. What is not established prior art is the conjunction claimed here: threshold-crossing dunning → single status-row flip with no teardown and no provider call → independent runtime gate at every spend surface that fail-closes before provider cost. By disclosing it fully and dating it, we make that combination unpatentable by others and keep it free. See docs/PRIOR-ART.md for the honest delta.
| Path | Contents |
|---|---|
DEFENSIVE-PUBLICATION.md |
the full disclosure: mechanism, data model, worked example, prior-art delta, one independent + sixteen dependent claims, appendices. |
docs/FIGURES.md |
the diagrams with standalone captions. |
docs/PRIOR-ART.md |
cited references, delta table, the novelty nub. |
docs/OPEN-SOURCE-APP.md |
mapping the reference to a deployable service + an AKS sketch. |
src/ |
clean-room, dependency-free, offline-runnable reference implementation. |
src/schema.sql |
illustrative PostgreSQL DDL — the status columns are the load-bearing element. |
cd src
node example.jsNo dependencies, no network, no credentials. It provisions a tenant fast, reconciles the seat asynchronously (with a simulated transient failure to exercise backoff and idempotent re-entry), spends while active, drives two payment failures across the threshold, and asserts that suspension flipped only status rows (wallet untouched, resources intact), that the identical spend is now refused before any provider call, that recovery restores service with the same resource ids (no reprovision), and that purge is fail-closed and retains the ledger. It prints ALL INVARIANTS HELD.
Empirically-tuned values (dunning threshold, retry envelope, cache TTL, parking window, fail-policy defaults) are [WITHHELD — trade secret] and appear in the reference as named, injectable config parameters with illustrative defaults. The mechanism is fully enabled without the specific tuned values.
Assuncao, G. (2026). Six-Verb Product-Adapter Billing Spine with Dual-Plane Runtime-Gate Suspension. Defensive Publication v1.0, Gus IT LLC, 2026-07-03.
© 2026 Gus IT LLC. Disclosure dedicated to the public as prior art; source dual-licensed AGPL-3.0-or-later + commercial.