A module-by-module review of what we can fully ship — covering every third-party connection, external dependency, and build risk before we make any customer promises.
forgestack/license-kernel (bundled into every paid package) and the License API server (built inside the hosted Symfony app) must be live before any package ships to buyers. Both are fully buildable now — no external dependencies, no unresolved gates.
Three items carry real pre-build risk you must resolve before starting those modules:
(1) Verify OVH KMS can sign with an imported RSA key before building H03 (credential vault).
(2) Confirm ContPAQi/Aspel póliza import format against a live install before the connectors A-hard tier.
(3) Get Mexican counsel sign-off on the CSD custody model before hosted goes live.
Everything else can be built and tested today. No module depends on technology that doesn't exist.
Framework-agnostic PHP 8.2+ package that authenticates the license token at app boot, calls the ForgeStack License API, caches responses (PSR-6 + file fallback), checks domain binding, and applies a graduated enforcement policy. Ships as a require dependency inside every paid ForgeStack package. Buyers never install it directly — it arrives automatically when they install any paid package. Thin Symfony 7.4 + Laravel 11/12 bridges wire the boot check automatically.
https://api.forgestack.build (prod), https://api-staging.forgestack.build (staging). One call per 24h (cached). Dev environments (localhost, *.test, *.ddev.site, *.local) bypass all network calls automatically.FORGESTACK_LICENSE_FORCE_STATE env var bypasses all network calls in CI and test environments. Set to valid, expired:5, revoked, etc.Owner.php) is injected into the ZIP by Satis download middleware at install time — the source repo contains only a placeholder stub. Buyers cannot redistribute the kernel with another buyer's fingerprint.Symfony 7.4 controller group inside the main forgestack.build application that validates license tokens, manages revocation, serves SAT catalog snapshots (for cfdi-mexico update notifications), and handles buyer domain self-service. Also provides the Satis auth_request endpoint that gates private package downloads. Three background jobs handle expiry cron, anomaly detection (no auto-revoke), and SAT catalog sync. Nginx + Lua handles rate limiting at the edge.
POST /api/v1/license/verify — token in body is the credential. Rate-limited by Nginx (10 req/min per token).GET /api/v1/catalog/* — SAT catalog snapshots for active licenses.POST/PATCH /api/v1/admin/* — token creation + revocation (internal only).POST /api/v1/dashboard/* — buyer domain self-service.LicenseResponse::fromValidPayload() exactly. A single typo in a field name silently breaks every installed license-kernel across all buyer environments.ngx_http_lua_module. The /internal/ routes (Satis auth) must be blocked from the public internet via Nginx deny all.Pure PHP 8.2+ value objects: Money (integer minor units, currency-scaled), Currency enum (MXN/BRL/ARS/CLP/COP/USD), Country. Every other module depends on this; it depends on nothing. No external APIs, no runtime network calls, no third-party accounts of any kind.
allocateByRatios handles lossless splitting used in billing proration and connector pólizas.Mexico postal code → colonia/municipio/estado lookup. Powered by an embedded SQLite database (~10–15 MB) compiled from SEPOMEX's public CSV data. Zero runtime network calls. Ships free; drives high download volume as an acquisition funnel.
bin/compile-db.php script compiles it into the SQLite file. Primary URL can be unstable; community GitHub mirror is the reliable fallback. Updated ~1–2×/year.ext-sqlite3 is built-in on PHP's official Docker images — no install needed.Generates, signs, stamps (timbra), cancels, and audits SAT-compliant CFDI 4.0 documents. Ships with offline-bundled SAT XSD/XSLT schemas, two PAC drivers (Facturapi REST, Finkok SOAP), DomPDF/TcPDF for receipts, and Carta Porte 3.1 + Pagos 2.0 complements. No runtime SAT server dependency — schemas are bundled.
AAA010101AAA, password 12345678a. Publicly available from SAT's developer portal. For integration tests only.cadenaoriginal_4_0.xslt has live SAT URL includes that must be intercepted and redirected to bundled files. Hardest single piece in the whole stack. Solved pattern in PHP community (phpcfdi does this). Full implementation is pre-written in the plan. Human time: ~3h debugging until XSLT resolves cleanly..key files are DER-encoded PKCS#8. Full CsdLoader.php code is already in the plan. AI generates it; human verifies against SAT test CSD.CFDI40145/CFDI40146. Rare. Service layer handles with $confirmacion retry. No human time beyond review.RFC format validation (Modulo-11 check digit), SAT catalog lookups compiled to static PHP arrays, and CSD certificate metadata parsing via ext-openssl. Zero runtime HTTP calls. Bundled free with cfdi-mexico, sold at $29 standalone.
bin/compile-catalogs.php generates static PHP arrays — compiled once, committed to repo.XAXX010101000 and XEXX010101000 are always valid — hard-coded as isGeneric(): bool. CFDI uses them constantly — never reject them.Single PaymentGatewayInterface over 4 complete gateway drivers plus stubs for PlaceToPay and Transbank. Covers OXXO, SPEI, Pix, Boleto, and card payments. Webhook signatures are verified before body parsing on all drivers. Task 14 adds payment-method tokenization (vault) needed by billing's card-on-file path.
x-signature header (verified against live docs). Sandbox at developer.mercadopago.com — free, immediate credentials.POST /webhook_keys endpoint (not HMAC — confirmed and corrected in SPEC). Sandbox at developers.conekta.com — free.DriverNotImplementedException. No work until Colombia/Chile market validates.awaiting_payment → paid state machine handles reconciliation. These flows are first-class in all 4 complete drivers.fs_oxxo_voucher template is the primary delivery channel.Subscription & metered billing engine — plans, subscriptions, invoicing, Mexican IVA (16%/8%/0%/exento with retenciones), proration, dunning, and payment reconciliation. Works standalone with a ManualPaymentAdapter and auto-wires with latam-pay and cfdi-mexico when present. No external API connections of its own — it orchestrates the other two modules.
(subscription_id, period_start) constraint + deterministic charge idempotency key. Highest-risk code in the package. AI generates it; human writes the failing tests first and validates the edge cases.Sends WhatsApp Business messages via Meta Cloud API or Twilio behind a single WhatsAppClientInterface. Ships with 6 pre-built billing lifecycle templates × 2 languages = 12 template definitions. Templates wire automatically to billing and latam-pay events via PSR-14 listeners.
forgestack:whatsapp:register-templates CLI command automates submission. Customers run it once during onboarding, not at first use.Symfony 7 application that assembles all packages and adds row-level multi-tenancy, a per-tenant credential vault (CSD keys, PAC/gateway secrets), EasyAdminBundle 4.x dashboard, and Symfony Messenger-backed multi-tenant billing orchestration. The platform is itself tenant zero — it bills its own customers through the same engine.
Syncs billing/CFDI/payment activity into customers' accounting ledgers. Two desktop ERPs (ContPAQi, Aspel COI) via file export; REST connectors (Siigo) as designed stubs. Split into two tiers: A-cheap (CFDI XML delivery to ContPAQi ADD folder — zero account mapping) and A-hard (póliza posting with double-entry mapping).
{addPath}/{year}/{month}/{RFC}/{uuid}.xml. No póliza mapping, no account chart, no ERP-side complexity. AI generates this completely.Non-code prerequisites — sandbox accounts, public data, legal reviews. All sandbox accounts are free and take under an hour to create.
api.forgestack.build staging live; POST /api/v1/license/verify responding; at least one fsk_test_* token created for dev testingsatis.forgestack.build with Nginx auth_request → /internal/verify-token; private repo credential working end-to-endngx_http_lua_module installed on the server for rate limiting + body-based token extractionAAA010101AAA.cer + .key, password 12345678a, from SAT developer portal (public)resources/schemas/The only items where "we can't build this as planned" is a real scenario. All three have explicit fallbacks or mitigation paths.
The Model B design for CSD signing requires OVH KMS to accept an imported RSA key and sign RSASSA-PKCS1-v1.5 + SHA-256. The plan documents this as unverified and requires a ~1-day PoC against the live OVH KMS API before building H03. If it fails, the explicit fallback is Azure/AWS KMS for the CSD signing key only — Model A (envelope encryption for gateway/PAC/ERP secrets) works with OVH KMS regardless, since it only needs encrypt/decrypt.
The CSD server-side custody model and the "the .key is not personal data" reading under the new 2025 federal data protection law need Mexican fiscal/data-protection counsel sign-off before hosted goes live. Research is done and documented. This does not block the dev-sold packages at all — customers hold their own CSD on the standalone track. Can run in parallel with all of Phases 0–3.5.
The póliza posting format for ContPAQi and Aspel COI is version-sensitive and not fully public. The plan's Task 00 gate requires confirming exact formats against a live install before writing the mappers — building against assumptions produces files the ERP silently rejects. This blocks Tasks 07–08 A-hard only; the full framework (Tasks 01–06), the A-cheap CFDI delivery tier, and all REST stubs build without it. Path: one friendly despacho with a ContPAQi install.