Tenant reference
The flat lookup, not the story: every literal fact you might need to copy a value out of, rather than read a narrative about. Tenant concepts's five pages explain what each thing is and why it's shaped that way; the task guides explain how to act on it; this page is where you come back for the exact state, threshold, or default once you already know the shape.
Every fact below is guarded by this site's own drift-check harness (scripts/doc-facts.mjs) against the real source it documents — a lifecycle state renamed, a grace period retuned, a quota's default changed, an export-archive entry renamed, or a Credential kind added/removed in code without a matching edit here fails npm test, naming exactly which fact and which file drifted.
Billing lifecycle + grace
The five states of your tenant's billing lifecycle (ADR-0043), decided exclusively by the control plane's own reconciler sweep — never by a webhook handler directly:
| State | Entered when | Grace before escalating |
|---|---|---|
provisioning | Signed up via GitHub OAuth — no completed Stripe Checkout yet. | — |
active | Stripe reports the subscription trialing or active (the trial itself counts as covered). | — |
past-due | A payment fails — including a card-required trial that expires with no successful charge. | 7 days, then escalates to suspended. |
suspended | past-due's grace elapses with no recovery. | 14 days, then escalates to decommissioning. |
decommissioning | suspended's grace elapses, or you cancel explicitly from the Billing Portal while active (skipping past-due/suspended entirely). | Terminal in v1 — no path back; see Close your account. |
past-due/suspended recover straight back to active the moment Stripe reports the subscription covered again (updating your card in the Billing Portal) — see Manage billing.
This table deliberately omits your plan's price and trial length: neither has a single code-side source of truth to drift-check against (the price is set on Stripe's own dashboard; the trial length a real deploy's config can override), so pinning a number here could go stale with no code change to catch it. See zozohq.com's pricing section for the current price and trial terms instead.
The two quotas
The two v1 quotas ADR-0054 draws a sharp line between — one flows to your Stack's own admission gate, the other never leaves the control plane. See Quotas for why each is enforced where it is.
| Quota | Default | Enforced |
|---|---|---|
Concurrent-Run cap (stacks.run_cap) | 1 | Your Stack's own admission gate — rendered into desired state, applied by your Dispatcher. |
Watched-Projects cap (stacks.watched_projects_cap) | 3 | Control-plane-side only — never rendered to your Stack; checked when a Project is registered. |
Export-archive contents
Every entry the export archive download bundles (ADR-0050), in the order it's written — a manifest first, so its contents are checkable from the archive alone:
| Entry | Contents |
|---|---|
manifest.json | What's inside and why — generation time, the journal's size, and one row per bundled Thread (its id, Project, issue, and size). |
journal.db | A raw, unencrypted copy of your Stack's own append-only Event journal — unlike the automatic backup, no encryption step, since this is you pulling your own data over your own already-authenticated session. |
bundles/<threadId>.bundle | One fetchable git bundle per Thread currently holding an Unshipped attempt — commits that never reached your remote, recoverable independent of the Thread or its Workspace still existing. |
Credential kinds
The full closed set of Credential kinds POST /providers/:name/credential accepts (ADR-0011, ADR-0035). See Auth & consent for why the consent column below is shaped the way it is.
| Kind | Consent required | Injected as |
|---|---|---|
oauth_token | Yes | Claude's CLAUDE_CODE_OAUTH_TOKEN — your own personal subscription. |
auth_file | Yes | Codex's uploaded ~/.codex/auth.json — your own personal subscription. |
api_key | No | Claude's ANTHROPIC_API_KEY, or Codex's auth.json OPENAI_API_KEY field — the vendor-blessed, unattended default a hosted tenant starts with (see the Quickstart). |
Related
- Tenant concepts — the narrative version of every table above: Two surfaces, Work model, Auth & consent, Quotas, and Data & privacy.
- Manage billing, Export your data, Close your account — the task guides these tables back.
docs/adr/0043-stripe-billing-and-the-five-state-tenant-lifecycle.md— the billing lifecycle's own design.docs/adr/0050-export-archive-and-the-decommission-gate.md— the export archive's own design.docs/adr/0054-the-two-v1-quotas-run-cap-flows-to-the-stack-watched-projects-stays-control-plane-side.md— the two quotas' own design.docs/adr/0011-bring-your-own-runtime-credentials-outside-the-journal.mdanddocs/adr/0035-api-key-credentials-are-first-class-amends-adr-0011.md— the Credential kinds' own design.