chore: release main

.github/workflows/ci.yml

@@ -39,6 +39,8 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: verify_package_docs.sh
+        env:
+          RELEASE_PLEASE_PR: ${{ github.event_name == 'pull_request' && startsWith(github.head_ref, 'release-please--') && '1' || '' }}
         run: bash scripts/ci/verify_package_docs.sh
 
       - name: Processor support matrix contract
@@ -70,6 +72,9 @@ jobs:
       - name: Verify Release Please manifest ↔ mix.exs @version
         run: bash scripts/ci/verify_release_manifest_alignment.sh
 
+      - name: Verify linked release contract
+        run: bash scripts/ci/verify_release_contract.sh
+
   release-gate:
     name: Release gate (${{ matrix.compatibility }}; elixir=${{ matrix.elixir }} otp=${{ matrix.otp }} sigra=${{ matrix.sigra }} opentelemetry=${{ matrix.opentelemetry }})
     if: github.event_name != 'schedule'

.github/workflows/publish-hex.yml

@@ -4,12 +4,13 @@ on:
   workflow_dispatch:
     inputs:
       package:
-        description: 'Package to publish. Run accrue before accrue_admin when recovering a same-day release.'
+        description: 'Package to publish. Run accrue before accrue_admin before accrue_portal when recovering a same-day release.'
         required: true
         type: choice
         options:
           - accrue
           - accrue_admin
+          - accrue_portal
       tag:
         description: 'Reviewed git tag or commit ref to publish from.'
         required: true
@@ -79,3 +80,35 @@ jobs:
         env:
           HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
           ACCRUE_ADMIN_HEX_RELEASE: ${{ env.ACCRUE_ADMIN_HEX_RELEASE }}
+
+  publish-accrue-portal:
+    name: Publish accrue_portal recovery
+    if: ${{ inputs.package == 'accrue_portal' }}
+    runs-on: ubuntu-24.04
+    env:
+      ACCRUE_PORTAL_HEX_RELEASE: "1"
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.tag }}
+      - name: Set up BEAM
+        uses: erlef/setup-beam@v1
+        with:
+          otp-version: '27.0'
+          elixir-version: '1.18.0'
+      - name: Install Hex
+        run: mix local.hex --force
+      - name: Verify accrue_portal release version
+        run: grep -n "@version \"${{ inputs.release_version }}\"" accrue_portal/mix.exs
+      - name: Install accrue_portal deps
+        run: cd accrue_portal && mix deps.get
+      - name: Dry run accrue_portal Hex publish
+        run: cd accrue_portal && mix hex.publish --dry-run
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
+          ACCRUE_PORTAL_HEX_RELEASE: ${{ env.ACCRUE_PORTAL_HEX_RELEASE }}
+      - name: Publish accrue_portal to Hex
+        run: cd accrue_portal && mix hex.publish --yes
+        env:
+          HEX_API_KEY: ${{ secrets.HEX_API_KEY }}
+          ACCRUE_PORTAL_HEX_RELEASE: ${{ env.ACCRUE_PORTAL_HEX_RELEASE }}

.github/workflows/release-please.yml

@@ -163,6 +163,49 @@ jobs:
             --manifest-file .release-please-manifest.json \
             --token "$RELEASE_PLEASE_TOKEN"
 
+          release_pr_number="$(gh pr list --repo "$repo" --state open --head "release-please--branches--${target_branch}" --json number --jq '.[0].number // empty')"
+          if [ -n "$release_pr_number" ]; then
+            release_branch="$(gh pr view "$release_pr_number" --repo "$repo" --json headRefName --jq '.headRefName')"
+            git fetch origin "$target_branch" "$release_branch"
+            git checkout -B "$release_branch" "origin/$release_branch"
+
+            expected_base="$(git rev-parse "origin/${target_branch}")"
+            actual_base="$(git merge-base HEAD "$expected_base")"
+            if [ "$actual_base" != "$expected_base" ]; then
+              git checkout "$target_branch"
+              git checkout -B "$release_branch" "$expected_base"
+              git push --force-with-lease origin HEAD:"$release_branch"
+
+              $release_please release-pr \
+                --repo-url "$repo" \
+                --target-branch "$target_branch" \
+                --config-file release-please-config.json \
+                --manifest-file .release-please-manifest.json \
+                --token "$RELEASE_PLEASE_TOKEN"
+
+              git fetch origin "$release_branch"
+              git checkout -B "$release_branch" "origin/$release_branch"
+            fi
+
+            repair_version="$(jq -r '.accrue // empty' .release-please-manifest.json)"
+            repair_admin_version="$(jq -r '.accrue_admin // empty' .release-please-manifest.json)"
+            repair_portal_version="$(jq -r '.accrue_portal // empty' .release-please-manifest.json)"
+
+            if [ -n "$repair_version" ] && [ "$repair_version" = "$repair_admin_version" ] && [ "$repair_portal_version" != "$repair_version" ]; then
+              bash scripts/ci/repair_linked_release_pr.sh --version "$repair_version"
+              if ! git diff --quiet; then
+                git config user.name "github-actions[bot]"
+                git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+                git add .release-please-manifest.json accrue_portal/mix.exs accrue_portal/CHANGELOG.md
+                git commit -m "fix: repair linked portal release PR to ${repair_version}"
+                git push origin HEAD:"$release_branch"
+              fi
+            fi
+
+            git checkout "$target_branch"
+            bash scripts/ci/verify_release_pr_scope.sh --pr "$release_pr_number"
+          fi
+
   publish-accrue:
     name: Publish accrue
     needs: release

.planning/ROADMAP.md

@@ -17,6 +17,7 @@ Start the next milestone with `$gsd-new-milestone`.
 - The next unused planning phase is now **120**.
 - The linked release-readiness pass remains the next concrete operational follow-up after archival.
 - Advanced schedules, broader pause/resume promotion, broader preview/proration parity, Hyperwallet reopening, and `FIN-03` stay out of scope unless a later milestone explicitly reopens them.
+- Maintenance triage references remain canonical in the archived v1.17 inventory backlog slices: [INT-10](research/v1.17-FRICTION-INVENTORY.md#backlog--int-10-phase-63), [BIL-03](research/v1.17-FRICTION-INVENTORY.md#backlog--bil-03-phase-64), and [ADM-12](research/v1.17-FRICTION-INVENTORY.md#backlog--adm-12-phase-65).
 
 ---
 *Last updated: 2026-05-07 — **v1.37** archived; no active milestone.*

.planning/STATE.md

@@ -48,6 +48,8 @@ Last activity: 2026-05-07 — archived `v1.37` roadmap and requirements, collaps
 
 - **`.planning/STRATEGY.md`** — active PROC-08 strategic parent.
 - **`.planning/ROADMAP.md`** — no-active-milestone summary plus recent archives.
+- **`.planning/research/v1.17-FRICTION-INVENTORY.md`** — canonical friction inventory for intake-gated maintenance and dated maintainer passes.
+- **`.planning/research/v1.17-north-star.md`** — stop-rule and maintenance-triage SSOT for the library-maintenance posture.
 - **`.planning/milestones/v1.37-ROADMAP.md`** — archived roadmap and milestone narrative for Phases 117–119.
 - **`.planning/milestones/v1.37-REQUIREMENTS.md`** — archived requirements and traceability for `SCM-01..06`.
 - **`.planning/milestones/v1.36-ROADMAP.md`** — archived roadmap and milestone narrative for Phases 112–116.
@@ -59,6 +61,8 @@ Last activity: 2026-05-07 — archived `v1.37` roadmap and requirements, collaps
 - **`.planning/research/PITFALLS.md`** — most recent contract-drift and proof-lane risk notes.
 - **`.planning/research/SUMMARY.md`** — most recent synthesized research summary.
 
+**Triage doctrine (read-only context, v1.17–v1.18):** [North star + stop rules](research/v1.17-north-star.md) · [Friction inventory](research/v1.17-FRICTION-INVENTORY.md)
+
 ## Deferred Items
 
 | Category | Item | Status |

.release-please-manifest.json

@@ -1,5 +1,5 @@
 {
-  "accrue": "1.0.0",
-  "accrue_admin": "1.0.0",
-  "accrue_portal": "1.0.0"
+  "accrue": "1.1.0",
+  "accrue_admin": "1.1.0",
+  "accrue_portal": "1.1.0"
 }

CONTRIBUTING.md

@@ -1,9 +1,10 @@
 # Contributing
 
-Thanks for contributing to Accrue. This repository ships two sibling Mix packages:
+Thanks for contributing to Accrue. This repository ships three sibling Mix packages:
 
 - `accrue/` for the core billing library
 - `accrue_admin/` for the LiveView admin UI
+- `accrue_portal/` for the customer billing portal UI
 
 ## Development setup
 
@@ -14,7 +15,7 @@ Install the supported toolchain first:
 - PostgreSQL 14+
 - Node.js for browser UAT in `examples/accrue_host`
 
-Then bootstrap both packages:
+Then bootstrap the package suite:
 
 ```bash
 cd accrue
@@ -23,6 +24,9 @@ mix deps.get
 cd ../accrue_admin
 mix deps.get
 npm ci
+
+cd ../accrue_portal
+mix deps.get
 ```
 
 Use the package-local READMEs and guides for host-app wiring, browser UAT, and release-oriented docs checks.
@@ -70,6 +74,15 @@ mix hex.build
 mix hex.publish --dry-run
 ```
 
+For `accrue_portal`, use the matching publish-mode dry run:
+
+```bash
+cd accrue_portal
+export ACCRUE_PORTAL_HEX_RELEASE=1
+mix hex.build
+mix hex.publish --dry-run
+```
+
 For provider-parity checks against Stripe test mode, follow the setup in [`guides/testing-live-stripe.md`](guides/testing-live-stripe.md). That lane is advisory/manual, not part of the required deterministic release gate, and it exists to catch provider-parity drift rather than replace Fake. Please keep real credentials out of shell history and logs.
 
 The required deterministic release gate still includes the checked-in trust review artifact, generated drift/docs drift, seeded performance smoke, compatibility floor/target checks, and browser accessibility/responsive checks. Keep webhook secrets, customer data, and PII out of docs, issue templates, screenshots, traces, and copied terminal output.