morethanadiagnosis-hub/openspec/changes/2025-11-17-merch-mvp/proposal.md

Proposal: Merch Store MVP

Status: draft Authors: Commerce Team Owners: Commerce Lead, Security Lead Created: 2025-11-17 Scope: spec Related: openspec/specs/feature-merch.md

Summary

• Launch a merch storefront using a PCI‑compliant provider with secure checkout, tax/shipping rules, and order webhooks.

Motivation

• Support the community via merch sales without handling card data directly.

Requirements

• Accessibility: accessible product listings, cart, and checkout handoff.
• Security/Compliance: no card data stored; PCI boundaries documented; webhook auth/signing.
• Operations: fulfillment integration, refunds/cancellations flows.

API

• Product catalog; orders; webhooks for fulfillment updates.

Test Plan

• Payment flow integration tests (sandbox); webhook signature verification tests; a11y checks on UI.

Rollout

• Pilot catalog; test orders; operations runbook.

Acceptance Criteria

• Accessible flows; PCI boundaries enforced; successful end‑to‑end order.

Slash Commands

• /review areas=commerce,security,compliance,web,mobile,accessibility
• /apply spec=openspec/specs/feature-merch.md
• /archive link=<PR>