Initial import of zapier-decisions from zapier monorepo

decisions/D001-prepaid-sot.md

@@ -0,0 +1,6 @@
+# D001 — Account-balance is the only prepaid writer
+
+**Status:** accepted  
+**Step:** 1
+
+Prepaid cents, credits, usage, and payments persist in `zappier-account-balance` (`books.json`). zappier-edge `balanceCents` is a cache filled from the books reply. Tests without NATS/HTTP books still mutate the cache so unit tests stay hermetic.

decisions/D002-identity.md

@@ -0,0 +1,6 @@
+# D002 — veraeUserId is the join key, not the JWT
+
+**Status:** accepted  
+**Step:** 2
+
+Public token remains the zappier API key. Chain JWT stays server-side (`tokenRef`). `zappier-identity` is the mailbox for bind/lookup so portal and middleware share one map.

decisions/D003-public-doors.md

@@ -0,0 +1,6 @@
+# D003 — Access planes are the only public HTTP doors
+
+**Status:** accepted  
+**Step:** 3
+
+Zapier → `:3024`, browser → `:3021`, customer API → `:3022`, leaf → `:3023`, staff → `:3025`. zappier-edge listens on `127.0.0.1:3000` for identity, Stripe, admin, and as upstream for those planes.

decisions/D004-leaf-accounts.md

@@ -0,0 +1,6 @@
+# D004 — Leaf cannot touch billing, even if authz is skipped
+
+**Status:** accepted  
+**Step:** 4
+
+`verae-nats-accounts/policy.json` is the allow-list. access-leaf refuses any target not in the leaf set. nats.conf documents INTERNAL vs LEAF accounts for when the lab cluster is replaced with a real accounts-enabled nats-server.

decisions/D005-fleet-local-first.md

@@ -0,0 +1,6 @@
+# D005 — HTTP services spawn locally; lan-134 stays off
+
+**Status:** accepted  
+**Step:** 5
+
+SSH to `70.88.205.134` blocked keepFloor. HTTP apps (`spawn.command`) prefer `kind=local`. `lan-134` is disabled unless `FLEET_ENABLE_LAN134=1`. Failed SSH hosts are skipped after 8s.