---
id: SAND-WP-0006
type: workplan
title: "SaaS extensions and payments layer"
domain: infotech
repo: sand-boxer
status: finished
owner: codex
topic_slug: custodian
created: "2026-06-23"
updated: "2026-06-23"
state_hub_workstream_id: "4dce12d5-f833-4d13-9140-280f29229c37"
---

# SaaS extensions and payments layer

Deliver INTENT pillar 4 (payments/metering) and routing engine v0 for
self-hosted vs SaaS backend selection.

**Predecessor:** SAND-WP-0005 (extension SDK — finished)  
**Follow-on:** SAND-WP-0007 (snapshots), real E2B/Modal adapters

## Payments and credits

```task
id: SAND-WP-0006-T01
status: done
priority: high
state_hub_task_id: "6a7df600-4a41-4942-8969-9e06a3b2406e"
```

`CreditsStore`, `estimate_cost` / `settle_usage`, pre-create balance check,
post-destroy debit, `SandboxStatus.meter` field. Docs: `docs/payments.md`.
CLI: `sandboxer credits show|add`.

## Routing engine

```task
id: SAND-WP-0006-T02
status: done
priority: high
state_hub_task_id: "f1a81915-57b8-4a72-9ca9-bca402084b4a"
```

`RouteSpec` on profiles, `resolve_extension` with strategies
(`prefer-self-hosted`, `lowest-cost`, `lowest-latency`, `explicit`).
Docs: `docs/routing.md`.

## ext.saas-stub

```task
id: SAND-WP-0006-T03
status: done
priority: high
state_hub_task_id: "91bce931-5cae-4bbf-8dce-095a603ec0da"
```

Metered SaaS stub extension — `estimate_cost`, `meter_actual`, no external API.
Profiles: `profile.saas-stub`, `profile.burst-sandbox`.

## Manager integration

```task
id: SAND-WP-0006-T04
status: done
priority: high
state_hub_task_id: "7e1e9b80-0b3e-4eee-b7ac-2b611f8a0f3d"
```

`SandboxManager` uses routing resolver; destroy loads `status.extension_id`;
meter settlement on destroy; meter events to State Hub.

## Tests

```task
id: SAND-WP-0006-T05
status: done
priority: high
state_hub_task_id: "7075d8fc-44d1-48fe-b061-a05385de31a8"
```

`test_routing.py`, `test_payments.py`, `test_saas_stub.py`.

## Deferred

```task
id: SAND-WP-0006-T06
status: wait
priority: low
state_hub_task_id: "c514c6b3-2be8-41e4-8e84-88f20ad80f7e"
```

Real `ext.e2b` / `ext.modal` adapters, BYOK via OpenBao, fin-hub export.