Skip to content

Clarify payment checkout and processor support - #549

Merged
AnnaXWang merged 3 commits into
mainfrom
hypeship/document-stripe-disclosure
Sep 5, 2026
Merged

Clarify payment checkout and processor support#549
AnnaXWang merged 3 commits into
mainfrom
hypeship/document-stripe-disclosure

Conversation

@AnnaXWang

@AnnaXWang AnnaXWang commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Summary

  • distinguish Stripe Link and Agentcard credential providers from merchant payment processors across the payment and Vaults guides
  • replace the Stripe-only checkout section with the native Stripe, Shopify, Square, Recurly, and Razorpay adapter formats and current validation caveats
  • remove processor compatibility as a provider-selection criterion and add Shopify and non-Stripe Agentcard examples
  • document the benefits and current reliability limits of KERNEL's native handoff
  • document safe handling of Stripe's hidden or duplicate disclosure controls and keep checkout submission one-shot

Testing

  • ran the Mintlify local preview
  • verified all five affected routes return HTTP 200
  • ran Mintlify broken-links successfully

Note

Low Risk
Documentation-only changes to Mintlify guides; no application code, APIs, or payment behavior changes.

Overview
This PR reframes payment docs so Stripe Link and Agentcard are credential providers, separate from the merchant's payment processor. It states that aliases can fill any standard card form (processor need not be Stripe) while native egress handoff only applies when the outgoing request matches a documented adapter.

The payments overview replaces the Stripe-only "Supported checkouts" section with Checkout and processor coverage: a table for Stripe, Shopify, Square, Recurly, and Razorpay POST formats, plus examples (e.g. Stripe Link on Shopify), validation caveats, a Why use KERNEL handoff section, and guidance to contact support for more processors. Provider choice is tied to approval lifecycle, not processor compatibility; comparison tables drop checkout-fit / Stripe-only constraint columns.

Across the browser agent, Agentcard, Stripe Link, and Vaults guides, wording shifts from "supported checkout/substitution" to recognized processor requests and native handoff. Prerequisites now require checkouts that match adapter coverage. Purchase verification is described as processor-agnostic (trusted order backend first). Checkout submission is one-shot (no retries on timeout or indeterminate results). Stripe agent-disclosure checkboxes get guidance for hidden/duplicate responsive controls (visible label, native click(), verify checked).

Actor/responsibility tables and the payments flow diagram now distinguish credential provider from merchant processor.

Reviewed by Cursor Bugbot for commit b6bfc17. Bugbot is set up for automated code reviews on this repo. Configure here.

@mintlify

mintlify Bot commented Sep 5, 2026

Copy link
Copy Markdown
Contributor

Preview deployment for your docs. Learn more about Mintlify Previews.

Project Status Preview Updated
Kernel 🟢 Ready View Preview Sep 5, 2026, 6:05 PM

💡 Tip: Enable Automations to automatically generate PRs for you.

@AnnaXWang AnnaXWang changed the title Document Stripe disclosure checkbox handling Clarify payment checkout and processor support Sep 5, 2026
cursor[bot]
cursor Bot approved these changes Sep 5, 2026
or an action is present, stop and ask me to resolve wallet setup outside this
agent. do not create another wallet or print, return, or open an action url.
3. create a KERNEL browser with `user-12345` attached as a vault, then navigate
it to https://buy.stripe.com/28E5kw7DtgKXdLqgiY53O00.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I want to keep https://buy.stripe.com/28E5kw7DtgKXdLqgiY53O00 since that's what our testing was done on

offers **I am an AI agent acting on behalf of someone else**, select that option.
don't bypass the disclosure or replace the page's normal submission with a raw
processor request.
stripe can render hidden or duplicate copies of its disclosure control for

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this is mentioned too many times in our docs now, find the single best place to include this information, do not mention more than 2x


Submit the checkout once. If the payment request pauses for user approval,
wait for the controller to finish that approval. Do not retry payment.
Stripe may render hidden or duplicate disclosure controls. Target the visible

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this seems like extraneous because we already mention it before

Comment thread integrations/payments/agentcard.mdx Outdated
<span className="kernel-brand-name">KERNEL</span> currently has adapters for
request formats used by stripe, shopify, square, recurly, and razorpay.

agentcard's direct SDK recognizes additional processors, but

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would say "kernel's native handoff aims to support the same processors that are supported by agentcard's direct SDK. email support@kernel.sh if you need
another processor so we can prioritize its adapter and validate a real checkout."

Comment thread integrations/payments/overview.mdx Outdated
different request layouts, and unrecognized processor endpoints pass through
without native handoff.

agentcard's direct SDK recognizes additional processors that

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would say "kernel's native handoff aims to support the same processors that are supported by agentcard's direct SDK. email support@kernel.sh if you need
another processor so we can prioritize its adapter and validate a real checkout."

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Stale comment

Risk assessment: Very Low

Verdict: Re-evaluated after the latest push. Risk did not increase. Previous approval stands (not re-approving).

This PR still only edits Mintlify documentation (*.mdx). The full diff touches five pages:

  • browsers/enable-payments-in-browser-agent.mdx
  • integrations/payments/overview.mdx
  • integrations/payments/agentcard.mdx
  • integrations/payments/stripe-link.mdx
  • vaults.mdx

No application code, config, CI, navigation, or infrastructure files change. There is no CODEOWNERS file, so no required codeowner review applies.

The latest commit (b6bfc17) only rearranges existing docs copy: it shortens example agent prompts, restores a Stripe payment-link URL in an example, and softens adapter-coverage wording. That does not expand blast radius or add production logic.

Across the PR, the edits:

  • Distinguish credential providers (Stripe Link, Agentcard) from merchant processors
  • Document native processor request formats (Stripe, Shopify, Square, Recurly, Razorpay) and keep pass-through caveats
  • Document Stripe disclosure-control handling and one-shot checkout submission in the guide body

Example prompt snippets live in product docs, not in deployed model-instruction files. Blast radius is limited to the docs site. No production logic, auth, billing code, or shared services are modified.

Risk level: Very Low
Action: No approval change. Existing approval remains.

Open in Web View Automation 

Sent by Cursor Automation: Assign PR reviewers

@AnnaXWang
AnnaXWang marked this pull request as ready for review September 5, 2026 20:42

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Risk assessment: Very Low

Verdict: Re-evaluated the current HEAD (b6bfc17). Risk did not increase. Previous approval stands (not re-approving).

Assessed from the file diff only (5 files, +150 / −59). Every changed path is Mintlify documentation (*.mdx):

  • browsers/enable-payments-in-browser-agent.mdx
  • integrations/payments/overview.mdx
  • integrations/payments/agentcard.mdx
  • integrations/payments/stripe-link.mdx
  • vaults.mdx

No application code, config, CI, navigation (docs.json), or infrastructure files change. There is no CODEOWNERS file, so no required codeowner review applies.

The edits rewrite payment-guide copy: they distinguish credential providers from merchant processors, document native adapter request formats, and add checkout-submission / disclosure guidance in the docs body. Example agent prompts live in product guides, not in deployed model-instruction files.

The post-approval commit (65a3f6ab6bfc17) only rearranges that same docs copy (shorter example prompts, restored Stripe payment-link URL, softer adapter-coverage wording). That does not expand blast radius or add production logic.

Risk level: Very Low
Action: No approval change. Existing approval remains.

Open in Web View Automation 

Sent by Cursor Automation: Assign PR reviewers

@cursor cursor Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit b6bfc17. Configure here.

<span className="kernel-brand-name">KERNEL</span>'s native handoff aims to
support the same processors supported by agentcard's direct SDK. email
[support@kernel.sh](mailto:support@kernel.sh) if you need another processor so
we can prioritize its adapter and validate a real checkout.

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Processor coverage copied across pages

Medium Severity

The credential-provider versus processor explanation, adapter list, and native-handoff support note are reproduced in full on multiple pages instead of living on the canonical checkout-and-processor-coverage section and being briefly summarized with a link. That breaks the single-source-of-truth pattern and already shows small wording drift across copies.

Additional Locations (2)
Fix in Cursor Fix in Web

Triggered by learned rule: Single source of truth — no deep content duplication across pages

Reviewed by Cursor Bugbot for commit b6bfc17. Configure here.

@rgarcia rgarcia left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

reviewed — looks good.

@AnnaXWang
AnnaXWang merged commit f98baf8 into main Sep 5, 2026
4 checks passed
@AnnaXWang
AnnaXWang deleted the hypeship/document-stripe-disclosure branch September 5, 2026 21:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants