Paid Membership & Access Planner

The problem this kills

Paid membership is where vibe-coded apps leak money quietly, and the leak is hard to see from the happy path. Your agent ships a signup form, a pricing page, and a user.tier === "premium" check in the template, and the demo looks perfect: you sign up, you pay, the article unlocks. Everything the founder clicks through works.

What has not been built is every way a membership ends. The card fails on renewal — nothing happens, access continues. A member cancels — the row is marked cancelled, the gate never re-reads it, access continues. A refund is issued, a chargeback lands, a subscription expires, a member downgrades mid-cycle — the app has no concept of an entitlement that can be revoked, because it only ever modelled the moment money arrived. You end up with a paying tier that anyone who once paid keeps forever.

The sharper failure is the gate itself. When "premium" is decided in the template, the protected content is usually already sitting in the JSON the page fetched — the paywall is CSS. The member doesn't need to hack anything; they need to open devtools, or scroll before the script runs. An entire membership business can ship with its product served to logged-out visitors.

Why your agent cannot fake this

This planner is grounded in a verified 100-product census — a fixed 60-product core cohort plus 40 adjacent products, reconciled across 150 verified source rows. Counts are deliberately conservative: a product is credited only where a retained official source explicitly documents the capability, so every number below is a floor, not an estimate.

The cohort is the part your agent cannot reconstruct, because "membership software" is four different product categories that disagree with each other. The core spans WordPress membership plugins (MemberPress, Paid Memberships Pro, ARMember, Restrict Content Pro, s2Member, WishList Member), hosted membership platforms (Memberful, MemberSpace, Memberstack, Outseta, AccessAlly), publisher paywalls (Piano, Zephr, Poool, Pelcro, Leaky Paywall, Accesstype, Evolok), and video/OTT access control (Uscreen, Muvi, ViewLift, Cleeng, InPlayer). The adjacent cohort covers creator and entitlement infrastructure — Patreon, Ko-fi, Circle, Mighty Networks, Whop, RevenueCat, and the Stripe / Chargebee / Recurly entitlement APIs. An agent working from blog posts averages those four categories into mush; the research keeps them separate and tells your agent which one it is building.

The decisive finding is the inversion between what the market advertises and what actually breaks. Plans and tiers are documented in 36 of 60 products, recurring pricing in 24 of 60. But failed-payment retry and dunning appear in only 4 of 60, refund and chargeback access consequences in 6 of 60, proration in 3 of 60, and explicit server-side entitlement verification in just 3 of 60. Those are not unimportant — they are underdocumented. They are exactly the lifecycle edges where access stays switched on after the money stops, and a planner that ranked features by marketing frequency alone would deprioritise every one of them. This one raises them on lifecycle risk instead.

What you actually get

A member-first planner that treats entitlement as a server-side decision with an expiry, not a flag on a user row. It walks your agent through the membership model and depth before any code, then holds the build to lifecycle gates:

• Depth tiers, honestly bounded. Basic is 9 features / 45 sub-features / 9 lifecycles. Moderate is 15 / 75 / 15. Advanced reaches 17–19 features / up to 95 sub-features / 17–19 lifecycles. The resolver enforces the budget and stops the build when a selection goes over, rather than quietly expanding.
• The must-love role is the member. Join, sign in, read or watch the thing they paid for, see what their plan includes, and change or cancel it without emailing support — that leads the product. Admin and reporting surfaces are not allowed to crowd the primary navigation.
• Every entitlement carries an end. Cancellation, expiry, refund, chargeback, failed payment and plan change each have to reverse access in the same transaction that records them, proven against their own lifecycle rather than a completion checkbox.
• The gate is server-side or it isn't a gate. Protected content is resolved and withheld on the server; teaser, meter, drip and denied states are explicit designed surfaces, not a stylesheet hiding a payload the client already holds.
• Membership model as an explicit branch. Content paywall, community access, file or video library, and course-style drip are separate decisions with different data models — never silently bolted together into one generic "membership."

The planner emits a hot CLAUDE.md or AGENTS.md plus split spec files, with a custody gate that stops the agent from scaffolding before the spec is written and locked.