Grant-is-truth candidate paywall

The candidate money flow is anonymous offers → authenticated embedded checkout → webhook-backed grant. The grant, rather than checkout completion, owns access.

Board-password access is a separate X-Board-Access mechanism. Employer posting payments use cavuno-board-post-a-job.

Render offers and gating

board.paywall.offers() is anonymous and returns an empty list when disabled. Internal Stripe price ids stay server-side.