Skip to content

ADR 0067 — Project OCTOPUS Wave-6 Channel Marketplace

Status Date Author Supersedes Superseded by
Accepted 2026-05-16 André Luiz Gallon — —

Context

Wave-1..3 ships TLSStress.Art via direct-sales (app.tlsstress.art self-serve + Cisco sales-led enterprise). Wave-5 (compliance) opens Defense/FedRAMP doors. Wave-6 opens channel-led GTM: cloud marketplace listings, partner MSP portals, multi-currency billing, non-card payment rails.

This ADR formalizes Wave-6. Trigger gate: $10M+ ARR OR first channel partner deal signed. Below the gate, direct-sales remains the only billing path.

Architectural decision

10 LOCKED decisions.

D1: Cloud marketplaces = AWS + Azure + GCP

Listings on all 3 hyperscalers:

  • AWS Marketplace SaaS Contracts + AWS Private Offers (committed use discounts, enterprise procurement)
  • Azure Marketplace + Microsoft AppSource (Microsoft's curated business app store + EA discount alignment)
  • GCP Marketplace (Workload Identity Federation + GCP commit discounts)

Each marketplace tracks entitlements via provider webhooks:

  • AWS: AWS Marketplace Metering Service + Entitlement Service
  • Azure: SaaS Webhook v3 (subscription lifecycle events)
  • GCP: Pub/Sub topic per marketplace listing

Webhooks resolve to canonical marketplace_subscription_id → TLSStress.Art deployment_id mapping in pkg/octopus/marketplace/.

D2: B2B SaaS platforms = Salesforce AppExchange + ServiceNow Store

Beyond hyperscalers, two B2B platforms for in-context discovery:

  • Salesforce AppExchange: TLSStress.Art appears in Sales/Service Cloud as an integration. Customer admin clicks "Install" → redirected to TLSStress.Art self-serve onboarding with pre-filled Salesforce org metadata.
  • ServiceNow Store: ITOps teams discover TLSStress.Art when managing incident workflows. ServiceNow tlsstress_test_run table integration via REST API.

Both billed via marketplace fees (AppExchange 15-25%, ServiceNow ~12%); fee tracking in pkg/octopus/marketplace/commission/.

D3: White-label MSP portal

Cisco MSP partners (Crosswork resellers, SonicWall channel) get a white-label TLSStress.Art portal under THEIR brand:

  • Custom domain (tls.acmemsp.com → TLSStress.Art via CNAME)
  • Custom logo + color palette (per-tenant theming)
  • MSP admin manages sub-tenants (the MSP's own customers)
  • Pricing: MSP buys at wholesale ~50% off retail; charges customers whatever they want
  • Revenue share: TLSStress.Art keeps wholesale; MSP keeps margin

Architectural impact: account_hierarchy table tracks reseller_id → customer_id → deployment_id. Pricing tier per reseller (NOT per customer). Existing Wave-1 admin console gets "Reseller Mode" toggle.

D4: Channel commission tracking via Crossbeam + Allbound

  • Crossbeam: partner data sharing (who is in which partner's pipeline) — prevents double-attribution conflicts
  • Allbound: partner portal (training, leads, deal registration, commission payouts)

Integration via webhooks to pkg/octopus/marketplace/commission/ for audit chain + Stripe payout reconciliation.

D5: Multi-currency settle-local

Wave-3 ships USD-only billing. Wave-6 adds:

  • EUR (EU customers settled in EUR via Stripe Tax EU)
  • GBP (UK post-Brexit specific entity)
  • BRL (LATAM, via NFe.io integration from Wave-2 W2-3)
  • JPY (APAC, via Stripe JP)
  • CAD (NA expansion)
  • AUD (APAC expansion)
  • MXN (LATAM expansion)
  • INR (India — RBI compliance requires specific handling)

Spec in ADR 0068.

D6: Crypto payments = Coinbase Commerce USDC/USDT settlement

Enterprise deals (Defense, Crypto Native firms) increasingly want stablecoin settlement:

  • USDC on Ethereum mainnet + Base L2
  • USDT on Tron (lower fees for LATAM/APAC)
  • Coinbase Commerce as PSP
  • On-chain audit chain entry for each settlement
  • KYC/AML via Coinbase + secondary screening (OFAC sanctions list)

Below $10M ARR, this is parked. Spec also in ADR 0068.

D7: BNPL for Enterprise = Klarna / Afterpay for contracts > $50k annual

Enterprise contracts $50k-500k+ annual: Klarna for Enterprise terms (net-60/net-90) allows customer to defer cash flow without TLSStress.Art carrying credit risk. Spec in ADR 0068.

Below $10M ARR, optional. Above, becomes table-stakes for enterprise deals.

D8: Patent claim mapping (Family G — Channel Multi-Provider)

Wave-6 establishes Patent Family G:

  • Claim 28: Cross-marketplace entitlement reconciliation (AWS + Azure + GCP unified deployment_id from disparate provider IDs)
  • Claim 29: White-label MSP-sub-tenant hierarchy with per-reseller pricing + audit chain attribution
  • Claim 30: Multi-currency settlement with deterministic FX reconciliation per audit chain entry

Provisional filing target Q3 2027.

D9: Code organization

pkg/octopus/marketplace/
├── aws/             # AWS Marketplace SDK wrappers
├── azure/           # Azure SaaS Webhook v3 handlers
├── gcp/             # GCP Marketplace Pub/Sub consumer
├── salesforce/      # AppExchange OAuth + sync
├── servicenow/      # ServiceNow Store REST adapter
├── reseller/        # White-label MSP portal logic
├── commission/      # Crossbeam + Allbound integration
└── types/           # canonical Subscription, Entitlement, Reseller types

pkg/octopus/payments/
├── multicurrency/   # FX, tax, settlement
├── crypto/          # Coinbase Commerce
├── bnpl/            # Klarna / Afterpay
└── types/           # Currency, Payment, Settlement types

D10: Cost + revenue model

Per-listing setup cost (one-time): - AWS Marketplace: free - Azure Marketplace: free (need Microsoft Partner Network membership ~$500/yr) - GCP Marketplace: free - Salesforce AppExchange: ~$10k Security Review + ~$5k/yr - ServiceNow Store: ~$5k Now Certified review + ~$2k/yr

Marketplace fees (revenue share): - AWS/Azure/GCP: 3% (private offer) to 5% (public) - Salesforce AppExchange: 15-25% - ServiceNow Store: ~12% - Crossbeam: subscription ~$15k/yr - Allbound: subscription ~$20k/yr

Per-deal commission to partners: - MSP wholesale: 50% off retail (~50% net margin to MSP) - VAR reseller: 15-25% commission on first-year ACV - Salesforce/ServiceNow partners: 10-15% commission

Expected revenue uplift: +30-50% ARR vs direct-only after 12 months in market.

Trigger gates (BLOCKING)

Do NOT begin Wave-6 implementation until ALL met:

  1. $10M+ ARR sustained 2+ quarters (validates direct-sales motion first before splitting attention)
  2. OR first channel partner deal signed (typically Cisco Crosswork / SonicWall referrer)
  3. Compliance/legal review of marketplace TOS for each provider
  4. Customer success ops team trained on multi-currency billing edge cases (FX conversion, refunds in different currencies)

Below gates, marketplace surface is internal-stub only.

Wave-6 PR roadmap

PR Scope Estimated LoC
PR-W6-1 (this) ADR 0067 channel marketplace umbrella docs
PR-W6-2 ADR 0068 multi-currency + crypto + BNPL docs
PR-W6-3 pkg/octopus/marketplace/ scaffold (types + interfaces) ~600
PR-W6-4 Reviewer checklist + rollout runbook docs
PR-W6-5 AWS Marketplace SaaS Contracts integration ~1200
PR-W6-6 Azure Marketplace SaaS Webhook v3 ~1000
PR-W6-7 GCP Marketplace Pub/Sub consumer ~800
PR-W6-8 Salesforce AppExchange OAuth + sync ~900
PR-W6-9 ServiceNow Store REST adapter ~700
PR-W6-10 White-label MSP reseller portal ~1500
PR-W6-11 Crossbeam + Allbound commission integration ~600
PR-W6-12 Multi-currency billing real (Stripe Tax + FX) ~900
PR-W6-13 Coinbase Commerce crypto payments ~700
PR-W6-14 Klarna BNPL enterprise terms ~500
Total ~10k LoC

Cross-references

  • ADR 0055 — admin console (predecessor; W6 expands marketplace capability)
  • ADR 0068 — sibling payment spec
  • ADR 0056 — provisioning flow that marketplace events trigger
  • Wave-2 sub-PR W2-3 — NFe.io BR (reused for BRL settlement)
  • AWS Marketplace SaaS Documentation
  • Azure SaaS Webhook v3 / Microsoft Partner Center
  • GCP Marketplace SaaS docs
  • Salesforce AppExchange Partner Program
  • ServiceNow Store Certification
  • Crossbeam docs / Allbound partner portal