[armando-rodriguez-cko]

Summary
The retry object of POST /payments has no top-level max_attempts or end_after_days; they belong to dunning. They are now deprecated. Payment sessions now use the shared CustomerRetry, and the retry and customer retry fields are documented.

Changes

• checkout_sdk/payments/payments.py: PaymentRetryRequest.max_attempts and end_after_days deprecated in favour of dunning; PaymentRetryRequest, DunningRetryRequest and DowntimeRetryRequest documented from the spec
• checkout_sdk/common/common.py: CustomerRetry documented
• checkout_sdk/payments/sessions/sessions.py: the duplicate CustomerRetry replaced by the one in common (the old import path still works)
• tests/payments/retry_request_serialization_test.py (new): every retry property, enabled=false, max_attempts=0, the deprecated fields, roundtrips and the spec example on all three endpoints

API Reference

• POST /payments (retry): https://api-reference.checkout.com/tag/payments/POST/payments
• POST /hosted-payments (customer_retry): https://api-reference.checkout.com/tag/hosted-payments-page/POST/hosted-payments
• POST /payment-links (customer_retry): https://api-reference.checkout.com/tag/payment-links/POST/payment-links
• POST /payment-sessions (customer_retry): https://api-reference.checkout.com/tag/flow/POST/payment-sessions

Breaking changes
None. PaymentRetryRequest.max_attempts and end_after_days are deprecated and will be removed in the next major version.

README
Not affected: the README does not document these types.

[agent-wall-e]

🔴 Risk Classification: MAJOR

Approval route: AI Review + Human Approval Required
Rollback controls: Change-freeze window + documented rollback plan

Classification reasons

• security_sensitive_path:checkout_sdk/payments/sessions/sessions.py

Operational gates

• ✅ jira_ticket (INT-1748)
• ✅ independent_review

Files analysed: 4

---

_{wall-e 2026.06.19-02 · policy 6b4ce2b3b45a…}

[agent-wall-e]

🔬 Debug — why this classification?

Each reason code emitted by the classifier, its source clause in the AI in SDLC Control Framework, and what it means.

Reason code	Kind	Clause	Meaning
security_sensitive_path — checkout_sdk/payments/sessions/sessions.py	classifying	§2.1 M4/M5	Path matched a sensitive pattern (auth, secrets, crypto, PCI, migrations, network IaC).

Kinds:

• classifying — this rule contributed to the chosen tier.
• informational — context only; did not by itself decide the tier.

See issue #3 for the proposal to formalise this map as Appendix A of the standards doc.

_{wall-e 2026.06.19-02 · debug}

[agent-wall-e]

🟢 Advisory review: Looks good to me

This PR still needs a human approval — wall-e cannot auto-approve it. For what it's worth, I read the diff and found nothing I'd block on.

Deprecates top-level max_attempts and end_after_days on PaymentRetryRequest, documents retry classes, consolidates CustomerRetry into common, and adds comprehensive serialization tests. The diff does exactly what the PR claims with no blocking issues found.

What I checked

• The sessions.py deletion of the local CustomerRetry and replacement with the common import is clean; the old import path (payment_sessions.CustomerRetry) is explicitly verified by test_sessions_module_exposes_shared_type.
• Deprecated fields on PaymentRetryRequest are comment-annotated but not enforced (no warnings.warn), which is fine for a Python SDK using comment-only deprecation conventions, and matches the stated intent of removal in the next major version.
• The test_should_serialize_zero_attempts test explicitly guards against the falsy-zero serialization footgun (where max_attempts=0 might be dropped by a if value check), which is good defensive coverage.
• Tests cover all three endpoints that use CustomerRetry (hosted payments, payment links, payment sessions) and the direct PaymentRequest retry path.
• No existing tests are weakened or removed; the new test file adds net-positive coverage.

---

_{This is not an approval. wall-e cannot auto-approve this PR — it is an opinion to help whoever does. Advisory review · us.anthropic.claude-sonnet-4-6 · wall-e 2026.06.19-02}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud