D-002: owner-approved design dated 2026-10-16, with implementation and mutual TLS security verification pending.
Control plane
Provider Reconciler controls desired state. A restricted, local Provider Host Manager can perform allowlisted process lifecycle actions on its own node. Cross-host management would require a separately authenticated node-agent transport.
The host manager must never submit orders, issue general provider credentials, or expose Docker management publicly.
Data plane
- Catalog Aggregator has a read-only Provider API role.
- Purchase Executor has narrowly scoped revalidation, order submission and status roles.
- Each isolated Provider API adapter authenticates the action/recipient identity and holds only its own upstream credential.
Operator UI, customer UI, Redis, backups and the host manager have no provider purchase authority.
Failure isolation
A failed adapter affects that provider’s reads and orders, not other providers or the Wallet ledger. Loss of host lifecycle may prevent restarts without necessarily stopping healthy adapters. Unknown order results require reconciliation, never an automatic alternate POST.
Outstanding validation
Mutual TLS identity, method authorization, lost acknowledgements, explicit error classes, remote host transport and integration tests remain proof gates.