Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Published catalog snapshots are reconstructible; live order placement still requires an independent provider price/stock check.
- The historical API v1 laboratory accepted only a restricted opaque product-ID character set; non-ASCII or percent-encoded legacy identifiers must fail closed until canonical routing is designed.
- Provider catalog read identity cannot authorize purchases, and the Provider Host Manager is not a generic Provider API proxy.
Verification still required
- Replace test-only provider adapter/registry wiring with an authenticated owner-approved runtime path.
- Verify real YSQL, Redis and provider mTLS integration; offline/in-memory tests do not prove production data-plane compatibility.
Focused verification (2026-10-28)
- The service image was built and ran with --once, no network, no root user, and a read-only filesystem. Redis runtime import was verified.
- Focused owner-local tests covered catalog assembly, atomic publishing, provider failure isolation/recovery, Redis cache outage/backoff/recovery, snapshot validation, and production-mode missing-Redis refusal.
- A disposable long-running container using an unreachable Redis URL remained running and logged the expected connection error. It was stopped after the check.
- Real YSQL provider/policy storage, actual Redis, authenticated Provider Adapter mTLS, full Compose integration and financial workflows remain unverified.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.