Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Inbound Payments accepts normalized, verifiably authenticated payment events; verified Wallet credit must be idempotent and owner-controlled.
- A callback is not proof that funds were irrevocably credited, and a later credit must not bypass an outstanding purchase liability.
Verification still required
- Validate signed gateway callback error handling, repeat events and ordering with the payment-adapter owner.
- Verify durable YSQL inbox/ledger row locking and concurrency; historical in-memory acceptance does not establish production settlement.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.