Evidence level: historically reviewed source and owner proposals; not freshly tested or certified for production.
Design and implementation invariants
- Purchase dispatch requires a validated command, authoritative Wallet hold and committed unique intent before any Provider POST.
- A timeout or unknown side effect must never cause a blind duplicate order; synthetic idempotency keys are not proof of upstream exactly-once semantics.
- The Provider purchase role is separate from catalog read, host lifecycle and financial SQL authority.
Verification still required
- Prove durable YSQL transaction, intent acknowledgement loss and crash recovery against real owner grants.
- Replace test-only provider client wiring with an approved role-authenticated adapter; verify upstream status/reconciliation before production order effects.
How to update
When the owner changes implementation or contract behavior, update this page and the relevant service interfaces. For cross-service changes, also update the platform interface map or decision register. State the actual verification performed; do not inherit historical pass claims without fresh evidence.