Conversation
…ntegrity, security hard stop, operability, deploy integrity, typecheck gate green 46 CRITICAL silent-mockware items eliminated (fail-loud or real integration, independently verified 12/12): simulated VTPass bill payments, fabricated NIP name enquiries, fake checkout bank accounts, KYC liveness auto-pass, hardcoded ledger balances, log-only Kafka producer dropping regulatory events, Math.random compliance scores, fabricated STR/goAML regulator references, hardcoded fund NAVs, fake USSD transfers, in-memory wallet ledger, fabricated admin/fraud/recon/settlement dashboards, fabricated rail quotes. Money integrity: atomic sendMoney/topUp (Stripe-verified), idempotency claim-then-execute, maker-checker payouts with fund reservation, guarded balance decrements, integer FX math, durable Postgres double-entry ledger, distinct ledger-leg references, atomic webhook crediting, funded virtual-card topUp. Security: all SQL injection sites parameterized (59 swept), PBAC authz on all money routers, committed mTLS private keys removed (ROTATE CA - compromised), fail-fast compose secrets, mandatory constant-time auth on 51 python services, rate limiting + CSRF origin guard registered. Ops: 10 background workers started, Stripe inbound webhook (signature-verified, idempotent), /api/health, /api/metrics + OTEL tracing, graceful shutdown, bridge failure gauge + strict money-path calls. Deploy: coherent 82-entry drizzle migration journal (schema drift closed), 7-job CI with gitleaks + hard money/security test gate, pinned k8s image tags, pinned pnpm toolchain, 237MB build artifacts untracked, typecheck gate GREEN (tsc 0 errors, was 935). Tests: real money-path tests (tRPC caller chain), signed-webhook tests, theater rewrites; 7392 passing / 133 remaining failures all env-gated or stale-contract, zero production bugs. Readiness: 23/100 -> 58/100 (independently verified) -> est ~85/100 (this branch). Audit trail: paygate-audit/ reports.
…rub default creds Assurance-audit findings remediation: - server/_core/demoData.ts (new): demoOrFail/demoArrayOrFail — SERVICE_UNAVAILABLE unless PAYGATE_SIMULATION_MODE=true, then loud WARN + simulation:true payloads - middlewareDashboard.ts: 32 silent source:demo fallbacks gated; fabricated mutation success (kafka.publish, workflow starts, permify.check allowed:true) now fail loud; pgbouncer unconfigured block returns zeros, not fake numbers - proxy.ts: BREAKING — client-controllable forceMock removed from all 9 procs; fetchPaygate returns null on failure; live-or-demoOrFail everywhere; checkBreaches never alerts on fabricated data - wave162.ts: NIP name-enquiry never returns plausible fake name (SIMULATED ACCOUNT NAME only in sim mode); permify bulkCheck + 12 more sites gated - routers.ts: register proxyRouter (pre-existing dead wiring — trpc.paygate.* 404'd at HEAD, 29/29 proxy tests failing) - crypto IDs: randomBytes replaces Math.random in INV/RCT/CLM/ORD/MMT refs - client: MOCK/LIVE toggle removed (DashboardLayout, RefreshContext, usePaygateData, InfraPage); badge truthful LIVE/OFFLINE/SIMULATION - config.py: remove baked-in INTERNAL_API_KEY + DB password defaults (fail closed) - repair 7 pre-existing client syntax corruptions (botched import edits) Verified: tsc server 0 errors; hard-gate suites 90/96 (6 DB tests need PG, pass in CI); grep source:demo=0, forceMock=0
…0 fail), missing-table migrations 0083/0084, client contract fixes, fail-loud completions; untrack Go build artifacts
…missing-table 500s (0085/0086), idempotency+atomicity hardening across money paths, webhook/internal auth fail-closed, full suite 8190 pass/0 fail vs live PG
…300 fixes, kill chains closed, adversarially verified)
…script exec modes
…y-over-time, WHT/TIN pack, accounting sync (QBO/Xero/Odoo), approvals, vendor directory, remittance advice, AR fee choice, recurring auto-pay, single-use virtual cards, partial payments, AP assistant, syndication
… telemetry middleware w/ tenant attrs, python shared telemetry across 53 services, go OTel SDK (bridge+6 services+Temporal interceptor), rust tracing-opentelemetry (12 services), consolidated collector + Loki logs, Tempo/Loki/Promtail/Novu compose, alert subscriptions + migration 0093
…duction-readiness branch
…splits, direct debit, wallet pay, payment requests, transfer recipients, DVA, customer risk (177 tests, migrations 0094-0098)
…y cleanup, kyc handler, reservation expiry worker)
…omer lifecycle, parity tests, trpc core, webhook dispatch, redis idempotency, bnpl handler)
…webhook durability, webhook failure alerts + retry DLQ, disputes/wallet go handlers, security scoping tests)
…ery, nexthub test contract fix)
… guard + transfer result codes)
…ips, cbn_str H26 idempotency)
…plit payments tests)
…tence, stripe C9 durability + PI dedupe)
…g engine, chargeback lifecycle C18/H6 state machine)
…rains, payment requests H17 guarded payments)
…rs H26 fail-closed money paths)
…9/C10/C15/C16/H19/M6/M11)
…x, M16 bigint math, H18 currency guard)
…money-action fail-closed)
…5, C19, H25, H28, M21)
…d + inbound credit)
…ailure handling, simulation gates)
…ts C2/C8/H7-H9/H27/C18)
…ripe idempotency, H8 reconciler, H9 wallet debit)
…merchant scoping, null-safe snapshots)
…y/topUp/payouts/crossBorder)
…ns, cart capability, ledger outbox)
…e, red envelope refund, platform sweeper registry)
…on, M7/M8 guards, H14/H16 charge lifecycle)
…nd, C12 link guards, C17 amount check, H11/H13 USDC+invoice)
Owner
Author
|
Owner
Author
Wave 2 synced — branch now 79/85 files (same 6 large files pending)Wave 2 (onboarding hardening + orphan-code closure) is now fully pushed except Wave-2 highlights (all gated: tsc server+client 0 errors, 115/115 test sweep green):
Still blocked (6 files, ~1.4MB total — need a DO NOT MERGE until these land — branch remains a mixed tree. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Re-creation of PR #185 after the F-12 security history scrub (approved: full scrub + force-push). GitHub auto-closed #185 when history was rewritten; this PR carries identical content on scrubbed history.
F-12 remediation (this force-push)
7D:2B:F0:FD:...:64:E4:37) compromised by committed private keys → new CA "PayGate Internal CA 2026" (11:1C:DE:43:...:3C:76:83), fresh server/client certs; only public.crt/.csrcommitted.infra/certs/{ca,server,client}.keypurged from ALL commits/branches viagit filter-repo; verified 0 objects remain; force-pushed all branches.Serialize/DeserializeonOcrRequest/BulkOcrRequest) — unblocks cargo gate.Content carried over from #185
Verification gates