NORMATIVE SAFETY GATE
A historical CONSUME result is not a new payment permit
A provider call is allowed only after a fresh transition returns provider_submission_permitted=true, current_state=CONSUMED and idempotent_replay=false. Replaying an earlier transition may recover history, but must never create a second provider attempt.
DURABLE JOURNAL
State survives process restarts and concurrent workers
Before consumption, the adapter atomically inserts or reads one record bound to the receipt, exact envelope and processor audience. Every state change uses compare-and-set semantics. There is intentionally no production in-memory fallback.
Download the frozen v1-compatible gateway implementation · Verify its v1.4.0 release manifest
PROVIDER CONTRACT
Deterministic keys separate create, confirm and settlement
Provider create and confirm operations use distinct stable idempotency keys derived from the immutable authorization binding. Confirmed success is committed. Confirmed failure can be released inside the legal settlement window. Pending and unknown outcomes remain reserved and enter reconciliation.
PAYEE IDENTITY
A merchant label alone cannot select the provider payee
The signed envelope must carry canonical payee identity v1. The gateway rejects an identity whose provider profile differs from the configured adapter. Stripe binds the connected and merchant account; x402 binds network plus payTo; MPP binds service origin plus method. A CUSTOM adapter must match its provider ID and provide exact same-origin well-known domain evidence.
The generic gateway validates and signs the reference; it does not perform network discovery. A custom provider's synchronous validateBinding implementation must match that reference to evidence previously fetched, authenticated and freshness-checked by the customer's trusted integration.
TRUST BOUNDARY
The adapter runs inside the customer's server
Payment methods, provider secrets and full provider responses stay outside MandateShield. The hosted service verifies authority and maintains its reservation state; it does not process or settle the payment.