Milestones
List view
The two things standing between this and a product someone else can adopt. The app is single-merchant by construction — the merchant is an environment variable and `sync_state` is a singleton by database constraint — so a second customer means a second deployment. And the path from nothing to a paid, attributed, verified payment is long, subtle, and mostly documented in code comments. **Done when:** a design is reviewed before implementation and a test proves cross-merchant reads are impossible through every endpoint; each merchant's cursor advances independently including for merchants with no activity; and someone outside the team completes onboarding end to end, timed, with the sticking points fixed.
No due date•3/3 issues closed`@accensa/sdk` is the component a seller's integration depends on, and it has never been published — `main` points at raw TypeScript, there is no build, no CHANGELOG, and no release process. It also holds a long-lived signing key in the seller's process with no guidance on what that key is or how to rotate it, and it cannot sign at all on the edge runtimes x402 sellers commonly deploy to. **Done when:** a packed tarball installs into a scratch project outside the workspace and imports cleanly from both ESM and CJS in CI; signing works on Node, Vercel Edge and one other runtime by feature detection; multiple public keys are accepted so a key can be rotated without downtime.
No due date•3/3 issues closed240+ green unit tests sit next to six API route handlers with no tests at all — and the route handlers are where the bugs in A1 actually live. Alongside that: a formatter for files carrying mangled whitespace from bad merges, stray artifacts in the repository root, and retention for diagnostics that are currently computed and thrown away. **Done when:** every route in `src/app/api/` has success and failure coverage, including the skipped-ledger and cursor-advances-across-empty-windows cases; each A1 route bug is reintroduced and caught by the new tests; every sync run's full result is persisted and queryable; a redaction test proves no secret reaches the logs.
No due date•6/6 issues closedThe indexer has failed silently for four days once, and 207 ledgers are permanently gone. It now detects that condition and reports it into a CI log nobody is paged on. This milestone closes the loop, and fixes the data layer underneath: a schema defined in two places that have already diverged, a fresh Postgres connection per request, and a multi-asset claim never exercised. **Done when:** cursor lag is observable from outside the sync path and alerts reach a named human — verified by deliberately breaking it in staging; one authoritative schema with a CI drift check; a testnet USDC payment is indexed, attributed and displayed with cross-asset totals made impossible.
No due date•6/6 issues closedEverything that writes to `payments`, or reads it, made trustworthy. The settlement hook is the only write path not derived from the ledger, and today it verifies a re-serialisation rather than the signed bytes; the dashboard and payments API are entirely unauthenticated; and webhook delivery runs inline in the indexing loop where it can stall the cursor. **Done when:** the hook verifies over raw request bytes and a non-ASCII payload round-trips; reports carry a signed timestamp and stale ones are rejected; revenue and route data require authentication while receipt verification stays public and `GET /api/sync` still 401s to the sync workflow; indexing duration is provably independent of webhook responsiveness.
No due date•5/5 issues closed