Summary
The reconciliation.ts service exists but needs certification that it fully detects and corrects drift between payments DB records and actual Stellar chain state. Scenarios: (1) a payment released on-chain but not marked in DB (crash between submit and DB write), (2) DB says released but no on-chain claim exists, (3) escrow Locked but never released and task expired.
Priority
P1 — Payment state drift can cause double-payments or lost funds.
Files to work on
backend/src/services/reconciliation.ts
backend/src/payment/payment.ts
backend/src/db/payments.ts
Requirements
- Audit
reconciliation.ts for correctness against all drift scenarios
- Ensure drift detection covers:
- DB
locked but no on-chain claimable balance found → mark orphaned
- DB
released but no on-chain release tx found → identify missing Horizon record
- DB
released but on-chain shows unreleased → flag for re-submit
- Expired escrow (task failed, escrow never refunded) → schedule refund
- Implement automatic remediation for unambiguous cases
- Add metrics:
reconcile.driftDetected, reconcile.remediated, categorized by type
- Emit
RECONCILIATION_EVENT for any drift detected and any remediation
- Add integration tests with a mocked Horizon API simulating each drift scenario
- Ensure remediation is idempotent (no double-refund on re-run)
Acceptance Criteria
Summary
The
reconciliation.tsservice exists but needs certification that it fully detects and corrects drift betweenpaymentsDB records and actual Stellar chain state. Scenarios: (1) a payment released on-chain but not marked in DB (crash between submit and DB write), (2) DB says released but no on-chain claim exists, (3) escrow Locked but never released and task expired.Priority
P1 — Payment state drift can cause double-payments or lost funds.
Files to work on
Requirements
reconciliation.tsfor correctness against all drift scenarioslockedbut no on-chain claimable balance found → mark orphanedreleasedbut no on-chain release tx found → identify missing Horizon recordreleasedbut on-chain shows unreleased → flag for re-submitreconcile.driftDetected,reconcile.remediated, categorized by typeRECONCILIATION_EVENTfor any drift detected and any remediationAcceptance Criteria