Harden distributed payment state for testnet beta

[ArgaAAL]

Summary

• move endpoint ownership, paid forwarding, payment credit, operator sequencing, withdrawal accounting, and dashboard aggregates onto atomic Supabase-backed state
• make escrow credit crash-recoverable by persisting signed transaction XDR and reconciling ambiguous submissions by transaction hash
• renew active Soroban contract storage TTL and cover the behavior with contract tests
• add CodeQL, dependency review, Dependabot, distributed-state smoke coverage, and a staging-only live replay harness
• update OpenSpec and beta evidence so staging proof and remaining production gates are explicit

Verification

• npm run test:beta
• npm run test:browser
• npm run audit:prod
• npm run audit:all
• npm run audit:rust (three documented Soroban-transitive maintenance warnings)
• cargo fmt --all -- --check
• locked Stellar contract build: 5,623 bytes, SHA-256 f0565cd5a3cbd9ab32ef8dbd01804432cae9ae729bd3ff1660136343649c6c12
• npm run scan:secrets
• git diff --check

Isolated staging proof

Canonical URL: https://project-02fi8.vercel.app

A real testnet replay completed against the staging-only Supabase project and fresh TTL-aware contract:

• guarded upstream without secret: 401
• paid proxy without payment: 402
• paid request: 200
• payment transaction: 379d490016bd7820365c84d3df3c61a9f2cec81e1e5c74b7010997be03f12ebb
• escrow credit transaction: eeff9ab24fe12bddc7930f74b44a715654e13b65d84aaa235dc3e935ec86d469
• signed withdrawal transaction: ee985b7936912308a253e2ca6c8911be76b5fecea40d0e259a884b762283268a
• developer credit: 0.0009 USDC; platform fee: 0.0001 USDC
• temporary API, developer, withdrawal, and replay fixtures were cleaned after verification

Production Vercel, production Supabase, and the production contract were not changed.

Production rollout gates

Do not merge/deploy as an implicit production migration. Before production release:

• restore and verify the production Supabase project
• apply 20260828000000_paygate_distributed_state_hardening.sql
• deploy and initialize a fresh TTL-aware escrow contract, then update production environment configuration
• run beta preflight and distributed-state smoke against production configuration
• deploy, perform the guarded live replay, and capture final screenshots/video evidence
• establish required branch checks after this PR reports their stable GitHub check names

Scope

Testnet production-beta only. Mainnet, refunds, buyer accounts, marketplace behavior, fiat checkout, and compliance guarantees remain out of scope.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
paygate-stellar	Ready	Preview	Aug 28, 2026 8:24am

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[ArgaAAL]

Repository-admin follow-up

The application and security jobs pass. The Dependency review job is currently red because GitHub reports that Dependency Graph is disabled for this repository.

An administrator should:

1. Enable Dependency graph at https://github.com/wildanniam/paygate-stellar/settings/security_analysis
2. Re-run the failed Dependency review job on this PR.
3. After the check names are established, protect main and require pull requests plus these stable checks:
   • Beta smoke tests
   • Secret scan
   • Dependency audit (root)
   • Dependency audit (frontend)
   • Dependency audit (backend)
   • Dependency audit (express-example)
   • Rust advisory audit
   • Dependency review
   • Analyze JavaScript and TypeScript

The current GitHub identity has write access but not repository-admin access, so no repository settings or branch protections were changed. Production infrastructure was also left untouched.