Two PSPs, three sites — the configuration + go-live plan · content/payment_rollout.md

Payment Platform Rollout — tradez.au · qalarc.com · goetica.ai

Date: 2026-09-10 · For: the conversation with your two payment platforms · Companion (technical): qalpay/README.md (the webhook contract + bridge) · Policy: law playbook §7 (500M cap, prepaid framing)

1. The shape of the thing (one diagram for every meeting)

customer ──pays AUD──► PAYMENT PLATFORM (yours) ──webhook──► qalpay bridge (:8839)
                                                              │ verify HMAC signature
                                                              │ idempotency check
                                                              │ platform escrow funded?
                                                              ▼
                                                     loopd ledger (system of record)
                                                       customer += cents  ──► program ledger
                                                       (sales tracked to the 500M cap —
                                                        the ledger REFUSES past it)
                                                              │
                                                              ▼
                                                     anchored receipt (on Qalnet)

What each platform gets from us: a webhook endpoint URL, a platform ID, and an HMAC secret (delivered out-of-band). What we need from each platform: payment-succeeded webhooks with a stable reference, AUD settlement, and idempotent retries. That's the entire integration surface — deliberately small.

2. The three sites, one money system

Same token, same ledger, same cap across all three — per-platform escrow keeps accounting separable while the program ledger enforces the global stop.

3. What to tell the payment platforms (the checklist)

Ask for (in order of importance): 1. Webhook delivery of payment.succeeded (any schema — we normalize; Stripe-shaped and flat both accepted) with: reference id, amount, currency, customer reference, and retries with the same reference (our idempotency registry handles duplicates safely). 2. AUD settlement to the qalarc operating account. (Phase 2's reserve account is a separate, segregated target — see backing design.) 3. A test/sandbox mode with signable webhooks so we can certify the integration end-to-end before live keys. 4. Refund API or manual refund flow (v1: we record + anchor refunds on our side; PSP-side refund notification can drive it later). 5. Checkout links/payment-intent URLs per product if they support hosted checkout — otherwise we collect on their embedded flow and reconcile via webhook.

Give them: the endpoint (behind HTTPS when public — bridge is localhost/Tailscale today), their platform secret, and our webhook response semantics (2xx = processed; 401 bad signature; 409 duplicate — safe to stop retrying; 500 = retry).

Tell them what this is (the legally-clean framing): they are processing prepaid service-credit purchases for qalarc's platforms — not token sales, not investment products. All marketing copy stays in that frame (law playbook).

4. Configuration (concrete, once you have the accounts)

# 1) start the bridge
(cd qalpay && setsid nohup python3 qalpay.py serve > run.log 2>&1 &)

# 2) register each platform (admin key printed once on first boot)
curl -X POST :8839/platforms -H "X-Admin: $QALPAY_ADMIN_KEY" \
  -d '{"name":"qalarc","webhook_secret":"<random-32>"}'   # → escrow agent created
curl ... {"name":"tradez",...} ; curl ... {"name":"goetica",...}

# 3) fund each platform escrow (pre-paid credit float, AU$)
curl -X POST :8839/platforms/qalarc/fund -d '{"cents":500000}'   # AU$5,000 float

# 4) point each PSP's webhook at (when public):
https://pay.qalarc.com/webhook/qalarc   # via Cloudflare Tunnel + access rule
# deliver secrets out-of-band (Signal to you, then into their dashboard)

Go-live gates per platform (all three must pass): sandbox webhook round-trip green in test_qalpay.sh-style harness → real AU$1 test purchase credited exactly (ledger delta = 1) → replay of the same webhook refused (409) → refund dry-run recorded → reconciliation report matches PSP dashboard to the cent → landing-page copy reviewed against the prepaid framing → then live keys.

5. Pricing sheet (initial, per platform)

No discounts on credit; discount services only (keeps parity clean). Doof rounding: on by default (5c) — dust to the Church.

6. Honest gaps before real money

1. HTTPS + public endpoint (Cloudflare Tunnel + access rules) — the bridge binds localhost by design until this exists.
2. Terms of Use per site (prepaid framing, fees, no secondary market) — lawyer gate.
3. Refunds v1 are ledger-side only (recorded + anchored; no automatic PSP reversal) — acceptable at small scale, upgrade before volume.
4. The reserve account is design + paper today: PSP settles to operations until the segregated account exists (Phase 2 per the backing doc + law playbook).
5. AUSTRAC VASP before any external transferability — unchanged.