Move the top-up and payment engines into the core, so both hosts keep only the UI.
Today TopUpPlatform and PaymentPlatform (#1314) hand each request to engines each host implements on its own:
- iOS:
IncomingPaymentService, ExternalPaymentService
- Android:
RealTopUpService, RealExternalPaymentService
The core would own:
- Top-up: source resolution (
//product//{productId}/{index}, private key, coins), SourceBusy across unfinished top-ups, the 1 h retry window from start, the 30 s funding wait, and the load_recycler_with_external_asset_unpaid batch with InfallibleUnpaidSigned origin. Coins are claimed once each.
- Payment: the plan → onboard coins → offboard vouchers state machine,
unload_recycler_into_external_asset[_and_loaded_coins], and durable resume with backoff.
- Persistence of both: the record saved before any transaction, the verdict stored once, source secrets wiped after it except a readable
NotClaimed one, and resume of every unfinished operation on launch.
- Statuses as today.
Hosts keep: the approval and privacy sheets, the acknowledgement sheets (ClaimedPartially, NotClaimed), and secure storage for source secrets behind a core seam.
Done when both hosts drop their engines and stores, and products see the same ids, statuses and errors.
Depends on #1314
Refs #1268, #778
Move the top-up and payment engines into the core, so both hosts keep only the UI.
Today
TopUpPlatformandPaymentPlatform(#1314) hand each request to engines each host implements on its own:IncomingPaymentService,ExternalPaymentServiceRealTopUpService,RealExternalPaymentServiceThe core would own:
//product//{productId}/{index}, private key, coins),SourceBusyacross unfinished top-ups, the 1 h retry window from start, the 30 s funding wait, and theload_recycler_with_external_asset_unpaidbatch withInfallibleUnpaidSignedorigin. Coins are claimed once each.unload_recycler_into_external_asset[_and_loaded_coins], and durable resume with backoff.NotClaimedone, and resume of every unfinished operation on launch.Hosts keep: the approval and privacy sheets, the acknowledgement sheets (
ClaimedPartially,NotClaimed), and secure storage for source secrets behind a core seam.Done when both hosts drop their engines and stores, and products see the same ids, statuses and errors.
Depends on #1314
Refs #1268, #778