v2.2.0 — provider integrations and bundled demo setup

Real-provider signup works end to end, with a bundled development and public-demo setup. Resend delivery callbacks, Didit V3 verification, and restricted Stripe keys now work together through the customer portal; a hosted signup was verified through payment, completed order, and active subscription.

Highlights

• Signed Resend delivery webhooks. /webhooks/resend verifies raw-body Svix signatures, stores redacted events idempotently, and returns a retryable response when storage is unavailable.
• Didit V3 compatibility. Session and decision requests use V3 endpoints and plural identity results. Signature verification handles sorted Unicode JSON, with a full raw-body fallback; envelope-only signatures are refused. Attestation requires an approved callback and API decision with one complete approved identity document.
• Reliable, private KYC callback storage. Event and corroboration writes commit atomically. Only the envelope and digest are retained. Duplicate events cannot roll back status, and deliveries without event IDs use a stable content hash that ignores refreshed retry timestamps.
• Restricted Stripe API keys. rk_test_ and rk_live_ work under the existing test/live mismatch, production-test-key, and live-card-reuse guards. Regression tests exercise the actual startup path.
• Bundled demo commands. scripts/dev brings together the CLI, services, PostgreSQL/pgvector, RabbitMQ, and Jaeger. scripts/demo layers a Cloudflare Tunnel and Caddy gateway over that stack. Management ports remain on loopback; public ingress reaches the customer portal and signed provider callbacks.
• Restart and build-context fixes. Infrastructure containers gain unless-stopped policies. Credentials, local mailboxes, and operator settings stay out of Docker build contexts. Public URL configuration is overridable through .env.

Documentation and changes since v2.1.3

New local-development and public-integration guides cover prerequisites, provider permissions, secure credential handling, deployment commands, and recovery limits. The decision-log chunker fixture was refreshed for the new entry.

This release also includes the previously committed base-Compose consolidation, fresh-machine runbook, live-test scaffolding corrections, and direct OpenRouter configuration after LiteLLM retirement.

Compatibility

SemVer minor. BSS_RELEASE 2.1.3 → 2.2.0. No database migration or new BSS business verb.

Didit session/decision calls now require V3. The attestation path supports one complete approved identity document; wallet-only workflows and multiple approved identity documents are not supported. Stored Didit webhook bodies intentionally contain the envelope and digest rather than raw verification data. Full raw-body legacy webhook signatures remain supported.

Existing mock payment methods must be replaced through Stripe-hosted card setup when switching providers. The deployment remains a single-host demo: persistent storage and restart policies do not provide off-host backups or failover, and a full host reboot recovery test has not yet been performed.

Gate

cargo fmt --all --check · workspace/all-targets/all-features clippy -D warnings (0 warnings) · release-profile workspace/all-features tests 547 pass / 0 fail (48 opt-in tests ignored) · 14 doctrine guards · Compose validation · shell syntax · staged credential scan.

Verified on the running demo: Resend sent/delivered callbacks; Didit hosted approval; Stripe test payment and signed charge callback; a completed BSS order and active subscription; OpenRouter CLI and operator web-chat catalog tool calling. Targeted database-backed webhook persistence, redaction, deduplication, and status-progression tests also passed.

The destructive hero suite was not rerun against the configured provider-backed demo for this cut. Earlier local mock backend and portal scenarios passed with reset and clock changes disabled. No release binaries or container assets are attached, matching the previous releases.

See DECISIONS, local development, and public integrations.