ProxyPay

ProxyPay is a universal payment identity masking layer across banking rails, crypto, and AI agent wallets.

This first pass is a minimal Elixir/OTP service core. It is intentionally not a Phoenix app yet: the focus is the supervised identity-masking runtime, rail adapter contract, and concrete fault-tolerance behavior.

Architecture

ProxyPay.Application
├── ProxyPay.Audit
├── ProxyPay.Registry
└── ProxyPay.Vault.Supervisor
    ├── ProxyPay.Session {:session, ...}
    ├── ProxyPay.Session {:session, ...}
    └── ProxyPay.Session {:session, ...}

ProxyPay.Identity.Mask
└── ProxyPay.Identity.MaskStrategy
    └── ProxyPay.Identity.DefaultMaskStrategy

ProxyPay.Rail
└── ProxyPay.Rail.Banking

Setup

ProxyPay targets Elixir 1.17+ and OTP 27+.

mix deps.get
mix test
mix credo
mix dialyzer

Core Modules

• ProxyPay.Application starts the OTP supervision tree.
• ProxyPay.Audit records structured mask/unmask events in memory and logs them.
• ProxyPay.Identity.Mask exposes the public mask/2 and unmask/2 API.
• ProxyPay.Identity.MaskStrategy defines the pluggable masking behaviour.
• ProxyPay.Rail defines the adapter contract for payment rails.
• ProxyPay.Rail.Banking is a mock banking rail adapter.
• ProxyPay.Session is a per-active-session GenServer under the dynamic vault supervisor.

Why OTP

ProxyPay sessions are short-lived units of payment identity work. Treating each active masking session as its own supervised process gives the system a useful failure boundary: one bad session can crash and restart cleanly without taking down sibling sessions or shared infrastructure.

The supervision tree makes that behavior explicit:

• the Registry gives each session a stable lookup identity;
• the DynamicSupervisor owns session lifecycles;
• ProxyPay.Session keeps per-session state and expires after a configurable TTL;
• ProxyPay.Audit stays independent from session failures.

The test suite demonstrates the OTP story directly: a killed session process is restarted by the supervisor, sibling sessions remain alive, and explicit Supervisor.terminate_child/2 removal of one dynamic child does not disturb the rest of the vault.

Out of Scope

• Real bank or crypto API integrations.
• Rust SDK or interop layer.
• Persistence beyond in-memory/ETS storage.