RelayPay v1.0.1 — Hardening Release

RelayPay v1.0.1 — Hardening Release

RelayPay v1.0.1 ships the post-v1.0.0 hardening batch: one scheduler instead of a broker fleet,
a cluster of verified correctness fixes, batched hot-path queries, and five security-posture
items — with /api/v1, idempotency replay bytes, SDK behavior, and every immutable journal
preserved exactly as shipped in v1.0.0.

Highlights:

• one broker-less scheduler (apps/worker/poller.py) now owns every background batch — provider
  recovery, webhook materialization and delivery, reconciliation, payouts, subscription recovery,
  inbound webhooks, and settlement forecasts — time-gated in-process with SKIP LOCKED claim
  semantics and lease tokens; Celery, Redis, and their dependencies are removed, and the fix
  surfaced and repaired a silently failing Kafka producer configuration that had left outbox
  events unpublished;
• verified correctness cluster: settlement questions now FAIL with a recorded reason when the
  model provider fails instead of staying stuck in PROCESSING; failed connector verifications
  persist their UNAVAILABLE observation; concurrent settlement-question creation, webhook
  acceptance, and workflow-run idempotency replay recover from races instead of 500ing;
  dispute packages invalidated between approval and submission fail closed with an audit
  observation; the login rate limiter no longer lets anonymous callers consume an org's budget
  and prunes expired keys;
• performance: payment list pages fetch authorizations and captures in two batched queries; the
  settlement loop runs one grouped pending-refund aggregate, three hoisted ledger-account
  lookups, and a running receivable balance instead of a full balance derivation per capture;
  admin settlement lists and settlement answers batch their per-row lookups; request-log
  retention prunes probabilistically (~1% of writes) instead of sorting the whole table per
  request; unbounded admin lists gained a default cap of 500 rows;
• security posture: pagination cursor MAC keys are domain-separated from the API-key pepper;
  GET /api/session/me is read-only (no per-render session-row write); unknown-email logins pay
  a fixed-cost argon2 verification so timing no longer reveals account existence; the Python
  image runs as a non-root relaypay user; the unauthenticated /metrics and worker metrics
  ports are documented with the network boundary they assume;
• documentation updated across architecture, deployment, operations resilience proofs,
  observability, and limitations for the scheduler consolidation and the rate-limit trust
  caveat.

This is synthetic INR portfolio software. It handles no real money, identity, merchant, banking,
or website data. Every merchant site, dispute, recovery case, and evaluation fixture is a
deterministic synthetic artifact. No deployment or hosting is included.

RelayPay v1.0.0 — Integrated Platform Release

RelayPay v1.0.0 — Integrated Platform Release

RelayPay v1.0.0 completes the integrated platform: every workflow from payment authorization to
merchant risk review now reports into one cross-workflow PostgreSQL analytics model, is verified by
one versioned deterministic evaluation suite wired into the release gate, and is demonstrated by
one runnable synthetic portfolio journey — with /api/v1, every immutable journal, and every
earlier lost-response guarantee preserved exactly as shipped.

Highlights:

• cross-workflow portfolio analytics computed purely in PostgreSQL: dispute package completion,
  evidence-retrieval precision from immutable draft versions, recovery rate and recovered INR,
  versioned analyst handling-time baselines, analyst intervention rate, invalid and policy-blocked
  action rate, workflow and model p50/p95 latency, model micro-USD cost per completed workflow,
  and raw plus approval-adjusted completion rates;
• six new low-cardinality relaypay_portfolio_* Prometheus gauges with a portfolio section in the
  Grafana operations dashboard; tenant and environment dimensions stay in PostgreSQL and are never
  Prometheus labels;
• a new admin endpoint GET /api/admin/v1/environments/{env}/analytics/portfolio
  (technical:read permission) served from the same analytics module;
• business events for risk-review escalations and completions, recovery-case closure, and approval
  decisions join the existing outbox stream; model invocations remain authoritatively recorded in
  model_invocations rows;
• a versioned evaluation dataset — 30 dispute, 30 recovery, 24 settlement (all four intents plus
  clarifications), 30 merchant-risk, and 20 adversarial cases — with a deterministic runner that
  replays the fixtures through the real domain services and asserts ≥0.90 evidence-retrieval
  precision and zero policy, numeric, citation, escalation, tenant, PII, injection, or
  duplicate-effect violations; the gate now runs in CI and records EvaluationDataset and
  EvaluationRun rows;
• provider-resilience proofs extended with router fallback-exhaustion and terminal-error
  no-fallback unit tests alongside the existing Redis-loss, Redpanda redelivery, Celery loss,
  worker shutdown, lease-reclaim, provider-outage, DLQ, approval-waiting, PII, injection, and
  tenant-isolation coverage;
• a release-only live-provider comparison script (scripts/compare_live_providers.py) that scores
  the settlement classifier across OpenAI, Claude, and Gemini when API keys are configured; it is
  intentionally not a CI gate;
• make portfolio-demo: one runnable end-to-end synthetic journey — payment authorization and
  capture through the deterministic provider, settlement question, recovery case, dispute draft,
  risk review, and the portfolio analytics summary;
• updated architecture documentation, ADR-010, threat model, limitations, operations guides,
  migration notes, and SDK/OpenAPI contract regeneration.

This is synthetic INR portfolio software. It handles no real money, identity, merchant, banking,
or website data. Every merchant site, dispute, recovery case, and evaluation fixture is a
deterministic synthetic artifact. No deployment or hosting is included.

RelayPay v0.15.0 — Merchant Risk Review Agent

RelayPay v0.15.0 — Merchant Risk Review Agent

RelayPay v0.15.0 adds a deterministic merchant onboarding risk review agent on the shared
PostgreSQL-authoritative runtime while preserving /api/v1 and every earlier lost-response
guarantee.

Highlights:

• a synthetic merchant-site mock service with immutable, code-defined snapshots only — HTML,
  catalogue, refund and privacy policies, contact details, WHOIS-like domain data, pricing, and
  claims; no live crawling and no uploaded real merchant evidence;
• deterministic checks for website/contact/policy completeness, identity consistency, domain age,
  pricing outliers, and merchant category;
• a bounded model role that returns structured suspicious-language and claim findings with exact
  verbatim quotes and source paths; invented quotes, unknown classifications, scores, SQL, and
  mutations are rejected;
• immutable onboarding snapshots, risk reviews, review versions, findings, score breakdowns, and
  escalation records;
• a versioned 0–100 risk score where completeness contributes 0–20, domain identity and age 0–20,
  category and content 0–30, pricing 0–15, and suspicious claims 0–15;
• severity bands LOW 0–29, MEDIUM 30–59, HIGH 60–79, and CRITICAL 80–100;
• hard-stop escalation for prohibited-category, impersonation, counterfeit, and guaranteed-return
  findings regardless of score, and severity escalation for HIGH and CRITICAL otherwise;
• HIGH confidence for deterministic evidence or two-source corroboration, MEDIUM for one direct
  source, LOW for model-only interpretation, with LOW-confidence findings never hard-stopping
  alone;
• reviewer annotations and escalation dispositions that never rewrite immutable evidence,
  findings, or scores;
• admin APIs, generated SDK models, a console risk workspace, seeded synthetic reviews, migration
  and release notes, and browser coverage with accessibility checks.

This is synthetic INR portfolio software. It handles no real money, identity, merchant, banking,
or website data. Every merchant site is a deterministic synthetic fixture. No deployment or
hosting is included.

RelayPay v0.14.0 — Settlement Intelligence Agent

RelayPay v0.14.0 — Settlement Intelligence Agent

RelayPay v0.14.0 adds a deterministic settlement intelligence agent on the shared
PostgreSQL-authoritative runtime while preserving /api/v1 and every earlier lost-response
guarantee.

Highlights:

• immutable, versioned merchant settlement policies with one IANA timezone, one daily cutoff,
  T+0/T+1/T+2 weekday delay, and include-or-skip weekends; the default is 17:00 Asia/Kolkata, T+1,
  weekends skipped;
• immutable pre-cutoff settlement forecasts with deterministic capture, refund, and
  receivable-offset line items; re-forecasts append a new sequence and never rewrite history;
• exactly four supported question intents — why is today's settlement lower, which payments are
  still unsettled, what is the refund cash impact, and when is the expected arrival tomorrow —
  with a typed clarification response for anything unsupported or ambiguous;
• a model contract that can only classify intent and dates; models never write SQL, compute
  financial values, or mutate state;
• fixed tenant-scoped query functions that produce every number, calculation step, citation
  (recordType, recordId, fieldPaths, snapshotSha256), and trace;
• lower-settlement answers compared against the latest immutable pre-cutoff forecast with capture,
  refund, receivable-offset, and settlement deltas;
• post-generation narrative validation that rejects altered numerics, unsupported claims, missing
  citations, cross-tenant record references, and malformed output;
• idempotent questions with workflow runs, model invocations, immutable prompt and pricing
  versions, and business events;
• admin APIs, generated SDK models, a console settlement workspace, local demo data, and browser
  coverage with accessibility checks.

This is synthetic INR portfolio software. It handles no real money, identity, customer, banking, or
provider data. All model output is deterministically validated and every integration is synthetic.
No deployment or hosting is included.

RelayPay v0.13.0 — Subscription Recovery Agent

RelayPay v0.13.0 — Subscription Recovery Agent

RelayPay v0.13.0 adds a consent-bound, terminal-safe synthetic subscription recovery workflow on the
shared PostgreSQL-authoritative agent runtime while preserving /api/v1 and every earlier
lost-response guarantee.

Highlights:

• strict recurring-payment.failed.v1 intake with payload digest verification and PII rejection;
• five deterministic failure classes with unknown outcomes restricted to provider lookup;
• immutable subscriptions, invoices, numbered payment attempts, policy versions, actions,
  communication records, and workflow-wide opt-outs;
• a code-reviewed fourteen-day policy capped at three retries and three consented messages;
• send-before-network payment/message records with status-only ambiguous recovery and one external
  effect per stable key;
• atomic terminal stops on success, opt-out, expiry, hard decline, and exhausted attempts;
• a responsive recovery queue and case console with explicit policy, consent, digest, and provider
  evidence;
• a fixed 30-case evaluation plus upgrade, dedupe, consent, race, limit, and terminal-safety gates.

This is synthetic INR portfolio software. It handles no real money, identity, customer, banking, or
messaging data. All provider and communication effects are deterministic mocks. No deployment or
hosting is included.

RelayPay v0.12.0 — Dispute Response Agent

RelayPay v0.12.0 — Dispute Response Agent

RelayPay v0.12.0 adds a human-controlled, synthetic dispute response workflow on the shared agent
runtime while preserving /api/v1, PostgreSQL authority, and all earlier lost-response gates.

Highlights:

• deterministic dispute.created.v1 case intake for six bounded reason codes;
• allowlisted evidence selection with explicit missing evidence and snapshot-bound citations;
• immutable agent/analyst draft versions and transactional audit events;
• deterministic signed ZIP packages with canonical manifests and per-file SHA-256 digests;
• maker-checker approval bound to exact package bytes, with edit-time invalidation;
• send-before-network submission and status-only ambiguous recovery with one external effect;
• analyst console for review, revision, approval, exact download, and submission;
• fixed 30-case evaluation plus upgrade, isolation, self-approval, and byte-stability gates.

This is synthetic INR portfolio software. It handles no real money, identity, customer, banking, or
card-network data. The dispute network is a deterministic mock. No deployment or hosting is included,
and the workflow intentionally stops at SUBMITTED.

RelayPay v0.11.0 — Shared agent runtime

RelayPay v0.11.0 — Shared agent runtime

RelayPay v0.11.0 adds a PostgreSQL-authoritative agent runtime and Redpanda-derived business-event
backbone while preserving the existing payment API and immutable financial evidence.

Highlights:

• transactional, lease-published outbox events with a fixed PII-free envelope and consumer dedupe;
• immutable workflow, prompt, pricing, and evaluation versions with durable runs and reclaimable steps;
• deterministic retries, token/cost ceilings, cancellation state, bounded artifacts, approvals, and DLQ;
• typed fake/OpenAI/Claude/Gemini provider boundary with safety-limited failover;
• tokenized evidence, injection delimiters, allowlisted tenant-injected read tools, and immutable traces;
• OPERATIONS_ANALYST/APPROVER roles plus tenant-scoped queue and run-trace console views.

This is synthetic INR portfolio software. It handles no real money, customer data, banking data, or
live submission. No hosting or deployment is part of this release. Redpanda, Redis, and Celery are not
business authorities; PostgreSQL remains authoritative.

RelayPay v0.10.0 — Cloudflare edge trust boundary

RelayPay v0.10.0

RelayPay v0.10.0 adds a locally reproducible Cloudflare edge trust boundary while keeping
PostgreSQL and the origin payment core authoritative.

Included

• Worker validation for API-key shape, request bounds, replay windows, and tenant rate limits;
• a SQLite-backed Durable Object used only for per-tenant edge coordination;
• signed synchronous origin requests with W3C trace-context continuity;
• digest-addressed R2 archival and Queue-only forwarding for validated inbound webhook bytes;
• explicit Queue acknowledgement/redelivery, origin-outage handling, and edge metrics;
• Wrangler-compatible local and CI gates with no public deployment.

Compatibility and safety

The merchant /api/v1, Python SDK, financial journals, immutable evidence, and idempotent
response bytes are unchanged. Cloudflare state may be lost or duplicated without changing
business truth. See the migration guide before enabling origin signature enforcement.

Synthetic data only. RelayPay is not a payment processor. Never submit real payment,
bank-account, identity, or customer data.

RelayPay v0.9.0 — Full operations console

RelayPay v0.9.0

RelayPay v0.9.0 turns the Scenario Lab into a tenant- and environment-scoped operations
workspace while preserving the payment core and frozen merchant API.

Included

• shared signed-cursor list and sanitized detail patterns for merchant accounts, settlements,
  beneficiaries, payouts, connectors, inbound and outbound webhooks, dead letters,
  reconciliation, API keys, audits, usage, and operational request metrics;
• strict organisation/environment predicates on every operational query;
• masked bank-account references and explicit exclusion of credentials and raw request bytes;
• keyboard-native navigation, semantic tables, visible focus, reduced-motion support, loading,
  empty, and error states;
• responsive layouts down to 320 px and automated Playwright/axe coverage across every view.

Compatibility and safety

All new endpoints are session-authenticated /api/admin/v1 reads. /api/v1, financial
journals, immutable evidence, and idempotent response bytes are unchanged. PostgreSQL remains
authoritative and the release performs no deployment or hosting.

Synthetic data only. RelayPay is not a payment processor. Never submit real payment,
bank-account, identity, or customer data.

RelayPay v0.8.0 — Operations observability and evidence

RelayPay v0.8.0

RelayPay v0.8.0 adds opt-in operations telemetry and reproducible measured evidence without
changing the frozen merchant API.

Included

• append-only transactional audits with structured, credential-free log emission;
• bounded request metadata and hourly usage rollups that never store headers, cookies, secrets,
  or request bodies;
• OpenTelemetry traces for FastAPI, SQLAlchemy, outbound HTTP, Celery, pollers, mocks, and the
  receiver, exported through an opt-in Collector;
• Prometheus latency, throughput, webhook, mismatch, claim-depth, worker, recovery, and
  circuit-state metrics;
• a version-controlled Grafana dashboard under the Compose observability profile;
• a bounded slow-provider fault and repeatable proofs for shutdown, commit-then-crash, Redis
  loss, retry exhaustion, and queue-notification loss;
• rollback-only EXPLAIN (ANALYZE, BUFFERS) before/after index measurement and bounded HTTP
  load measurement.

Compatibility and safety

/api/v1 remains compatible with the v0.6 baseline. PostgreSQL remains authoritative, Redis
remains acceleration only, and no network I/O occurs inside financial transactions.
Observability is disabled by default and captures low-cardinality operational metadata only.

Synthetic data only. RelayPay is not a payment processor. Never submit real payment,
bank-account, identity, or customer data.

See docs/migrations/v0.8.0.md and docs/operations/observability.md. Measured results are
published from the canonical green CI run; they are observations, not production SLOs. This
release does not deploy or host RelayPay.