Prototype status — not production-ready. The checked-in Flutter client and Go wallet server are incomplete experiments. They do not yet implement the canonical sync contract, authentication, encryption-at-rest, secure secret storage, release signing, or a deployable server image. Do not process real payments or real SMS data with this repository.
OpenPay Congo is being specified as a mobile local-first payment inbox and outbox. The mobile device records payment events while offline; a backend later replicates an immutable ledger and derives balances. The public interoperability contract is additive planning material, not evidence that this behavior is implemented.
android-client/— Flutter prototype for Android; it currently parses a narrow Orange SMS format and has incomplete flows.wallet-plugin-go/— Go/SQLite wallet-server prototype; its current routes are legacy and are not the canonical v1 contract.docs/— canonical contract, PRDs, ADRs, reliability notes, and the Docker-only contract validator..github/workflows/ci.yml— current baseline CI; it needs the planned release and supply-chain hardening described in the documentation.
- Git.
- Docker Desktop for all reproducible CI checks below.
- Flutter 3.44.9 with Dart 3.12.2 for the Android CI image.
- Go 1.26.5 for the Go prototype (
go.modrequests that toolchain). - No Docker deployment image release process exists yet.
The commands below exercise only the present prototypes; they do not establish CI or production readiness.
# Flutter prototype
cd android-client
flutter pub get
flutter analyze
flutter test
flutter run
# Go prototype (creates/uses a local wallet.db in this directory)
cd ../wallet-plugin-go
go test ./...
go run ./cmd/server
# Canonical public-contract validation — Docker only
cd ..
docker build --target test -f docs/Dockerfile .The contract build uses no bind mounts or named volumes; its dependencies are image-internal. The Android prototype requests SMS/biometric capabilities; use only test messages and a test device.
Run these commands from the repository root for reproducible CI evidence:
# Canonical public contract and delivery-policy validation
docker build --target test -f docs/Dockerfile .
# Go public tests, vet, race detector, and runtime image
docker build --target test -f wallet-plugin-go/Dockerfile wallet-plugin-go
docker build --target runtime -t openpaycongo-wallet:local -f wallet-plugin-go/Dockerfile wallet-plugin-go
# Flutter analysis, tests, and a non-production debug APK
docker build --target analyze -f android-client/Dockerfile.ci android-client
docker build --target test -f android-client/Dockerfile.ci android-client
docker build --target artifact --output type=local,dest=android-client/build/ci \
-f android-client/Dockerfile.ci android-client
# Admin UI health and browser journey against its Compose fake upstream
docker compose -f admin-ui/compose.test.yaml up --build --abort-on-container-exit --exit-code-from browser
docker compose -f admin-ui/compose.test.yaml down --volumes --remove-orphansandroid-client/build/ci/app-debug.apk is debug-signed CI output, not a distributable release. The admin Compose journey uses a checked-in fake upstream and is browser/health evidence for the UI boundary, not live backend integration evidence. The Dockerfiles make prototype checks reproducible; they do not add deployment configuration, database configurability, signing, SBOMs, provenance, or a production image release process.
docs/parity-harness.mjs is issue #11 harness foundation. It sends canonical analytics HTTP requests to named targets and emits explicit skips for unavailable capabilities. Docker tests prove fixture reference pass plus controlled divergent response failure. This is not evidence legacy Go, Node, or Laravel implementations satisfy parity; adapters must add their target configuration after identity and HTTP slices land.
| Area | Current state | Planned contract |
|---|---|---|
| Mobile inbox | Keystore-encrypted trusted-SMS evidence and append-only local decisions; no canonical sync | Offline inbox/outbox, explicit server delivery state, proven recovery UX |
| Backend ledger | Prototype Go/SQLite endpoints | Authenticated immutable replicated ledger and derived balance |
| Sync | Not implemented | POST /v1/sync/push, GET /v1/sync/pull, POST /v1/sync/ack |
| Merchant integration | Not implemented | One canonical event push with idempotency semantics |
| Releases | No signed Android or container release | Signed/mobile release, SBOM, provenance, scan, rollback evidence |
The older French material records product intent, not implemented controls. Treat API keys/HMAC, encryption, parser sharing, and retry behavior there as unimplemented until a release says otherwise. Raw SMS is deliberately excluded from the canonical public event payload. Never commit credentials, production SMS, or wallet databases.
The canonical API specifies OAuth-style scopes, RFC 9457 problem responses, idempotency, and storage parity. Implementation, threat modeling, key management, retention, replay defense, and operational approval remain required.
- Mobile PRD
- Backend PRD
- Architecture, reliability and recovery, and interoperability/storage parity
- Canonical OpenAPI 3.1 contract, event schema, and fixtures
- ADR 001 — local-first authority, ADR 002 — replicated sync, ADR 003 — parser proposal trust
Android truth note: the current slice requests RECEIVE_SMS, receives platform broadcasts while the process is absent, enforces an encrypted exact sender allowlist, and records trusted evidence locally for review. It does not use READ_SMS, claim default-handler status, guarantee zero loss, provide server reconciliation, or establish Google Play exception approval. Biometric authentication remains an authenticator result, not a runtime permission.
There are no real-app screenshots in this repository. Screenshots will be added only after capture from the actual app running a documented, reproducible test journey; no mockups or fabricated product evidence will be substituted.