Architecture and control points

​

Runtime shape

User intent -> frontend -> backend policy -> provider or domain service -> authoritative state -> returned UI

​

Financial controls

• The canonical finance ledger is the only monetary source of truth.
• Verified payments create a commission exactly once when the event is eligible.
• Refunds and chargebacks reverse commission exactly once.
• Self-referrals are excluded from commissionable attribution.
• Payout eligibility is a backend decision, not a client-side balance calculation.

​

Operational controls

• Idempotency: Retries should not duplicate payment, access, commission, payout, or workflow side effects.
• Role boundaries: Customer, creator, affiliate, and admin routes have separate responsibilities and permissions.
• Certification gates: High-risk capabilities remain unavailable until their test and operational evidence is accepted.
• Auditability: Runs, ledger entries, provider references, and status history should make a support or finance investigation possible.