Integrators · Status

Integration readiness

Evidence-based status for abraxasworld.xyz — what is live, what awaits pilot proof, and which release gates stay open.

Canonical host: https://abraxasworld.xyz. Full reconciliation (including stale-origin audit): docs/INTEGRATION_READINESS_RECONCILIATION.md in the repository.

✅ Live today

Merged to main and available on abraxasworld.xyz (beta deployment).

  • Partner Flow integration kit + OpenAPI contract (abraxasworld.xyz)
  • Partner Flow evaluate / complete / refresh APIs
  • Fail-closed partner return URL allowlist
  • Public + partner-authenticated receipt verification
  • P1-2 fail-closed trust evaluation + server-derived idempotency (PR #113)
  • P1-3 partner-flow audit metadata + trace analyzer (PR #114)
  • Integration preflight script (npm run integration:preflight)
  • External security-review readiness package (docs only, PR #115)
  • Google zkLogin + browser session for holder routes
  • Good Trouble hosted pilot checkout UI (/good-trouble/*)

🧪 Beta-ready — pending human evidence

Code and operator tooling exist; production sign-off or pilot evidence still required.

  • Good Trouble pilot/sandbox integration (not GA production policy until evidenced)
  • Production IAT scenarios A–D (walkthrough checklist exists; results unsigned)
  • Partner-flow trace audit on real flow_trace_id (CLI ready; operator must run)
  • Refresh replacement receipt cycles on live expired receipts
  • Second relying party self-serve onboarding

⛔ Release gates — pending / blocked

Explicit gates that must not be marked complete without signed evidence.

  • Institutional Acceptance Test (IAT) — NOT complete
  • Independent external security review — NOT complete
  • v1.0.0-beta.0 baseline tag — NOT created
  • PROTOCOL_COMPATIBILITY freeze sign-off — code complete; IAT evidence pending
  • RELEASE_DECISION.md — draft only
  • P1-1 immutable policy versions — code merged; apply migration 055 in Supabase

🔭 Later / out of scope (current cycle)

Intentionally deferred; not required for first pilot wiring.

  • On-chain Move passport mainnet
  • MoonPay / fiat ramp production
  • Self-serve partner dashboard
  • Rate limiting at edge
  • P1-4 biometric telemetry persistence
  • General availability (GA) marketing claim

How another protocol integrates

  1. Read the integrator guide — Partner Flow sequence, browser session model, callback contract.
  2. Review the OpenAPI contract — Machine-readable paths under /api/v1/partner-flow/* and receipt verification.
  3. Download the OpenAPI YAML — Canonical server: abraxasworld.xyz — use for codegen and CI contract tests.
  4. Complete the onboarding checklist — Operator steps in docs/PARTNER_ONBOARDING_CHECKLIST.md — partner row, policy, allowed_return_urls.

Integration wiring checklist

Operator + integrator tasks before calling a partner wired. Separate from release gates below.

  • Partner row exists in production Supabase (`partners`) (operator)
  • Active `partner_policies` row bound to partner_id (operator)
  • `allowed_return_urls` includes exact production callback URLs (fail-closed) (operator)
  • `ABRAXAS_ISSUER_URL` and JWKS issuer match abraxasworld.xyz (operator)
  • Signing configured (`/api/trust/status` → signing_configured: true) (operator)
  • Holder browser session secret configured for partner-flow routes (operator)
  • Migrations 053 (idempotency) and 054 (audit index) applied in target DB (operator)
  • Partner site links to /partner/verify with partner_id, policy_id, return_url (integrator)
  • Partner backend verifies receipt via public or authenticated receipt API (integrator)
  • `npm run integration:preflight` PASS with production URL + read-only Supabase (engineering)

Wiring complete when:

  • All INTEGRATION_WIRING_CHECKLIST items verified with operator evidence (Supabase row screenshots or preflight PASS).
  • End-to-end pilot flow exercised: evaluate → (passport path if needed) → complete or refresh → partner callback with receipt_id.
  • Receipt validation succeeds: GET /api/receipts/{id}/public returns signature_valid: true on production.
  • Return URL allowlist rejects non-listed callbacks (fail-closed probe documented).
  • integration:preflight exits 0 with INTEGRATION_PREFLIGHT_BASE_URL=https://abraxasworld.xyz and read-only service role.
  • No stale abraxas-app.vercel.app issuer or redirect in the partner's live callback path.

Release gates (not complete)

  • Institutional Acceptance Test (IAT) signed in PRODUCTION_WALKTHROUGH_RESULTS.md — open
  • Independent external security review report + disposition — open
  • Tag v1.0.0-beta.0 (not created) — open
  • PROTOCOL_COMPATIBILITY.md + manifest contract tests at release SHA — open
  • RELEASE_DECISION.md signed — open