# MVP-TECH-002 — Surfboard payment and fiscal integration readiness

## Discovery story

As the product/engineering team, we need a verified Surfboard Demo integration contract for payment
and the Swedish fiscal cash register so that staging exercises the selected provider while local
development stays deterministic and production can later switch to Live configuration safely.

## Scenarios

### MVP-TECH-002-S01 — Capability and access discovery is recorded

- **Given** Surfboard's public integration brief and developer documentation plus the team's
  separately managed Demo account and enabled capabilities
- **When** discovery is performed
- **Then** an in-repository result records evidence or explicit unknowns for line items, gross/VAT,
  checkout initiation, supported in-store payment methods, success/failure/cancellation, timeout
  reconciliation, idempotency, stable references, auth/environments, Demo support, webhooks, ECR
  enablement, register and shift lifecycle, control-unit/declaration data, receipts, X/Z reports,
  and Live certification prerequisites
- **Evidence:** discovery/manual evidence with source/date and an ADR or dedicated discovery record.

### MVP-TECH-002-S02 — Discovery does not block the fake flow

- **Given** Surfboard Demo access, hardware, or an ECR capability remains unavailable or incomplete
- **When** MVP ordering is developed locally or exercised by automated acceptance
- **Then** the provider-neutral fake supports all application acceptance work independently
- **Evidence:** architecture review plus MVP-TECH-001 executable evidence.

### MVP-TECH-002-S03 — Adapter and environment scope follows verified findings

- **Given** the discovery result
- **When** real integration work is planned
- **Then** Surfboard-specific fields stay inside adapters, staging selects Demo from server-side
  configuration, production can select Live without code changes, and unsupported or uncertain
  capabilities remain explicit
- **Evidence:** review of the discovery record and adapter task.

## Invariants and exclusions

Fetch `https://surfpay.ai/llms.txt` at implementation time and follow its linked authoritative API
and ECR guides. Use the deterministic fake for local development and automated acceptance because it
is reproducible, offline, and requires no shared credentials. Use Surfboard Demo in staging; never
use Live for tests. Keep API URL, key, secret, merchant/store/terminal/register identifiers, and
webhook secrets in the deployment secret/configuration system with empty examples only. Never handle
card numbers, CVV, or track data. Live enablement requires separate production credentials,
Surfboard certification, explicit release approval, and a merchant-completed Skatteverket
declaration where applicable.

## Implementation tasks

[MVP-TASK-033](../tasks/MVP-TASK-033.md) and [MVP-TASK-034](../tasks/MVP-TASK-034.md).