# MVP-TASK-034 — Surfboard Demo payment and ECR adapter

**Status:** Blocked  
**Parent:** MVP-TECH-002-S03; MVP-TECH-001-S02–S03; applicable MVP-PAY-001 scenarios

## Objective and required behavior

Implement the smallest Surfboard payment and Swedish ECR adapters established by task 033. Staging
must use Surfboard Demo end to end, while local/test keep the deterministic fake and production is
ready for Live through deployment configuration rather than source changes.

## Scope, areas, and non-goals

Add infrastructure adapters, injected HTTP transport, validated server-only configuration,
composition, redacted diagnostics, and controlled contract tests. Map the provider-neutral operation
ID to Surfboard idempotency/correlation semantics; send integer minor units, numeric SEK currency,
verified tax-inclusive line items/VAT, and the discovered terminal/register/shift context; interpret
the response envelope status rather than HTTP status alone; preserve Surfboard references; and map
every timeout, malformed response, and unverified state to `unknown`. Implement only the ECR
lifecycle needed for a legal sale, receipt, and end-of-day evidence established by task 033.

Staging configuration uses a console-issued Demo base URL, API key/secret and non-production
merchant/store/terminal/register identifiers from its secret store. Production accepts an
independent Live base URL and credentials with the same schema, but stays disabled until contract,
certification, merchant onboarding, ECR enablement, terminal/register setup, and Skatteverket steps
are complete. Keep `.env.example` values empty. Never commit, log, return to the browser, or place
in test fixtures any secret; never accept PAN, CVV, or track data. No Live CI transactions, guessed
payloads, broad provider framework, refunds, or scope beyond verified capabilities.

## Evidence and acceptance

Use parent scenario IDs in adapter tests; ordinary application acceptance remains fake-backed.
Provide a separately triggered staging smoke test that creates a Demo order, initiates payment, and
polls or consumes a verified webhook to a terminal state without exposing credentials. Accept only
when a real Demo response and final state are recorded safely, payment and required ECR/receipt
facts reconcile, duplicate safety is evidenced, secrets remain server-side, local startup needs no
Surfboard access, staging cannot select Live accidentally, production configuration needs no code
change, limitations are explicit, traceability/contracts/ADR are current, and inherited DoD passes.
If a prerequisite is unavailable, record the precise blocker rather than inventing behavior.

## Current implementation and blocker (2026-10-10)

The repository-side payment portion is implemented but the task cannot be accepted yet. The
provider-neutral request now carries validated priced lines and VAT; the Surfboard adapter creates
and initiates an order once, polls bounded status reads, maps only verified terminal states, keeps
unknown outcomes conservative, emits allowlisted diagnostics, and is selected from validated
server-only configuration. The signed raw-body webhook ingress and OpenAPI contract are also
present. Local/test acceptance remains fake-backed.

The following mandatory human/environment prerequisites from ADR 004 are unavailable in this
workspace: Demo credentials and base URL, a Demo merchant/store/networked terminal, confirmed Demo
ECR enablement and cash register/control-unit facts, a deployed public HTTPS webhook subscription,
and confirmed receipt `sequenceNumber` ownership/reset semantics. Consequently no real Demo response
or terminal payment state has been recorded, no payment/ECR/receipt reconciliation exists, and the
fiscal adapter and smoke test cannot be safely completed without guessing or risking an unverified
write. Production remains disabled pending the separate Live prerequisites. Resume only after those
values and confirmations are supplied through the deployment secret system (never chat or source);
then implement the accepted `FiscalGateway`, add the separately triggered Demo smoke, record
redacted evidence, and rerun the inherited DoD.