Ten-minute path
The deep path. Read the raw evidence, verify the ledger, run the fake-PayPal demo and check the quality gates.
Everything here is PayPal sandbox only. The commands run on a normal developer machine with Node 22 and npm. This site never needs a build on a shared machine; the repository runs its own checks in GitHub Actions.
Minutes 0 to 2: the status and the gates
Follow the two-minute path. It gives you the shape: four real passes, one failure with a fallback, one real probe in progress.
Minutes 2 to 4: the raw sandbox evidence
Open the committed run logs. They are JSON lines. Tokens, buyer emails and payer ids read [REDACTED].
- G1, partial capture: two runs, a wallet buyer (4 Nov) and a card-funded PayPal account (5 Nov).
- G2, card and guest authorize
- G4, webhook verification: six real events.
- Nightly sandbox reports: runs 42200708552 and 42317068784, redacted.
Gate G0 has no evidence file. Its only record is the gate-g0 Actions run log (run 41815593520), which needs repository access and expires with log retention.
Minutes 4 to 6: the settlement logic
Read Settlement saga and Retries and unknown outcomes. The saga is a pure state machine in packages/payments/src/saga/machine.ts. It was run against the fake PayPal in full, and against the real sandbox as one lot of three holds and one in-process crash (nightly specs R7, R8 and R10).
Minutes 6 to 8: verify the audit trail yourself
The engine writes a hash-chained ledger. A public export can be checked without a server.
npm ci
node packages/engine/bin/verify-ledger.mjs path/to/ledger.jsonlIt prints the entry count and head hash, or the first bad entry, and exits non-zero on tampering.
Rejected bids are not in the ledger. The server keeps them in the room log only (decisions D-0014 and D-0029 in docs/DECISIONS.md).
Minutes 8 to 10: run the fake-PayPal demo and read the open items
- Follow the "Run it" section of
README.md. The default run isnpm ci, thennpm start -w @gavel/serverwithPAYMENTS=fakeandPAYPAL_ENV=sandbox(the README lists the other variables, with development values). PAYMENTS=fakeuses the built-in fake PayPal: no network access and no PayPal account are needed. Production mode refuses fake payments.- The scripted
/api/demo/*routes are mounted only withDEMO_MODE=1andPAYMENTS=fake.
The fake PayPal is a test double. What you see there says nothing about the real sandbox; the gates do.
Then read Tough questions and Security review, which lists the open items.
Further checks that run in CI
| Check | Where |
|---|---|
| Fresh-clone install, typecheck and tests each week | clean-clone.yml and scripts/clean-clone-check.mjs |
| Quality report built from a named commit | report.yml |
| Judge walkthrough spec (fake stack, steps 1 and 2) | packages/e2e/specs/judge-walkthrough.spec.ts, run nightly by judge-smoke.yml, which fails red while JUDGE_URL is unset |
| What was checked before the repo went public | docs/PUBLIC-REPO-CHECKLIST.md |
Last updated on