Orchestration only, and proud of the boundary.

A payment orchestrator. It instructs a business's own provider account to collect, learns the outcome, and tells the merchant — through a hosted page for payers, a merchant dashboard, an back office, and a contract the rest of a merchant's systems can rely on.

One Rust service, four roles (web, worker, scheduler and the callbacks web), one database, one stylesheet. Providers join as versioned documents the engine reads, so adding a provider is data, not a code change. The gates that keep the architecture honest run in CI, and refuse work that would route around them.

Not a bank, not a wallet, not an acquirer. It holds no money: a guard refuses any schema that counts a balance or pays anyone out. It computes no fees. It knows nothing about any specific provider: the knowledge lives in the provider's own document.

Written proposals for each part (checkout engine, wallet custody boundary, credits, the provider protocol, the sign-in guide), the changelog since the first build, and a design document that names what the look borrows and why. The three documents a release answers to are the contract, the gates and the stories.