Integration checklist

Use this checklist before asking OpenPoly to enable production traffic.

Build

• Implement backend call to POST /api/operator/launch.
• Store operator API key in server-only secret storage.
• Implement wallet adapter paths:
  • GET /balance
  • POST /debit
  • POST /credit
  • POST /debit-reversal
• Implement webhook receiver with signature verification and replay protection.
• Map operator user identity to stable external_user_id.
• Support product: "polyflight" in the launch request while preserving omitted-product Opinion behavior.
• Accept all documented mini_app_polyflight_* wallet reasons and additive native metadata.
• Subscribe to and deduplicate the complete mini_app.polyflight.* event catalogue.

Configure

• Create operator API key with only needed scopes.
• Configure allowed Mini App launch host in operator dashboard.
• Configure wallet adapter base URL and auth secret in operator dashboard.
• Configure webhook endpoint URL, event subscriptions, and webhook secret.
• Review existing endpoint subscriptions when adding Polyflight; edit the saved selection instead of replacing the URL or signing secret. An empty event selection means all current and future types.
• Confirm market visibility mode and any allowlist or blocklist rules.
• If Polyflight is enabled, assign its read scopes explicitly and confirm current terms/settlement timezone.

Validate

• Launch Mini App from operator backend with test user.
• Confirm launch token redemption works only once.
• Confirm wallet adapter debit, credit, and reversal are idempotent.
• Confirm ambiguous primary mutations stop for manual review rather than being replayed automatically.
• Confirm webhook receiver accepts valid signature.
• Confirm webhook receiver rejects bad signature and stale timestamp.
• Confirm failed webhook delivery retries and can be replayed.
• In dashboard Integration UAT, explicitly select Opinion or Polyflight and inspect the same external user's callback against its ticket and wallet-operation evidence. The Polyflight ticket card additionally needs polyflight_terms:read; wallet operations need balance_operations:read; delivery inspection needs webhooks:read and polyflight:read. UAT lists missing selected-product event subscriptions across active endpoints (an empty selection means all). A wallet connection test or active endpoint alone does not certify product callbacks or wallet effects.
• Confirm callback delivery previews are not original signed bytes; verify receiver HMAC against received raw body and dedupe even an already accepted 2xx replay.
• Confirm staging drills pass before production cutover.
• Confirm Polyflight purchase/payout uses native IDR without Opinion FX.
• Complete the Polyflight player walkthrough: quote, purchase, ticket state, flight history, and Black Box proof.
• Reconcile a Polyflight win, loss, full refund, compensation, and manual-review case through operation, event, statement, and export.
• Certify the narrowly allowed Polyflight loss /credit with amount 0, reason mini_app_polyflight_loss, :loss key, operation: "loss" / result: "lost" metadata, unchanged balance, durable same-key acknowledgement, and optional remote reference; newly planned wins include result: "won".
• Confirm new loss ticket.resolved events include the delivery obligation ID, with no loss payout pending/processed callback or monetary accounting impact; result finality is independent of delivery. Do not backfill historical losses or rewrite older planned/dispatched requests.
• Confirm stakeMinor includes feeMinor, netStakeMinor is net of fee, potentialPayoutMinor is not paid cash, pending amountMinor is owed, processed is credited, and full refund/compensation reverses stake rather than charging another fee.
• Keep the one-time feeMinor user charge inside stakeMinor; ticketFeeShareBps and positionShareBps are commercial allocation rates, never extra wallet charges. Compare exact unscaled IDR minor-unit strings without FX conversion or floating-point rounding.
• Verify positive, negative, and zero signed-position examples.

Production gate

• Secret rotation runbook prepared.
• On-call owner for wallet adapter and webhook receiver assigned.
• Logging redacts API keys, launch tokens, webhook secrets, and wallet secrets.
• Manual-review and compensation paths understood by operator support team.
• Polyflight liability, statement, payment, reconciliation, and safe-entry-disable paths understood.
• Staging simulator evidence kept separate from real external-wallet contract certification.
• Separate explicit production authorization recorded before deployment, enablement, or production wallet activity.