Ten-minute path
The deep path. Read the raw evidence, verify the ledger, run the fake-PayPal demo and check the quality gates.
Everything here is PayPal only. The commands run on a normal developer machine with Node 22 and npm. This site never needs a build on a shared machine; the repository runs its own checks in GitHub Actions.
Minutes 0 to 2: the status and the gates
Follow the two-minute path. It gives you the shape: four real passes, one partial result (G5, speech accuracy) with a fallback, one real probe in progress.
Minutes 2 to 4: the raw sandbox evidence
Open the committed run logs. They are JSON lines. Tokens, buyer emails and payer ids read [REDACTED].
- G1, partial capture: two runs, a wallet buyer (4 Nov) and a card-funded PayPal account (5 Nov).
- G2, card and guest authorize
- G4, webhook verification: six real events.
- Nightly sandbox reports: runs 42200708552 and 42317068784, redacted.
Gate has an evidence file, docs/evidence/G0/G0-20261109T031839Z.jsonl, from a re-run on 9 Nov (run 42555610707). It proves connectivity, token scopes and order creation only.
Minutes 4 to 6: the settlement logic
Read Settlement saga and Retries and unknown outcomes. The is a pure state machine in packages/payments/src/saga/machine.ts. It was run against the in full, and against the real sandbox as one lot of three holds and one in-process crash (nightly specs R7, R8 and R10).
Minutes 6 to 8: verify the audit trail yourself
The writes a . A public export can be checked without a server.
npm ci
node packages/engine/bin/verify-ledger.mjs path/to/ledger.jsonlIt prints the entry count and head hash, or the first bad entry, and exits non-zero on tampering.
Rejected bids are not in the ledger. The server keeps them in the room log only (decisions D-0014 and D-0029 in docs/DECISIONS.md).
Minutes 8 to 10: run the fake-PayPal demo and read the open items
- Follow the Run it locally page (the "Quick start" section of
README.mdhas the same command). The default run isnpm ci, thennpm start -w @gavel/serverwithPAYMENTS=fakeandPAYPAL_ENV=sandbox;TOKEN_SECRETandADMIN_KEYare generated withopenssl rand. For the web app, copypackages/web/.env.exampletopackages/web/.env.localbeforehand. PAYMENTS=fakeuses the built-in fake PayPal: no network access and no PayPal account are needed. Production mode refuses fake payments.- The
/api/demo/*routes are mounted only withDEMO_MODE=1andPAYMENTS=fake.
The fake PayPal is a test double. What you see there says nothing about the real sandbox; the gates do.
Then read Tough questions and Security review, which lists the open items.
Further checks that run in CI
| Check | Where |
|---|---|
| Fresh-clone install, typecheck and tests each week | clean-clone.yml and scripts/clean-clone-check.mjs |
| Quality report built from a named commit | report.yml |
| Nightly judge smoke on the public site (steps 1 to 17 of its own) | qa/live-redteam/run.mjs, run nightly by judge-smoke.yml against the public domains (inputs web_url and api_url); the job fails when any step fails |
| What was checked before the repo went public | docs/PUBLIC-REPO-CHECKLIST.md |
Last updated on