Rails integration — Listener + Webhook Manager

Inbound: the Listener

An Edge Function, one adapter per rail. It:

1. Receives Transaction Notifications from Tonder Backend and Menta Backend.
2. Verifies the signature (rail webhook secret from Vault, per the rails registry).
3. Normalizes to the internal event shape.
4. Attaches/derives the correlation_id.
5. Inserts into transaction_events (dedup on (correlation_id, acquirer)).

Outbound: the Webhook Manager

An Edge Function or worker. After a journal posts, it:

• Delivers to the outbound endpoints registered in webhooks.
• Signs with the per-endpoint HMAC secret (Vault).
• Retries failed deliveries with backoff, logging every attempt to webhook_deliveries.
• Also drives the merchant Dashboard via Supabase Realtime.

Operators configure endpoints and replay failures from the Admin Panel (module 7).

Correlation ID

Mandatory on every notification

If a rail can't supply a correlation_id, the Listener mints a deterministic one and records the mapping — but push the rails to send it. It is the one thread through the entire system.

Hosted Checkout / PCI

The Hosted Checkout embeds Tonder Lite SDK v2.0 — Vecnet stays out of PCI scope (no PAN touches Vecnet; card data is tokenized via Skyflow). Full spec in Hosted Checkout; PCI posture in Security.

Still needed — Listener-adapter blocker

The exact Tonder API (payment request/response + webhook payload) and Menta API (POS notification payload + signature scheme) contracts are required to build the adapters. See open items.