Real-Bank Payment Verification — Proof of Concept

What Was Tested

The intended test sends a real payment to a designated Mercury account, lets it appear in that institution's transaction records, exports the transaction data, and securely imports the file into TideLinx.

TideLinx then normalizes the institution-specific record, reconciles the incoming payment against an existing receivable, evaluates the transaction against verification rules, generates a commerce authorization, and transmits that authorization to a connected application.

This page does not claim that the live $10.17-class settled payment for TLX-POC-MERCURY-001 has been Review-signed. Status is read from the frozen database record. If that fetch fails, the page stays PENDING. A synthetic fixture path exists so Review can walk the software. Public proof stays pending until Review signs.

Test Architecture

Real Bank Payment → Mercury → Institution-Originated CSV → TideLinx Institution Adapter → Normalization → Reconciliation → Verification → Commerce Authorization → Connected Application

┌──────────────────────┐
│ Commerce Application │
└──────────┬───────────┘
           │ Receivable
           ▼
┌──────────────────────┐
│      TideLinx        │
│ Reference Generation │
└──────────┬───────────┘
           │ Real Payment
           ▼
┌──────────────────────┐
│ Financial Institution│
│       Mercury        │
└──────────┬───────────┘
           │ Transaction Export
           ▼
┌──────────────────────┐
│  Institution Adapter │
│       Mercury        │
└──────────┬───────────┘
           ▼
┌──────────────────────┐
│ Normalized Transaction│
└──────────┬───────────┘
           ▼
┌──────────────────────┐
│ Reconciliation Engine│
└──────────┬───────────┘
           ▼
┌──────────────────────┐
│ Payment Verification │
└──────────┬───────────┘
           ▼
┌──────────────────────┐
│Commerce Authorization│
└──────────┬───────────┘
           │ Webhook/API
           ▼
┌──────────────────────┐
│ Commerce Application │
│   Order Released     │
└──────────────────────┘

Test Procedure

1. Create a receivable with payment reference TLX-POC-MERCURY-001 and amount 10.17 USD.
2. Confirm the connected application order is LOCKED.
3. Receive a settled credit on the designated Mercury account (live evidence later).
4. Export institution-originated CSV. Do not collect bank login credentials.
5. Upload the CSV in Financial Data → Import Transactions.
6. Confirm the Mercury adapter detects the format by header names.
7. Confirm exact reference + amount + currency auto-authorizes only when those rules pass.
8. Confirm the signed commerce.authorization.created webhook releases the order.

Results

Result cards are filled from poc_evidence_records. Blank fields mean evidence has not been written yet. A CSV walk may fill SHA-256, authorization ID, and webhook event without flipping Result to PASS. Only a Review-sign API call sets review_signed_at.

Failure Tests

• POC-02 Wrong amount — PENDING / not_run
• POC-03 Unknown reference — PENDING / not_run
• POC-04 Duplicate import — PENDING / not_run
• POC-05 Identical CSV re-upload — PENDING / not_run
• POC-06 Invalid CSV — PENDING / not_run
• POC-07 Modified headers — PENDING / not_run
• POC-08 Ambiguous transaction — PENDING / not_run

Evidence

Scaffolding lives in docs/proof-of-concept/mercury-001/. Screenshots, the source-file SHA-256, and the redacted evidence manifest are filled from the frozen record when those fields exist. Unredacted bank statements, account numbers, webhook secrets, and private keys are not published.

Review can inspect the frozen row without signing: GET /api/public/proof-of-concept/TLX-POC-MERCURY-001.

What This Proves

When the evidence package is complete, the test is intended to demonstrate:

• ingestion of authentic financial transaction data;
• institution-specific transaction parsing;
• conversion into a standardized TideLinx transaction format;
• reconciliation against a predefined receivable;
• duplicate-detection controls;
• deterministic verification logic;
• generation of a machine-actionable commerce authorization;
• transmission of that authorization to another application;
• auditable recording of the verification sequence.

What This Does NOT Prove

• direct Mercury API integration;
• a partnership with Mercury;
• endorsement by Mercury;
• production integration with Trinidad & Tobago banks;
• regulatory approval by a financial regulator;
• support for every banking institution;
• that CSV is the only ingestion method TideLinx can support;
• that every transaction can be automatically reconciled;
• that a fabricated or sample CSV is public proof of a real payment.

This architecture is designed so a later test can be described as validated using Mercury-originated transaction data. It does not represent or imply a partnership, endorsement, certification, integration agreement, or commercial relationship between TideLinx and Mercury.

Technical Architecture

Adapters convert institution-specific files into a canonical transaction. Reconciliation has no Mercury-specific logic. Auto-authorization requires an exact payment reference, exact amount, exact currency, a non-duplicate row, an acceptable source status, and a receivable that is still awaiting payment.

SUPPORTED means the adapter is implemented and covered by technical tests. VALIDATED is reserved for genuine institution-originated evidence. Planned Trinidad & Tobago banks and Wam are listed as NOT_VALIDATED only.

Security & Privacy

• No bank username, password, cookie, MFA token, or session credential is collected for this path.
• Uploads are authenticated, tenant-scoped, SHA-256 hashed, and capped at 10 MB. CSV only.
• Webhooks are signed, timestamped, replay-protected, and uniquely identified.
• Raw bank CSVs are never published. Filenames are redacted in API responses.
• Public Result is PENDING whenever review_signed_at is null. Import cannot set PASS.

Version History

2026-08-24 — Ingestion layer and public page published with result PENDING Review.

2026-08-24 — Frozen poc_evidence_records row; public status read from the database.