Tack Gateway — IXOPAY Luxury Developer Console

TACK GATEWAY CONSOLE — COMMAND CENTER & E2E TEST SUITE

Tack Gateway is a secure, sub-10ms machine-to-machine (M2M) autonomous payment routing engine. Built per the IXOPAY Project Charter, this console provides full visibility into gateway telemetry, contract test matrices, hosted payment pages, and multi-rail network adapters.

Developer Console Workbenches & Live Capabilities

🌐 MASTER E2E TOPOLOGY🟢 ACTIVE ➔

7-node network pipeline & readiness status.
Live data authority & ping telemetry.
Audit proof bundle generation.

🧪 AUTOMATED TEST MATRIX🟢 23 SUITES ➔

100% Jest parity with single/batch execution.
RFC 8785 JCS canonical Invoice_Hash verification.
Sub-10ms latency SLAs & failure assertion diffs.

🛡️ HPP WORKBENCH & RAILS🟢 MULTI-RAIL ➔

TokenEx iFrame SAQ-A zero-PAN PCI isolation.
Mastercard AP4M, Visa TAP & Tilopay REST adapters.
Live PI2PI price tampering defense visualizer.

Core Architecture & SLA Performance Metrics

⚡ Sub-10ms Gateway SLA Verification

Core Express router state transitions & PPCB canonical hashing execute under 3ms P99.

🛡️ PPCB Anti-Tampering & 100% Contract Test Pass Rate

RFC 8785 JCS canonical SHA-256 Invoice Hash prevents post-authorization price manipulation across all test suites.

Slide 1 of 2 — Console Command Center

OUTSIDE AGENT HPP ARCHITECTURE & SECURITY MODEL

Tack Gateway solves the fundamental PCI violation of guest AI agents: card numbers can never enter LLM context windows or agent logs. Card details are isolated browser-direct inside an IXOPAY TokenEx iFrame (SAQ-A) while cart parameters are cryptographically bound using RFC 8785 Invoice_Hash.

4-Step End-to-End Execution Flow

STEP 1: AGENT TOOL CALL

Guest AI agent calls Tack MCP tool execute_payment with cart items & amount.

STEP 2: PPCB CART LOCK

Gateway locks price & items with an RFC 8785 canonical Invoice_Hash digest.

STEP 3: TOKENEX iFRAME

Human user enters card in TokenEx iFrame. 100% Zero-PCI SAQ-A scope isolation.

STEP 4: SETTLEMENT

Gateway maps vault token into Visa TAP / AP4M network cryptogram in < 10ms.

🛡️ Zero-PCI Liability

Merchants avoid raw PAN ingestion completely. All cardholder data is captured browser-direct in IXOPAY TokenEx vault.

🔒 PI2PI Defense

Prompt injection attacks trying to tamper cart price ($38.88 ➔ $3.88) are rejected instantly by PPCB hash verification in < 2ms.

⚡ Sub-10ms SLA

Gateway internal processing overhead executes under 3ms P99, well within our enterprise 10ms SLA target.

Slide 2 of 2 — HPP Architecture

👤

PERSONA 1: CHARLOTTE (CONSUMER & DELEGATE)

Charlotte delegates purchasing authority to Tack Payer Agent with strict L2 spending caps ($50.00 max limit).

🎯 Active Goal: Verify L2 Spending Cap & Biometric FIDO2 Step-Up

1. Select Test Vector Scenario

L2 Max Budget ($):

Allowed Merchant ID:

Cart Total ($):

Currency:

2. Inbound Vector Payload & Header JSON

Modifications update JSON in real time

🟢 SYSTEM IDLE

1. DISCOVERY & ROUTING

READY

/.well-known/ai-payments.json

2. MANDATE & SPENDING CAP

READY

L2 Spending Budget Check

3. PPCB INVOICE HASH

READY

RFC 8785 JCS SHA-256

4. TOKENEX VAULT & SETTLEMENT

READY

PCI SAQ-A Zero-Storage

// Select a vector scenario above and click "⚡ Execute Scenario" to process transaction payload...

OUTSIDE AGENT HPP & TOKENEX iFRAME WORKBENCH

Simulates external AI shopping agents calling Tack Payment MCP tools, PPCB cart locking, and IXOPAY TokenEx SAQ-A iFrame card entry.

❌ 1. THE PROBLEM

AI Agents cannot handle raw credit card numbers. Passing card data into LLM prompts causes catastrophic PCI violations & LLM security leaks.

🛡️ 2. THE TACK FIX

Isolates card capture inside a 100% Zero-PCI TokenEx iFrame and locks cart prices mathematically via RFC 8785 Invoice_Hash before settlement.

💰 3. BUSINESS VALUE

Merchants accept autonomous AI payments with ZERO security liability, zero custom checkout code, and < 10ms network settlement speed.

Select Interactive Presentation Demo Scenario

⚡ DEMO-01: Happy Path Settlement EXPECTED: 200 APPROVED

What You Will See: Guest AI Shopping Agent calls execute_payment tool. Consumer enters card safely in TokenEx SAQ-A iFrame. Gateway completes settlement via Visa TAP in < 10ms.

🔒 Security Model: 100% Zero-PCI scope isolation + RFC 8785 Invoice_Hash cart lock.

🛡️ DEMO-02: PI2PI Price Tamper Attack Defense EXPECTED: 401 REJECTED

What You Will See: Prompt injection payload attempts to modify cart price ($38.88 ➔ $3.88) post-signature. Gateway detects price tamper & blocks transaction in < 2ms.

🛡️ Security Model: PPCB parameter binding rejection (401 INVOICE_HASH_MISMATCH). Zero funds lost.

🚀 DEMO-03: Scheme Multi-Rail Handover EXPECTED: HANDOVER COMPLETE

What You Will See: Dynamic network scheme handover. Real-time switching between Visa TAP (Ed25519), Mastercard AP4M (ES256), and TokenEx Direct UTT container.

⚡ Security Model: Multi-scheme network token container mapping.

End-to-End Payment System Topology

Real-time map of all gateway components, network rails, and active sandbox connectors.

📐 PAYMENT INFRASTRUCTURE SCHEME & DATA FLOW PIPELINE 7-NODE TOPOLOGY

Real Module Telemetry & Standalone Interactive Tests

1. AI Agent Tooling 🟢 ACTIVE

Exposes standard payment discovery tools to AI buyer agents (WebMCP standard).

Module: webmcp-tooling

2. Central Routing Engine 🟢 ACTIVE (<10ms)

Validates cart integrity, prevents price tampering, and routes transactions.

Module: core-router

3. Mastercard Agent Pay 🟡 LOCAL ENGINE

Verifies SD-JWT verifiable intent mandate tokens using ES256.

Module: verifiable-intent

4. Visa Trusted Agent (TAP) 🟢 LIVE SANDBOX

Validates HTTP message signatures (RFC 9421) and connects to Visa Sandbox.

Module: visa-tap

5. Tilopay Gateway Rail 🟢 LIVE SANDBOX

Processes multi-currency authorizations and settlement (USD & CRC).

Module: tilopay-adapter

6. Card Vault (Zero-PAN) 🟢 LIVE SANDBOX

Tokenizes cards in the browser so card numbers never touch the gateway (TokenEx Vault).

Module: vault-tokenex

7. Settlement & Audit Seal 🟢 AUDIT SEAL

Finalizes transaction settlement and generates cryptographic proof receipts for all parties.

Module: audit-proof

📡 LIVE SERVICES STATUS Heartbeat active...

⚡ TACK GATEWAY 🟢 ONLINE · 0.4ms

http://localhost:3000

Core routing engine & PPCB parameter binding.

🟢 HOST RUNTIME PORT 3000 (<10ms SLA)

🏪 TEST MERCHANT AURA CHECKING...

http://localhost:4000

Storefront feed (/products.json) & discovery manifest.

STORE:

POWER

🤖 IXONAUT AGENT CHECKING...

http://localhost:5050

Sovereign key wallet & autonomous mandates.

POLICY:

POWER

⚡ REAL-TIME SSE TELEMETRY STREAM (/console/api/events/stream)

[Listening for real-time autonomous packet telemetry...]

📦 LIVE MERCHANT PRODUCT CATALOG (Port 4000 /products.json) Select any live merchant product to run a 7-stage autonomous purchase or test anti-tampering defenses.

Settlement Rail:

Loading live product catalog from http://localhost:4000/products.json...

📊 TRACEABILITY & E2E BENCHMARK TELEMETRY REAL-TIME HUD

E2E Execution Status

Ready to Execute

Lifecycle State

Gateway Routing Overhead (< 10ms SLA)

⚡ Core Routing: --ms

Tack Gateway Internal SLA Target

Total E2E Transaction Time

⏱️ Total Time: --ms

< 5s (Optimal) · > 30s (Slow)

SLA SPEEDOMETER (< 10ms TARGET)

P50: 0.38ms P90: 0.65ms P99: 0.92ms

⚡ 7-Stage Autonomous Payment Lifecycle

Step-by-step cryptographic pipeline executed across Buyer Agent, Merchant Storefront, and Gateway Router.

🤖 Buyer Agent (:5050) 🏪 Merchant (:4000) ⚡ Tack Gateway (:3000)

Select any product from the live catalog above to execute the 7-stage autonomous flow.

🛡️ Tri-Party Post-Settlement Report & Audit Seal

Cryptographic proof and receipts issued simultaneously to User, Agent, and Gateway.

🧾

No Active User Receipt

Execute a 7-stage transaction to generate an itemized zero-PAN receipt.

🤖

No Agent Ledger Update

Execute a 7-stage transaction to update buyer sovereign budget ledger.

⚡

No Gateway Telemetry Seal

Execute a 7-stage transaction to view Merkle proof & SLA benchmark.

🌐 External Sandbox Provenance & Reference IDs

Dual-system cross-audit keys: compare Tack Gateway internal cryptographic records against external sandbox rail parameters.

🌐

No Active Cross-Audit Provenance

Execute a 7-stage transaction to generate internal & external sandbox reference IDs.

⚡ INSIDE OUR SYSTEM (Tack Gateway Core)

GATEWAY PROVENANCE

Gateway Transaction ID: -

Canonical Invoice_Hash (JCS): -

Mandate ID / Custody Key: -

Correlation ID: -

Audit Proof Merkle Digest: -

Tack Core Routing Latency: -

Gateway PCI Scope: PCI-DSS SAQ-A Zero-PAN Isolated

🏢 OUTSIDE OUR SYSTEM (Sandbox Authority)

SANDBOX AUTHORITY

Active Sandbox Authority: -

External Sandbox Endpoint: -

External Network Transaction ID: -

Network Authorization Code: -

External Reference ID: -

Neutral Vault Token (TokenEx UTT): -

Vault Provider & ID: TokenEx Cloud Vault (ID: 3424164957274270)

💡

Independent Portal Traceability Guide:

To cross-reference this transaction outside Tack Gateway, open the respective payment provider or sandbox console and look up the external network transaction ID or authorization code.

Developer Console Workbenches & Live Capabilities

Core Architecture & SLA Performance Metrics

4-Step End-to-End Execution Flow

PERSONA 1: CHARLOTTE (CONSUMER & DELEGATE)

OUTSIDE AGENT HPP & TOKENEX iFRAME WORKBENCH

❌ 1. THE PROBLEM

🛡️ 2. THE TACK FIX

💰 3. BUSINESS VALUE

Executive & Technical Q&A Reference

Internal Code Contract Test Suite Matrix

End-to-End Payment System Topology

⚡ 7-Stage Autonomous Payment Lifecycle

🛡️ Tri-Party Post-Settlement Report & Audit Seal

🌐 External Sandbox Provenance & Reference IDs

Enter Security PIN

Developer Console Workbenches & Live Capabilities

Core Architecture & SLA Performance Metrics

4-Step End-to-End Execution Flow

PERSONA 1: CHARLOTTE (CONSUMER & DELEGATE)

OUTSIDE AGENT HPP & TOKENEX iFRAME WORKBENCH i

❌ 1. THE PROBLEM

🛡️ 2. THE TACK FIX

💰 3. BUSINESS VALUE

Executive & Technical Q&A Reference

Internal Code Contract Test Suite Matrix

End-to-End Payment System Topology

⚡ 7-Stage Autonomous Payment Lifecycle

🛡️ Tri-Party Post-Settlement Report & Audit Seal

🌐 External Sandbox Provenance & Reference IDs

Module Specification & Data Provenance

Configure Ecosystem Service Targets

Stage Technical Inspector & Cryptographic Artifacts

Field & State Specifications

OUTSIDE AGENT HPP & TOKENEX iFRAME WORKBENCH