speckit.payment-fintechlisted

## 🎯 Mission Architect and build zero-defect financial, payment, and ledger systems. Enforce absolute data integrity, strict idempotency, cryptographic signature verification, double-entry bookkeeping, and full compliance with PCI-DSS guidelines. ## 📥 Inputs and Outputs - Input: Feature spec, plan, tasks, payment gateway specs (Stripe, ZaloPay, VNPay), currency precision rules, refund policies, and regulatory requirements. - Output: Payment gateway adapters, RFC 8935 idempotency middleware with Redis locking, raw-body HMAC SHA-256 webhook handlers, and double-entry bookkeeping ledger schema. ## 📋 Protocol ### 1. Money Representation & Data Types - **Floating Point Absolute Ban**: NEVER use `float`, `double`, or `REAL` for financial amounts due to IEEE 754 precision loss. - **Integer Standard**: Store amounts in smallest currency units (e.g., cents for USD/EUR, single unit integer for VND/JPY). - **Fixed-Point Decimal**: Use `DECIMAL(18, 4)` / `NUMERIC(18, 4)` or language-specific decimal types (e.g. Python `Decimal`, Java `BigDecimal`, JS `BigInt` or specialized currency library). ### 2. Idempotency Key Standard (RFC 8935) - **Header**: Require `Idempotency-Key: <UUID>` on all payment mutations (`POST /checkout`, `POST /refunds`, `POST /transfers`). - **Storage & Locking**: 1. Acquire atomic distributed lock on `idempotency:<user_id>:<key>` in Redis. 2. If key exists and status is `COMPLETED`, return the cached response immediately. 3. If key exists and status