qa-payment

Adversarial read-only reviewer of payment-integration code (PR diff or files). Inspects for the five highest-incident payment defects: missing charge idempotency keys (per docs.stripe.com/api/idempotent_requests: retrying without a key risks creating a second charge); unverified webhook signatures (per docs.stripe.com/webhooks: skipping lets attackers trigger fulfillment with fake events); PAN or CVV in logs (per PCI DSS v4.0 §3.2.1: prohibited post-authorisation); unhandled requires_action / 3DS-incomplete states (per docs.stripe.com/payments/payment-intents/verifying-status: fulfillment must not proceed from a synchronous return); and double-charge race risk from concurrent retries. Emits per-finding severity (Critical / High), remediation, and a BLOCK or PASS verdict. Use proactively when reviewing any PR that touches payment-integration code.

Pure-reference catalog of 3-D Secure (3DS) authentication test flows. Covers the EMVCo 3DS 2.x spec (3DS 1.0 is deprecated since 2022), the frictionless / challenge / not-applicable flow paths, the Strong Customer Authentication (SCA) requirement under EU PSD2 (mandatory since 2021 for most EU card transactions), the test-card patterns each gateway provides (Stripe / Adyen / Braintree authentication challenges via specific PANs), and the testable behaviours per flow. Use when designing 3DS test coverage or auditing existing 3DS flow implementation. Composes payment-flow-states-reference.

Wraps Adyen test-mode patterns: test-API-key initialization, the canonical Adyen test cards (Visa 4111 1111 1111 1111; 5454 5454 5454 5454 3DS frictionless; 4917 6100 0000 0000 3DS 2 challenge), the per-flow result codes (Authorised / Refused / Pending / RedirectShopper / Error), the HMAC-SHA256 webhook validation, and notifications-vs-API duality (Adyen separates synchronous API calls from asynchronous notifications). Use when testing Adyen-integrated code. Composes payment-flow-states-reference + 3ds-test-flow-reference.

Wraps Braintree (PayPal-owned) sandbox testing patterns: sandbox merchant credentials, Drop-in / Hosted Fields client-side patterns, the Transaction lifecycle (submitted_for_settlement → settled), Braintree's distinctive test-card behaviours (specific PANs trigger specific errors), and the webhook verification (Braintree Webhook Parser). Use when testing Braintree-integrated code. Composes payment-flow-states-reference + 3ds-test-flow-reference.

Workflow-driven skill that builds the chargeback / dispute test suite. Covers the canonical reason codes (Visa CB Reason Code 10.4 fraud / 13.1 services not provided; Mastercard MCC 4855; per-network code lookups), the per-gateway dispute API (Stripe Disputes; Adyen Chargeback notifications; PayPal Disputes API), the merchant-evidence-submission flow + window, the auto-evidence-collection patterns, and the disposition outcomes (won / lost / accepted). Use when designing dispute coverage. Composes payment-flow-states-reference.

Pure-reference catalog of payment lifecycle state machines across Stripe, Adyen, PayPal, and Braintree. Covers the canonical states (created / requires_action / processing / succeeded / requires_capture / canceled / failed), authorisation vs capture (separate vs combined), the asynchronous webhook states, refund / dispute / chargeback transitions, and the per-platform terminology mapping (Stripe PaymentIntent.status vs Adyen Authorisation/Capture vs PayPal Order). Use when designing tests for payment flows or auditing state-handling code. Composes 3ds-test-flow-reference.