Commerce Integrity Auditor for Ecommerce in Taiwan

E-commerce CIA (Commerce Integrity Auditor) is a specialized diagnostic tool for developers building or maintaining transactional systems. It solves the "silent death" problem—where every individual function returns a success code while the integration layer between them fails, resulting in lost orders, double-charged customers, or ghost inventory. It maps your codebase onto a cybernetic model (Viable System Model) to detect cross-boundary invariant violations that standard unit tests miss.

What it does

• Cross-Boundary Sweeps executes 24 specialized checks for temporal coupling, race conditions, and semantic drift between your shop and payment gateways.
• Closed-Loop Verification drives real browser walks to ensure every action (checkout, refund, pickup) has a visible feedback surface and consistent state across customer and admin views.
• Sandbox Stress Testing performs automated end-to-end walks through provider sandboxes (Stripe, Adyen, NewebPay, ECPay, etc.) to verify callback integrity.
• State-Delta Ladders measures arithmetic correctness across observers, ensuring database rows, admin screens, and gateway logs agree on the exact quantity moved.
• Detector Roll Calls audits your internal safety nets to ensure jobs like settlement reconciliation actually report coverage and haven't gone blind.

How it works

1. Discovery scans your repo for payment integration roots, test runners, and sandbox credentials.
2. Sweep maps the system architecture and runs the doctrine-specific integrity checks (S1-S24).
3. Walk executes automated browser and sandbox round-trips to generate proof-of-work artefacts.
4. Report produces a numbered audit with evidence ledger rows, grading findings by severity and consequence.

Frameworks & tools

Works with any transactional stack using Stripe, Adyen, NewebPay, ECPay, PayUni, TapPay, or LINE Pay. Supports automated verification via Playwright, Docker, and standard test runners like PHPUnit, Pest, or Jest.

Why this beats prompting it yourself

Generic AI audits focus on syntax and local logic. This skill enforces a hard "Nothing Dies Silently" law, hunting for specific emergent defects—like a gateway callback that 200s but fails to update an order—that require mapping state across three or more disconnected systems.

Use cases

• Auditing a checkout flow before a high-traffic launch.
• Hardening a payment gateway integration against race conditions and TOCTOU bugs.
• Verifying compliance and transactional integrity for a handoff to a new maintainer.
• Debugging "ghost" order status changes that leave no trace in the error logs.

Known limitations

Does not perform production gateway calls. Requires valid sandbox credentials for E2E walks. Analysis depth is budget-capped by the selected Tier (Screen vs. Walk vs. Full).