Erycina selects a provider, verifies what that provider says, and records a fact. It never becomes your merchant of record.
The boundary
Erycina owns the commercial spine: tenants, products, immutable offers, orders, processor selection, checkout initiation, verification of provider notifications, and the normalised payment facts that come out the other end.
It does not own access. A verified provider event produces an idempotent, typed payment fact; that fact never directly unlocks media. Heimdall alone creates, refreshes, and revokes the signed entitlement claims that do. Erycina maps resources to the capabilities it requires and verifies those claims during protected delivery.
The separation is the point. A payment system that can also grant access will, eventually, grant access it should not have.
Immutable offers
The amount, currency, content class, and processor eligibility are fixed by the server in an immutable offer before a checkout begins. The client never supplies an authoritative price, and a replayed or edited request resolves to the same order it always did.
Browser checkout, API checkout, renewals, refunds, disputes, cancellations, imports, and replay all pass through the same driver verification and the same payment-fact commit. There is one path to a payment fact, not one per situation.
Providers
The driver scaffold covers CCBill, Segpay, Verotel, and Stripe.
The first three are first-class targets for explicit material. That ordering is deliberate. Most payment integrations in open-source projects are built around Stripe and then discover that the business they were built for is prohibited.
Stripe is included for creators selling material Stripe permits. It rejects explicit offers before any external request is made — not as a policy gesture, but because sending them would be a violation of your own agreement with Stripe, made on your server, in your name.
A payment adapter existing in Erycina does not mean a provider permits every use of that adapter.
You choose your providers. You sign their agreements, pass their underwriting, answer their identity checks, absorb their chargeback rules, and live with their geographic restrictions. Erycina holds credentials you supply and speaks the protocol; it has no relationship with your processor and cannot advocate for you when one goes wrong.
Tax
Erycina does not determine your tax obligations. Cross-border sales of digital services to consumers commonly trigger VAT or its equivalent where the buyer is, and physical goods are frequently treated differently again. The EU’s VAT One Stop Shop lets eligible businesses register in one Member State and report cross-border B2C supplies through it instead of registering in each.
If your instance collects money and pays it onward to other people, that is a materially different activity from being paid for your own work, and it deserves professional advice before the first transaction rather than after it. The responsibility checklist raises this explicitly.
Current state
The drivers exist with focused local contract tests. Trusted notification ingress, immutable order and payment-fact persistence, merchant onboarding, secret injection, registered notification endpoints, the Heimdall intake, and provider-specific integration tests do not.
Credentials in the shipped configuration are empty placeholders. Do not point this at real money yet.