TJ Provider Verify Manual review

Provider Verification Room

Buyer noteNot proof ProviderHuman review DeliveryEvidence gated

Manual provider dashboard review before paid or delivered.

This private room closes the dangerous gap after a buyer submits a redacted payment confirmation or a Webhook Quarantine event arrives. The operator verifies PayPal, Wise, Payoneer, WeChat Pay, or Alipay in the provider dashboard, records only safe redacted evidence, then decides whether the order stays pending, moves to review, or can be marked paid manually.

Review methods Evidence template Buyer confirmation Webhook quarantine Fulfillment desk
01Match order 02Match amount 03Check status 04Redact proof 05Decide 06Deliver
No provider login from this page Webhook Quarantine is review evidence only No raw dashboard screenshots No tokenized links or QR payloads No money movement
Premium fulfillment evidence suite with payment review, delivery proof, and status lanes
Manual provider dashboard review Buyer text is intake, not settlement Only provider state can clear the paid gate
Redaction rule Record the decision, not the secret Safe tails, safe labels, no balances
Provider verification keeps the first order from being shipped on a fake receipt while still keeping secrets out of the product archive.

Manual provider dashboard review

Match the payment, then redact the evidence.

Each provider has different labels, but the operator decision uses the same rule: order reference, amount, currency, payer label, timestamp, provider status, settlement risk, and redacted evidence location must line up before delivery.

PayPal

Match transaction status and payer label.

Check order id or invoice note, gross amount, currency, payer email label, received time, status, dispute/hold indicator, and fee/net amount when safe. Store only a redacted reference tail such as `PAYPAL-1234`.

Wise

Match transfer receipt and settlement state.

Check payment request or transfer reference, amount, currency, sender label, received or processing state, expected availability, and any cancellation or reversal warning. Do not capture balances or full account details.

Payoneer

Match payment request and availability.

Check payment request id tail, payer company label, amount, currency, paid/processing/held state, fee/net when visible, and withdrawal availability. Keep full request ids and dashboard URLs out of source and chat.

WeChat Pay

Match order note and receipt time.

Check buyer order id note, RMB amount, payer nickname label, receipt time, merchant ledger status, refund/dispute flags, and settlement state. Do not store QR payloads, full transaction ids, or personal phone numbers.

Alipay

Match merchant order and fund state.

Check merchant order note, amount, currency, payer label, paid time, settlement or risk-control state, and refund/dispute flags. Do not paste full screenshots, account balances, or full payment serial numbers.

Do not capture

Keep private dashboards private.

No full screenshots, account balances, full transaction ids, bank/card/account numbers, provider tokens, tokenized links, QR payload internals, raw phone numbers, or secret environment values.

Redacted evidence template

Record the facts needed to defend the delivery decision.

01orderIdInternal order reference, not provider secret.
02providerPayPal, Wise, Payoneer, WeChat Pay, or Alipay.
03amount / currencyMust match quote, invoice, and checkout context.
04payerLabelRedacted email, nickname, company, or buyer label.
05safeReferenceTailLast 4-6 visible chars only, such as `PAYPAL-1234`.
06providerStatusConfirmed, processing, held, disputed, not found, or needs review.
07verifiedAt / verifiedByManual review timestamp and operator name.
08evidenceLocationPrivate local folder or ticket path with redacted proof only.
09operatorDecision`payment_pending`, `needs_review`, `paid_manual`, or `fulfilled`.
10remainingRisksHolds, disputes, pending settlement, refund window, or missing intake.

Webhook Quarantine

A callback is not a paid decision.

The webhook lane records `provider_webhook_quarantined` events from a redacted bridge. It does not update order status, verify provider funds, unlock delivery, activate real provider webhooks, or move money.

Endpoint

/api/provider-webhook

Requires `PROVIDER_WEBHOOK_TOKEN` and accepts only redacted event envelopes. Raw provider payloads are rejected.

Packet

npm run webhook:packet

Packages the quarantine contract, smoke-test map, stop gates, and local evidence that webhook events stay under manual provider review.

Decision

Still manual

Only the operator review path can move an order to `paid_manual` or `fulfilled`; webhook evidence alone keeps the order pending or under review.

Decision ladder

What the operator is allowed to mark.

Not found or mismatched amount: keep `payment_pending` and ask for corrected buyer confirmation. Found but held, disputed, pending, or unclear: set `needs_review`; no delivery. Found, matched, settled enough for your risk rule: set `paid_manual` with redacted evidence location. Only after paid_manual plus intake and delivery evidence: set fulfillment `delivered` and use delivery kit.