Repository navigation
Add post-integration management (go-live, ops, diagnostics, support) … - #15
Merged
Merged
Conversation
…and fix audit issues
Post-integration coverage (v3.4.0):
- New references/post-integration.md: Paymob's 9 go-live stages, merchant-side
go-live checklist, wizard go-live document upload, Dashboard operations
(transactions, orders, quick links, users & roles), refunds in ops, balances,
disputes, monitoring + daily reconciliation, symptom->tool diagnostics,
support channels + redacted ticket template, key rotation and post-launch changes.
- SKILL.md: Phase 4 routing, capabilities menu rows, new troubleshooting rows.
- live-resources.md: full Integration Wizard catalog (Code Lab, Postman export,
Virtual Showroom, account tools, go-live docs, HMAC Signature Troubleshooter,
Store Check at /store-doctor/, Mobe, Contact Support, feedback).
- New commands: /paymob-go-live-check, /paymob-support-ticket.
- universal-prompt.md, AGENTS.md, README, manifests synced.
Fixes:
- Checkout samples priced orders from the browser request; all backends now
load amount/items server-side, share one request/response contract with the
frontend, and the Pixel sample calls an endpoint that exists.
- universal-prompt Python HMAC used str(bool) -> "True" (always mismatched).
- Timing-safe compares could throw on length mismatch (Node, Python, card-token,
subscription samples).
- Python missing `import os`; .NET intention id parsed as Int64; .NET missing
System.Net.Http.Json and IOrderRepository DI; React return page missing hooks
and fell back to Paymob order_id; Ruby duplicate heading; CSRF skipped on
browser-facing checkout (Rails/Django).
- country "EG" -> "EGY"; {base_url} defined without trailing slash; idempotency
key wording aligned to obj.id; refund/void table unified; dashboard key path;
dangling intention-api.md reference; HMAC null-value note; stray README tag.
- /paymob-check-hmac: checks for safe compare, stringification, hmac location.
- validate.py: new cross-reference checks (references listed in SKILL.md,
backtick reference mentions resolve, commands documented/exist, README versions).
OmarAboulMakarem
approved these changes
Oct 4, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add post-integration management (go-live, operations, diagnostics, support) — v3.4.0
Why
The skill stopped at "first test payment passed". Merchants also need help going live, running the integration day to day, diagnosing problems with Paymob's own tools, and getting support. This PR adds that, and fixes the gaps and bugs found in an audit of the existing plugin.
What's new
references/post-integration.mdlive-resources.md: Code Lab, account tools, go-live docs, HMAC Signature Troubleshooter, Store Check (/store-doctor/), Mobe, Contact Support.SKILL.md: Phase 4 routing, capabilities-menu rows, new troubleshooting rows./paymob-go-live-check: read-only readiness audit./paymob-support-ticket: drafts a redacted ticket and routes it to the right channel. It files through MCPcreate_support_ticketonly after explicit confirmation.universal-prompt.md,AGENTS.md, README and manifests, bumped to 3.4.0.Fixes
universal-prompt.md: booleans were stringified as"True", so verification always failed.hmac. They now check length first (Node, Python, card-token and subscription samples).import os.System.Net.Http.Json, and had no DI registration for the order repository.countryis nowEGYeverywhere (wasEGin one sample).{base_url}is defined as the full origin without a trailing slash.obj.id.intention-api.mdreference is fixed./paymob-check-hmac: now also checks safe comparison, value stringification, and where thehmacis read from.validate.py: new cross-reference checks:SKILL.mdTesting
python3 scripts/validate.pypasses.Please review
post-integration.md) against the live site.