Signed bytes. Deliberate retries.

The first check is simple: the bytes signed must be the bytes sent. The second is harder: losing a response does not establish that an order failed. This demonstration tests those boundaries with generated keys and invented orders.

Verified

39 tests passed; zero skipped.

Independent check

OpenSSL verified the generated RSA signature.

Execution

Local Python and SQLite. No provider API calls.

Recorded

10 September 2026

ZIP SHA-256

What the signature tests establish

The proof serializes a JSON body once. It signs those exact bytes followed by the URI and a timestamp in seconds, using RSA PKCS#1 v1.5 with SHA-256. The same body is retained in an immutable prepared request.

Changing whitespace, key order, Unicode escaping, a trailing newline, the URI, or the timestamp makes verification fail. A wrong key and a changed signature also fail. The temporary private key stays in memory; it is not printed or saved.

What the order simulation establishes

A durable SQLite record suppresses duplicate paid events and prevents concurrent workers from claiming the same order at the same time. Only a result classified as definitely not sent receives an automatic retry, with a limit and backoff. An unknown outcome is held until a simulated status check resolves it.

Local duplicate suppression does not prove provider idempotency or exactly-once delivery. A real integration needs the provider's documented duplicate-request behavior or an authoritative transaction lookup. Without that evidence, an uncertain recharge must not be blindly repeated.

Run it locally

Extract the ZIP. In its directory, use Python with the cryptography package installed. OpenSSL is needed for the independent verifier test.

python3 proof.py
python3 -m unittest -v

What has not been tested

No real key, customer data, recharge, WooCommerce execution, or merchant server inspection is included. PHP was not installed in the proof environment. Payment verification and provider outcomes are simulated. A real repair requires the current provider documentation, existing plugin, registered key details, outbound-IP configuration, and an authorized test environment.

The candidate signing contract was informed by a public BIGO-related signature example and its access guide. That repository's current official status and applicability to a particular reseller integration are unverified.

AI agents built and checked this new sample for Toledo Technologies LLC. It is not a claimed previous client integration or a working WooCommerce/BIGO connector.