v23 Production — sudanna.ai/s26/

🇸🇩 سودانا — بوابة المطورين

AI Brain · Telemedicine · StepController · Subscription Engine

Designed for national-scale deployment · Government integration · NGO & institutional usage

Get API Key →

🟢 حالة النظام اللحظية

جاري تحميل حالة النظام...

🧪 Live Execution Trace — Real Example

Actual execution path for: "عندي ألم في الصدر"

REQUEST
POST /s26/api/visitor_ask.php
Content-Type: application/json

{
  "question": "عندي ألم في الصدر"
}
EXECUTION TRACE
Gateway::handle()
  → revenueGate(plan_key=free)    ✅
  → IE(554 rules) → conf=0.72     (no direct answer)
  → detectService: medical         ✅
  → PDE: REAL + mandatory          ⛔
  → HARD GATE triggered
  → tryStartFlow(medical_tele_v1)  ✅
  → StepController.start()
  → flow_session created (DB)
  → createMedicalCase() pending
DB WRITES
INSERT → flow_sessions
  session_id: abc123...
  flow_id: medical_telemedicine_v1
  status: active
  current_step: intake_symptoms

(after triage)
INSERT → medical_records
  user_id, symptoms, triage_level
  specialization, session_id
RESPONSE
{
  "success": true,
  "source": "flow",
  "blocked_ai": true,
  "medical_context": true,
  "flow": {
    "session_id": "abc123...",
    "step": "intake_symptoms",
    "progress": {
      "current": 1,
      "total": 7,
      "pct": 14
    }
  }
}
blocked_ai: true — Gateway never called AIClient for this request. StepController has full control. No AI answer was served or possible.
This is a real execution path from Sudanna Engine v23 — not a mock or simulation.

📊 إحصائيات اليوم

🗄️ حالة الجداول

🤖

Sudanna Dev Assistant

Local · No API
مرحباً بالمطور 👋 أنا مساعدك الذكي لفهم منصة سودانا.
بدء flow طبي Hard Gate listing_boost blocked_ai

💳 Payment API — نظام الدفع الثنائي

سودانا تدعم طريقتي دفع تنتهيان بنفس pipeline:

1️⃣ أوفلاين (تحويل بنكي)

POST /api/payment/create_invoice
{
  "service": "legal",
  "amount": 500,
  "user_id": 123
}

→ رفع إيصال → Admin يوافق → payment.confirmed

2️⃣ أونلاين (Gateway)

POST /api/payment/webhook.php
Headers:
X-Webhook-Signature: sha256=...

{
  "reference_code": "SD-123-LEG-20260425-A1B2C3",
  "transaction_id": "TXN_789",
  "amount": 500,
  "gateway": "local_gateway",
  "status": "success"
}

→ تحقق التوقيع → تحقق المبلغ → payment.confirmed

📊 Unified Pipeline

payment.confirmed (offline OR gateway)
  → QueueEngine::enqueue()
  → Worker → AIOrchestrator
  → TaskEngine::postConfirm()
  → INSERT notifications ✅
  → FinancialAgent::confirmPayment()
  → 4 ledger entries (debit=credit) ✅

🔐 Webhook cURL Example

curl -X POST https://sudanna.ai/s26/api/payment/webhook.php \
  -H "Content-Type: application/json" \
  -H "X-Sudanna-Sign: sudanna_test_webhook_2026" \
  -d '{
    "reference_code": "SD-1-LEG-20260425-TEST",
    "transaction_id": "TXN_TEST_001",
    "amount": 500,
    "gateway": "test",
    "status": "success"
  }'

📈 Payment Status Tracking

GET /api/payment/status.php?ref=SD-1-LEG-20260425-A1B2C3

Response:
{
  "reference_code": "SD-1-LEG-20260425-A1B2C3",
  "status": "paid",
  "amount": 500,
  "paid_at": "2026-04-25 10:33:00",
  "method": "offline",
  "ledger_balanced": true
}

🔒 Payment System — Production Rules

1. الإيصال (Receipt)

كل دفعة مؤكدة تُنشئ تلقائياً سجلاً في payment_receipts برقم تسلسلي RCP-YYYYMMDD-NNNNNN. الإيصال مرتبط بالفاتورة و4 القيود المحاسبية. لا يمكن إنشاء إيصالَين لنفس الفاتورة (UNIQUE invoice_id).

2. البريد الإلكتروني

عند تأكيد الدفع، يُرسَل بريد تلقائي من finance@sudanna.ai يحتوي: رقم الإيصال، المبلغ، الرمز المرجعي، وقت الدفع، رابط الإيصال الرقمي.

3. أمان الـ Webhook

لا يوجد bypass أو test mode في الإنتاج. التحقق من التوقيع HMAC-SHA256 إلزامي. الـ WEBHOOK_SECRET يُولَّد من JWT_SECRET عند الإعداد.

X-Webhook-Signature: sha256={HMAC-SHA256(body, WEBHOOK_SECRET)}

4. انتهاء صلاحية الفاتورة

الفاتورة تنتهي بعد 48 ساعة. الـ cron يُلغيها تلقائياً كل 6 ساعات. المستخدم يستلم إشعاراً عند الانتهاء ويجب إنشاء فاتورة جديدة.

States

pending → proof_uploaded → under_review → paid ✅
pending → rejected ❌ (admin أو انتهاء صلاحية)
paid → refunded ↩️
) -->

🏗️ System Architecture

1. Client → AI → Bank Flow

Client AI Layer Risk+Fraud+Limits Orchestrator D→P→C→T→G Bank Adapter NO_CUSTODY Bank Core Source of Truth FinancialAgent Ledger+Receipt EventBus →Queue→Worker webhook

2. Payment Flow — Dual (Offline + Gateway)

Invoice Created (reference_code UNIQUE)
         │
    ┌────┴────┐
    │         │
OFFLINE    GATEWAY
    │         │
Transfer   Gateway
Bank Proof  Webhook
    │         │
Admin       Signature
Review       Verify
    │         │
    └────┬────┘
         │
FinancialAgent::confirmPayment()
  ├── 4 Ledger entries (DEBIT=CREDIT)
  ├── Wallet balance updated
  ├── Receipt generated (RCP-YYYYMMDD-NNNNNN)
  └── Email → finance@sudanna.ai
         │
EventBus("payment.confirmed")
  └── Queue → Worker → TaskEngine
        ├── notification to user
        └── kpi_daily updated

3. Decision Gate — AI Pipeline

Request (amount + user_id)
    │
    ├── RiskEngine.assess()     → risk_level: low/medium/high/critical
    ├── FraudGraph.check()      → is_fraud: true/false
    ├── SmartLimits.check()     → allowed: true/false
    └── CashFlowEngine.canAfford() → can_afford: true/false
                │
    MOST RESTRICTIVE WINS
                │
    ┌───────────┴───────────┐
  BLOCK                  ALLOW
(403)                  (200)
                          │
                    Execute Service

4. Reconciliation — Bank ↔ System ↔ Ledger

Daily at 2:30 AM (cron)
        │
ReconciliationEngine::run(date)
  ├── System: SELECT paid invoices WHERE DATE=?
  ├── Ledger: SUM(debit), SUM(credit) WHERE DATE=?
  └── Bank: BankAdapter::getStatement(from, to)
        │
  ┌─────┴─────┐
PASS         FAIL
  │           │
  ├── Log     ├── Alert Admin (notification)
  │           ├── BLOCK all payouts for date
  │           └── Log audit_logs (immutable)
  │
Settlement ALLOWED (3:00 AM)
  └── SettlementEngine::processDate(date)
        ├── ReconciliationEngine::isPassed(date) → GATE
        ├── provider_earnings WHERE status=pending
        ├── BankAdapter::initiatePayout()
        └── Ledger: DEBIT Provider(2002) CREDIT Cash(1001)

5. Accounting — Double-Entry Ledger

Payment Received (1000 SDG):
  DEBIT  Cash(1001)           1000  ← money enters
  CREDIT UserLiability(2001)  1000  ← owed to user
  DEBIT  UserLiability(2001)  1000  ← settling
  CREDIT UserWallet(1002)     1000  ← wallet funded
  ─────────────────────────────────
  SUM(debit) = 2000 = SUM(credit) ✅

Settlement Payout (900 SDG to provider):
  DEBIT  ProviderLiability(2002) 900 ← paying out
  CREDIT Cash(1001)              900 ← money leaves
  ─────────────────────────────────
  BALANCED ✅ — Sudanna never holds

6. Revenue Streams — All Through Ledger

Stream              Rate    Ledger Account    Trigger
────────────────────────────────────────────────────
Service Commission  10%     Revenue(4001)     booking.completed
Payment Fee         0.5%    Revenue(4001)     payment.confirmed
Subscription        Fixed   Revenue(4002)     subscription.paid
API Usage           /call   Revenue(4002)     api_engine.used
Provider Listing    Fixed   Revenue(4001)     listing_boost

ALL revenue:
  ✔ goes through ledger
  ✔ linked to invoice_id
  ✔ reconciled with bank
  ✔ auditable (trace_id)

7. Production API Endpoints

Endpoint MethodSLAAuthPurpose
/api/decision/check POST<100msSessionAI decision gate
/api/cashflow/summary GET<200msSessionSpending analysis
/api/limits/check POST<50msSessionLimit validation
/api/fraud/check POST<100msSessionFraud detection
/api/payment/webhook POST<2sHMACGateway webhook
/api/payment/status GET<200msPublicPayment status
/api/reconcile/run POST<5minAdminTrigger reconcile
/api/payout/process POST<30sAdminTrigger settlement

8. System Principles + SLA

Principle          Definition
──────────────────────────────────────────────────────
NO_CUSTODY         Sudanna never holds money (shadow ledger only)
DEBIT_ONLY         No credit/loans ever extended
BANK_SOURCE        Bank statement wins on any mismatch
IDEMPOTENT         Every operation safe to retry
EVENT_DRIVEN       All state changes via EventBus
AI_CONTROLLED      AI gates every payment decision
AUDITABLE          trace_id on every action, immutable logs

SLA
──────────────────────────────────────────────────────
Decision check     < 100ms
Webhook confirm    < 2s
Full payment       < 5s
Email dispatch     < 10s
Reconciliation     < 5min (daily)
Settlement         after reconciliation PASS