Registration & KYC -- The Seams

The design says what to build; this says where it can move. A map of every contract the redesign must live within — the shared DTO, the shared database objects, and the cross-service HTTP calls — each labelled fixed (changing it is a cross-repo or prod migration), flexible (reshapeable inside axis), or branch-soft (unreleased on feat/246 — shape it before it merges). Every claim is verified against axis / platform-core / core / .NET source, and the live prod schema.

• The DTO looks like the hard seam — but it's soft with an ordered rollout. The PaymentCard fields requiresKyc / kycLocked / deferredLoadAmount pass through the .NET tier unbranched and are branched on by two Angular UIs. But every branching consumer is our code, so the names/meanings are reshapeable via expand/contract.
• The prod schema is small and confirmed.cpm.payment_card.{kyc_locked, requires_kyc}, cpm.kyc_lock (7 columns, no initial_funded_date), core.program_configuration flags.
• The HTTP calls the design needs already exist — the release endpoint (overloaded), the verdict read, the cardholder forward. One carries a live cross-tenant IDOR.
• The big lever is unreleased. core's entire KycLock machinery + initial_funded_date are branch-only (PR #273, open) — prod-confirmed absent. This is the co-design window.
• One framing correction: platform-core owns no database schema — no migrations, no entities. The lock tables are axis-owned.
• The seam to watch:feat/246 makes core read & write axis's cpm.kyc_lock directly — the opposite of the design's "axis is sole owner." Resolve before #273 merges.

Every seam below carries one of these. The whole point of the map is which bucket each object is in.

platform-core PaymentCard — looks like the hardest seam — but soft via expand/contract, because every branching consumer is ours.

The three lock fields — response-only, released

Where the fields are produced — all axis, all flexible

 // axis PaymentCardEntity.toPaymentCardDTO(accessLevel) :359 dto.setRequiresKyc(getRequiresKyc()); // :392 dto.setKycLocked(isKycLocked()); // :393 dto.setDeferredLoadAmount( getDeferredAmount(getId())); // :397, from KYC_LOCK // getRequiresKyc() :520 -- the D4 "lie" if (this.requiresKyc == null) return KycLockService.isKycRequired(this); // kyc flag ALONE -- reg-only card reads false

Consumers — the .NET tier is pipes; the Angular UIs are the sinks

The card-status enum — no "pending" value

Constants.CardStatus (platform-core) is a processor mirror: Activated, Blocked, Suspended, Risk, Stolen, Lost, Expired, NotActivated, Fraud. There is no "pending verification" value. The design's choice holds: keep verification off the status enum (it's a separate concern, modelled as the pending-activation record).

Three tables across two schemas. Columns confirmed against setldpay_prod.

cpm.kyc_lock — axis-owned (prod: 7 cols, 39,931 rows)

cpm.payment_card — axis-owned (prod: 1,857 kyc_locked)

core.program_configuration — core-owned, axis reads cross-schema

What actually runs in prod — the config space is tiny

The cross-service calls the design needs — all already exist.

Release — core → axis & card-balance-api → axis

One endpoint, overloaded on personUuid. POST /api/cpm/v1/partners/{partnerExtId}/kyc/inquiries/verifyIndividual → KycInquiryHandler.onVerifyIndividual.

 // onVerifyIndividual :38 if (req.getPersonUuid() != null && !req.getPersonUuid().isEmpty()) { // RELEASE branch PaymentCardEntity card = PaymentCardEntity.findById(cardId); // :47 -- UNSCOPED (the IDOR) activateAndLoadCard(cardId, card); // un-suspend + replay parked load } else { // INQUIRY branch: KycInquiryValidator + screening/comprehensive (no money) }

Verdict — axis → core

The "is this person verified, to what level" read — already wired, already used. This is the channel for the design's amount-aware, never-cached verdict check.

 GET /core/api/v1/{partnerExternalId}/person/{uuid} // core PersonController.getPerson :135 -> GetPersonResponse kycResults: List<KycResultDTO> { status: KycStatus, kycLevel: KycLevelEnum, validFrom, validUntil }

Everything core-side is unreleased. PR #273 open. Prod-confirmed absent.

core-service on feat/246-card-expiry — 12 ahead, 0 behind, PR #273 OPEN

Each flow, and exactly which seam it touches — and in which bucket the change sits.

The pattern: every flow is axis-internal except where it touches core — the verdict read (already wired) and the replacement/transfer path.