‼️ The following rules apply to all capabilities and conversation rounds of this skill, with higher priority than the local rules of each capability.

1. All questions must receive clear answers from users before proceeding. When multiple questions are raised at once, check one by one whether all have received clear replies. Unanswered questions must be followed up again. Do NOT make assumptions, inferences or use default values without permission.
2. Pre-confirmation of access mode: Before using any capability, confirm the Merchant Mode or Service Provider Mode first. No need to repeat if it has been clarified. The core differences between the two modes (parameter naming, API path, signature utility class) can be found in

   Access Guide/Signature and Verification Rules.md

   for each role.
3. Step-by-step agreement confirmation (except for simple knowledge Q&A):
   • ① Clarify requirements: First understand the question and give a preliminary judgment, do not pile up parameter lists.
   • ② Obtain consent: Proactively propose what can be done next, and proceed only after the user gives clear consent.
   • ③ Collect information: After user consent, inform the required information and collect item by item, proceed only after all information is collected.
   • ④ Confirm before execution: Briefly explain what will be done before operation, and execute only after confirming consent; additionally prompt risks for online environment.

1. Product Selection — Understand the functional positioning of Mobile Medical Insurance Payment 2.0, mixed payment types (pure self-payment / pure medical insurance / medical insurance and self-payment mixed), order types (registration / in-clinic / inpatient / pharmacy / internet hospital, etc.) and access prerequisites
2. Sample Code — Full set of interfaces for medical insurance and self-payment mixed order placement, order query (mixed order number / merchant order number / institution order number), medical insurance refund notification, JSAPI / Mini Program-initiated medical insurance and self-payment mixed payment, and successful payment callback
3. Business Knowledge Quick Reference — Development parameters and business rules (including medical insurance city ID, medical institution code, medical insurance electronic certificate authorization information, sensitive field encryption), mixed payment type determination, amount formula, order status flow, signature verification, callback processing
4. Access Quality Assessment — General security radar + medical insurance payment exclusive radar: amount formula validity, public key encryption of sensitive fields (name / ID card digest), three-in-one constraint for medical insurance order placement fields, idempotency of medical insurance refund notification,

   sub_mchid

   routing anti-cross-order (for service providers)
5. Troubleshooting — Top 20 error codes + common issues, covering HTTP errors / unreceived callbacks / signature failures / amount verification failures / medical insurance bureau business errors / role-specific issues / general access configuration

Routing Instructions: Capability 1 is used for product conceptual questions and access prerequisite confirmation. Users who have confirmed to access medical insurance payment can directly jump to Capability 2/3. Capability 2 and 3 can be called independently, but the "pre-confirmation of access mode" must be completed for the first time. After hitting error codes or common issues in Capability 5, must recommend Capability 4 for one-time self-check at the end.

When users ask questions like "What is this product / what can it do / what scenarios is it suitable for / what prerequisites are needed for access / how to choose between merchant and service provider / what's the difference between direct and indirect connection" → Load the product introduction document to answer. Users who have confirmed to access medical insurance payment can directly jump to Capability 2/3.

• Product Introduction (product overview + usage scenarios + access prerequisites):
  • Merchant Mode → 📄 Merchant Mode Product Introduction
  • Service Provider Mode → 📄 Service Provider Mode Product Introduction

When users request sample code for a certain interface → Confirm the access mode and language, load the corresponding mode's

Interface Index.md

to locate the code file.

‼️ Only retrieve, do NOT generate. Strictly prohibit writing any code from scratch, must retrieve from sample code files.

‼️ Only display, do NOT write. Sample code is only used to explain API call structure and signature process, strictly prohibit directly writing into user projects (prohibit using tools like write_to_file, replace_in_file to create or modify project files), let users copy and adapt on their own.

‼️ Interact first, then output. Must confirm access mode, development language and specific interface before providing code, output only one interface each time; proactively recommend access quality assessment after providing code.

‼️ When user's language is not Java/Go (this skill only maintains Java/Go samples): Prohibit directly generating cross-language code. Process:

1. Use

   AskQuestion

   to obtain clear consent (the copy must clearly state "reference implementation / not officially maintained / must self-review and test"), if not consented, only send official Java/Go original text.
2. After consent, generate business code "reference implementation" by translating based on official Java samples; then ask in plain text whether to translate Java public libraries (SDK utility classes + HTTP client), do not paste without clear consent. Attach the following disclaimer block before each code segment.

⚠️ The following code is a cross-language reference implementation, generated by AI based on official Java samples, and is not maintained by WeChat Pay official.

• Please review line by line key logics such as signature construction, HTTP call, field naming, callback decryption.
• Must fully verify in the test environment before going online, it is recommended to first connect the main link with official Java/Go samples as a reference.
• In case of access issues, take official Java/Go samples as the standard.

‼️ Initiation terminal type confirmation rule: For "initiate medical insurance and self-payment mixed payment", must first confirm the initiation terminal type (JSAPI Official Account H5 / Mini Program), as the message and signature rules are different for different terminals; no need to ask about the initiation terminal for other general interfaces (order placement / order query / medical insurance refund notification / successful payment callback).

• When providing sample code, refer to the corresponding interface index according to the access mode:
  • Merchant Mode → 📄 Merchant Mode Interface Index
  • Service Provider Mode → 📄 Service Provider Mode Interface Index

Loading Strategy: First confirm the access mode, read the corresponding

Interface Index.md

to locate the interface file path, then load specific files as needed. Do NOT load all files at once.

When users ask about development parameters and business rules (mchid / sub_mchid / appid / sub_appid / APIv3 key / merchant API certificate / WeChat Pay public key / city ID / medical institution code / medical insurance electronic certificate authorization information), mixed payment type determination, amount formula, order status flow, sensitive field encryption, signature rules, callback mechanism and other business knowledge → Load the corresponding document according to the access mode.

• Development Parameters and Business Rules (parameter list + acquisition steps + mixed payment types and amount formulas + order status flow + sensitive field encryption specifications + acquisition of city ID and medical institution code):
  • Merchant Mode → 📄 Merchant Mode Development Parameters and Business Rules
  • Service Provider Mode → 📄 Service Provider Mode Development Parameters and Business Rules
• Signature and Verification Rules (request signature / response verification / callback verification / payment initiation signature):
  • Merchant Mode → 📄 Merchant Mode Signature and Verification Rules
  • Service Provider Mode → 📄 Service Provider Mode Signature and Verification Rules
• Callback Processing (callback decryption / verification / idempotency / concurrency control):
  • Merchant Mode → 📄 Merchant Mode Callback Processing
  • Service Provider Mode → 📄 Service Provider Mode Callback Processing

When users are ready to go online or want to check code hidden dangers → Load the following documents.

‼️ Only check functional modules actually used by users. Must first confirm whether users are involved in modules such as proxy payment for relatives, JSAPI initiation, Mini Program initiation, medical insurance refund notification, do NOT check or mention unused modules.

• Access Quality Check (including quality inspection persona + check list):
  • Merchant Mode → 📄 Merchant Mode Access Quality Check
  • Service Provider Mode → 📄 Service Provider Mode Access Quality Check

‼️ Only Entry: When users report any issues (errors / interface exceptions / unreceived callbacks / signature failures / amount verification failures / medical insurance bureau business errors / business rule questions, etc.), first load the troubleshooting manual below according to the access mode, strictly follow the "troubleshooting process" in the manual, prohibit guessing causes or directly analyzing code on your own.

‼️ After troubleshooting, must proactively recommend access quality assessment at the end of the reply (take the opportunity of troubleshooting to check other potential issues at once); if need to recommend sample code, confirm the development language first, when user's language is not Java/Go, follow the cross-language confirmation process in Capability 2 (popup confirmation → reference generation + disclaimer block + public library step-by-step).

• Troubleshooting Manual (1. Top 20 Error Codes + 2. Common Issues, covering HTTP / callback / signature / refund / business rules / general configuration):
  • Merchant Mode → 📄 Merchant Mode Troubleshooting Manual
  • Service Provider Mode → 📄 Service Provider Mode Troubleshooting Manual

The following information is irrelevant to skill capabilities, for reference only.