Signed receipts and audit.

A dashboard tells you what a server chose to display. A signed record tells you what actually happened, and lets you prove it later without asking anyone. Each receipt embeds an audit record signed with an ed25519 key, plus the public key to verify it. The signature covers the decision, so a receipt cannot be edited after the fact without breaking it.

The record binds the identities involved into one chain of custody: the principal's KYC reference, the agent, the exact mandate, the beneficiary, and the payout order. A mandateHash ties the receipt back to the precise signed mandate that authorised it, so a receipt and its mandate always agree.

{
  "status": "settled",
  "outcome": "proceed",
  "mandateId": "mnd_9f2c8a1b",
  "kotaniOrderRef": "kot_7781",
  "customReference": "groceries-jul",
  "simulated": true,
  "quote": {
    "payerSends": 111.40,
    "feePct": 0.027,
    "recipientAmount": 2000,
    "expiresAt": "2026-07-14T08:20:00Z"
  },
  "audit": {
    "auditId": "aud_5b2e",
    "emittedAt": "2026-07-14T08:12:00Z",
    "chain": {
      "principalKycRef": "kyc_01HZX9",
      "mandateId": "mnd_9f2c8a1b",
      "agentId": "agent:household-ops",
      "beneficiaryRef": "gogo-checkers",
      "kotaniOrderRef": "kot_7781"
    },
    "mandateHash": "sha256:4d9f2a...",
    "corridor": "ZAR:ZA",
    "amounts": { "recipient": 2000, "currency": "ZAR" },
    "outcome": "proceed",
    "simulated": true,
    "signature": {
      "alg": "ed25519",
      "publicKey": "302a300506032b6570...",
      "value": "c71a9f..."
    }
  },
  "auditPublicKey": "302a300506032b6570..."
}

Verify the audit record against auditPublicKey. The chain block is the answer to the question a dispute really asks: which authority was exercised, and for whom.

This is what a control plane usually sells as two separate dashboards. Here they are one artefact. Observability is the signed record of every settlement. Disputes are resolved by pointing at that record: it names the purpose the payout was declared for, the beneficiary it reached, and the mandate that permitted it.

The simulated field is always present and always surfaced. It states plainly whether the payout was a real-funds settlement or a sandbox run, and it stays true until the licensed payout integrator is live in production. A receipt never pretends to be more than it is.