# Why a payment was paid

> One payment's evidence, link by link from the purchase order to the receipt: how each fact is known, the signatures checked in your browser, the download, and who can see it.

Every payable and every contractor milestone has one page that says why it was paid: what was agreed, what was delivered, the bill, the payee, the decision, the people who stepped in, the payment, the receipt and the signatures, link by link. Each fact on it says how it is known, so what code or someone outside Vestiarion checked stands apart from what a person only stated. Every member of the workspace can read it, viewers included. It works the same on Arc testnet and on Arc mainnet.

## Open it

- **From a card.** On **Bills & receivables**, open a bill by its name: its card's footer links **Why it was paid** once it is paid, and **Evidence so far** before. A milestone's card on **Contractors** links it the same way, and so does a payable's card on **Treasury**.
- **From the decision trail.** At the foot of a payable's **How the agent decided**, **The whole chain, from purchase order to receipt** opens the same page.
- **Not for receivables.** The page is about money the workspace pays: a receivable has none.

The page belongs to its record's section: the sidebar and the header name **Bills & receivables** for a payable and **Contractors** for a milestone, and the section in the header leads back there. Its address names the record, not a payment attempt, so it stays the same once the record is paid.

A payable or milestone not paid yet shows its chain so far and says "Not paid yet. This is the chain so far, read-only: nothing on this page pays, approves or changes anything." A bill a person rejected says "Not paid: a person rejected this bill." One paid by a simulated transfer, in a sandbox workspace, says "Paid in a simulation: nothing moved on chain. This is its evidence as it stands.", and its status reads **Paid in a simulation**.

A bill paid early, with its early-payment discount, names what was paid beside the bill: the line under the title reads, for example, "98.00 USDC to Northwind Hosting, for a 100.00 USDC bill less its early-payment discount", and the box about the record shows the bill's **Amount** and what was **Paid**.

## How each fact is known

Every fact carries one of seven labels, in words with an icon beside it, never told by colour alone. The box **How each fact is known** explains them, strongest first, and counts how many of the chain's facts each holds:

| Label | What it means |
|---|---|
| **Verified outside** | Someone outside Vestiarion answered: the chain's record of the transaction, GitHub, the screening service. |
| **Checked by code** | A rule Vestiarion runs computed it: the three-way match, the guardrails, a signature, the written policy. |
| **Stated by a person** | A member or the payee entered it. The page names who, and when. |
| **Inferred** | Read, not recorded: the model's judgement, sample data, or a setting as it is today. |
| **Missing** | Nothing records it. Where it can still be added, the page says how. |
| **Could not open** | A check got no answer, or a link can't be opened (deleted, private, refused or expired): it never counts as verified. |
| **Does not match** | A check answered, and its answer contradicts the record. |

As the box says, "Each link reads as its weakest fact, so it is never labelled above what its least-supported fact is." A label comes from where a fact came from, never from the entry that recorded it: goods a person marked received stay **Stated by a person**, though the entry that records them is signed.

## The links, in order

![The evidence page of a paid bill, titled Why it was paid, with the line October design retainer: 12.50 USDC to Northstar Studio. Each link says how it is known, and where it came from. Two of its links: 5, The decision, reads as Inferred: Inferred, DeepSeek decided to pay it, as the written policy would, the model's judgement from the facts it was given; then Checked by code, Code checked it before anything was sent, with each check passed, each fact with its time and entry 45, and the link How the agent decided, step by step. 7, The payment, reads as Checked by code: Verified outside, Paid 12.50 USDC to the payee on Arc testnet, the block that holds the transfer, and The transaction marked Checked by Vestiarion; then Checked by code, Entry 45 records this transaction.](https://www.vestiarion.xyz/docs/guides/evidence-chain.png)

*Each fact with its label, when it was recorded, and the entries it rests on; a link reads as its weakest fact.*

1. **What was agreed**: the purchase order on the bill, who entered it and when, or that the counterparty is marked as paid without purchase orders. For a milestone, its terms (title, amount, payee) and who added them: on **Contractors**, through the API, or as a bounty on GitHub.
2. **What was delivered**: the goods or services marked received, by whom and when. For a milestone, the merged pull request GitHub reported, which is **Verified outside**, or a person's verification by hand with the link they gave. For work [accepted from Asana](https://www.vestiarion.xyz/docs/guides/asana), Asana's word that the task was completed, **Verified outside**, beside the person who accepted the work against its criteria; an acceptance taken back because the task was reopened or changed reads **Missing**.
3. **The bill**, for a payable only: who added it and from where: the invoice form, a document a model read (with the document's SHA-256; the document itself is not kept), a list imported with **Import a list** (with the row it came from and the list's SHA-256; the list itself is not kept), an email, Telegram, Slack, the API, or a recurring payment. A bill written in another currency in shadow mode states its amount as written, which is the person's fact; converting it to USDC is a separate fact, **Checked by code**, with the rate, who published it and on which day.
4. **The payee**: the address paid; who gave it (a member, the payee through their payee link or on GitHub, or a mirror address Vestiarion made in shadow mode) and who confirmed it; the screening result before the payment and its source; and any screening match a person dismissed.
5. **The decision**: who decided, the model by name or the written policy, and whether the written policy agreed; then what code checked before anything was sent, worded as the decision trail words it. The model's judgement is **Inferred**: it decides from the facts it was given. **How the agent decided, step by step** opens the trail on **Bills & receivables**.
6. **People**: approvals, a first of two approvals, verdicts in shadow mode, returns and rejections. When nobody stepped in, it says "No person approved it: code let the agent pay it within the workspace's rules."
7. **The payment**: the transaction on the chain it was made on, linked to its explorer. When the page opens, Vestiarion reads that chain's own record of the transaction: it is **Verified outside** when the record holds a transfer of the amount to the payee, **Does not match** when it does not, and **Could not open** when the chain did not answer. A payment made in shadow mode says it mirrors a bill the business paid its own way. A bill paid early says what the early-payment discount took off it, citing the entry that recorded the discount. Then the entry that records the transaction. A payment that did not go through says so in words, never calling a payment that may still settle a failure: "Outcome unknown" when Circle did not answer its send, "Not sent" when it stopped before Circle took it, "Gateway reported it failed" when it may still be minted, or that Circle ended it, with where to act: Approvals for a payable, Contractors for a milestone, or the agent's next cycle while it comes back to the bill. See [When a payment does not settle](https://www.vestiarion.xyz/docs/guides/payment-exceptions).
8. **The books**, for a payable brought in from Xero only: its payment booked against the bill in Xero. Once Xero answered when Vestiarion read it back, it is **Verified outside**, with the payment's id in Xero and who approved the booking; sent and not read back yet, it is **Could not open**; waiting for an owner or admin to approve it, **Missing**. A payment on Arc testnet or in shadow mode is never booked into a real organisation, which this step says, **Checked by code**. See [Book payments in Xero](https://www.vestiarion.xyz/docs/guides/xero#5-book-payments-in-xero).
9. **The receipt**, for a payable only: whether it is shared, by whom, and whether its link still opens. Its signed entry is checked, and so is the entry it names, as the public receipt page checks them: that entry must record the payee's transaction or, for a payout to another chain through CCTP, the burn on Arc. The link itself is never shown again: only its hash is kept.
10. **Signatures**: every entry the chain rests on (below).

Each fact names who stated it by email, and when: "a former member" for someone no longer in the workspace, and "the payee" for an address sent through a payee link or GitHub. For an address sent through a payee link, the next fact names the member who created the link, who counts as having given the address.

Under each fact, the numbers of the entries it rests on open them in the **Audit log**.

A link Vestiarion checked, such as the transaction, is marked **Checked by Vestiarion**. A fact that is **Missing** says what would fill it, such as "A person marks them received with Add details on Bills & receivables."

## Links that can't be opened

A link someone gave, such as a milestone's pull request, the comment a bounty was attached with, or the evidence a milestone was verified by hand with, is checked before the page says what it is. Only `https` links are shown.

- **It opens**: the pull request or comment is public on GitHub, or in a private repository your workspace's own [GitHub connection](https://www.vestiarion.xyz/docs/guides/github) reads, where your people open it, the Asana task or attachment your workspace's own [Asana connection](https://www.vestiarion.xyz/docs/guides/asana) reads, or the workspace's own storage serves the signed file. The link is marked **Checked by Vestiarion**, and a merged pull request in your own private repository stays **Verified outside**.
- **It can't be opened**: it was deleted, its repository is private and your workspace's GitHub connection does not reach it, GitHub refused access, or a signed link expired. The page names it without offering it, marked **Can't be opened** with the reason when it is known, such as "GitHub does not show it publicly: it was deleted, or its repository is private." A fact resting on it is never counted as verified: a merged pull request that can't be opened reads **Could not open**, with "Its link can't be opened, so it is not counted as verified."
- **It is not checked**: Vestiarion checks links on GitHub and on its own file storage only. Any other link, such as a document on a drive, is shown as given and marked **Not checked by Vestiarion**, with why; it opens in your browser, never on Vestiarion's server, and its fact stays **Stated by a person**. A check that got no answer is marked **Could not open**, and is not counted as verified either.

How the check is made, so that it never reaches anything it should not:

- Vestiarion never opens the link itself. For a pull request or a comment it asks GitHub's API, at an address it builds from the link's owner, repository and number; for a signed file, the workspace's own storage, with the link's own signature and nothing else.
- A link with another scheme, a user name or password, a port, a numeric or private address, or any other site is never requested at all. Before each request the address is checked again and its name resolved, and nothing is sent unless every address it has is public. A redirect is not followed, except GitHub's own to a renamed repository.
- GitHub is asked through the workspace's own GitHub connection where the repository is in it. A private repository that only Vestiarion's own GitHub token can read, or one GitHub refuses that token, is described as GitHub describes it to the public, "GitHub does not show it publicly: it was deleted, or its repository is private.", in as many questions and for as long as a deleted one, so the check tells no one more than the workspace could see. Your sign-in is never sent anywhere.
- An answer is kept for a few minutes at most: five for a link that opens, two for one that can't be opened, thirty seconds when the service did not answer. At most 25 links are checked on a page.

The same check runs on **Contractors**: a milestone's card says a pull request can't be opened beside **Verified by**, with the reason and no link, and says a link on another site is not checked.

A bill's document is never kept, only its SHA-256, and a deal cost records only whether it has a document; a receipt's link is never shown again, only its hash is kept. There is nothing there to open, so nothing there is offered.

## Signatures

![The last link, 9, Signatures, reads as Checked by code: 6 entries verify, each signed with the workspace's key, its hash following from its content, its signature and the hash before it; the Audit log checks the whole chain, entry after entry. Below, in one line: A signed entry proves who recorded what, and when. It does not prove the goods were good or the work was done. Then Checked again in your browser: all 6 verify, and the list Every entry, checked here one by one (6), opened on entries 41 to 46, each with its summary, action, time and Verifies.](https://www.vestiarion.xyz/docs/guides/evidence-signatures.png)

*Every entry checked on the server and again in the browser, and what a signature does not prove.*

The last link says, in one line: "A signed entry proves who recorded what, and when. It does not prove the goods were good or the work was done."

Each entry is checked alone, twice: its body hash, its Ed25519 signature with the workspace's key, and its hash from the hash before it. The server checks it when the page opens, and your browser checks it again with the same verifier the public receipt page uses, then says, for example, "Checked again in your browser: all 6 verify." **Every entry, checked here one by one** lists each entry with its time and the server's check. The whole chain, entry after entry, is what **Verify hash chain** on the **Audit log** checks, and the audit export: see [Verify an audit export](https://www.vestiarion.xyz/docs/guides/audit-export).

## Download evidence

**Download evidence**, beside the page's title, saves the page as a JSON file in the format `vestiarion-evidence/1`:

- `workspace`, `network` and `subject`: the workspace, the network's name, and the record with its payee, amount and status, with `paidAmount` for a bill paid early with its discount and `simulated` for a payment made in a simulation;
- `labels`: the seven words, what each means, and how many facts each holds;
- `steps`: every link with its facts, each with its label in words, who stated it and when, its notes, links and entries;
- `entries`: every entry in full, with the fields the audit export carries (`seq`, `ts`, `actor`, `domain`, `action`, `summary`, `detail`, `body_hash`, `signature`, `prev_hash`, `hash`, `signing_key_id`) and the server's check of each;
- `keys`: the workspace's public keys, so each entry can be checked alone, and `checkAnEntry`, how.

The file is named for the workspace, the kind of record and the start of its id, such as `vestiarion-evidence-your-workspace-invoice-5f1e2d3c.json`. Every member can download it, viewers included, as they can the audit export. Downloading it is not recorded in the ledger: it carries one payment's evidence, which every member can already see. To print the page, print it from your browser.

## Who can see this

At the foot of the page, **Who can see this** says who may see, download and share it:

![The panel Who can see this, as an owner sees it for a paid bill whose receipt is shared. This page: Every member of this workspace, viewers included. Nobody outside it: the page needs a member's sign-in. Download evidence: Every member, as the audit export. The file names people by email, as this page does. Outside the workspace: From this page, only the receipt, which is shared now: anyone with its link can open it. A receipt's public page shows the amount, the payee's address and the transactions, and no names. As an owner or admin, you can share it or stop sharing it with Share receipt on Bills & receivables. Webhooks and API keys, which an owner or admin sets up in Settings, also carry the ledger outside: a webhook receives each entry written while it is set up, and an API key can read every entry, these included. A connected Slack channel and each member's own Telegram chat are told the agent's decisions. At the foot: Nothing on this page shares or changes anything: Download evidence is its only action.](https://www.vestiarion.xyz/docs/guides/evidence-access.png)

*Who may see, download and share the evidence, with the receipt's state and what your role allows.*

- **This page**: "Every member of this workspace, viewers included. Nobody outside it: the page needs a member's sign-in."
- **Download evidence**: "Every member, as the audit export. The file names people by email, as this page does."
- **Outside the workspace**: from this page, only the receipt, once an owner or admin shares it with **Share receipt** on **Bills & receivables** (see [Share a receipt](https://www.vestiarion.xyz/docs/guides/first-payment#8-share-a-receipt)). "A receipt's public page shows the amount, the payee's address and the transactions, and no names." The panel says whether the receipt is shared now, was shared and then stopped, or is not shared. A bill with no payment on chain, such as one not paid yet or paid in a simulation, says "From this page, nothing: only a payment Vestiarion made on chain has a receipt, and this bill has none." Otherwise, an owner or admin reads "As an owner or admin, you can share it or stop sharing it with Share receipt on Bills & receivables."; anyone else is told their role cannot, and that an owner or admin shares it. A milestone has no receipt: "From this page, nothing: a milestone has no receipt."
- **The workspace's other ways out**, for a payable and a milestone alike: "Webhooks and API keys, which an owner or admin sets up in Settings, also carry the ledger outside: a webhook receives each entry written while it is set up, and an API key can read every entry, these included." and "A connected Slack channel and each member's own Telegram chat are told the agent's decisions." See [Webhooks](https://www.vestiarion.xyz/docs/webhooks) and [Add invoices from your own system](https://www.vestiarion.xyz/docs/guides/api-invoices).

The page shares, unshares and changes nothing itself: "Nothing on this page shares or changes anything: Download evidence is its only action."