You adapted AP2
for account to account.
Which means the proof has to land before the money does.

Did the granter hold what it granted, checked against a source it committed in advance

Three artifacts go in. A grant, an entitlement source the granting party claims to hold, and a qualification record. SCOPE_CONTAINMENT and QUANTITY_CONTAINMENT check that the grant fits inside the entitlement, ENTITLEMENT_INTERVAL_ORDER checks the timing, and QUALIFICATION_RECOMPUTE derives the class rather than reading it. QUALIFICATION_PRECEDENCE requires the qualification record to have been committed in the right order, so nobody produces the paperwork after the fact.

Run the unqualified case. It returns valid true with a class of unqualified, because the granter granted more than its own entitlement source supported. A valid true receipt saying the grant was bad is the more useful of the two outcomes, and it is the one that is hard to get from any party with a stake in the grant standing up.

QUALIFIER_DISJOINT is the gate that carries the independence claim. The qualifier cannot be the granting party. That is enforced in the verifier rather than promised in a sales deck.

What it does not prove, in plain words. It does not say the entitlement source is genuine, accurate, current, or lawfully obtained. It does not say the qualifier is competent or free of conflict in fact. A class of qualified does not make the grant valid, enforceable or binding, and does not authorize the grantee to act. The boundary, verbatim from the schema. This receipt attests only that a named grant, a named entitlement source held by the granting party, and a named qualification record satisfy the stated deterministic containment and ordering procedure over disclosed commitments. It does not establish that the entitlement source is genuine, accurate, current, lawfully obtained, or sufficient under any contract, mandate, charter, licence, regulation, or statute. It does not establish that the qualifier is competent, diligent, independent in fact, or free of conflict. A qualification of qualified does not make the grant valid, enforceable, or binding, does not ratify the grant, and does not authorize the grantee to act. A qualification of unqualified does not make the grant void, does not establish fault, breach, negligence, or bad faith, and does not allocate risk, responsibility, liability, loss, or remedy. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, and it authorizes no action, payment, sanction, denial, or remedy.

Every hop narrowed, or the chain does not verify

Four comparisons carry the meaning, and they are all mechanical. ATTENUATION_CEILING_NONINCREASING says no hop raised the amount ceiling. ATTENUATION_EXPIRY_NONEXTENDING says no hop pushed the expiry out. ATTENUATION_CATEGORY_SUBSET says no hop added a category the parent did not have. ATTENUATION_DEPTH_STRICT_DECREASING says the remaining depth went down every time. Then ACTION_CEILING_WITHIN_FINAL_LINK, ACTION_TIME_WITHIN_FINAL_TERM and ACTION_CATEGORY_MEMBER check the action that actually happened against the last link in the chain.

Category names travel as commitments, not as strings. The receipt can say an action was inside a permitted category without revealing which category, which matters when the chain crosses an institutional boundary and neither side wants to publish its taxonomy.

The conforms run below is the positive case. Note what it costs to fake: to widen an authority mid chain and still verify, you would need the parent link to have been signed with the wider ceiling in the first place, which puts the evidence right back where it belongs.

What it does not prove, in plain words. It does not say the root authority is valid, that a grantor was entitled to delegate, or that the supplied chain is complete or exclusive. It cannot decide whether authority exists outside the chain it was handed. It does not say the action occurred, was authorized, lawful, effective, paid, settled, or accepted. The boundary, verbatim from the schema. This receipt attests only that the supplied delegation links and supplied action assertion satisfy the stated mechanical attenuation comparisons at verification. It does not attest that the root authority is valid, that a grantor is entitled to delegate, that the supplied chain is complete or exclusive, that any linked credential is the one an acceptor uses, that an action occurs, that the action is authorized, lawful, effective, enforceable, paid, settled, or accepted, that any party has knowledge or notice, that a category name is revealed, or that any person bears responsibility, loss, harm, fault, or liability. It cannot decide whether authority exists outside the supplied chain, whether a missing link exists, whether an action is proper, or whether an external rule permits it.

Classify whether an instruction was checkable when it was fixed, not after the loss

The operator declares the kinds of predicate its committed instruction contained. Not the text, kinds, carried as keyed pseudonyms. The service classifies each kind against a published ruleset and recomputes a verifiability_class of machine_checkable, partially_checkable, subjective or unclassifiable. VERIFIABILITY_CLASS_RECOMPUTE derives the class, and mint refuses to sign a body that arrives with the class already filled in.

RULESET_PRECEDENCE is the gate that makes it worth anything. The ruleset digest has to have been committed at or before the instant the instruction was fixed. If the ruleset came later, the receipt gets a precedence_class of ruleset_follows_intent and fails closed. That cuts both ways on purpose, which is the point of an independent instrument.

Run subjective and then unclassified. The first says nothing in the instruction could be machine checked. The second returns valid true with a class of unclassifiable, because the precommitted ruleset never named one of the declared kinds. That second one is the receipt declining to guess, and it is the state a careful reader looks for first. The service never receives the instruction text, and NO_INTENT_CONTENT_LEAK is a gate rather than a policy.

What it does not prove, in plain words. It does not say the instruction was reasonable or that the customer understood it. It does not say the declared predicate kinds are complete or honestly declared, and it does not say these are the predicates a court or a regulator would think mattered. It decides no dispute and entitles nobody to rely on the class. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed a verifiability class from the declared predicate kinds of one committed intent, against a classification ruleset whose digest was committed at or before the intent was fixed. It does not attest that the intent was reasonable, that the Card Member understood it, that the declared predicate kinds are complete or honestly declared, that the predicates are the ones a court or regulator would consider material, that any claim is payable or deniable, or that any party is entitled to rely on the class. This service does not read the intent text and never receives it.

Tie the agent that acted to the credential it was admitted under

Two artifacts go in. One admission credential, and one receipt of something the agent did. Both are reduced to a subject commitment under a single salt the credential itself already committed to, and SUBJECT_COMMITMENTS_IDENTICAL wants those two commitments byte identical. TEMPORAL_RELATION then checks the conduct happened at or after the admission and inside a maximum separation signed in advance, so a credential cannot be stretched over conduct it was never meant to cover.

Neither identifier appears in the signed body. The receipt travels to a merchant, a scheme or a counterparty institution without naming the agent, the operator, or the customer. Both sides can recompute the same answer from the same two artifacts, and neither has to open its detection stack to the other.

What it does not prove, in plain words. It does not say the credential was validly issued or that the admitting party was entitled to admit. It does not say the conduct occurred or that the conduct was allowed. It ties two artifacts to one subject and puts them in order, and that is all. The boundary, verbatim from the schema. This receipt attests only that a supplied admission credential and one supplied conduct receipt yield byte identical subject commitments under one disclosed binding salt that the admission credential already commits to, and that the extracted conduct instant is at or after the stated admission instant and within the signed maximum separation. It does not attest that the admission credential is validly issued, that any admitting party is entitled to admit, that either identifier is true, that the subject is a person or entity of any asserted kind, that the conduct occurred, or that the conduct is authorized. It does not decide authenticity beyond the checked signatures and stated verification class, completeness of records, actual knowledge, intent, fault, fraud, contractual effect, legal effect, regulatory effect, eligibility, title, responsibility, liability, or any dispute. It does not authorize admission, access, conduct, a transaction, credential presentation, disclosure, or reliance by any party. It does not establish that either source artifact is complete, exclusive, current, unrevoked, unaltered before receipt, or truthful. It cannot decide whether an absent conduct receipt exists, whether another admission credential exists, whether the admitting party relied on the credential, whether the conduct service observed all conduct, or whether any party knew of the other artifact.

Approved, declined, or taken against a mandate that had already been pulled

MANDATE_LIVENESS_RECOMPUTE derives whether the mandate was live at the decision instant instead of accepting a flag. CONSTRAINT_EVALUATION_RECOMPUTE and DECISION_RELATION_RECOMPUTE derive the per constraint results and the relation between them and the stated decision. If a body claims approved where the recomputation says otherwise, the relation gate is what catches it.

The three runs below are the three outcomes an operator actually needs to distinguish afterwards. approved, the decision was inside a live mandate. declined, the request asked for more than the mandate allowed and was refused. revoked, the mandate had already been pulled when the decision was taken. On a push flow the third one is the expensive case, because the transfer it produced has no Recall reason attached to it.

NO_CARDHOLDER_IDENTITY_LEAK is a gate, and OBSERVER_ROLE_DECLARED forces the signer to state the role it observed from. The amount travels as a commitment, so the receipt can be handed across an institutional boundary without disclosing the figure.

What it does not prove, in plain words. It does not say the goods or services were delivered, that the customer intended the purchase, that the merchant is legitimate, that funds settled, or that any party outside the named observer agrees with the finding. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed the stated authorization decision from the supplied confidential evidence at the stated instant. It does not attest that the underlying goods or services were delivered, that the cardholder intended the purchase, that the merchant is legitimate, that funds settled, that the issuer honored the decision, or that any party outside the named observer agrees with the finding.

One transaction, one authority signed before it, and the outcome recomputed by the service

The amount, the currency, the timing and the scope of one transaction are compared against the constraints of one authority receipt, and MANDATE_PRECEDES_TRANSACTION requires that authority to have been signed before the transaction was authorised. CONFORMANCE_RECOMPUTE and OUTCOME_RECOMPUTE then derive the per constraint results and the overall outcome rather than accepting them. That is what the fail run demonstrates: a body whose declared result is pass where the recomputed result is fail does not verify, and the failed gate is printed on screen.

Why the signer matters more here than anywhere else on the page. AP2 states that the Payment Mandate is “verified by the Credential Provider, Network, and Merchant Payment Processor,” per the specification. Every one of those parties is inside the transaction. Their verification is correct and it is also self interested, and on a rail with no reversal, self interested is the property that eventually gets challenged. A non party signer produces the same arithmetic with that objection removed.

NO_PAN is a gate and there is no account identifier field either. The check runs on commitments and constraint terms, so it sits beside the payment flow rather than inside it, and it never becomes a place where customer credentials live.

What it does not prove, in plain words. It does not attest that the customer granted the delegation, that the declared agent identity is genuine, or that the transaction was authorised or settled by any scheme. It is not a payment authorisation. It does not deny, resolve or adjudicate any dispute, and it does not limit any right a consumer holds under any reimbursement rule. It evaluates one transaction against a per transaction constraint and evaluates no cumulative spend or velocity limit, which is the reason the next instrument exists. The boundary, verbatim from the schema. This receipt attests that the named transaction's amount, currency, timing and scope were compared against the constraints of one specific delegated authority receipt that was signed before the transaction was authorised, and that the outcome was recomputed by this service from that comparison rather than supplied by the caller. It does not attest that the cardholder granted the delegation, that the declared agent identity is genuine, that the transaction was authorised or settled by any network, that goods or services were delivered, or that the displayed terms digest corresponds to anything a person actually read. It is not a payment authorisation and carries no cardholder credential. No card network, issuer, or regulator currently recognises this receipt as authentication data, as compelling evidence, or as a liability shift, and it does not create one. It does not deny, resolve, adjudicate or affect any dispute, and it does not limit any right a consumer holds under Regulation E, Regulation Z, or any equivalent rule. This receipt evaluates one transaction against a per transaction constraint and does not evaluate cumulative spend, transaction velocity, or any aggregate limit across multiple transactions under the same mandate, so a series of individually conforming transactions may still exceed a spending intent this receipt cannot see. It evaluates the delegated authority receipt as supplied and inherits that receipt's revocation limitation, so it does not attest that the mandate was still unrevoked at the moment the transaction was authorised.

Distinct acceptor count, dispersion class and cumulative relation, with nothing disclosed

Acceptors travel as keyed pseudonyms derived under a window salt the receipt committed to. DISTINCT_ACCEPTOR_COUNT_RECOMPUTE and DISPERSION_CLASS_RECOMPUTE derive the count and the shape, CUMULATIVE_RELATION_RECOMPUTE derives whether the accumulated position stayed inside the declared constraint, and WINDOW_CONTINUITY plus WINDOW_PREDECESSOR_INTEGRITY chain windows so a period cannot be quietly skipped.

NO_ACCEPTOR_IDENTITY_LEAK is a gate. The window salt, the acceptor identities, the contribution multiset, the exact dispersion ratio and the accumulated amount are all withheld. What comes out is a class and a relation, which is enough for a counterparty to act on and not enough for it to reconstruct your book.

The breached run returns valid true with a cumulative relation that went past the mandate. Read that alongside the AP2 rule that Shopping Agents “MUST NOT present any subsequent open Payment or Checkout Mandates without receiving a rejection receipt from the previous one,” per the specification. That rule governs one agent’s sequencing. This receipt measures what actually accumulated.

What it does not prove, in plain words. It does not say every action under the authority reached the issuing service, that every acceptor reported, or that a non reporting acceptor was inactive. It does not say the declared expected acceptor population is complete or that any acceptors are unrelated. It is not an authorization control and does not prevent, block, reverse, delay or validate an underlying action. The boundary, verbatim from the schema. This receipt attests only that the issuing service, for the declared authority grouping and accounting window, receives the contribution and coverage evidence it describes, verifies the stated keyed pseudonym derivations under a committed window salt, recomputes the stated distinct acceptor count, dispersion class, commitments, cumulative relation, and coverage class, and signs that limited result. It does not attest that every action under the authority reaches the issuing service, that every acceptor reports, that a nonreporting acceptor is inactive, that the declared expected acceptor population is complete, that any acceptors are legally or institutionally unrelated, or that any pseudonym reveals an acceptor identity. It does not disclose the window salt, acceptor identities, contribution multiset, checked action count, exact dispersion ratio, cumulative constraint, or accumulated amount. It is not an authorization control and does not prevent, block, reverse, delay, ratify, or validate an underlying action. It does not decide whether an action, authority, constraint, report, acceptor, or actor is valid, authorized, proper, compliant, enforceable, or lawful. It does not deny, resolve, adjudicate, or affect any dispute or right.

Did the action run before the pull, inside the propagation bound, or after it

A named action, a named revocation, and a propagation bound that was committed before any of it happened. PROPAGATION_COMMITMENT_MATCH and PRECOMMITMENT_ORDER enforce that ordering, so the bound cannot be widened after an awkward action shows up. CLASSIFICATION_RECOMPUTE derives the class. CLOCK_CONSERVATISM resolves ambiguous timing against the party asserting the favourable reading, rather than in its favour.

Run before and then after. The first is an action that ran while the authority was still good. The second is an action that ran once the pull had been given its committed time to propagate, and there is no honest reading of that one that excuses it. NOTIFICATION_EVIDENCE_CANDOUR is worth noting: evidence of notification records only its stated class, and the schema refuses to let that be read as proof anyone received, read, or understood it.

What it does not prove, in plain words. It does not say the revocation was authorized, delivered, valid, or effective as a matter of contract or law. It does not say the action was authorized, unauthorized, excused, ratified or wrongful. A class of within_propagation_bound does not excuse the action and allocates no fault, liability, loss or remedy. The boundary, verbatim from the schema. This receipt attests only that a named action, a named revocation, and a precommitted propagation bound satisfy the stated deterministic temporal classification procedure. It does not establish that the revocation is authorized, delivered, valid, enforceable, or effective as a matter of contract or law. It does not establish that the action is authorized, unauthorized, excused, ratified, wrongful, binding, or ineffective. A class of within_propagation_bound does not excuse the action and does not allocate risk, fault, responsibility, liability, loss, or remedy. Notification evidence records only the stated evidence class and does not establish that an actor receives, reads, understands, or has actual knowledge of revocation. This receipt does not decide any contractual, statutory, regulatory, evidentiary, or legal consequence, and it does not authorize any action, payment, sanction, denial, or remedy.

Nothing landed on the committed channels, over a closed interval, with no gaps

ROSTER_PRECOMMITMENT_ORDER requires the channel roster to have been committed before the interval opened, which is what stops anyone quietly dropping the channel where the effect actually landed. OPENING_ANCHOR_PRECEDENCE, CLOSING_ANCHOR_LAG, CHAIN_CONTINUITY and GAP_BOUND then require an unbroken chain of anchors per channel across the whole interval, so an unobserved stretch shows up as a gap rather than as silence.

Run quiescent and then effect. The second returns valid true and reports that something did land. A quiescence instrument that could only ever say yes would be worthless, and the schema is blunt about the residual limit: a verdict of quiescent means only that no effect was admitted on the committed channels, as reported by the anchoring parties.

This is the natural object for the AP2 human not present flow, where “The User now leaves the session, having delegated the shopping task to the Shopping Agent,” per the flows document. When nobody is watching for an hour, the claim worth signing is that the hour was uneventful.

What it does not prove, in plain words. It does not say the roster enumerates every channel through which an effect could occur, that the anchoring parties are complete, honest or diligent, or that no effect occurred outside the committed roster or the covered interval. It proves absence within a fence that somebody drew, and it makes you look at who drew the fence. The boundary, verbatim from the schema. This receipt attests only that a named authority, a channel roster committed before the interval opened, and a set of per channel continuity anchors satisfy the stated deterministic absence procedure over the named closed interval. A verdict of quiescent means only that no effect was admitted on the committed channels within the covered interval as reported by the anchoring parties. It does not establish that the roster enumerates every channel through which an effect could occur, that the anchoring parties are complete, honest, or diligent, or that no effect occurred outside the committed roster, outside the covered interval, or through an unreported path. It does not establish that any authority was suspended, revoked, exhausted, dormant, or unused as a matter of contract or law, and it does not establish quiescence of intent, capability, or obligation. A verdict of effect_observed does not establish that the effect was unauthorized, wrongful, or in breach. This receipt decides no contractual, statutory, regulatory, evidentiary, or legal consequence, allocates no risk, fault, responsibility, liability, loss, or remedy, and authorizes no action, payment, sanction, denial, or remedy.

Every constraint has to be timestamped before the loss, or the receipt names nobody

A precommitment only counts if it was committed strictly before the loss instant. PRECOMMITMENT_PRECEDENCE computes a precedence_class of all_precommitments_precede_loss or some_precommitments_follow_loss from the timestamps rather than trusting the field. So nobody writes a rule after the loss and points at it. Not the agent platform, not the merchant, and not the institution holding the exposure.

Run hindsight and watch it come back naming nobody, because the precommitments in that body post date the loss. That is the behaviour that makes the object usable in front of a counterparty institution or a regulator, since the first thing either of them looks for is the case where it guessed. And note the signer again: an attribution signed by one of the two institutions splitting a reimbursement is an argument, and the same arithmetic signed by a non party is something the other side has to answer.

What it does not prove, in plain words. It does not say the loss occurred, that the observations are complete, that any party acted with intent, that any legal duty was breached, or that any amount is owed. It cannot bring money back and nothing on this page suggests it can. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed which precommitted constraints the supplied observations violated, and which parties had made those precommitments before the loss instant. It does not attest that the loss occurred, that the observations are complete, that any party acted with intent, that any legal duty was breached, or that any amount is owed.

A lookup in a table both parties committed in advance, not an argument after the fact

ALLOCATION_PRECEDENCE requires the table digest to predate the loss instant, ATTRIBUTION_LINK and ATTRIBUTION_INTEGRITY bind it to a specific fault attribution, and SETTLEMENT_POSITION_RECOMPUTE derives the position rather than reading it. The outcome keys are ordinary: a single party position, a shared position, or none.

Run respondent and then none. The second is built on an indeterminate attribution and maps to no position at all. An allocation instrument that always produces an answer is just a coin flip with a signature on it, and the none outcome is the reason this one is not that.

What it does not prove, in plain words. It does not say any amount is owed, that any party will pay, that the allocation table is enforceable, or that any contract exists between the named parties. Whether the recomputed position entitles anyone to payment is decided solely by the parties’ own agreement. The boundary, verbatim from the schema. This receipt attests only that a named observer recomputed a settlement position between two named parties from one named fault attribution outcome and a precommitted allocation table whose digest was committed before the loss instant. It does not attest that any amount is owed, that any party will pay, that the allocation table is enforceable, or that any contract exists between the named parties. Whether the recomputed position entitles anyone to payment is decided solely by the parties' own agreement.

Two books, one comparison, nothing disclosed by either side

Each side commits a keyed digest over the same declared field list, signed by a distinct registered attestor key. ATTESTOR_KEY_DISTINCTNESS and ATTESTOR_QUORUM enforce that they really are two parties, TIME_ANCHOR_DRIFT_BOUND and OBSERVATION_WINDOW_TOLERANCE bound how far apart the two observations may be, and COMMITMENT_EQUALITY_RECOMPUTE derives the comparison. NO_RAW_STATE_LEAK is a gate.

When the books genuinely disagree, the receipt says so and names no winner, because it cannot know which record is right without read access it deliberately does not have. That limit is in the boundary text, printed below, in the schema’s own words.

What it does not prove, in plain words. It does not disclose any position, balance, holder identity or account identifier. It does not say either committed digest is a correct digest of the record it names, because confirming that needs read access this receipt does not confer. It does not decide which record is correct when the two disagree. The boundary, verbatim from the schema. This receipt attests that two named records, each observed at a named cursor and at a named instant, and each committed by a distinct registered attestor key to a keyed digest computed over the same declared list of fields, produced the comparison outcome that this service recomputed from those two committed digests and those two instants against the declared window tolerance. It does not disclose any position, balance, holder identity, or account identifier. It does not attest that either committed digest is a correct digest of the record it names, because confirming that requires read access which this receipt does not confer. It does not decide which record is correct when the two records diverge, assigns no fault to either operator, does not decide whether the underlying settlement, transfer, or register update was proper, and does not effect or reverse any settlement. A window_exceeded outcome records only that the two observations were too far apart for the comparison to be decisive.