Audit & Compliance

{
  "proposed_by":                "c6a8…37e1",   // Priya Raman
  "approved_by":                "e5d4…08fa",   // Sandra Osman — distinct, enforced
  "amount_cents":               109400000,
  "escrow_balance_cents":       141800000,
  "escrow_balance_source":      "escrow_accounts",
  "escrow_balance_as_of":       "2026-08-19T06:00:00Z",
  "approved_undisbursed_cents": 0,
  "available_cents":            141800000,
  "screening_gate":             "cleared",
  "payee_account":              "•••• 7842"    // masked at write time, never stored raw
}

1 · This is a system of record, so it never summarises past its evidence. Every figure either resolves to a stored row an examiner can pull, or is rendered as absent. There is no compliance score and no percentage on this surface: a score lets one failing statutory control vanish into a rounding, and the whole point of the page is that it cannot.
2 · Filter scope is part of the result. GET /v1/audit-log accepts actor, exchange, action, from, to, cursor and limit. Outcome, resource type and free text are applied in the browser over the fetched page. Every control carries a query or page only marker and the count next to a page-only filter is never presented as a total. Adding a filter without adding its marker is a review rejection.
3 · The exchanger is never in a fund-movement approval path. disbursement.authorized is the exchanger's signed instruction and renders as Instruction — not an approval; it is not counted toward the approval quorum and is not a gate on the QI's decision. Release requires two authorized officers, and the approver is never the proposer — enforced at the API, at a DB check constraint, and shown here as the self_approval_blocked row. Any UI that reads a proposer's own submission as an approval, or that puts the exchanger in the approving position, is constructive receipt under Treas. Reg. §1.1031(k)-1(g)(6).
4 · Status is derived from evidence, never from one flag. A renewal that was filed is not a renewal that was granted — the Oregon row stays lapsed until the state's certificate is attached. A screening that ran once at counterparty add is not a rescreening cadence. A row written locally is not a durable row. Each of those is a separate stored fact, and the surface reads all of them before it picks a colour.
5 · An overdue statutory obligation is permanently alarming. It cannot be acknowledged, snoozed, dismissed, or aged into a neutral state, and it never renders green. The only thing that clears it is the evidence that satisfies it.
6 · Identity is the first gate, and it belongs to the person. kyc.completed is written from the provider's callback. No console role can mark an exchanger verified by proxy, and no “sign on behalf” affordance exists anywhere — the eSign Act and UETA require the signer's own intent, so the control is absent rather than permission-gated.
7 · Absence is rendered, not hidden. The six Not tracked cadence rows have no schema behind them and are listed precisely for that reason. Deleting them would make the register look complete and make the surface a liability. When a schema lands, the row changes status in place and keeps its identity.
8 · Integrity claims are split into enforced and not. Delete-refusal, fail-closed inserts and the absent UPDATE policy are shipped and shown green. The hash chain, the monotonic sequence, the service-role UPDATE guard and any alerting are not, and the verifier stays visibly disabled with the missing capability named. A greyed control that says why is honest; a page with no control reads as though verification already passed.
9 · Export is audited before it is produced. The audit row is written and forwarded first; if that write fails the export returns 500 and no file exists. Two live defects are drawn as defects: the audit-log CSV writes no audit row of its own, and it exports only the loaded page rather than the filtered result. Both must be fixed in the implementation, not designed around — an incomplete export an examiner believes is complete is worse than no export button.
10 · Every row carries its real action and deep-links to the section it concerns. A ledger row opens the file at Funds, Identification, Identity & AML or E-Sign — never a generic overview. A cadence row opens its licence, policy or queue. A row with genuinely nothing to open renders a disabled control that says so.
Fully tokenized against ../tokens.css — no raw hex and no inline colour outside token references; --ink-4 is used for icons, rules and disabled glyphs only, never body text. Light and dark are both designed. All names, identifiers, amounts and references are synthetic demo data.