Cedulon

Missing evidence is itself evidence.

Agents can already pay on open rails such as x402 and AP2. Cedulon sits above those rails as an audit layer: a signed spend receipt, a chained epoch checkpoint, and a reconciliation of the rail extract. If a spend left no receipt, the gap is the finding.

How it works

Cedulon flow from manifest to reconciliation audit Trade Manifest signed offer before payment Policy Decision Point default deny, fail-closed Payment rail x402 or other settlement Signed Spend Receipt COSE_Sign1, Ed25519 Epoch Checkpoint totals and previous hash Reconciliation Audit rail extract versus receipts

The gap we close

Anyone can verify a receipt

A signed spend record checks as valid or tampered. That is the easy half.

Nobody sees a missing receipt

A spend that never issued a receipt leaves no object to verify. The books still look clean.

Cedulon turns the gap into evidence

The companion audit compares the rail extract to the receipt chain. A bypass in this repository prints audit: 1 settlement without receipt → FAIL

Gated spend (repository API)

import { PolicyEngine } from "@cedulon/core";
import { generateReceiptKeys } from "@cedulon/receipts";
import { gatedSettle } from "@cedulon/x402-adapter";

const engine = new PolicyEngine({
  maxAmount: 10n, maxCumulative: 30n, maxPayments: 3, windowMs: 3600000,
});
const keys = generateReceiptKeys();
const result = gatedSettle(engine, {
  req: { amount: 1n, currency: "USD", payee: "q", nonce: "n1", nowMs, tool: "spend" },
  payer: "p", paymentHeader: "mock",
}, { receiptPrivatePem: keys.privateKeyPem, receiptPublicPem: keys.publicKeyPem }, nowMs);

Measured in this repository