Glossary

Glossary

Term	Meaning
Permit	An agent's spending authority: cap_cents, allowlist, expiry, revoked
Four-clause gate	amount ≤ remaining ∧ merchant ∈ allowlist ∧ now < expiry ∧ ¬revoked
Remaining	cap − reserved − captured (after any tighten)
Reserve	An ALLOWED check holds cap against a pending authorization (auth_id)
Hold	A PayPal AUTHORIZE authorization. Money is held, not moved
Escrow	Permit's record of one hold plus its release predicate
Predicate D	delivery_hash: sha256 of the delivered bytes equals the precommitted hash
Predicate A	acceptance_signature: the counterparty's HMAC over escrow, hash and amount
Capture	Money moves. Only through the release-verifier
Void	Release a hold. The reservation is freed
Receipt	One hash-chained ledger entry
Claim ledger	The in-memory SHA-256 hash chain of receipts
UNKNOWN	Escrow state after a capture timeout or a PENDING capture. Resolved only by reconcile
Reconcile	Query provider truth, then record CAPTURED or void (fail closed)
CLEANUP_PENDING	A void timed out. The reservation stays held until retry_cleanup succeeds
Carve	A sub-permit's cap, reserved on its parent
Roll-up	A child capture moves each ancestor from reserved to captured
Lineage gate	A child spend needs every ancestor live
Cascade revoke	Revoke a subtree, void its holds, release carves post-order
E-stop	Revoke one permit and void its in-flight holds (not a cascade in code)
Tighten	Narrow a live permit (cap, merchants, expiry, threshold). Never widen
Approval threshold	Spends above it need the principal's approval
Merchant binding	The sandbox rail refuses merchants other than the configured account
Mock rail	MockPayPalClient: in-memory, deterministic, with fault injection
Sandbox rail	SandboxPayPalClient: real PayPal sandbox REST, CAD