2.1.0

A company of agents with tab as the money layer: tab company and the dashboard at https://app.paidwithtab.com.

Company: a mission, a budget, agents with roles, and tickets. Every run gets its own mandate signed by the company's owner key, capped at the smallest of the company's remaining budget, the agent's per-run budget and the ticket's cap. What a run spent is what the gateways booked against that mandate, attributed to the run, the ticket and the company. Warns at 80 percent, pauses at 100. A ticket closes only with evidence. Hire, budget, approve, pause and publish are board actions signed with the owner key and verified on every read.

Server: accounts with scrypt passwords and HttpOnly sessions, a Host allowlist against DNS rebinding, same-origin checks on cookie mutations, per-address rate limits on sign up and log in, private-address checks on gateways, and a content security policy on the dashboard.

Gateway: body_allow and body_fixed per route, upstream_query, receipts by payer and since, and spend by mandate id at /.well-known/tab/mandate/<id>/spent.

Templates: examples/companies/research.json (Field Notes) and seller.json (Quote Desk).

Install: npm i -g paidwithtab@2.1.0 (not published to npm; 2.2.0 is the first company release there).