Attribution Integrity · AF-11h

How Do We Know the Deal Actually Closed?

Russel could try to hide the deal and keep the whole bank commission. He can't. Watch the four-handshake cryptographic chain in motion — hardware-bound signatures, hash-linked events, and a customer veto that overrides any provider's word. This is the system of record Matt ratified as the Enterprise Architecture constitution on 2026-06-28.

Best viewed with motion enabled

Three actors · three hardware-bound keys

Every actor's phone or laptop generates a hardware-anchored key at first sign-in (Apple Secure Enclave · Android StrongBox · WebAuthn). The private key never leaves the device. Every signature they make on the chain is bound to that key — meaning nobody, not even Flip360, can forge or replay it.

John

Referrer · Tax Accountant

iPhone · Secure Enclave

Sally

Client · The Veto Vote

Android · StrongBox

Russel

Partner · Mortgage Broker

Laptop · WebAuthn

The 4-handshake chain — watch it fire

A signed envelope travels through 5 stations. Each station stamps its own hardware signature and hash-links to the previous. If any link is missing, tampered with, or forged — the whole chain breaks and commission stays PENDING forever.

// signed envelope on the wire · sample from POST /chain/v1/h3b
{ "v": 1, "receipt_code": "FLP-A93F-2Q7X",
  "partner_id": 4021, "deal_value_cents": 120000000,
  "product": "Home loan · Bank X · 30yr",
  "prev_event_hash": "a7f2c9…", // hash-linked to H3a
  "signed_at": "2026-07-07T04:12:19Z", "device": "key-XG9…",
  "signature": "0xa3f...b8d" // Ed25519, hardware-bound
}

The cheat attempt — and why it fails

Two identical setups. Two different outcomes. The only difference: Sally's final tap. This is the mechanic that makes the platform trust-minimising — no provider's word is ever the last word.

Scenario A · Russel tries to hide

Russel never signs H3b

Bank X pays Russel $7,800 outside the platform. Russel keeps quiet, hoping Flip won't notice.

What the engine does

Chain incomplete. Commission engine does not fire. But H1+H2 are already on the immutable chain — Flip360 has proof that Russel accepted a referral from John and now owes an explanation.

Attribution monitor flags it Sally gets a nudge SMS Russel loses Trust Score

Scenario B · Chain closes properly

Sally taps "Yes, pay John"

Russel signs H3b with the $1,200,000 amount. Sally gets a push notification, opens the app, sees the deal, taps confirm.

What the engine does

Chain complete. Commission engine fires legitimately at H4. Ledger entry written · RCTI raised · Stripe Connect transfer queued · Community pool credit posted — atomically, idempotently.

RCTI auto-generated $1,326 → John $93.60 → Cricket Club

The doctrine: H3b is only an accrual estimate; H4 is the release. Russel signing settled alone doesn't move a cent. Only when Sally (the client) also signs — with her own hardware-bound key — does commission become ELIGIBLE. She has veto power. Ratified in the EA constitution 2026-06-28.

The ledger state machine · watch a dollar travel

A commission entry can be in exactly one of these five states at any time. It can never skip ahead. Russel cannot mark his own entry PAID — the engine controls transitions based on chain events.

PENDING

COOLING_OFF

ELIGIBLE

APPROVED

PAID

H3b signed
accrual only

H4 signed
clawback window open

Cooling-off expired
no refund/reversal

Ops approves batch
Stripe Connect queued

Money in the bank
chain closed

CLAWED_BACK If refund/reversal within clawback band (0–365d)

VOID If H4 withhold, or chain integrity broken

Code reference: src/engine/types.ts:16 — EntryStatus union · enforced in src/engine/stage-trigger.ts.

The six functional guarantees · already in code

Same trust primitives as ASX CHESS, SWIFT, and NPP — applied to peer referral commissions. Hover any hex for its file citation.

Immutable record

Every chain event is hash-linked to the previous. Change any byte and the chain breaks visibly.

chain_events · prev_event_hash

Non-repudiable signatures

Hardware-bound Ed25519 keys. Same primitive as Apple Pay, CBA NetBank biometric, and passkeys.

src/chain/verify.ts

Idempotent settlement

Duplicate H4 signals or webhook re-fires never double-pay. UNIQUE constraint on envelope hash.

stage-trigger.ts · idempotency_key

Three-way reconciliation

Chain events · commission_events · ledger_entries — must reconcile to the same amount, always.

engine/posting.ts (DR = CR)

Evidentiary audit trail

Every entitlement has a walkable evidence pack — court-defensible, timestamp-verified.

/evidence/:entitlement_id

Regulator-ready disclosure

RCTI auto-generation, AUSTRAC AML/CTF hooks, MFAA/CPA/MIA disclosure summary APIs.

/api/chain/head · /faq

The evidence pack · what auditors see

When the chain closes, an evidence pack assembles automatically. Every layer references the one above. Big-4 auditors walk this from top to bottom and can verify every hash independently. No trust in Flip360 is required.

INTENT_SIGNED · John

Ed25519 · hash a7f2c9… · 2026-07-01 09:14

ACK_BY_REFEREE · Sally

Ed25519 · hash b8e3d2… · prev=a7f2c9… · 2026-07-01 09:22

H3a

INTAKE_BY_PARTNER · Russel

Ed25519 · hash c9f4e3… · prev=b8e3d2… · 2026-07-02 11:03

H3b

SETTLEMENT_WITNESSED · Russel

Ed25519 · hash d0a5f4… · prev=c9f4e3… · value=120000000c · 2026-08-17 14:47

OUTCOME_CONFIRMED · Sally

Ed25519 · hash e1b6a5… · prev=d0a5f4… · verdict=PAY · 2026-08-17 18:29

RCTI raised · $1,560 P2P referral fee

Russel → John · via Flip360 · GST-compliant · Stripe Connect queued

Auditor: walk this evidence pack

Why this matters for the investment

The moat

Every commission marketplace competitor (LinkUp, Refer.io, PartnerHero, referral CRMs) relies on self-reporting — the closer types "yes, I closed the deal" into a form. Flip360 doesn't. The 4-handshake chain with a customer veto is the same architectural primitive as ASX CHESS. Once we ship it, competitors need a $10M+ engineering rebuild to catch up.

The regulator story

AUSTRAC AML/CTF filing, ATO RCTI compliance, MFAA/CPA/MIA disclosure obligations — every one of them requires evidentiary audit trail. Our chain gives us this for free. Payment platforms without it (Rewardsly, Ambassador) end up building it retrospectively at 10× the cost.

Status: Live in production · Sprint EA-1 through EA-4 complete · Ratified by Matt 2026-06-28

Code: src/chain/ · src/engine/ · src/routes/chain.tsx

Worked Example ($ flow) Deal Fee Doctrine Live: the 5 sign pages Live: chain explorer FAQ · four-handshake explainer