fix: surface Graph evidence for site payment outcomes

[SuPuHe]

Summary

The API now automatically queries The Graph for every durable payer wallet in the workspace, while OneShot persists an audit row for every site payment outcome (approved, failed, rejected, or uncertain). The cabinet surfaces the OneShot state together with transaction hashes and Graph indexing evidence, without treating Graph as settlement authority.

Scope and acceptance criteria

• The change is limited to the Graph transaction-evidence workflow.
• Every site payment outcome is represented in the activity audit trail.
• Graph activity is refreshed automatically for durable payer wallets and can show indexed or unmatched transfers.
• Failed, rejected, and uncertain outcomes remain visible even without a transaction hash.
• No unrelated cleanup is included.

Product and security invariants

• Tenant isolation remains fail-closed.
• Sponsor authorization, auditability, and daily caps remain enforced where applicable.
• Recipients cannot modify sponsor controls or access sponsor-only data.
• No secret, token, production identifier, or personal data is committed or pasted into review prompts.
• Any non-applicable invariant is explained below.

Invariant notes:

The Graph remains observation-only candidate evidence. OneShot/Arc state remains authoritative for payment, settlement, retries, and recovery. NOT_INDEXED or UNAVAILABLE is explicitly not treated as proof that a payment did not happen.

Validation

Commands and results:

pnpm test: PASS — 80 files, 1057 tests
pnpm test:browser: PASS — 8 tests
pnpm test:integration: SKIPPED — suites loaded; no container runtime available
pnpm typecheck: PASS
pnpm lint: PASS
pnpm build: PASS
pnpm --filter @oneshot/contracts check:generated: PASS
git diff --check: PASS

Independent review evidence

Gate A — exact candidate tree before push

• Base commit SHA: 65200cc2dfcf22912e532a157232e439d623044f

• Candidate tree SHA: 3fd55ce69b4902da1a359d3c35194822f7058faa

• Candidate commit SHA (if already committed but unpushed): a5beee8e303ea27d248e56f437b98830ed6c5099

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: VERDICT: PASS (manual run reported by requester)

• Findings or residual risks: Graph indexing is event-based; a reverted or otherwise non-emitted transfer cannot become indexed evidence. OneShot/Arc state remains authoritative.

• The reviewed tree equals the committed tree.

Gate B — exact remote PR head

• Pull request URL/number: pending

• Remote head commit SHA: pending

• Remote head tree SHA: pending

• Reviewer tool: free-pi-cli

• Reviewer model: deepseek-v4-flash

• Verdict: pending

• Findings or residual risks: pending

• Gate B reviewed the current remote head and matches Gate A's approved tree, or a fresh Gate A was run for the changed tree.

• Agent policy / repository-policy and all applicable CI checks pass.

Risk and rollback

• Residual risks: The Graph can lag or lack an event for a failed/reverted transaction; the UI shows that limitation explicitly and still shows the durable OneShot outcome.
• Rollback or recovery plan: Revert commit a5beee8e303ea27d248e56f437b98830ed6c5099; no database schema migration was added.

Human merge

• A human owner has reviewed the evidence and will perform the merge.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	oneshot	a5beee8	Sep 13 2026, 01:52 PM