Changelog
What shipped to production at thepoints.io, by commit. Dates are America/Phoenix.
Also available as Markdown and JSON.
2026-10-07 · PR #63 ·
bd5d4d6Blog: five user-group posts and a footer Products section
Five blog posts, one each for AI agents, agent operators, merchants, consumers, and developers, plus a Products section in the site footer. No change to product behavior.
2026-10-07 · PR #61 ·
2fbda2dUC-21: saved-payee cycle drafts and an admin mandate view
Mandate cycles can be drafted to a saved payee and need a fresh human approval each cycle. Approvals expire after 1 hour by default, and there's no automatic cycle scheduler yet. Money doesn't move while execution is not enabled. Adds a session-authenticated route that drafts a cycle payment to a saved payee, a read-only internal admin view of mandates for POINTS staff, and refuses a cycle claim made before the cycle date with HTTP 409.
2026-10-07 · PR #60 ·
be3e5b5UC-21: authenticated mandate routes
Session-authenticated API routes (not available over MCP) to create, list, read, prepare, skip, and cancel recurring payment mandates, plus attach and claim routes for cycles. A claim records the claim only, returns executed: false, and does not move money.
2026-10-07 · PR #59 ·
209d7f6UC-21 follow-ups
Expired or revoked cycle approvals can be reopened only with a fresh approval; cycles that may have been attempted are marked refused. Attaching a payment requires the mandate amount, currency, and payee to match, and claims re-check UC-26 scope (per-payment limits and the counterparty allow-list; usage across payments is not persisted yet). Unattended claims are refused unless the authorization allows them. Transaction errors are logged by type without secrets.
2026-10-07 · PR #58 ·
3f7e262Test suite fixes
Updated outdated unit tests; no change to product behavior.
2026-10-07 · PR #57 ·
51cfb7eUC-21 recurring mandate hardening
Only the mandate owner or the recorded approver can attach an approval. Mandate rows are locked during changes, a retried prepare returns the same cycle, and a claim and the move to the next cycle date commit together.
2026-10-05 · PR #55 ·
d359aa1UC-21: recurring mandates with a fresh approval each cycle
Adds recurring payment mandates and cycles. A mandate is not a standing approval: each cycle needs its own fresh, unused human approval, and prepare or claim is refused without one. Approve does not execute. Execution: not enabled.
2026-10-05 · PR #56 ·
fb31df1UC-26: approval scope on spend envelopes
Spend envelopes can carry a payment-count cap, a total cap, and a counterparty allow-list (empty means the approved payee only). Reusing an interactive approval unattended is refused by default. Aggregate caps are in progress: usage across multiple payments is not persisted yet.
2026-10-05 · PR #53 ·
8399901UC-22: spend envelope and approval ledger
Approving a draft records a signed spend envelope, and every decision (approved, revoked, expired, denied) is appended to an approval ledger. A human still approves from the draft. Approve does not execute.
2026-10-02 · PR #52 ·
07de613Payee external account id field
Payees can store the ACH provider's external account id, set by staff or the account owner. Only the id is stored, never routing or account numbers, and no payment path reads it yet. ACH settlement: not enabled.
2026-10-02 · PR #47 ·
5e30a4eget_payment_status reports revoked
get_payment_status now returns the revoked status for a revoked authorization instead of a tool error.
2026-10-02 · PR #46 ·
220cc20Policy schema versioning
Policy vocabulary responses and prepared drafts carry a policy schema version. A client that sends an unsupported version is refused before any spend is reserved.
2026-10-02 · PR #45 ·
e42af70Revocation and zero clock skew
An approved authorization that has not executed can be revoked; its status becomes revoked and its signature is cleared. Expiry checks allow zero clock skew.
2026-10-02 · PR #44 ·
204b5dcCash bucket accounting
Spend accounting separates unreserved, reserved, and escrowed cash, so outstanding drafts and holds are not counted as spendable. The available balance shown is unreserved cash only.
2026-10-02 · PR #43 ·
b00b03eRead-time expiry from executableUntil
An approved authorization past its executableUntil time reads as expired immediately, and its reserved spend is released.
2026-10-02 · PR #42 ·
249b991Atomic reserve to settle
Preparing and approving a draft, and the settlement step, use row locks and conditional updates, so concurrent requests cannot reserve the same spend twice. A lost race is refused.
2026-10-02 · PR #41 ·
6e2aaa2ACH scaffolding (fail-closed)
Internal ACH provider scaffolding. Every ACH path is refused by default. ACH settlement: not enabled.
2026-10-02 · PR #40 ·
07f2c71P2: escrow, charge on 2xx, graduated autonomy
Code for escrow before work, charging only after an HTTP 2xx with the fee taken before sending, and graduated autonomy by merchant, amount, frequency, and history. These patterns require execution (not enabled).
2026-10-02 · PR #39 ·
63f4546P1: spend reservation, policy vocabulary, velocity caps
Stale pending drafts expire, and outstanding drafts reserve spend against daily and monthly limits. The canonical payment-category vocabulary is available over MCP, and unknown categories are denied. Velocity and anti-fragmentation caps apply. Approve does not execute.
2026-10-02 · PR #38 ·
c9c3459P0: signed authorization envelope
Approving a draft produces a signed authorization envelope covering amount, payee, asset, and expiry. Any mismatch, expiry, or missing key is refused. Approve does not execute. Execution: not enabled.