# POINTS changelog What shipped to production at thepoints.io, by commit. Dates are America/Phoenix. ## 2026-10-07: Blog: five user-group posts and a footer Products section PR #63 · commit `bd5d4d6` Five blog posts, one each for AI agents, agent operators, merchants, consumers, and developers, plus a Products section in the site footer. No change to product behavior. ## 2026-10-07: UC-21: saved-payee cycle drafts and an admin mandate view PR #61 · commit `2fbda2d` Mandate cycles can be drafted to a saved payee and need a fresh human approval each cycle. Approvals expire after 1 hour by default, and there's no automatic cycle scheduler yet. Money doesn't move while execution is not enabled. Adds a session-authenticated route that drafts a cycle payment to a saved payee, a read-only internal admin view of mandates for POINTS staff, and refuses a cycle claim made before the cycle date with HTTP 409. ## 2026-10-07: UC-21: authenticated mandate routes PR #60 · commit `be3e5b5` Session-authenticated API routes (not available over MCP) to create, list, read, prepare, skip, and cancel recurring payment mandates, plus attach and claim routes for cycles. A claim records the claim only, returns executed: false, and does not move money. ## 2026-10-07: UC-21 follow-ups PR #59 · commit `209d7f6` Expired or revoked cycle approvals can be reopened only with a fresh approval; cycles that may have been attempted are marked refused. Attaching a payment requires the mandate amount, currency, and payee to match, and claims re-check UC-26 scope (per-payment limits and the counterparty allow-list; usage across payments is not persisted yet). Unattended claims are refused unless the authorization allows them. Transaction errors are logged by type without secrets. ## 2026-10-07: Test suite fixes PR #58 · commit `3f7e262` Updated outdated unit tests; no change to product behavior. ## 2026-10-07: UC-21 recurring mandate hardening PR #57 · commit `51cfb7e` Only the mandate owner or the recorded approver can attach an approval. Mandate rows are locked during changes, a retried prepare returns the same cycle, and a claim and the move to the next cycle date commit together. ## 2026-10-05: UC-21: recurring mandates with a fresh approval each cycle PR #55 · commit `d359aa1` Adds recurring payment mandates and cycles. A mandate is not a standing approval: each cycle needs its own fresh, unused human approval, and prepare or claim is refused without one. Approve does not execute. Execution: not enabled. ## 2026-10-05: UC-26: approval scope on spend envelopes PR #56 · commit `fb31df1` Spend envelopes can carry a payment-count cap, a total cap, and a counterparty allow-list (empty means the approved payee only). Reusing an interactive approval unattended is refused by default. Aggregate caps are in progress: usage across multiple payments is not persisted yet. ## 2026-10-05: UC-22: spend envelope and approval ledger PR #53 · commit `8399901` Approving a draft records a signed spend envelope, and every decision (approved, revoked, expired, denied) is appended to an approval ledger. A human still approves from the draft. Approve does not execute. ## 2026-10-02: Payee external account id field PR #52 · commit `07de613` Payees can store the ACH provider's external account id, set by staff or the account owner. Only the id is stored, never routing or account numbers, and no payment path reads it yet. ACH settlement: not enabled. ## 2026-10-02: get_payment_status reports revoked PR #47 · commit `5e30a4e` get_payment_status now returns the revoked status for a revoked authorization instead of a tool error. ## 2026-10-02: Policy schema versioning PR #46 · commit `220cc20` Policy vocabulary responses and prepared drafts carry a policy schema version. A client that sends an unsupported version is refused before any spend is reserved. ## 2026-10-02: Revocation and zero clock skew PR #45 · commit `e42af70` An approved authorization that has not executed can be revoked; its status becomes revoked and its signature is cleared. Expiry checks allow zero clock skew. ## 2026-10-02: Cash bucket accounting PR #44 · commit `204b5dc` Spend accounting separates unreserved, reserved, and escrowed cash, so outstanding drafts and holds are not counted as spendable. The available balance shown is unreserved cash only. ## 2026-10-02: Read-time expiry from executableUntil PR #43 · commit `b00b03e` An approved authorization past its executableUntil time reads as expired immediately, and its reserved spend is released. ## 2026-10-02: Atomic reserve to settle PR #42 · commit `249b991` Preparing and approving a draft, and the settlement step, use row locks and conditional updates, so concurrent requests cannot reserve the same spend twice. A lost race is refused. ## 2026-10-02: ACH scaffolding (fail-closed) PR #41 · commit `6e2aaa2` Internal ACH provider scaffolding. Every ACH path is refused by default. ACH settlement: not enabled. ## 2026-10-02: P2: escrow, charge on 2xx, graduated autonomy PR #40 · commit `07f2c71` Code for escrow before work, charging only after an HTTP 2xx with the fee taken before sending, and graduated autonomy by merchant, amount, frequency, and history. These patterns require execution (not enabled). ## 2026-10-02: P1: spend reservation, policy vocabulary, velocity caps PR #39 · commit `63f4546` Stale pending drafts expire, and outstanding drafts reserve spend against daily and monthly limits. The canonical payment-category vocabulary is available over MCP, and unknown categories are denied. Velocity and anti-fragmentation caps apply. Approve does not execute. ## 2026-10-02: P0: signed authorization envelope PR #38 · commit `c9c3459` Approving a draft produces a signed authorization envelope covering amount, payee, asset, and expiry. Any mismatch, expiry, or missing key is refused. Approve does not execute. Execution: not enabled.