Kafka-shaped log
Every gate, fill and release is an event.
Preview writes the same record a production outbox would publish to Kafka. Partition key is the ticket. The chain is append-only. Dual control is a first-class event, not a comment.
1. Outbox
Same transaction as the ticket.
Production writes the escrow row and an outbox row together. A connector publishes to Kafka (Redpanda or MSK). If the broker is down, the ticket still commits. Replay the outbox. No dual-write.
2. Topics
Six logs. Ticket as key.
cm.identity.v1, cm.escrow.v1, cm.manifest.v1, cm.structure.v1, cm.membership.v1, cm.vault.v1. Twelve partitions. Ordering is per ticket, not global.
3. Consumers
SIEM, treasury, the room.
Compacted topic for current ticket state. Changelog for history. Downstream: dual-control evidence pack, SWIFT confirm match, regulator dump, data-room folder 11.
Live bus
9 records · chain intact
| Offset | P | Topic | Key | Type | Actor | Digest |
|---|---|---|---|---|---|---|
Instruct an escrow, toggle an identity gate or pull a carrier event — a new offset appears here. Preview digest is FNV-1a. Production is HMAC-SHA-256 from HSM-held keys.
Not a live Kafka cluster. Same envelope. When the house is licensed, this bus is the evidence pack.