Struct ReceiptPayload 

pub struct ReceiptPayload<'a> {
    pub kind: &'a str,
    pub reference: &'a str,
    pub amount: &'a str,
    pub currency: &'a str,
    pub recipient: &'a str,
    pub method: &'a str,
    pub timestamp: &'a str,
    pub tool_call_id: &'a str,
    pub approval_pos: &'a str,
    pub approved_args_hash: &'a str,
    pub subject: &'a str,
}

The receipt body fields receipt_payload signs, named at the call site.

Replaces positional &str arguments: with the positional form, two same-typed fields (e.g. recipient and method) could be swapped at a call site and still compile, silently signing a corrupt receipt. Naming the fields here makes such a swap a compile error.

The field set, names, and the order they are serialized in receipt_payload are the signed-payload contract: they must NOT change without a version bump, or previously-persisted receipts stop verifying.

kind and the trailing four fields are v2 additions: the event kind (direction) plus the binding tuple and an opaque subject. Inbound (the server was paid) receipts have no approved tool call, so they pass empty strings for the binding tuple and subject; outbound (the control plane paid a 402 service) receipts populate them. Both directions sign their kind.

Fields

kind: &'a str

The event kind the payload is stored under (payment_receipt for inbound, outbound_payment_receipt for outbound). Signed so a payload cannot be re-filed under the other direction’s kind (v2; empty for legacy v1).

reference: &'a str

Chain/transaction reference (e.g. tx id) the receipt settles.

amount: &'a str

Decimal amount as a string (avoids float drift).

currency: &'a str

Currency / asset symbol.

recipient: &'a str

Recipient address.

method: &'a str

Settlement method (e.g. tempo).

timestamp: &'a str

RFC3339 settlement timestamp.

tool_call_id: &'a str

The paid_fetch tool-call id this payment answered (v2; empty for inbound and legacy v1).

approval_pos: &'a str

Decimal string of the approval_request log position the payment answered (v2; empty for inbound and legacy v1).

approved_args_hash: &'a str

sha256 hex of the approved args_json — the same idempotency-key component the outbound_payment_attempt marker carries, so a verifier can cross-check the receipt against the attempt (v2; empty otherwise).

subject: &'a str

Opaque principal the spend is attributed to. Currently the conversation id; the structured agent/tenant identity is supplied later by the declarative-catalog identity model. Treat as opaque (v2; empty otherwise).

Trait Implementations

impl<'a> Clone for ReceiptPayload<'a>

fn clone(&self) -> ReceiptPayload<'a>

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'a> Copy for ReceiptPayload<'a>

impl<'a> Debug for ReceiptPayload<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.