Contract-to-revenue infrastructure · v1.0.2

AI reads the deal.
Code counts the money.

RoyaltyOS turns PDF agreements into human-reviewed financial rules, reconciles PayPal revenue, and pays contributors — with every cent traceable to a clause, a rule, and an approval.

Open RoyaltyOS → Run the amendment demo

Boundary: AI interprets. Deterministic software calculates. Humans authorize. PayPal moves money.

Supabase·OpenAI Structured Outputs·PayPal Sandbox·ClamAV·Render
RULESET ACTIVEa3f9…c41d

Producer · post-recoupment 20%

Frozen · hashed · compiler-validated

SETTLEDlargest-remainder

$0.00

Conserved to the cent · ledger balanced

PAYOUT SUCCESSidempotent

PayPal batch · no duplicates

Approved by finance · step-up verified

How it works

Four gates. No silent money.

  1. 01

    Upload & seal

    PDF magic-byte, size and page validation, SHA-256 hash, ClamAV scan in production, immutable version in private Supabase Storage.

    contract_v3.pdf · sha256 9be2…77aa

  2. 02

    AI extracts, humans decide

    OpenAI Responses API with strict JSON schema reads up to 3 prior versions, flags contradictions — ambiguous rules stay review-required until a person approves.

    REVIEW_REQUIRED clause 4.2 vs amendment §2

  3. 03

    Deterministic settlement

    Fixed-precision engine: percentages, recoupment, caps, floors, date gates, largest-remainder allocation. What-if simulations never post.

    $12,480.00 → $2,496.00 + $9,984.00 · Σ conserved

  4. 04

    Approve, then PayPal pays

    Finance re-authenticates, approves, executes idempotent payout batches. Webhooks + polls reconcile every item; only failed items retry, as a new version.

    PAYOUT SUCCESS batch 7f3a · key 1ca9…

Guarantees

The LLM never touches money.

Deterministic engine

Same rules + same revenue = same payout, every time. Money-conservation invariants enforced in SQL.

Human approval gate

Password step-up + finance role required. Approved lines are immutable.

Idempotent payouts

DB locks + unique payout version + PayPal ids. Retries can't double-pay.

Hash-chained audit

Every state change leaves a tamper-evident row. Integrity RPC on demand.

Private contracts, scanned

Immutable versions in a private bucket. Malware scan fails closed.

Read-only PayPal AI

Official PayPal MCP, restricted to list/get. Mutation prompts rejected pre-call.

Amendment demo

Watch a 5% change get caught.

The demo amendment cuts Producer's post-recoupment share from 20% to 15%. RoyaltyOS surfaces it for human review instead of silently activating.

Producer post-recoupment20%
Producer post-recoupment20%

CONSISTENT no conflict with prior versions

Open in Contracts → fixtures/demo/royaltyos-demo-agreement-v1.pdf

Who does what

Four seats, one ledger.

Contract Manager

Creates contracts, uploads PDFs, runs AI analysis, shepherds review → activation.

Finance

Reviews settlements, verifies identity, approves, executes and retries payouts.

Contributor

Sees only their own lines — clause → rule → revenue → payout, end to end.

Auditor

Reads Insights + Audit: hash chains, ledger balance, CSV exports. No pay buttons.

Start in minutes

Open the sandbox control room.

Sign in, bootstrap a workspace, upload the demo PDFs, and follow the User Flow to your first reconciled payout.

Open RoyaltyOS → View Insights