AUDITOR — production wired (read-only)

Sample rows removed. Evidence projections via CASA_API.auditportal. Cannot mutate source records, permissions, publication, refunds, or audit history.

FINANCE LEDGER — receipts / refunds / settlements

Posted ledger entries are immutable. Refunds enforce requester≠approver≠executor SOD. Settlements match without rewriting history. No gateway payloads or religious/photo cells in finance views.

Read-only

Auditor workspace has no Add/Edit/Delete/Approve/Refund/Publish controls. Optional audit observations only.

Receipts

WhenRecordActor / subjectSummary