Reconciliation needs evidence, not another export

A CSV can match and still fail to explain

Finance teams need rows and totals, but an operational dispute asks harder questions: who created the obligation, what changed, which payment satisfied it, whether a callback was delivered, and whether an event sequence has been altered.

The Government Payments design exposes both tabular payment and reversal views and a cursor-ordered event stream. Those are complementary products: one supports accounting work; the other supports provenance and investigation.

Operating principleMatching answers what. Evidence answers how, when, and by whom.

Chain the event history

Each published event carries a payload hash, previous hash, and event hash. This does not turn an ordinary database into a blockchain, and it should not be marketed that way. It creates a practical tamper-evident sequence: later verification can detect a changed payload or a broken chain.

Correlation IDs connect the same operation across caller logs, service logs, stored events, and polling responses. Actor and source fields preserve institutional context. Cursor order gives consumers a deterministic resume point.

• Keep the business identifier and the transport correlation together.
• Hash canonical event payloads, not presentation-specific exports.
• Let consumers resume after a durable cursor.
• Provide filtered finance exports without weakening the event record.

Delivery is a second state machine

A committed payment event and a delivered callback are different facts. The outbox separates them: the business transaction commits once, while a background dispatcher signs and delivers the notification.

Transient failures retry with backoff. Permanent client errors become dead letters. Operators can inspect and retry delivery without replaying the payment. That separation is what makes callback recovery safe.