# Social trading receipts and follows — September 30, 2026

The goal is to connect trading to useful discussion without letting a shared post
pick another person's amount, wallet, recipient or signing permissions.

## Confirmed Spot receipts

After a successfully verified protected Kuru Spot trade, the user can share it
from the order panel or a completed assistant Spot ticket. Publication requires
an explicit public disclosure checkbox and an optional separately written note.
Editing that note resets consent. Account/hash changes clear the composer. The
private assistant conversation and wallet balance are not copied into the post.

The backend requires an Orb session plus a verified Privy token bound to that
profile's own non-imported Orb Wallet. It independently reads the transaction,
successful receipt, canonical block header, current/historical pinned contract
runtime code and pinned market parameters on Monad testnet 10143. Only canonical
direct market buy/sell calls with positive minimum output, non-margin execution,
fill-or-kill, exact native value and matching sender/chain/receipt are accepted.
User-submitted receipt objects do not establish a badge or override verified values.

The card labels its output as the **contract minimum**, not an actual fill, PnL,
complete history, advice or a proof of trading skill. It is one selected transaction.
“Verified when published” is a historical check, not a continuously monitored
badge. Six receipt publications per user per minute are allowed inside the
general feed limit. No RPC is called for each card on each timeline load.

Receipt hash uniqueness and a transactional post/receipt insert make retries
idempotent. A different profile cannot take an already shared receipt. The feed
stores canonical public receipt JSON and joins it once into normal post reads.
Foreign-origin writes, missing consent, failed/pending transactions and mismatched
wallets are rejected. General text/media publishing remains available as before.

## Independent check and a new quote

`/spot/receipt.html#tx=<hash>` is a static read-only verifier. It reads the public
Monad RPC, needs no Orb account, does not call the Orb feed API and never connects
to or signs with a wallet. The portable directory includes the generated bundle,
readable validation source and public contract pins. Build with
`node scripts/build-spot-receipt.mjs`. It can be hosted independently.

The verifier relies on the chosen public RPC; it is not a trustless light client
or an audit of Kuru's code. Cross-check with independent sources when appropriate.
Code pins fail closed on changes and require an explicit new review.

“Prepare my own swap” opens only the venue, side and source hash. The amount starts
blank. No quote, signature, approval or trade is sent automatically. The recipient
chooses an amount, requests a fresh quote and uses the existing reviewed signer.

## Follow people

Authenticated profiles can follow/unfollow public feed authors. The relationship
uses an idempotent explicit boolean write, not a racing toggle. Following shows
the viewer's own public posts and public posts from the people they follow, capped
at 100 per read (bounded topic searches retain the existing limits). Private
profile fields still use the previous profile-access checks. Following is not a
friendship, invitation, role grant or permission to read private messages.

## Validation and limitations

`test-orb-social.mjs` uses real local-EVM transfers, protected buy/sell receipts,
calldata tampering and real route/SQLite persistence with fixture Privy ownership.
`test-orb-social-ui.mjs` tests following, public consent/reset and a new blank-amount
swap at mobile width. These do not replace live authentication rehearsal or audit.
Feed follows, post storage, moderation and discovery remain hosted by Orb.