REST is the present; the ledger is the truth
An operator's REST integration tells them what just happened — a settled bet, a refunded round, a session reconnect. The audit ledger tells them what is true: a totally ordered, append-only event stream, signed and time-stamped, that survives every retry, every replay and every regulator inspection.
If the REST surface is the API, the ledger is the contract.
Why we ship the ledger to operators
Operators that consume the ledger reconcile faster. A nightly settlement run becomes a stream-sync; a regulator inquiry becomes a query, not a forensic excavation. Reconciliation desks stop building reconciliation tools.
The ledger never silently drops events. If it stops emitting, that is itself an event.
Schema discipline, not schema gymnastics
We version the event taxonomy and gate breaking changes behind a major version, with a deprecation window measured in months, not weeks. The audit ledger is the surface where backwards compatibility is most expensive, so it is the surface where we are most disciplined.
Idempotency keys, monotonically-increasing offsets, signed event envelopes. None of it is glamorous. All of it is non-negotiable.
What we do not do
We do not collapse settlement into a single REST call and hide the rest behind retries. We do not batch the ledger into a daily file dump. We do not tell operators to ‘just call the API again’ when something looks off.
The ledger is what we built first. Everything else hangs off it.