Evidence

Every claim in this documentation can be checked. This page lists what has actually run, with the transaction behind it and the command that reproduces it.

Nothing has run on Stellar mainnet, and no anchor is signed, so no real local currency has moved on Stellar. The runs below are on Stellar testnet with a mock anchor. The one run against real money is the prototype’s, on Tempo, and it is labelled as such.

Stellar testnet

Both runs on 17 October 2026, on Stellar testnet, signed through the signer interface.

The reference survives a real transaction

pnpm stellar:smoke sends a payment with a Corridor Reference as its MEMO_HASH, then asks Horizon for that account’s payments and finds the movement again by its memo — the join reconciliation uses, with no indexer in the path.

reference 0x020114290001a1494e71ec7073bfffc84d758d67d2c6cf255f57adc6fd6cb505
sent 0.1 XLM   → stellar.expert/explorer/testnet/tx/175ad420…54781c
read back 0.1 XLM with the same reference, decoded out of MEMO_HASH
ledger 5241532 · 2026-10-17T10:00:47Z

What	Result	Transaction
Payment carrying the reference in MEMO_HASH, read back off Horizon and decoded whole	Reference matched byte for byte; checksum valid	175ad420…

The reference decodes to version 2, kind payout, EUR → KES, public lane, payout id 01a1494e-71ec-7073-bfff-c84d758d67d2, and a valid checksum. See Corridor Reference.

pnpm stellar:wallets && pnpm stellar:smoke

A whole payout through the saga engine

pnpm stellar:payout plans a EUR → KES route, reserves the customer’s balance, opens an anchor order, funds it exactly once with a real Stellar payment, books every movement double-entry, and prints the ledger invariants.

What	Result	Transaction
Route planned, balance reserved, order opened and funded exactly once, every movement booked	Saga completed; checkInvariants() clean; customer balance closed to zero	ac025984…

pnpm stellar:payout

The funding payment carries the anchor’s own memo, not the Corridor Reference — memo_type: text, memo: mock-8313e798, as Horizon reports it. That is the real SEP-31 shape: a receiving anchor assigns the memo, so the reference travels in the SEP-31 fields and the join key becomes (anchor, transaction id) (ADR 0003). An earlier run took the simpler path with the reference in MEMO_HASH; both paths are exercised.

Both runs move XLM, because a funded testnet USDC trustline needs an issuer faucet. The USDC path is the same call with a different asset. The anchor in the payout run is MockPartner with chains: ["STELLAR"]: the route, the saga, the Stellar payment and every ledger entry are the real ones, and only the fiat side is simulated.

Against a real SEP server

The hardest thing to show without a signed anchor is that the SEP path works against something Corridor does not control. examples/anchor brings up Stellar’s own Anchor Platform, configured as a receiving SEP-31 anchor, and the same pnpm stellar:payout runs against it over the network.

./examples/anchor/up.sh
CORRIDOR_ANCHOR_BASE_URL=http://localhost:8080 \
CORRIDOR_ANCHOR_PLATFORM_URL=http://localhost:8085/ \
CORRIDOR_PAYOUT_CURRENCY=USD pnpm stellar:payout

Step	Result
SEP-1	stellar.toml discovered over HTTP at a base URL that is not the home domain
SEP-10	The anchor’s challenge verified before the vault signed it, and exchanged for a JWT
SEP-38	A firm quote: 7 stellar:native sold for iso4217:USD
SEP-31	Order opened with the quote, the beneficiary fields and the Corridor Reference; the anchor returned its receiving account and memo 13453
Funding	A real Stellar payment carrying the anchor’s id memo — ecc31ac7…
The anchor’s observer	The anchor saw the payment on-chain by itself and advanced the transaction
Polling	SEP-31 has no webhook, so the saga polled GET /transactions/{id} to completed
The books	paid 1538 USD at 2.1978; invariants clean; the customer’s balance closed to zero

No local currency moved: the anchor is Stellar’s reference implementation, run locally, and telling it the beneficiary was paid is a step a real anchor performs itself off its own rail. Everything on Corridor’s side of the exchange is real, and nothing in the adapter is stubbed. See examples/anchor.

Ramp, through the SDK

On 21 October 2026, pnpm ramp:demo ran the hosted API in-process against Stellar testnet and drove it only through @corridor/ramp-sdk, in testnet USDC (Circle’s testnet issuer). A sandbox app signed up; an end user was onboarded with a sponsored account and USDC trustline, holding no XLM; the user’s USDC was bought on the testnet DEX with the sponsor’s friendbot XLM (testnet has no USDC faucet, and this stands in for the user’s own deposit); and a 5 USDC payout ran to completed against the mock anchor. The order ran as a saga on the route planner and settled only after the reconciler found the funding payment on Horizon by the anchor’s memo and exact amount. The user’s key stayed in the script, which signed through the SDK’s signXdr hook.

Step	Result	Transaction
Sponsored onboarding	Account and USDC trustline created inside beginSponsoringFutureReserves, signed by the sponsor and the user	85614afc…
USDC into the trustline	10 USDC by path payment from XLM on the testnet DEX	bea90002…
Funding the anchor	5 USDC built by Ramp with the anchor’s memo, signed by the user, submitted in a sponsor fee bump; hash checked against the one Ramp built	51c67a8e…
Status and usage	Order completed once the anchor reported payout and Horizon showed the funding; /v1/usage reported 5 USDC routed to KES (64,450 minor units)	—

The sandbox plan charges no fee, so this run carried no fee operation; the fee path (a second payment to the fee account in the same transaction, matched before the fee is booked) is covered by the tests.

The test suite

Measure	Value
Tests	161 passing, no network (one more against Postgres when TEST_DATABASE_URL is set)
Stellar venue	20 tests: the reference on a real transaction shape, issuer identity, the held-key signer, and the Horizon quirks that would otherwise lose every memo
Routing	11 tests: hub enforcement, every route shape, the shielded refusal, the off-Stellar list
Reference codec	12 tests: encode, decode, checksum, version rejection, currency pairs
Ledger	7 tests: balance per asset, no-overdraft, exactly-once external refs, append-only, global invariants
Saga engine	6 tests: compensation order, manual_review, lease fencing under a real race
SEP anchor	16 tests against a stubbed anchor: discovery over HTTPS or a given base URL, the challenge check, the quote, the funding method read from the anchor’s own /info, the receiving account whether it arrives on the POST or the GET, both amount shapes, and the status mapping
Anchor funding	5 tests: the anchor’s memo is carried, the reference is the fallback, and a retry after a crash finds the payment instead of paying twice
Ramp	18 tests: fees in integer minor units and decimal-string rates, sponsored onboarding, the full withdrawal as a saga settled from Horizon, an anchor’s “completed” with no chain evidence refused, one payment never settling two orders, chain evidence surviving a concurrent anchor update, unsigned orders lapsing and compensating, a tampered transaction refused, quotes spent once and expiring, agent spending limits, tenant isolation, deposits, failed payouts, key expiry and rotation, webhook backoff and dead letters
Ramp SDK	7 tests over HTTP: signup to completed payout, idempotent replay and conflict, a collection link, agent tools under a policy, error codes, per-key rate limits with secret-free request logs, key rotation and dead letters
Ramp OpenAPI	2 tests: the spec documents exactly the served routes, and every $ref resolves
Partners, webhooks, signers, recon	The rest

pnpm test        # 161 tests
pnpm typecheck   # tsc -b, clean

Read-only reconciliation

pnpm watch:report runs the same observers and matcher against Stellar accounts Corridor does not control, with no keys loaded:

CORRIDOR_WATCH=GABC…,GDEF… pnpm watch:report

It is covered by five tests in packages/recon/src/readonly.test.ts — reference matching, heuristic matching, short, missing and unexpected — and has not been run against a design partner’s production accounts, because there is no design partner yet.

The prototype, on Tempo

Corridor’s earlier prototype settled on Tempo and reached its payout rails through bespoke provider APIs. It is a different repository and a different build; its result is kept here because it is where the saga engine, the ledger and the reconciliation matcher were proven against real money.

On 11 October 2026, the prototype moved real money end to end: 2.90 USDC.e on Tempo became ₦3,891.48 in a Nigerian bank account in 74 seconds. It went Tempo to Base and Base to Solana through Across, then Paj paid out in naira. The payout was funded by the founder and paid into the founder’s own account.

74 seconds

From the deposit (07:39:22 UTC) to the bank credit (07:40:36 UTC).

₦3,891.48 credited

Paj quoted ₦3,911.64 for 2.89 USDC at 1,350.74; ₦20.16 (0.5%) was deducted before delivery.

The reference in the narration

The bank statement line begins JIT corridor0201 — the start of the same reference that was on the chain.

Leg	Result	Transaction
Tempo USDC.e → Base USDC	2.90 in, filled in about 1 s	0x730f513c… → fill 0xb399654d…
Base USDC → Solana USDC	Filled in the vault’s own USDC account	0xa2d52268… → fill s6YKpCJ9…
Solana USDC → payout order	2.89 USDC to the order’s deposit address, reference in the Memo program	4sWxGHfG…
Payout	Order 6acb3d5488922b136a79182a COMPLETED	Bank credit: ₦3,891.48, narration JIT corridor0201

The reference was 0x020114280001a129e6df26764eac2e71fbadc2fb0d81d995c61e2bfb84995221: a payout from EUR to NGN on the public lane, with payout id 01a129e6-df26-764e-ac2e-71fbadc2fb0d. The public record is in examples/mainnet/payouts.json.

What carries over and what does not. The reference codec, the ledger, the saga engine, the partner interface and the reconciliation matcher are the same code, now on Stellar. The Tempo, Across, Zcash and NEAR packages were deleted rather than left dormant, and the prototype’s treasury console was removed rather than left reporting a chain this build no longer settles on. Stellar is Corridor’s home from here.

What is not evidenced

Stated here so nothing has to be inferred from an absence.

• No signed anchor, so no real local currency has moved on Stellar. The SEP path has run against Stellar’s own Anchor Platform locally, not against a licensed anchor.
• No mainnet run. Code paths are identical; nothing has run on Stellar mainnet.
• No SEP-6 collection, anywhere.
• No cctp.transfer, so no Stellar → Solana movement has happened.
• No stellar.pathPayment, so no on-ledger FX has run.
• No treasury console, for Stellar.

See Roadmap for what would change each of those.