Musha

The manager asks in Shona. The owner reads it in English and approves with PayPal.
Two dashboards, one shop: the owner's console and the manager's chat.
The receipt names another supplier. Musha asks one question, and the owner releases US$84.00.
PayPal holds US$180.00 until the manager proves the spend.
PayPal's own record beside the proof at 100: US$172.00 released, US$8.00 back.

Two sisters, two cities, one shop. PayPal holds Chipo's money until Farai's proof releases it.

Chipo, a nurse in Leicester, owns a tuck shop in Mbare, Harare. Her sister Farai runs it. Each signs in to a dashboard of her own. Farai asks for stock money in Shona, in the shop's chat, and Chipo reads the request in English. Chipo approves with PayPal, and PayPal holds the money. Gemini reads Farai's receipt, the goods photo and the counter camera, and plain rules decide. PayPal captures exactly what the receipt proves, Payouts sends it to the shop, and the rest returns to Chipo.

Inspiration

Zimbabweans abroad sent home US$2.45 billion in 2025, by the Reserve Bank of Zimbabwe's count (RBZ 2026 Monetary Policy Statement). From January to August 2026 they sent US$1.86 billion, up 22% on the same months of 2025 (The Herald, citing RBZ statistics). Much of the economy it reaches is informal: 76.1% of business establishments (ZimStat, 2023 Economic Census, preliminary report).

Women stand at both ends of this corridor. 56% of Zimbabwe-born residents of England and Wales are women (ONS, Census 2021), and women hold 62% of informal-sector jobs in trade at home (from ZimStat's Q3 2024 Labour Force Survey).

Once the money lands, the sender loses sight of it. PayPal already holds money until it is captured, for up to 29 days. Musha lets the evidence decide the capture. Musha gives a remittance a receipt.

What it does

Musha works for any business owner and the manager who runs the business for them.

Two dashboards. The owner signs in to the owner's console: requests, approvals, calls, the week, the books and the money. The manager signs in to the manager's dashboard: the chat with Musha, buys, proofs, the day's close and the counter camera. Any owner creates a shop and invites a manager with a link.
The chat, wired to WhatsApp. Musha's chat with the manager is wired to the WhatsApp Business Cloud API: the manager's messages, photos and voice notes reach Musha through a signed webhook, and Musha's replies go back to the manager's WhatsApp. The same chat runs on the manager's dashboard. A manager links a number by sending a one-time code from it.
The hold. The owner approves with PayPal, and PayPal holds the money: US$180.00 for 40 trays of eggs.
The proof. Gemini reads the receipt, the goods photo and the counter camera. Plain rules check the supplier, the price, the date, every earlier receipt and the delivery the camera saw, then decide.
The release. PayPal captures exactly what the receipt proves, Payouts sends it to the shop, and the rest returns to the owner: US$172.00 released and US$8.00 back.
One question, then the owner. The oil receipt names Mbare bakery, and the request named Mbare wholesale. Musha asks the manager one polite question. The manager answers in Shona: wholesale ran out of oil, and the bakery had the same oil for four dollars less. The answer rides into the shop's call to the owner, and the owner releases US$84.00 on the owner's own button, with US$4.00 back.
The calls. The owner calls the shop, and the shop calls the owner when the money needs them. Gemini Live answers from the books, shows a fresh still from the counter and carries the owner's words to the manager, translated. Money moves on the owner's own buttons.
Wages. PayPal Payouts pays the manager's wages, US$60.00, on the record.
The mandate. The owner saves their PayPal in Vault once. Musha's agent approves routine stock inside the owner's terms (US$200 a request, US$500 a week, suppliers the owner has paid before, within 10% of usual prices) and brings everything else to the owner. When the day's close leaves sugar low, Musha asks for it itself, and the agent holds US$73.00 inside the terms.
The books. Transaction Search matches every PayPal hold, release, return and payout to a line in the books, and each shop's match reads that shop's own PayPal rows. The Money view, on AG Grid Enterprise and AG Charts Enterprise, sets each buy beside PayPal's own record with every PayPal ID.
Any counter. An old phone on the counter, or an IP camera through the bridge, gives the shop its eyes. The manager agrees to the counter camera first, and the owner's console shows when.

How we built it

PayPal, end to end. Each PayPal surface does one job.

Orders v2 with intent: AUTHORIZE. Every approval, by the owner or the owner's agent, places a hold on the owner's money.
Payments v2. A partial capture with final_capture takes what the receipt proves and returns the rest. A void returns a whole hold. A job reauthorizes each hold after the 3-day honor period and voids it before day 29.
Payouts. Captured money goes to the shop's PayPal. Wages go to the manager.
Vault v3. Setup tokens and payment tokens save the owner's PayPal once. The agent places merchant-initiated holds.
Transaction Search. Plain code matches PayPal's transactions to the ledger, line by line, by the IDs and custom IDs Musha puts on every order and payout.
Webhooks. Musha verifies every event with PayPal before it touches the books, and books each event once.
JavaScript SDK v6. PayPal's buttons approve each hold and save the owner's PayPal for the agent.
PayPal Agent Toolkit. The reconcile agent calls the toolkit's read-only tools and writes the owner's summary.
PayPal-Request-Id on every POST. A retry moves money once.

The books equal the money. Every ledger line carries a reference built from PayPal's own IDs. The API response and the webhook post to the same reference, so the books stay exact whichever arrives first.

Gemini reads. Plain rules decide. Gemini 3.8 Flash reads every photo and message into a JSON schema. The proof engine scores the reading in plain code. A contradiction turns a release into one question, whatever the score.

Sign-in and WhatsApp. Passwords are scrypt hashes with their own salts. Sessions are server-side rows keyed by a hash of the browser's token. The WhatsApp webhook checks Meta's signature over the raw body before it reads a byte, handles each message once, and sends Musha's replies through the Cloud API, with a template outside the 24-hour window.

The stack. FastAPI and SQLAlchemy on Python, with SQLite. React, TypeScript and Vite for both dashboards. AG Grid and AG Charts for the books and the money. One Google Cloud Run service serves the API and the web app. Litestream copies every database change to Cloud Storage. Cloud Scheduler runs the hold job, and Secret Manager keeps the keys.

Measured. 240 synthetic test receipts in two sets of 120, the second held out. Genuine receipts released: 80 of 80. Flawed receipts held: 160 of 160, each sent to a question with the money held. Every release is exact to the cent.

Challenges we ran into

Money that waits has a clock. A PayPal hold lasts 29 days, and capture belongs inside a 3-day honor period. Musha's hold job reauthorizes each hold once, after the honor period, and voids it before the limit.

Two messengers, one ledger. PayPal reports a capture in the API response and again in a webhook, in either order. References built from PayPal's IDs made every posting idempotent.

One sandbox, many shops. Every Musha shop shares one PayPal sandbox account, and PayPal lists its own balance holds and sweeps around each payment. Musha now ties each PayPal row to its shop by IDs and custom IDs it sets itself, so each shop's match reads that shop's money alone.

Decisions a person can audit. Money needs reasons the owner can read. Gemini reads, plain rules decide, and every reason sits on the card.

Accomplishments that we're proud of

One PayPal loop, end to end: a hold, a partial capture with the change returned, a void, Payouts, a Vault-backed agent, Transaction Search and verified webhooks.
An exact release: on a US$180.00 hold, PayPal captured US$172.00 and returned US$8.00.
A measured proof engine, with every flawed receipt held for a question.
An agent that spends inside written terms and explains each approval.
An owner and a manager, two dashboards, one chat on WhatsApp.

What we learned

An authorization is the right shape for money that waits for proof. PayPal holds, captures a part, and returns the rest. Musha adds the evidence.
The model reads, and the rules decide. An owner trusts a decision they can read.
Families at home already build trust on open records. One Zimbabwean woman in four saves in a savings club (World Bank Global Findex 2025). Musha gives every shop run from afar the same open record.

What's next for Musha

A vision, marked as one.

Mobile money wallets top up the shop's PayPal, and cash on the counter becomes money the owner can see.
The manager's record. Every receipt builds the manager's record, and a lender reads it. Bank credit reaches 1% of small business owners in Zimbabwe today (FinScope MSME Survey 2022).
More rails. The same proof engine runs on any remittance rail with an API.

Run your business at home from anywhere. Musha means home, in Shona.