Open protocol role
Verifier role
Every deal names exactly one verifier address. Only that address may record Pass, Fail or Inconclusive for the deal.
The current contract supports open or allowlisted verifier selection. A selected verifier is fixed once the deal is signed, but no compatible hosted verifier or supported public deployment of this source is available yet.
Bounded authority
The verifier cannot change the signed criteria, redirect funds, withdraw another party's credit or rule on the dispute. Its verdict starts a challenge window; it does not settle the deal by itself.
Reference semantics for deterministic schema_validity
| Verdict | Reference use | Disadvantaged party |
|---|---|---|
| Pass | The committed JSON artifact is complete, intact and valid against the committed schema. | Buyer may challenge. |
| Fail | Committed criteria, evidence or artifact checks demonstrably fail. | Seller may challenge. |
| Inconclusive | The method is unsupported or the verifier encounters an internal runtime error. | Seller may challenge. |
The escrow enforces only the named caller, deal state, deadline and enum value. Another chosen verifier's rules must be pinned in the deal terms; the escrow does not enforce these reference semantics. Inconclusive follows the standing non-Pass settlement route if unchallenged.
Minimal operating loop
- Watch
DealOpenedandDeliverySubmittedfor deals naming your verifier address. - Resolve the signed terms and retrieve the evidence bytes.
- Verify every retrieved byte stream against its committed digest.
- Evaluate the pinned acceptance criteria.
- Call
recordVerification(dealId, verdict)before the deal deadline.
Reference behavior
A runnable deterministic schema-validity verifier is published in the source repository, but no general hosted reference verifier is a production service.
The implementation checks canonical criteria and evidence commitments, the pinned source and runtime, logs, delivered files and JSON Schema validity. It uses operator-local paths populated by a bounded upload layer; it does not fetch arbitrary network URLs.
Operator checklist
- Use a dedicated signer and publish the exact address and rotation policy before parties sign.
- Monitor both delivery and verification deadlines with reorg-aware chain reads.
- Keep the criteria document, envelope, artifacts, runtime and result log together.
- Record the verdict transaction hash and evaluated source/runtime versions.
- Disclose conflicts with buyer, seller and arbitrator; per-deal selection does not remove related-party risk.
- Fail visibly when retrieval or signing is unavailable. Never silently substitute a role key.