> ## Documentation Index
> Fetch the complete documentation index at: https://docs.arcenpay.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Verify-Then-Settle Escrow

> Autonomous commit-reveal escrow primitive for machine commerce — locking funds, verifying deliverables cryptographically, and auto-refunding without human intervention.

When autonomous AI agents buy datasets, fine-tuned model weights, or compute results, counterparty risk is asymmetric:

* **Pay upfront?** The merchant could fail to deliver or return corrupted data.
* **Pay after delivery?** The buyer could consume the data and refuse to settle.

ArcenPay's **Verify-Then-Settle Escrow** implements an automated commit-reveal protocol that holds funds in reservation, allows the agent to autonomously verify deliverables against cryptographic commitments, and settles or refunds automatically **without human arbitration**.

```
┌─────────────────────────────────────────────────────────────────────────────┐
│                    VERIFY-THEN-SETTLE ESCROW PROTOCOL                       │
│                                                                             │
│  1. Reserve: Buyer Agent locks funds in escrow (status: RESERVED)           │
│     POST /api/v1/public/escrow/reserve                                      │
│                                                                             │
│  2. Commit & Deliver: Provider fulfills request with ProviderCommitment     │
│     { mode: "exact_hash", commitment: "sha256...", ... }                    │
│                                                                             │
│  3. Autonomous Verify: Buyer agent verifies deliverable locally:            │
│     exact_hash: SHA-256(canonical JSON deliverable) === commitment          │
│     schema_conformance: validates required fields, types & timestamp        │
│                                                                             │
│  4. Settlement or Dispute:                                                  │
│     • If VALID: Buyer confirms -> funds released to Provider (RELEASED)     │
│     • If INVALID: Buyer disputes -> funds refunded to Buyer (REFUNDED)      │
│     • If TIMEOUT: ArcenPay auto-refunds after challenge window              │
└─────────────────────────────────────────────────────────────────────────────┘
```

## Verification Modes

ArcenPay supports three autonomous deliverable verification modes:

1. **`exact_hash`:** The deliverable is deterministically serialized (sorted keys, canonical JSON) and its SHA-256 hash must strictly match the provider's commitment string.
2. **`schema_conformance`:** Deliverable must satisfy required structural properties, property types, and maximum age freshness without requiring byte-for-byte matching.
3. **`attestation`:** Deliverable carries an attestation signature from an approved oracle or verifier.

A reservation moves through four states: `reserved` (funds locked), `released` (verified and confirmed to the provider), `refunded` (dispute upheld or challenge window lapsed), or `disputed` (claim filed, pending resolution). Query it with `agent.getSettlementStatus()` or `GET /api/v1/public/escrow/status`.

## Using Escrow in the Agent SDK

The `@arcenpay/agent` SDK provides a streamlined drop-in method `agent.fetchEscrowed()`:

```ts theme={null}
import { ArcenAgent } from "@arcenpay/agent";

const agent = new ArcenAgent({
  privateKey: process.env.AGENT_PRIVATE_KEY!,
  chainId: 9100000,
});

// 1. Fetch under commit-reveal escrow terms
const { response, payload, verified, commitment, disputeReceipt } = await agent.fetchEscrowed(
  "https://provider.analytics.org/alpha/orderbook",
  {
    escrowMode: "exact_hash",
    maxPrice: "2.50",
  }
);

if (verified) {
  console.log("Deliverable verified! Funds settled to provider.");
  console.log("Data payload:", payload);
} else {
  console.warn("Verification failed! Automatic dispute filed.");
  console.log("Refund receipt:", disputeReceipt);
}
```

## Dispute Windows & Autonomous Refunds

Each reservation defines a `challengeWindowSeconds` (typically 300 to 3600 seconds):

* While the window is open, the buyer agent can file a `DisputeClaim` with cryptographic evidence (`actualPayloadHash`).
* ArcenPay evaluates the claim deterministically. If valid, funds are unlocked and refunded to the buyer's balance.
* If the challenge window expires with no dispute and no explicit confirmation, funds auto-finalize to the provider.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.