Each one names a property, how it is enforced in code, and how it is
tested. Two of them have a record of the day they failed, what it cost, and why the tests that
existed did not catch it. Those are left in deliberately. A list of properties that have never
been broken is a list nobody has pushed on.
2 of the 13 have a record of the day they failed, marked in the index. Those are the ones worth reading.
Money
I1 Escrow pays out at most once per job
Exactly one of: released to the seller, or refunded to the buyer. Never both, never twice.
Enforced bystore.transition(), a synchronous compare-and-set that claims a job into settling before any transfer. It contains no await, so two requests cannot interleave.
Also enforced by the deadline sweeper, which observes Hedera's scheduled transaction rather than performing its own transfer when one is armed.
Tested byattack.js, five concurrent approvals against one job, exactly one accepted.
Broken on 2026-09-12. The sweeper released at the deadline and the scheduled transaction executed. Two 0.05 HBAR debits for one job, thirteen seconds apart, both visible on chain. The local tier hid it: there the check and the write sit in one synchronous block, while the Hedera path has four awaits between them.
I2 A paid job always exists
Once settlement succeeds, a job record exists before anything else is allowed to fail.
Enforced by ordering: settle, record the deposit, store the job, and only then arm the timer. Arming is best-effort and wrapped.
Tested byregression.js case 5, which injects a schedule failure and asserts the job is still present and held.
Broken on 2026-09-12. A transient mirror-node lookup inside scheduleRelease threw after settlement. The request returned 500 and the job was never stored: funds sitting in escrow with no record of whose they were.
I3 Losing the timer never costs the money
If the on-chain schedule cannot be armed, or is armed and never fires, the buyer's funds still resolve.
Enforced by the sweeper's fallback, which releases directly once the grace period (90 seconds by default) has passed beyond expiry with no execution.
Tested byregression.js case 5.
I4 Silence is not a veto
An unresponsive buyer cannot trap a seller's money. The review window always ends.
Enforced by a Hedera scheduled transaction armed at payment time, with the review deadline as its expiry and waitForExpiry(true).
Tested byprove-live.js case 3, which waits without intervening and confirms the release came from the schedule rather than from us.
Authority
I5 Only the buyer who paid may decide
Approve and reject are restricted to whoever made the payment.
Enforced by a claim token issued once in the payment response. Only its SHA-256 is stored, and comparison uses timingSafeEqual.
I6 The server never hands out what authorises spending
The stored token hash is never serialised to a client.
Enforced by stripping it in publicJob() before any job leaves the process.
I7 No work without payment
The agent is never invoked on an unpaid request.
Enforced by verifying the payment before doWork() is reached.
Truthfulness
I8 Every output states which tier produced it
A degraded result is never presented as a full one.
Enforced by a byline carried on every deliverable naming the worker tier and model.
I9 A local run never claims anything about Hedera
Running without keys produces no Hedera-shaped assertions.
Enforced by the stand-in tier labelling itself in the UI, in /health, and on every receipt.
I10 A transaction id is a real transaction id
Anything shown as a transaction id resolves for a third party on the mirror node.
Verifiable by you, on the proof page, without asking us.
I11 Upstream error text never reaches a buyer
Provider errors are not passed through.
Enforced by mapping failures to our own messages before they leave the process.
Secrets
I12 No secret is ever committed
Keys live outside the repository and never enter it.
Enforced by a pre-commit hook plus npm run check:secrets.
I13 A public endpoint never spends the server's own funds without a limit
The demo buy route is bounded, and can be switched off entirely.
Enforced by per-IP rate limiting, an input cap, and the DEMO_BUY switch.