cascrow-cli 1.4.0 → 3.1.0

package/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## 3.1.0 — 2026-10-20
+
+Prepared as 3.0.1 (texts only) and never published; new options made it a minor release.
+
+- **New command `cascrow human-review --contract <id> [--milestone <id>] [--reason "…"]`** (either party asks a person at cascrow to review a verification outcome, Art. 22(3) GDPR; decided within one month, both parties receive the decision with its reasons) **and `cascrow human-review --contract <id> --list`** (the requests and their decisions). A request already open prints its deadline and exits 0. A refused call's error now carries the server's body.
+- The review-queue help no longer says an undecided milestone completes after 48 h or 14 days: it completes when its window closes only when the panel's own YES opened the review and the contract's terms let silence count; any other review goes to cascrow's human review.
+- **`cascrow create` takes `--review-days <n>`** (your review window, 2–30 days, default 14; under 7 only if both parties registered as businesses) **and `--panel-alone`** (the panel decides alone: YES above 85 % completes, anything else is a rejection the builder can resubmit against). The server validates both and answers with its own sentence.
+- `cascrow verify` says "5 AI models run by 5 different providers" (was "5 independent AI models").
+- New hint for **`SCREENING_UNAVAILABLE`** (the new-money sanctions screen fails closed — nothing was created; retry), and the V3 text table carries the no-arbiter veto sentence.
+
+The 3.0.1 notes, unchanged:
+
+- The wallet-linking instructions (the custody-path refusal and the builder agent) follow cascrow's Sign-In with Ethereum challenge: `GET /api/user/wallet/challenge?address=<your wallet>`, sign the returned message with that wallet, `POST /api/user/wallet` — or `npx cascrow-signer@0.2.0 link`. The old one-line challenge is refused by the server.
+- `cascrow v3 sign` runs the pinned `cascrow-signer@0.2.0`; 0.1.0 can no longer link a wallet.
+- The builder agent names the panel's OpenAI model correctly (GPT-4o-mini).
+- The package now carries its MIT `LICENSE` and ships only `index.js`, `README.md`, `CHANGELOG.md` and `LICENSE`. `builder-agent.js`, a demo agent that no command runs, stays in the repository.
+
+## 3.0.0 — 2026-09-27
+
+- **`cascrow join` says what the builder can do now**: a $0 verification contract is active at once; a contract with an amount waits for the payer's MilestoneEscrowV3 offer, accepted with your own key (`npx cascrow-signer@0.1.0 accept --milestone <id>`). The JSON carries the server's `status` and `activated`. The builder agent prints the same.
+- **`cascrow review --decision APPROVE`** says "approved and completed (a verification-only contract: no money moves)" and prints the contract status; the "escrow is being released" line and the "Release tx" it never received are gone.
+- **New outcome `NOT_COMPLETABLE_WITHOUT_ESCROW`** at `cascrow verify --proof` (stream), `cascrow verify --contract` (the one-shot submit: the server's 409, with its hint) and `cascrow status` (the new `notCompletableWithoutEscrow` field ends the wait): the panel approved a milestone that carries an amount without a MilestoneEscrowV3 escrow — nothing completed it, no money moved, contact support.
+- **Breaking: `releaseHoldUntil` / `release_hold_until` are gone** from `verify` and `status` output; a bare `VERIFIED` no longer promises a retried release. `passed` on the one-shot `verify --contract` is `verdict === "approved"`.
+- **Breaking: `cascrow fund` is removed** (cascrow Phase 6 — the v2 RLUSD escrow is gone). It now only prints why: a contract with `--amount 0` is active by itself once the builder has joined, and a milestone with an amount is a MilestoneEscrowV3 escrow in native XRP — `cascrow v3 offer`, the builder accepts (`cascrow v3 sign accept`), and the payer funds with one transaction from their own machine (`cascrow v3 sign fund`). Nothing is sent.
+- The `escrow-fund` refusal and the help text no longer point at `escrow-prepare` / `escrow/sync` (both removed); `--amount` is described as the switch to the MilestoneEscrowV3 offer flow.
+- A COMPLETED milestone no longer reads "funds released": the line says whether no money was held (verification only) or a MilestoneEscrowV3 escrow paid out on chain. `review` / `review-queue` describe a verdict that completes or hands back a verification-only milestone and moves no money.
+- The builder agent (`builder-agent.js`) waits for the milestone to be active rather than "funded", and its demo deliverable describes the product as it is now.
+
+## 2.1.0 — not published on its own, released as part of 3.0.0
+
+- `cascrow v3 offer | acceptance | accept-submit | prepare | report-tx | attestation | claims` — the MilestoneEscrowV3 remote calls. `cascrow v3 sign <command…>` runs the PINNED local signer (`npx cascrow-signer@0.1.0`) with this terminal attached; the CLI itself stays dependency-free and never sees a key.
+- `cascrow fund` refuses a MilestoneEscrowV3 milestone with the way to fund it; every V3 refusal code prints what can be done about it; a V3 verification reads as a recommendation that moves no money.
+
+## 2.0.0 — not published on its own, released as part of 3.0.0
+
+- **Breaking: `cascrow escrow-fund --private-key` is removed.** It sent your EVM private key to cascrow, which signed the deposit server-side; cascrow no longer accepts, stores or signs with anyone's key. Fund a v2 escrow by signing locally: `GET /api/agent/escrow-prepare` returns the two unsigned transactions, you sign and broadcast them with your own wallet, then `POST /api/escrow/sync`. Funding a MilestoneEscrowV3 contract from an API client is not available yet. **If you ever passed a private key to this command, treat that key as exposed and move its funds to a new wallet.**
+- `cascrow register` no longer receives a generated wallet: registration returns `wallet: null` and a note on how to link your own (`GET /api/user/wallet/challenge` → sign → `POST /api/user/wallet`).
+
 ## 1.4.0 — 2026-09-25
 
 - New `cascrow status --proof <id> [--wait]` — show, or wait for, a proof's verification result. `submit` now points to it: verification starts by itself after an upload.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cascrow
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,8 +1,8 @@
 # cascrow-cli
 
-Command-line interface for [Cascrow](https://cascrow.com) — trust infrastructure for the agent economy (AI verification, on-chain reputation, milestone escrow) on the XRP Ledger, for shells, CI pipelines, and subprocesses.
+Command-line interface for [Cascrow](https://cascrow.com) — trust infrastructure for the agent economy (AI verification, on-chain reputation, and a non-custodial milestone escrow in native XRP), for shells, CI pipelines, and subprocesses.
 
-AI agents and their operators use Cascrow to create milestone-based contracts, submit proof of completion, and get verified by a **5-model AI majority vote** — with funds released automatically on-chain. No humans required.
+AI agents and their operators use Cascrow to create milestone-based contracts, submit proof of completion, and get verified by a **5-model AI majority vote**, anchored on the XRP Ledger. For paid work the AI verdict is a signed, non-binding recommendation: the money sits in a MilestoneEscrowV3 smart contract that only the parties (or an arbiter they chose) can move — cascrow holds no key that can move escrowed funds and never signs an escrow transaction.
 
 ## Install
 
@@ -51,8 +51,6 @@ is never anchored.
 | `register` | Create an agent account, get an API key instantly | No |
 | `verify` | Submit proof and get an AI verdict in one call (recommended) | Yes |
 | `create` | Create a milestone contract | Yes |
-| `fund` | Activate a milestone (simulation — no on-chain tx) | Yes |
-| `escrow-fund` | Fund a milestone with real on-chain RLUSD escrow | Yes |
 | `submit` | Upload proof text — verification starts by itself; returns `proofId` | Yes |
 | `status` | Show, or `--wait` for, the verification result of a proof | Yes |
 | `get` | Get contract status and milestones | Yes |
@@ -60,7 +58,11 @@ is never anchored.
 | `handoff` | Send a contract invite to a Builder agent by Agent ID | Yes |
 | `check-invites` | Check pending contract invites for this agent | Yes |
 | `review-queue` | As funder: list milestones still waiting for your verdict | Yes |
+| `v3-claims` | As payer: list MilestoneEscrowV3 claims you can still object to on chain | Yes |
+| `v3 offer \| acceptance \| accept-submit \| prepare \| report-tx \| attestation \| claims` | MilestoneEscrowV3, remote half — cascrow prepares and reads, you sign | Yes |
+| `v3 sign <command…>` | Runs the pinned local signer, `npx cascrow-signer@0.2.0 <command…>` — your key stays on your machine | Signer's own |
 | `review` | As funder: approve or reject a milestone under manual review | Yes |
+| `human-review` | Either party: ask a person at cascrow to review a verification outcome (Art. 22(3) GDPR), `--list` its decisions | Yes |
 | `me` | Print this agent's ID | Yes |
 
 Run `cascrow --help` (or `cascrow`) any time for the full, always-current option reference.
@@ -85,7 +87,7 @@ Exactly one of `--pr`, `--code`, or `--image` is required alongside `--task`.
 --key-name <name>       optional label for the API key (default: cli)
 ```
 
-### `verify` [one-shot — recommended for escrow contracts]
+### `verify` [one-shot — recommended for text proof]
 
 ```
 --contract <id>         required  contract ID
@@ -100,7 +102,8 @@ Exactly one of `--pr`, `--code`, or `--image` is required alongside `--task`.
 ```
 --title <title>         required  short milestone title (printed on the certificate)
 --days <n>              optional  deadline days from now (default: 7)
---amount <usd>          optional  RLUSD to lock in escrow (default: 0 = verification-only)
+--amount <usd>          optional  default 0 = verification-only (active once the builder joins);
+                                  above 0 = a MilestoneEscrowV3 escrow in native XRP (see below)
 --criteria <text>       optional  what the AI panel checks the proof against (max 4000 chars)
 --criteria-file <path>  optional  the same, read from a file
 --checklist-file <path> optional  JSON array of { title, severity?, id? } (max 20), scored item by item on text proofs
@@ -110,21 +113,8 @@ Exactly one of `--pr`, `--code`, or `--image` is required alongside `--task`.
 Keep acceptance criteria out of `--title`: the title is printed on the public
 certificate, and the panel judges the proof against `--criteria`.
 
-### `fund`
-
-```
---contract <id>         required
---milestone <id>        optional  defaults to first available
-```
-
-### `escrow-fund` [real on-chain RLUSD — agent's own wallet]
-
-```
---contract <id>         required
---private-key <key>     required  EVM private key (funds come from this wallet)
---amount <usd>          IGNORED   the escrowed amount is the milestone's own amountUSD
---milestone <id>        optional
-```
+`cascrow fund` was removed in 3.0.0: a verification-only contract needs no funding,
+and a paid milestone is funded by the payer's own transaction (`cascrow v3 sign fund`).
 
 ### `submit` [or use `verify` for text proof in one call]
 
@@ -175,16 +165,16 @@ No options.
 ### `review-queue`
 
 No options. Lists the contracts on which you, as funder, still owe a manual
-verdict — the pull behind the `manual_review.required` webhook. A webhook nobody
-received is a decision nobody makes, and cascrow auto-approves an undecided
-milestone after 48 hours (agent contracts) or 14 days (human) and releases the
-escrow, so poll this whenever you have funded work in flight.
+verdict on a verification-only contract — the pull behind the
+`manual_review.required` webhook. A webhook nobody received is a decision nobody
+makes; cascrow completes an undecided milestone when its review window closes
+only when the panel's own verdict opened the review with a YES — any other review goes to cascrow's human review instead; the window is the contract's `reviewWindowDays` (default 14 days; 48h on an agent contract created before 2026-10-20 in review mode `MANUAL_AUTO` or `AUTO`). A verdict completes or hands back the milestone and moves no money.
 
 ### `review`
 
 ```
 --contract <id>         required  from `cascrow review-queue`
---decision <APPROVE|REJECT>  required  APPROVE releases the escrow; REJECT returns
+--decision <APPROVE|REJECT>  required  APPROVE completes the milestone; REJECT returns
                                   the milestone to the builder, who can resubmit
 --milestone <id>        required once more than one milestone of the contract is
                                   pending review; `review-queue` names it
@@ -224,18 +214,25 @@ Five AI models vote in parallel on submitted proof:
 
 | Confidence | Outcome |
 |---|---|
-| > 85% + 3/5 YES | **VERIFIED** — funds released on-chain automatically (escrow contracts only) |
+| > 85% + 3/5 YES | **VERIFIED** — a verification-only milestone completes; for a MilestoneEscrowV3 milestone it is a recommendation, and the money moves only by the parties' own on-chain calls |
 | 60–85% | **PENDING_REVIEW** — manual review triggered |
 | < 60% | **REJECTED** — resubmit with stronger proof |
 
-## Example: Escrow Flow (RLUSD locked on-chain)
+## Example: Paid milestone (MilestoneEscrowV3, native XRP, testnet)
 
 ```bash
-cascrow create --title "Deploy API" --amount 100 --days 14
-cascrow escrow-fund --contract <contractId> --private-key 0x...
+cascrow create --title "Deploy API" --amount 100 --days 14          # as payer
+cascrow v3 offer --milestone <id> --review-period-sec 259200        # terms frozen at an XRP/USD rate
+cascrow v3 sign accept --milestone <id> --network testnet           # as builder: check + sign locally
+cascrow v3 sign fund --milestone <id> --network testnet             # as payer: ONE transaction from your machine
 cascrow verify --contract <contractId> --proof "API live at https://api.example.com, all endpoints responding"
+# The verdict is a recommendation. The builder claims on chain; the payer releases or objects.
 ```
 
+`cascrow v3 sign …` runs the pinned local signer (`npx cascrow-signer@0.2.0`), which keeps
+your key on your machine. This CLI never takes a private key (`escrow-fund`, which did, was
+removed in 2.0.0 — if you ever passed a key to it, treat that key as exposed and move its funds).
+
 ## Example: Agent-to-Agent Handoff
 
 ```bash
@@ -252,7 +249,7 @@ cascrow join --invite <code>
 
 | Chain | Purpose |
 |---|---|
-| XRPL EVM Sidechain (Chain ID 1449000) | RLUSD escrow smart contract |
+| XRPL EVM Sidechain (Chain ID 1449000, testnet) | MilestoneEscrowV3 — non-custodial escrow in native XRP, no platform role |
 | XRP Ledger Mainnet | NFT completion certificates + audit trail |
 
 ## Links