cascrow-mcp 3.0.0 → 3.1.0

package/CHANGELOG.md

@@ -1,6 +1,22 @@
 # Changelog
 
-## 3.0.0 — unreleased (owner publishes)
+## 3.1.0 — 2026-10-20
+
+Not published yet when the second half of these changes landed; everything below ships in one 3.1.0.
+
+- **New tools `cascrow_request_human_review` and `cascrow_human_reviews`.** Either party of a contract can ask for a person at cascrow to review a verification outcome (Art. 22(3) GDPR), with an optional `reason`; a person decides within one month and both parties receive the decision with its reasons (`human_review.decided`). `cascrow_human_reviews` lists the requests on a contract with their status, deadline, outcome and the reviewer's statement. A second request while one is open comes back as `status: "ALREADY_OPEN"` with its `dueAt`, not as an error.
+- **New tool `cascrow_rotate_callback_secret`.** Callbacks to your `callbackUrl` are now signed with a secret of your own account (`X-Cascrow-Signature: sha256=HMAC-SHA256(secret, "t=" + <unix ms of X-Cascrow-Timestamp> + "." + <raw body>)`). Two steps: without `confirm` the tool only returns the warning; with `confirm: true` it rotates and returns the new secret — the previous one stops verifying at once, and the new one enters the conversation. `cascrow_set_discoverable` never relays the secret into the model's context (it says a secret exists and points to the rotate tool).
+- **`cascrow_create_contract` takes `reviewWindowDays` (2–30, default 14; under 7 only between two businesses) and `panelDecidesAlone`**, and returns the server's `reviewTerms` — what the builder sees before joining. The `agentReviewMode` description says what happens since 2026-10-20: without the funder's decision a milestone completes only when the panel's own verdict opened the review with a YES; any other review goes to cascrow's human review.
+- **`cascrow_get_reputation` reads `stats: null`**: a builder who has not consented to publishing their figures shows "Figures: not published" and only the milestones they published one by one — never read as "no track record". An address that publishes nothing at all answers like an unknown one.
+- **`cascrow_v3_acceptance_get` names the free veto** of an escrow without an arbiter — in its description and in its result whenever the signed typed data names the zero address as arbiter: the payer can object to every claim at no cost, and an objected claim ends in a refund after the deadline.
+- New hint for **`SCREENING_UNAVAILABLE`**: the new-money sanctions screen fails closed — nothing was created, retry in a few minutes; existing escrows are not affected.
+- **`cascrow_set_discoverable` takes `showNameOnCertificates` and `consentVersion`.** `showNameOnCertificates` shows the company name (or name) as "Delivered by" on the public check page of the account's certificates. Turning it or `discoverable` ON publishes the account holder's name and needs their consent: without `consentVersion` nothing changes, and the tool returns `code: "CONSENT_REQUIRED"` with the server's exact consent text and the `consentVersion` to send once they agree. The text is passed on as the server sends it, never kept in this package. Turning either off needs nothing. The reply also says whether the name is shown on certificate check pages.
+- **Wallet linking follows cascrow's Sign-In with Ethereum challenge:** `GET /api/user/wallet/challenge?address=<your wallet>`, sign the returned message with that wallet, `POST /api/user/wallet`. The old one-line challenge is refused by the server. Every `cascrow-signer` pin is now `cascrow-signer@0.2.0` — 0.1.0 can no longer link a wallet (its other commands keep working).
+- `cascrow_verify`'s description names the panel's OpenAI model correctly (GPT-4o-mini).
+- `@modelcontextprotocol/sdk` `^1.32.1` (was `^1.15.0`, a range that admitted versions affected by GHSA-6qxp-vccf-f47h).
+- The package now carries its MIT `LICENSE` and ships only `index.js`, `README.md`, `CHANGELOG.md` and `LICENSE`; `server.json`, `smithery.yaml` and `REMOTE_HTTP_SERVER.md` stay in the repository, where the MCP registry and Smithery read them.
+
+## 3.0.0 — 2026-09-27
 
 - **`cascrow_join_contract` says what the builder can do now.** The server's answer carries `status` and `activated`, returned as well as rendered: a $0 verification contract is active at once — submit proof; a contract with an amount waits for the payer's MilestoneEscrowV3 offer, which you accept with your own key (`npx cascrow-signer@0.1.0 accept --milestone <id>`). It used to say "Contract is now AWAITING_ESCROW — ready to receive proof once funded" for both, so a $0 builder waited for money that never comes.
 - **New outcome `NOT_COMPLETABLE_WITHOUT_ESCROW`.** When the panel approves a milestone that carries an amount without a MilestoneEscrowV3 escrow, nothing can complete it: `cascrow_verify` renders "⛔ NOT COMPLETED — … no money moved; contact support", `cascrow_mcp_submit` surfaces the server's 409 with the same hint, and `cascrow_get_proof_status` / `cascrow_watch_verification` read the new `notCompletableWithoutEscrow` field and stop polling. Such a milestone used to read as "approved, the automatic payout did not go through — the release can be retried", a retry that no longer exists.
@@ -12,13 +28,13 @@
 - `cascrow_review_queue` / `cascrow_review_contract` describe what a funder verdict does now: it completes or hands back a verification-only milestone and moves no money. A COMPLETED milestone no longer reads "funds released" — it says whether no money was held or a MilestoneEscrowV3 escrow paid out on chain.
 - `cascrow_get_reputation` prints `totalReleasedUsd` (and the XRP released by MilestoneEscrowV3 escrows) instead of "RLUSD released". `totalRlusdReleased` is still in the response, deprecated.
 
-## 2.1.0 — unreleased (owner publishes)
+## 2.1.0 — not published on its own, released as part of 3.0.0
 
 - **MilestoneEscrowV3, remote half.** New tools: `cascrow_v3_offer` (payer offers terms), `cascrow_v3_acceptance_get` / `cascrow_v3_acceptance_submit` (builder reads the frozen terms and hands over the acceptance signature), `cascrow_v3_prepare` (an UNSIGNED transaction — rebuild `data` and check `to`/`chainId` yourself), `cascrow_v3_report_tx` (a transaction HASH only; a signed transaction is refused before anything is sent) and `cascrow_v3_attestation` (the non-binding AI recommendation for a claim). cascrow never signs, sends or relays: signing happens in the separate, pinned local signer, `npx cascrow-signer@0.1.0`.
 - `cascrow_fund_milestone` refuses a MilestoneEscrowV3 milestone with the way to fund it (`npx cascrow-signer@0.1.0 fund`), and every V3 refusal code (`V3_DISABLED`, `RATE_UNAVAILABLE`, `V3_NOT_OFFERED`, `OFFER_EXISTS`, `V3_OFFER_OPEN`, `ATTESTATION_PENDING`, `CLAIM_PROOF_UNKNOWN`, `V3_ESCROW`, `INVALID_SIGNATURE`, `V3_INDEX_STALE`, …) comes with what the recipient can do.
 - A verification of a V3 milestone reads as `V3_RECOMMENDATION` — "moves NO money" — in `cascrow_verify` and `cascrow_mcp_submit`, never as approved/paid or rejected.
 
-## 2.0.0 — unreleased (owner publishes)
+## 2.0.0 — not published on its own, released as part of 3.0.0
 
 - **Breaking: `cascrow_escrow_fund` is removed.** It sent the agent's EVM private key to cascrow, which signed the deposit server-side; cascrow no longer accepts, stores or signs with anyone's key. A host that still calls the tool by name gets an error that says so, and nothing it passed is read. Fund a v2 escrow by signing locally: `GET /api/agent/escrow-prepare` returns the two unsigned transactions, you sign and broadcast them with your own wallet, then `POST /api/escrow/sync`. Funding a MilestoneEscrowV3 contract from an API client is not available yet. **If you ever passed a private key to this tool, treat that key as exposed and move its funds to a new wallet.**
 - The anonymous-mode message states the real number of tools (it said 18).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Cascrow
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -2,7 +2,7 @@
 
 MCP server for [Cascrow](https://cascrow.com) — trust infrastructure for the agent economy: AI verification, on-chain reputation, and — for work that is paid — a non-custodial milestone escrow (MilestoneEscrowV3, native XRP; testnet for now).
 
-AI agents use Cascrow to create milestone-based contracts, submit proof of completion, and get verified by a **5-model AI majority vote**, with every verdict anchored on the XRP Ledger. For a paid milestone the AI result is a signed, non-binding recommendation: the money sits in a MilestoneEscrowV3 smart contract that only the payer, the builder or an arbiter they chose can move — cascrow holds no key and never signs.
+AI agents use Cascrow to create milestone-based contracts, submit proof of completion, and get verified by a **5-model AI majority vote**, with every verdict anchored on the XRP Ledger. For a paid milestone the AI result is a signed, non-binding recommendation: the money sits in a MilestoneEscrowV3 smart contract that only the payer, the builder or an arbiter they chose can move — cascrow holds no key that can move escrowed funds and never signs an escrow transaction.
 
 ## Quick Start
 
@@ -130,7 +130,7 @@ Rate limit: 3 registrations per IP per hour.
 | `cascrow_verify_work` | Verify AI work with no escrow contract, from a GitHub PR, pasted code, or a base64-encoded screenshot. Returns a public report URL. With `CASCROW_API_KEY` set, the verdict is also anchored on the XRP Ledger mainnet — anonymous calls are not. |
 | `cascrow_get_contract` | Get contract status and all milestone states. |
 | `cascrow_list_my_contracts` | List all contracts for this agent, as Requester and/or Builder. |
-| `cascrow_review_queue` | As funder of a verification-only contract: list milestones still waiting for your verdict. Poll it — an undecided milestone is completed automatically after 48 h under review mode `MANUAL_AUTO` or `AUTO`, 14 days otherwise. |
+| `cascrow_review_queue` | As funder of a verification-only contract: list milestones still waiting for your verdict. Poll it — an undecided milestone is completed automatically when its review window closes only when the panel's own verdict opened the review with a YES — any other review goes to cascrow's human review instead; the window is the contract's `reviewWindowDays` (default 14 days; 48h on an agent contract created before 2026-10-20 in review mode `MANUAL_AUTO` or `AUTO`). |
 | `cascrow_v3_claims` | As payer of a MilestoneEscrowV3 escrow: list claims that release it unless your own wallet calls `object()` before `objectionDeadline`. cascrow cannot object for you. |
 | `cascrow_v3_offer` | As payer: offer MilestoneEscrowV3 terms (native XRP) for a milestone. The builder accepts with their own key. |
 | `cascrow_v3_acceptance_get` / `cascrow_v3_acceptance_submit` | As builder: read the frozen terms, hand over your EIP-712 acceptance signature (binding until `acceptBy`). |
@@ -138,15 +138,18 @@ Rate limit: 3 registrations per IP per hour.
 | `cascrow_v3_report_tx` | After you broadcast: the transaction **hash** (never a signed transaction), so the index re-reads now. |
 | `cascrow_v3_attestation` | cascrow's signed, non-binding AI recommendation for a claim. |
 
-**Signing is never done here.** cascrow holds no key of yours and relays nothing. For MilestoneEscrowV3 use the separate local signer — `npx cascrow-signer@0.1.0` (CLI or its own MCP server, tools `cascrow_signer_*`) — which checks every prepared transaction against its own pinned chain and contract.
+**Signing is never done here.** cascrow holds no key of yours and relays nothing. For MilestoneEscrowV3 use the separate local signer — `npx cascrow-signer@0.2.0` (CLI or its own MCP server, tools `cascrow_signer_*`) — which checks every prepared transaction against its own pinned chain and contract.
 | `cascrow_review_contract` | As funder of a verification-only contract: approve (completes it) or reject (hands it back) a milestone the AI panel scored 60–85. Moves no money. |
-| `cascrow_join_contract` | Join a contract as Builder agent via invite code. The answer says whether it is active now (`activated: true`, a $0 contract — submit proof) or waits for the payer's MilestoneEscrowV3 offer (accept it with your own key: `npx cascrow-signer@0.1.0 accept --milestone <id>`). |
+| `cascrow_request_human_review` | As funder or builder: ask for a person at cascrow to review a verification outcome (Art. 22(3) GDPR). Decided within one month, sent to both parties with reasons. |
+| `cascrow_human_reviews` | The human-review requests on a contract: status, deadline, outcome and the reviewer's statement. |
+| `cascrow_join_contract` | Join a contract as Builder agent via invite code. The answer says whether it is active now (`activated: true`, a $0 contract — submit proof) or waits for the payer's MilestoneEscrowV3 offer (accept it with your own key: `npx cascrow-signer@0.2.0 accept --milestone <id>`). |
 | `cascrow_handoff` | Send a contract to another agent by Agent ID. |
 | `cascrow_get_agent_id` | Get this agent's own Agent ID. |
 | `cascrow_check_invites` | Check pending contract invites. |
 | `cascrow_get_reputation` | Look up any agent's on-chain track record by wallet address — completed, failed, success rate and value released (`totalReleasedUsd`, plus XRP for MilestoneEscrowV3; `totalRlusdReleased` is deprecated) over every eligible milestone, plus the milestone records the builder has published (opt-in, default private) with their proof hashes. No auth required. |
 | `cascrow_discover_agents` | Search discoverable Builder agents by skill tag and minimum success rate. |
-| `cascrow_set_discoverable` | Opt into the agent marketplace, set skill tags, register a callback URL. |
+| `cascrow_set_discoverable` | Opt into the agent marketplace or into being named on certificate check pages, set skill tags, register a callback URL. Turning a name on needs the account holder's consent: the first call changes nothing and returns the text to show and the `consentVersion` to send. |
+| `cascrow_rotate_callback_secret` | Replace the callback signing secret and return the new one (callbacks carry `X-Cascrow-Timestamp` and `X-Cascrow-Signature: sha256=HMAC-SHA256(secret, "t=" + <unix ms of the timestamp> + "." + <raw body>)`; reject a timestamp more than 5 minutes off). The first call changes nothing and returns a warning — the old secret stops verifying and the new one enters the conversation; call again with `confirm: true`. `cascrow_set_discoverable` never returns a secret. |
 
 ## How Verification Works
 
@@ -192,12 +195,12 @@ Claude will:
 
 1. **Requester (payer)** creates the contract (`cascrow_create_contract`) with an `amountUSD` above 0 and hands it to the **Builder** (`cascrow_handoff`); the builder joins (`cascrow_check_invites` + `cascrow_join_contract`).
 2. The payer offers the escrow terms — amount in native XRP at a frozen XRP/USD rate, review period, optional arbiter — with `cascrow_v3_offer`.
-3. The builder reads the frozen terms (`cascrow_v3_acceptance_get`), checks them and signs the acceptance with its own key (`npx cascrow-signer@0.1.0 accept`, or `cascrow_v3_acceptance_submit` with a signature made elsewhere). The signature binds until `acceptBy`.
-4. The payer funds the escrow with **one transaction from its own machine**: `npx cascrow-signer@0.1.0 fund --milestone <id>` (or the signer's MCP tool `cascrow_signer_fund`).
+3. The builder reads the frozen terms (`cascrow_v3_acceptance_get`), checks them and signs the acceptance with its own key (`npx cascrow-signer@0.2.0 accept`, or `cascrow_v3_acceptance_submit` with a signature made elsewhere). The signature binds until `acceptBy`.
+4. The payer funds the escrow with **one transaction from its own machine**: `npx cascrow-signer@0.2.0 fund --milestone <id>` (or the signer's MCP tool `cascrow_signer_fund`).
 5. The builder delivers → `cascrow_submit_proof` → `cascrow_watch_verification`. The AI result is a signed, non-binding recommendation (`cascrow_v3_attestation`).
 6. The builder claims on chain with the submission's `manifestHash`. The payer releases, or objects before the objection deadline (`cascrow_v3_claims` lists open claims); without an objection the builder can take the money after the review period.
 
-cascrow never accepts, creates, stores or signs with a private key and is never the arbiter (`cascrow_escrow_fund`, which took a key, was removed in 2.0.0 — if you ever passed a key to it, treat that key as exposed and move its funds). Each agent links its own wallet once — `GET /api/user/wallet/challenge` → sign → `POST /api/user/wallet`. A contract without an amount needs none of this: it is active once the builder has joined.
+cascrow never accepts, creates, stores or signs with a private key and is never the arbiter (`cascrow_escrow_fund`, which took a key, was removed in 2.0.0 — if you ever passed a key to it, treat that key as exposed and move its funds). Each agent links its own wallet once — `GET /api/user/wallet/challenge?address=<your wallet>` → sign the Sign-In with Ethereum message → `POST /api/user/wallet` (or `npx cascrow-signer@0.2.0 link`). Replacing a linked wallet by API key also needs the current wallet's signature (`cascrow-signer link --old-home …`). A contract without an amount needs none of this: it is active once the builder has joined.
 
 ## Blockchain Architecture
 

package/index.js

@@ -40,8 +40,8 @@ const CUSTODY_TOOL_REMOVED =
   "Error: This way of funding has been removed: cascrow never accepts, creates, stores or signs with private keys. " +
   "A $0 verification contract needs no funding — it is active once the builder has joined. " +
   "A milestone with an amount is a MilestoneEscrowV3 escrow in native XRP, funded by the payer with one transaction " +
-  "from their own machine: first link the wallet you will fund from (GET /api/user/wallet/challenge, sign the message, " +
-  "POST /api/user/wallet), then run the local signer: npx cascrow-signer@0.1.0 fund --milestone <milestoneId>. " +
+  "from their own machine: first link the wallet you will fund from (GET /api/user/wallet/challenge?address=<your wallet>, sign the message with that wallet, " +
+  "POST /api/user/wallet), then run the local signer: npx cascrow-signer@0.2.0 fund --milestone <milestoneId>. " +
   "If your request contained a private key, treat it as exposed and move its funds to a new wallet. " +
   "[CUSTODY_PATH_REMOVED]";
 
@@ -50,7 +50,7 @@ const CUSTODY_TOOL_REMOVED =
 // app). v3-client-text-parity.test.ts holds the copy equal to the owner.
 // BEGIN v3-client-text
 const V3_CLIENT_TEXT = {
-  "signerPin": "cascrow-signer@0.1.0",
+  "signerPin": "cascrow-signer@0.2.0",
   "remoteTools": [
     "cascrow_v3_offer",
     "cascrow_v3_acceptance_get",
@@ -61,17 +61,18 @@ const V3_CLIENT_TEXT = {
     "cascrow_v3_claims"
   ],
   "codeHints": {
-    "V3_DISABLED": "MilestoneEscrowV3 is switched off for NEW money right now (offers, acceptances, funding). An escrow that already exists is never locked: object, release, refund, claim and withdraw keep working (cascrow_v3_prepare, or npx cascrow-signer@0.1.0 without cascrow at all).",
+    "V3_DISABLED": "MilestoneEscrowV3 is switched off for NEW money right now (offers, acceptances, funding). An escrow that already exists is never locked: object, release, refund, claim and withdraw keep working (cascrow_v3_prepare, or npx cascrow-signer@0.2.0 without cascrow at all).",
     "RATE_UNAVAILABLE": "cascrow could not get a consistent XRP/USD rate from its two sources, so no offer can be priced. Nothing was created; retry in a minute.",
+    "SCREENING_UNAVAILABLE": "cascrow could not complete the sanctions screening this new-escrow step needs (offer, acceptance or funding), so nothing was created or prepared. This is a condition on cascrow's side, not a finding about you or your counterparty — retry in a few minutes. It does not touch escrows that already exist: their actions keep working (cascrow_v3_prepare, or npx cascrow-signer@0.2.0).",
     "V3_NOT_OFFERED": "The payer has not offered MilestoneEscrowV3 terms for this milestone yet — only the payer can (cascrow_v3_offer). The payer has been notified.",
     "OFFER_EXISTS": "An open offer already exists for this milestone and stays valid until it expires. Wait for the payee's acceptance or for the offer to lapse; sending the same inputs again returns the same offer.",
-    "V3_OFFER_OPEN": "An open MilestoneEscrowV3 offer, or a signed acceptance that is not funded yet, is bound to this milestone or wallet, so it cannot change now. Wait until the payer funds the escrow from their own machine (npx cascrow-signer@0.1.0 fund --milestone <milestoneId>) or the offer or acceptance lapses.",
+    "V3_OFFER_OPEN": "An open MilestoneEscrowV3 offer, or a signed acceptance that is not funded yet, is bound to this milestone or wallet, so it cannot change now. Wait until the payer funds the escrow from their own machine (npx cascrow-signer@0.2.0 fund --milestone <milestoneId>) or the offer or acceptance lapses.",
     "ATTESTATION_PENDING": "The AI panel has not finished on this claim. Its result is a non-binding recommendation — as payer you can object NOW, before the objection deadline, without waiting for it.",
     "CLAIM_PROOF_UNKNOWN": "This claim's proofHash matches no evidence submitted to cascrow, so there is no AI recommendation for it. As payer, judge the delivery yourself and object before the objection deadline if it is not what was agreed.",
-    "V3_ESCROW": "This milestone is held in a MilestoneEscrowV3 escrow: only its payer, payee or arbiter moves that money, on chain, with their own key. Get the unsigned transaction with cascrow_v3_prepare, or sign locally with npx cascrow-signer@0.1.0.",
+    "V3_ESCROW": "This milestone is held in a MilestoneEscrowV3 escrow: only its payer, payee or arbiter moves that money, on chain, with their own key. Get the unsigned transaction with cascrow_v3_prepare, or sign locally with npx cascrow-signer@0.2.0.",
     "V2_ESCROW_PRESENT": "This milestone or its contract still carries data of the retired v2 (RLUSD) escrow, so it cannot become a MilestoneEscrowV3 escrow. Nothing was changed; contact support.",
-    "INVALID_SIGNATURE": "The acceptance signature does not verify for your linked wallet over these exact terms (EIP-712, low-s, from an ordinary account). Sign the terms returned by cascrow_v3_acceptance_get again — npx cascrow-signer@0.1.0 accept does it and checks them first.",
-    "V3_INDEX_STALE": "cascrow's index of the chain is behind. Read the escrow from the chain directly (npx cascrow-signer@0.1.0 claims, or getEscrow / ClaimSubmitted); every deadline, above all an objection window, runs on chain regardless.",
+    "INVALID_SIGNATURE": "The acceptance signature does not verify for your linked wallet over these exact terms (EIP-712, low-s, from an ordinary account). Sign the terms returned by cascrow_v3_acceptance_get again — npx cascrow-signer@0.2.0 accept does it and checks them first.",
+    "V3_INDEX_STALE": "cascrow's index of the chain is behind. Read the escrow from the chain directly (npx cascrow-signer@0.2.0 claims, or getEscrow / ClaimSubmitted); every deadline, above all an objection window, runs on chain regardless.",
     "ACCEPTANCE_LAPSED": "The acceptance expired without funding, so the milestone is closed — this is not a failure of either party. A new attempt is a new milestone.",
     "NOT_COMPLETABLE_WITHOUT_ESCROW": "The work was approved, but this milestone carries an amount without a MilestoneEscrowV3 escrow, and the previous escrow system has been removed — nothing can complete or pay it, so it was left as it was and NO money moved. cascrow has opened a case for it; contact support@cascrow.com with the contract ID. Do not resubmit: your evidence is recorded.",
     "RELEASE_HOLD_REMOVED": "releaseHoldHours was removed with the previous escrow system; send the contract without it. A MilestoneEscrowV3 escrow's review period is agreed in the payer's offer (cascrow_v3_offer), and a $0 verification contract has no payout to delay.",
@@ -81,14 +82,15 @@ const V3_CLIENT_TEXT = {
   },
   "joined": {
     "active": "Joined as Builder. This is a $0 verification contract, so it is active now — submit proof for a milestone (cascrow_submit_proof). No money is held or moved.",
-    "awaitingOffer": "Joined as Builder. The milestones carry an amount, so nothing is funded yet: wait for the payer's MilestoneEscrowV3 offer, then accept it with your own wallet key — npx cascrow-signer@0.1.0 accept --milestone <milestoneId>, or on the contract page. cascrow never signs for you. Submit proof once the payer has funded the milestone.",
+    "awaitingOffer": "Joined as Builder. The milestones carry an amount, so nothing is funded yet: wait for the payer's MilestoneEscrowV3 offer, then accept it with your own wallet key — npx cascrow-signer@0.2.0 accept --milestone <milestoneId>, or on the contract page. cascrow never signs for you. Submit proof once the payer has funded the milestone.",
     "unknown": "Joined as Builder. The server did not say whether the contract is active — check it with cascrow_get_contract before submitting proof."
   },
   "payeeHints": {
-    "CLAIM_PROOF_UNKNOWN": "This manifest is not a sealed submission of this milestone, so cascrow will not confirm it and nothing was signed. As payee, claim with the manifestHash the evidence door returned (the upload's answer, or cascrow_get_proof_status): npx cascrow-signer@0.1.0 submit-claim --milestone <milestoneId> --proof-hash <manifestHash>."
+    "CLAIM_PROOF_UNKNOWN": "This manifest is not a sealed submission of this milestone, so cascrow will not confirm it and nothing was signed. As payee, claim with the manifestHash the evidence door returned (the upload's answer, or cascrow_get_proof_status): npx cascrow-signer@0.2.0 submit-claim --milestone <milestoneId> --proof-hash <manifestHash>."
   },
-  "fundRemoved": "cascrow_fund_milestone was removed (and with it fundMilestone in cascrow-sdk and `cascrow fund`). A $0 verification contract is active by itself once the builder has joined — there is nothing to fund. A milestone with an amount is a MilestoneEscrowV3 escrow in native XRP: the payer offers terms (cascrow_v3_offer), the builder accepts with their own key, and the payer funds it with one transaction from their own machine — npx cascrow-signer@0.1.0 fund --milestone <milestoneId>. cascrow never signs or sends for you.",
-  "recommendation": "🧭 AI RECOMMENDATION {verdict} for this MilestoneEscrowV3 submission ({confidence}% confidence on this file) — this verdict moves NO money. The submission is YES only when every file in it has a definite AI yes; only then is it claim-ready. As payee: claim on chain with the submission's manifestHash (npx cascrow-signer@0.1.0 submit-claim --milestone <milestoneId> --proof-hash <manifestHash>). As payer: release, or object before the objection deadline.",
+  "fundRemoved": "cascrow_fund_milestone was removed (and with it fundMilestone in cascrow-sdk and `cascrow fund`). A $0 verification contract is active by itself once the builder has joined — there is nothing to fund. A milestone with an amount is a MilestoneEscrowV3 escrow in native XRP: the payer offers terms (cascrow_v3_offer), the builder accepts with their own key, and the payer funds it with one transaction from their own machine — npx cascrow-signer@0.2.0 fund --milestone <milestoneId>. cascrow never signs or sends for you.",
+  "recommendation": "🧭 AI RECOMMENDATION {verdict} for this MilestoneEscrowV3 submission ({confidence}% confidence on this file) — this verdict moves NO money. The submission is YES only when every file in it has a definite AI yes; only then is it claim-ready. As payee: claim on chain with the submission's manifestHash (npx cascrow-signer@0.2.0 submit-claim --milestone <milestoneId> --proof-hash <manifestHash>). As payer: release, or object before the objection deadline.",
+  "noArbiterVeto": "No arbiter is named. The payer can object to every claim at no cost, and after the deadline an objected claim ends in a refund to the payer. This escrow protects you only against an inactive payer, not a dishonest one.",
   "reportTxOnlyHash": "cascrow_v3_report_tx takes a transaction HASH (0x + 64 hex characters) and nothing else. cascrow never accepts a signed transaction — broadcast it yourself to the chain's public RPC."
 };
 // END v3-client-text
@@ -191,7 +193,7 @@ function retryAfterOf(res, data) {
  * here: a single call either answers or throws; only the poll loop waits and asks
  * again.
  */
-async function fetchJson(method, path, { json, form, deadlineMs = REQUEST_CLIENT_ABORT_MS } = {}) {
+async function fetchJson(method, path, { json, form, deadlineMs = REQUEST_CLIENT_ABORT_MS, headers = {} } = {}) {
   const controller = new AbortController();
   const timer = setTimeout(() => controller.abort(), deadlineMs);
   let res;
@@ -199,7 +201,7 @@ async function fetchJson(method, path, { json, form, deadlineMs = REQUEST_CLIENT
   try {
     res = await fetch(`${BASE_URL}${path}`, {
       method,
-      headers: { ...authHeader, ...(json !== undefined ? { "Content-Type": "application/json" } : {}) },
+      headers: { ...authHeader, ...headers, ...(json !== undefined ? { "Content-Type": "application/json" } : {}) },
       ...(json !== undefined ? { body: JSON.stringify(json) } : form !== undefined ? { body: form } : {}),
       signal: controller.signal,
     });
@@ -261,8 +263,8 @@ async function apiGet(path) {
   return fetchJson("GET", path);
 }
 
-async function apiPatch(path, body) {
-  return fetchJson("PATCH", path, { json: body });
+async function apiPatch(path, body, headers) {
+  return fetchJson("PATCH", path, { json: body, headers });
 }
 
 async function uploadProof(milestoneId, filename, content) {
@@ -485,13 +487,27 @@ const TOOLS = [
           type: "string",
           enum: ["AUTO", "MANUAL", "MANUAL_AUTO"],
           description:
-            "What happens when the AI panel is unsure (confidence 60–85). AUTO (default) rejects; MANUAL waits for your decision " +
-            "via cascrow_review_contract, and completes the milestone automatically after 14 days without one; MANUAL_AUTO waits 48 h for your decision, then completes it. " +
-            "AUTO also completes a milestone after 48 h without your decision when it reaches your review anyway — a rejection overturned on appeal, or a panel outage after an earlier real verdict. " +
-            "On either 48-hour mode a milestone the panel never judged (every run timed out) is not completed; it waits for your decision. " +
+            "What happens when the AI panel is unsure (confidence 60–85). AUTO (default) rejects: the panel decides alone (the same as panelDecidesAlone: true). " +
+            "MANUAL and MANUAL_AUTO put the milestone to your decision via cascrow_review_contract; since 2026-10-20 the two behave the same, and your window is reviewWindowDays. " +
+            "Without your decision a milestone completes automatically only when the panel's own verdict opened the review with a YES; any other review " +
+            "(a NO majority, a panel outage, a rejection overturned on appeal, an escalation after the builder used up their resubmissions) is handed to cascrow's human review instead — it never completes on silence. " +
             "The window is counted from the email notice to you, never before the milestone was put to you (a panel verdict, an escalation after the builder used up their resubmissions, or a rejection overturned on appeal); without a sent notice it does not start. " +
             "Contracts without an amount only, and nothing moves: a milestone completed this way reports decidedBy \"sla\".",
         },
+        reviewWindowDays: {
+          type: "integer",
+          minimum: 2,
+          maximum: 30,
+          description:
+            "Your review window in days (default 14). Below 7 days only when both you and the builder registered as businesses — " +
+            "otherwise the contract is refused (REVIEW_WINDOW_NEEDS_BUSINESS). The builder sees it before joining.",
+        },
+        panelDecidesAlone: {
+          type: "boolean",
+          description:
+            "true: the panel decides alone — a YES above 85 % completes, anything else is a rejection the builder can resubmit against; you do not review. " +
+            "Defaults to agentReviewMode === \"AUTO\"; contradicting agentReviewMode is refused (REVIEW_MODE_CONFLICT). The builder sees it before joining.",
+        },
         milestones: {
           type: "array",
           minItems: 1,
@@ -533,7 +549,7 @@ const TOOLS = [
               },
               amountUSD: {
                 type: "number",
-                description: "Optional. Omit or set to 0 for a verification-only contract: it is active by itself once the builder has joined, and no money moves. An amount above 0 makes the milestone a MilestoneEscrowV3 escrow in native XRP — the payer offers terms with cascrow_v3_offer, the builder accepts, and the payer funds it from their own machine (npx cascrow-signer@0.1.0 fund).",
+                description: "Optional. Omit or set to 0 for a verification-only contract: it is active by itself once the builder has joined, and no money moves. An amount above 0 makes the milestone a MilestoneEscrowV3 escrow in native XRP — the payer offers terms with cascrow_v3_offer, the builder accepts, and the payer funds it from their own machine (npx cascrow-signer@0.2.0 fund).",
               },
             },
           },
@@ -571,7 +587,7 @@ const TOOLS = [
     name: "cascrow_verify",
     description:
       "Start (or re-run) AI verification for a proof and return the result. " +
-      "5 AI models vote in parallel (Claude, GPT-4o, Gemini, Mistral, Cerebras). " +
+      "5 AI models vote in parallel (Claude, GPT-4o-mini, Gemini, Mistral, Cerebras). " +
       "Returns decision, confidence score, action (VERIFIED/PENDING_REVIEW/REJECTED), and per-model votes. " +
       "Upload already starts verification by itself: for a proof you just submitted use cascrow_watch_verification { proofId } instead. " +
       "If a verification of this proof is already running, this call waits for it rather than failing. " +
@@ -602,7 +618,7 @@ const TOOLS = [
       "Use this when another agent or user has created a contract and shared an invite code with you. " +
       "The answer says whether the contract is active now (activated: true — a $0 verification contract; submit proof right away) " +
       "or waits for the payer's MilestoneEscrowV3 offer (activated: false — accept it with your own wallet key: " +
-      "npx cascrow-signer@0.1.0 accept --milestone <id>, then submit proof once the payer has funded it).",
+      "npx cascrow-signer@0.2.0 accept --milestone <id>, then submit proof once the payer has funded it).",
     inputSchema: {
       type: "object",
       required: ["inviteCode"],
@@ -704,15 +720,26 @@ const TOOLS = [
     name: "cascrow_set_discoverable",
     description:
       "Configure this agent's discovery settings: opt in/out of the agent marketplace, " +
+      "whether its name is shown on the public check page of its certificates, " +
       "set skill tags so Requester agents can find you, and register a callback URL to receive " +
       "real-time events instead of polling (handoff received, milestone funded, verified, rejected). " +
-      "Call this once after registering to make yourself visible and reactive.",
+      "Turning discoverable or showNameOnCertificates ON publishes the account holder's name and needs " +
+      "their consent: call without consentVersion first — nothing changes, and the answer carries the exact " +
+      "text to show them and the consentVersion to send if they agree. Turning either off needs nothing.",
     inputSchema: {
       type: "object",
       properties: {
         discoverable: {
           type: "boolean",
-          description: "Set to true to appear in cascrow_discover_agents searches",
+          description: "Set to true to appear in cascrow_discover_agents searches (needs consentVersion, see above)",
+        },
+        showNameOnCertificates: {
+          type: "boolean",
+          description: "Set to true to show the company name (or name) as \u201cDelivered by\u201d on the public check page of this account's certificates (needs consentVersion, see above)",
+        },
+        consentVersion: {
+          type: "string",
+          description: "The consent version the server named, sent only after the account holder agreed to the text it returned",
         },
         skills: {
           type: "array",
@@ -721,11 +748,25 @@ const TOOLS = [
         },
         callbackUrl: {
           type: "string",
-          description: "HTTPS URL to receive real-time event notifications (POST). Set to null to disable.",
+          description: "HTTPS URL to receive real-time event notifications (POST, signed — see cascrow_rotate_callback_secret). Set to null to disable.",
         },
       },
     },
   },
+  {
+    name: "cascrow_rotate_callback_secret",
+    description:
+      "Replace this agent's callback signing secret and return the new one. Callbacks are signed " +
+      "X-Cascrow-Signature: sha256=HMAC-SHA256(secret, \"t=\" + <unix ms of X-Cascrow-Timestamp> + \".\" + <raw body>). " +
+      "The previous secret stops verifying immediately, and the new secret enters this conversation. " +
+      "Call without confirm first: nothing changes and the answer is the warning; call again with confirm true to rotate.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        confirm: { type: "boolean", description: "true only after reading the warning a call without confirm returns." },
+      },
+    },
+  },
   {
     name: "cascrow_list_my_contracts",
     description:
@@ -771,7 +812,7 @@ const TOOLS = [
     description:
       "As the PAYER, offer MilestoneEscrowV3 terms for a milestone (native XRP, one escrow per milestone). cascrow prices it from two XRP/USD sources, freezes the terms " +
       "and notifies the builder, who accepts with their own key. reviewPeriodSec is your objection window after a claim: 24 h only with watcherDeclared=true " +
-      "(you declare that you run a watcher, e.g. npx cascrow-signer@0.1.0 watch), otherwise at least 72 h; a first job with a new builder gets 7 days. " +
+      "(you declare that you run a watcher, e.g. npx cascrow-signer@0.2.0 watch), otherwise at least 72 h; a first job with a new builder gets 7 days. " +
       "An arbiter is optional — without one an objection costs nothing and the money returns to you after the deadline. Answers OFFER_EXISTS with the open offer's expiry.",
     inputSchema: {
       type: "object",
@@ -790,7 +831,8 @@ const TOOLS = [
     description:
       "As the BUILDER (payee), read the payer's frozen MilestoneEscrowV3 offer: the EIP-712 typed data to sign, escrowId, payer, amount in wei, the rate snapshot and acceptBy. " +
       "Check every term yourself before signing — your signature binds you until acceptBy and cascrow cannot revoke it. " +
-      "npx cascrow-signer@0.1.0 accept checks it against its own pinned chain and contract and signs locally. Answers V3_NOT_OFFERED while the payer has not offered.",
+      "npx cascrow-signer@0.2.0 accept checks it against its own pinned chain and contract and signs locally. Answers V3_NOT_OFFERED while the payer has not offered. " +
+      `If the offer names no arbiter (arbiter null; the zero address in the typed data), tell the builder before signing: ${V3_CLIENT_TEXT.noArbiterVeto}`,
     inputSchema: { type: "object", required: ["milestoneId"], properties: { milestoneId: { type: "string" } } },
   },
   {
@@ -809,7 +851,7 @@ const TOOLS = [
     description:
       "Get the UNSIGNED MilestoneEscrowV3 transaction for an action: { chainId, to, value, data, call: { fn, args }, escrowId, action, role, expect }. " +
       "cascrow never signs, sends or relays it. Before signing, rebuild data from the contract ABI yourself and check to/chainId against your OWN configuration — " +
-      "npx cascrow-signer@0.1.0 does all of that and sends to the public RPC. After funding, object/release/refund/claim never depend on this tool: the escrow can be moved from the chain alone.",
+      "npx cascrow-signer@0.2.0 does all of that and sends to the public RPC. After funding, object/release/refund/claim never depend on this tool: the escrow can be moved from the chain alone.",
     inputSchema: {
       type: "object",
       required: ["milestoneId", "action"],
@@ -825,7 +867,7 @@ const TOOLS = [
   {
     name: "cascrow_v3_report_tx",
     description:
-      "After YOU broadcast a MilestoneEscrowV3 transaction, tell cascrow its hash so the index re-reads the chain now instead of within five minutes. " +
+      "After YOU broadcast a MilestoneEscrowV3 transaction, tell cascrow its hash so the index re-reads the chain now instead of at the next scheduled read (up to 30 minutes). " +
       "Takes a transaction HASH only — never a signed transaction; cascrow relays nothing. Reporting is optional: the index reads the chain anyway.",
     inputSchema: {
       type: "object",
@@ -851,7 +893,7 @@ const TOOLS = [
       "(confidence 60–85 lands in PENDING_REVIEW). APPROVE completes the milestone; " +
       "REJECT hands the milestone back so they can resubmit stronger evidence — it is not terminal. " +
       "This decides verification-only ($0) contracts and moves no money: a MilestoneEscrowV3 escrow is released or objected to " +
-      "on chain by the payer's own key (cascrow_v3_prepare, or npx cascrow-signer@0.1.0). " +
+      "on chain by the payer's own key (cascrow_v3_prepare, or npx cascrow-signer@0.2.0). " +
       "Call cascrow_review_queue first: it names the contractId and the milestoneId. " +
       "milestoneId is required once more than one milestone of that contract is pending.",
     inputSchema: {
@@ -864,6 +906,35 @@ const TOOLS = [
       },
     },
   },
+  {
+    name: "cascrow_request_human_review",
+    description:
+      "As the funder OR the builder of a contract, ask for a person at cascrow to review a verification outcome (Art. 22(3) GDPR) — at any time, on any milestone the panel has decided. " +
+      "A person decides within one month (dueAt) and both parties receive the decision with its reasons (webhook human_review.decided; read it with cascrow_human_reviews). " +
+      "On a verification-only ($0) contract the decision can complete the milestone, reject it, or revoke a completion and withdraw its certificate; on a MilestoneEscrowV3 milestone it is a statement and changes nothing on chain. " +
+      "One open request per milestone: asking again while one is open answers ALREADY_OPEN with its dueAt. milestoneId is required once the contract has more than one milestone. " +
+      "reason is your own words to the reviewer (at most 2000 characters).",
+    inputSchema: {
+      type: "object",
+      required: ["contractId"],
+      properties: {
+        contractId: { type: "string" },
+        milestoneId: { type: "string", description: "Required once the contract has more than one milestone." },
+        reason: { type: "string", maxLength: 2000, description: "Why you ask for a review — shown to the reviewer only, never to the other party." },
+      },
+    },
+  },
+  {
+    name: "cascrow_human_reviews",
+    description:
+      "The human-review requests on a contract you are a party to, newest first: status (OPEN / DECIDED / CLOSED), dueAt, outcome and the reviewer's statement (decisionNote, which the reviewer wrote for both parties). " +
+      "Your own reason is returned to you only. The pull side of the human_review.requested / human_review.decided webhooks.",
+    inputSchema: {
+      type: "object",
+      required: ["contractId"],
+      properties: { contractId: { type: "string" } },
+    },
+  },
   {
     name: "cascrow_get_proof_status",
     description:
@@ -1010,7 +1081,7 @@ const TOOLS = [
 
 // ─── Tool handlers ────────────────────────────────────────────────────────────
 
-async function handleCreateContract({ milestones, agentReviewMode }) {
+async function handleCreateContract({ milestones, agentReviewMode, reviewWindowDays, panelDecidesAlone }) {
   const deadline = (days) => {
     const d = new Date();
     d.setDate(d.getDate() + (days ?? 7));
@@ -1038,6 +1109,9 @@ async function handleCreateContract({ milestones, agentReviewMode }) {
       };
     }),
     ...(agentReviewMode !== undefined ? { agentReviewMode } : {}),
+    // The review terms — validated by the server (review-terms.ts).
+    ...(reviewWindowDays !== undefined ? { reviewWindowDays } : {}),
+    ...(panelDecidesAlone !== undefined ? { panelDecidesAlone } : {}),
   };
 
   const data = await apiPost("/api/contracts", payload);
@@ -1052,6 +1126,8 @@ async function handleCreateContract({ milestones, agentReviewMode }) {
     inviteLink: inviteCode,
     contractUrl,
     milestoneCount: milestones.length,
+    // What the builder will see before joining (window, who decides) — the server's own words.
+    reviewTerms: data.reviewTerms ?? null,
     message: `Contract created with ${milestones.length} milestone(s). View it here: ${contractUrl}`,
   };
 }
@@ -1426,9 +1502,6 @@ async function handleGetReputation({ walletAddress }) {
       : data.milestones,
   };
   const { stats, milestones = [], skills = [] } = marked;
-  const successPct = stats.successRate !== null
-    ? `${Math.round(stats.successRate * 100)}%`
-    : "no data yet";
 
   const milestoneLines = milestones.slice(0, 5).map((m) => {
     const proofLinks = Object.entries(m.proofs)
@@ -1445,6 +1518,25 @@ async function handleGetReputation({ walletAddress }) {
   // "Completed: 12" next to no evidence and no reason — a refusal with no reader
   // (F-72). Kept byte-identical to the in-repo server's copy; the two are a pair
   // this repo already knows about (SEC-009).
+  // `stats` is null when the builder has not consented to publishing their
+  // figures (the server answers 404 when nothing at all is public). Said in words,
+  // because "no figures" must not read as "no track record". Byte-identical to the
+  // in-repo server's copy.
+  if (!stats) {
+    return {
+      ...marked,
+      message: [
+        `Agent reputation for ${walletAddress}:`,
+        "  Figures: not published — this builder has not agreed to publish their track-record figures. Only the milestones they published one by one are shown.",
+        skills.length > 0 ? `  Skills: ${skills.join(", ")}` : null,
+        milestones.length > 0 ? `\nPublished milestones:\n${milestoneLines}` : null,
+      ].filter(Boolean).join("\n"),
+    };
+  }
+  const successPct = stats.successRate !== null
+    ? `${Math.round(stats.successRate * 100)}%`
+    : "no data yet";
+
   const noPublishedNote = stats.milestonesCompleted > 0
     ? "\nPublished milestones: none — this builder has not made any milestone record public. The counts above cover every eligible milestone."
     : null;
@@ -1505,32 +1597,88 @@ async function handleDiscoverAgents({ skill, minRate, limit } = {}) {
   };
 }
 
-async function handleSetDiscoverable({ discoverable, skills, callbackUrl } = {}) {
+async function handleSetDiscoverable({ discoverable, showNameOnCertificates, consentVersion, skills, callbackUrl } = {}) {
   const body = {};
-  if (discoverable !== undefined) body.discoverable = discoverable;
-  if (skills       !== undefined) body.skills        = skills;
-  if (callbackUrl  !== undefined) body.callbackUrl   = callbackUrl;
+  if (discoverable           !== undefined) body.discoverable           = discoverable;
+  if (showNameOnCertificates !== undefined) body.showNameOnCertificates = showNameOnCertificates;
+  if (consentVersion         !== undefined) body.consentVersion         = consentVersion;
+  if (skills                 !== undefined) body.skills                 = skills;
+  if (callbackUrl            !== undefined) body.callbackUrl            = callbackUrl;
 
-  const data = await apiPatch("/api/agent/settings", body);
+  let data;
+  try {
+    data = await apiPatch("/api/agent/settings", body, { "x-cascrow-channel": "mcp" });
+  } catch (err) {
+    // Turning a name consent on without the account holder's agreement is refused
+    // by the server, and its answer carries the words to show. They are passed on
+    // as they come, never kept here, so this package cannot show an outdated text.
+    if (!(err instanceof CascrowApiError) || err.code !== "CONSENT_REQUIRED") throw err;
+    const consents = Array.isArray(err.body?.consents) ? err.body.consents : [];
+    const texts = consents.map((c) => `${c.purpose}: ${c.text?.en ?? ""}`).join("\n\n");
+    return {
+      code: "CONSENT_REQUIRED",
+      consentVersion: err.body?.consentVersion ?? null,
+      consents,
+      message:
+        "Nothing was changed — neither the switch nor any other setting sent with it. Turning this on publishes the account holder's name. Show them the text below; only if they agree, " +
+        `call cascrow_set_discoverable again with consentVersion "${err.body?.consentVersion ?? ""}".\n\n${texts}`,
+    };
+  }
 
   const parts = [];
   if (data.discoverable !== undefined)
     parts.push(`Discoverable: ${data.discoverable ? "✅ yes" : "❌ no"}`);
+  if (data.showNameOnCertificates !== undefined)
+    parts.push(`Name on certificate check pages: ${data.showNameOnCertificates ? "✅ yes" : "❌ no"}`);
   if (data.skills?.length > 0)
     parts.push(`Skills: ${data.skills.join(", ")}`);
-  if (data.callbackUrl)
-    parts.push(`Callback URL: ${data.callbackUrl}`);
-  if (data.profileUrl)
-    parts.push(`Public profile: ${BASE_URL}${data.profileUrl}`);
+  // A settings change never relays the callback secret into the model's context
+  // (owner decision, 2026-10-19) — only cascrow_rotate_callback_secret does, after
+  // its warning. The secret the server created is dropped here, unread.
+  const { callbackSecret, callbackSecretNotice, ...shown } = data;
+  void callbackSecretNotice;
+  if (shown.callbackUrl)
+    parts.push(`Callback URL: ${shown.callbackUrl}`);
+  if (shown.callbackUrl && callbackSecret)
+    parts.push("Callbacks are signed with a new secret that is not shown here — call cascrow_rotate_callback_secret to obtain it.");
+  if (shown.profileUrl)
+    parts.push(`Public profile: ${BASE_URL}${shown.profileUrl}`);
 
   return {
-    ...data,
+    ...shown,
     message: parts.length > 0
       ? `Agent settings updated:\n${parts.map((p) => `  ${p}`).join("\n")}`
       : "Settings saved.",
   };
 }
 
+// The same words as src/lib/callback-secret-text.ts ROTATE_WARNING (this package
+// cannot import it; callback-secret-doors.test.ts holds the two equal).
+const ROTATE_WARNING =
+  "WARNING: this replaces the callback signing secret. The previous secret stops verifying immediately — " +
+  "callbacks signed from now on use the new one, so update your receiver at once. The new secret is returned " +
+  "in this tool result, which means it enters this conversation's context and transcript: store it only in the " +
+  "receiver's configuration, do not repeat it, and rotate again if this conversation may be read by anyone else.";
+
+/**
+ * The ONE MCP door to the callback signing secret. Two steps: without `confirm`
+ * nothing changes and the answer is the warning; with `confirm: true` it rotates
+ * (POST /api/agent/settings/callback-secret) and returns the secret.
+ */
+async function handleRotateCallbackSecret({ confirm } = {}) {
+  if (confirm !== true) {
+    return { rotated: false, warning: ROTATE_WARNING, message: `${ROTATE_WARNING}\n\nNothing was changed. Call cascrow_rotate_callback_secret again with confirm: true to rotate.` };
+  }
+  let data;
+  try {
+    data = await apiPost("/api/agent/settings/callback-secret", {});
+  } catch (err) {
+    if (!(err instanceof CascrowApiError) || err.code !== "NO_CALLBACK_URL") throw err;
+    return { rotated: false, code: "NO_CALLBACK_URL", message: "No callback URL is set, so there is no secret to rotate. Set one with cascrow_set_discoverable { callbackUrl }, then call this tool again." };
+  }
+  return { rotated: true, callbackSecret: data.callbackSecret, warning: ROTATE_WARNING, message: `${ROTATE_WARNING}\n\n${data.message ?? ""}` };
+}
+
 /**
  * The funder's pending-verdict queue, and the verdict itself.
  *
@@ -1611,7 +1759,17 @@ async function handleV3Claims() {
 // hosted twins are the handleV3* functions in src/app/api/mcp/route.ts.
 async function handleV3Offer(args) {
   const data = await apiPost("/api/escrow/v3/offer", args);
-  return { ...data, message: "Offer frozen and sent to the builder. They accept with their own key; you then fund with one transaction from your machine: npx cascrow-signer@0.1.0 fund --milestone " + args.milestoneId + "." };
+  return { ...data, message: "Offer frozen and sent to the builder. They accept with their own key; you then fund with one transaction from your machine: npx cascrow-signer@0.2.0 fund --milestone " + args.milestoneId + "." };
+}
+
+/**
+ * Whether the offer an acceptance would sign names no arbiter — read from the
+ * typed data that is signed (the zero address), not from the convenience field.
+ * The same function in the hosted server (src/app/api/mcp/route.ts).
+ */
+function noArbiter(data) {
+  const a = data?.typedData?.message?.arbiter ?? data?.arbiter;
+  return typeof a !== "string" || /^0x0{40}$/i.test(a);
 }
 
 async function handleV3AcceptanceGet({ milestoneId }) {
@@ -1620,7 +1778,9 @@ async function handleV3AcceptanceGet({ milestoneId }) {
     ...data,
     message:
       "These are the payer's frozen terms. Check them yourself — your signature binds you until acceptBy, and nothing in cascrow revokes it. " +
-      "npx cascrow-signer@0.1.0 accept --milestone " + milestoneId + " checks them against its own pinned chain and contract and signs on your machine.",
+      "npx cascrow-signer@0.2.0 accept --milestone " + milestoneId + " checks them against its own pinned chain and contract and signs on your machine." +
+      // S-05: the free veto, said with the terms it applies to (owner: V3_CLIENT_TEXT).
+      (noArbiter(data) ? ` ${V3_CLIENT_TEXT.noArbiterVeto}` : ""),
   };
 }
 
@@ -1639,7 +1799,7 @@ async function handleV3Prepare({ milestoneId, action, proofHash, reasonHash, new
     ...data,
     message:
       "UNSIGNED transaction — cascrow does not sign, send or relay it. Before signing: rebuild data from the contract ABI, and check to and chainId against your OWN configuration, not this answer. " +
-      "Then broadcast it yourself and report the hash with cascrow_v3_report_tx. npx cascrow-signer@0.1.0 does all of this locally.",
+      "Then broadcast it yourself and report the hash with cascrow_v3_report_tx. npx cascrow-signer@0.2.0 does all of this locally.",
   };
 }
 
@@ -1657,6 +1817,32 @@ async function handleV3Attestation({ escrowId, claimIndex }) {
   return { ...data, message: "A non-binding AI recommendation, signed by cascrow. It moves no money: only the payer's release, an unobjected claim running out its window, or the arbiter pays." };
 }
 
+/**
+ * The two human-review doors — the same answers as the hosted server's
+ * (src/app/api/mcp/route.ts). An open request is not an error for the agent: it has
+ * nothing to do but wait, so ALREADY_OPEN comes back as a result with the deadline.
+ */
+async function handleRequestHumanReview({ contractId, milestoneId, reason }) {
+  try {
+    const data = await apiPost("/api/human-review", { contractId, ...(milestoneId ? { milestoneId } : {}), ...(reason ? { reason } : {}) });
+    return { ...data, message: `Human review requested (request ${data.requestId}). A person at cascrow decides by ${data.dueAt}; both parties receive the decision with its reasons. Read it with cascrow_human_reviews { contractId: "${contractId}" }.` };
+  } catch (err) {
+    if (err instanceof CascrowApiError && err.code === "HUMAN_REVIEW_ALREADY_OPEN") {
+      const dueAt = err.body && typeof err.body.dueAt === "string" ? err.body.dueAt : null;
+      return { status: "ALREADY_OPEN", dueAt, message: `A human review of this milestone is already open${dueAt ? `; a person at cascrow decides by ${dueAt}` : ""}. There is no need to ask again.` };
+    }
+    throw err;
+  }
+}
+
+async function handleHumanReviews({ contractId }) {
+  const data = await apiGet(`/api/human-review?contractId=${encodeURIComponent(contractId)}`);
+  const requests = Array.isArray(data.requests) ? data.requests : [];
+  if (requests.length === 0) return { requests: [], message: "No human-review requests on this contract." };
+  const lines = requests.map((r) => `  - ${r.id} [${r.status}]${r.source === "REVIEW_LAPSED" ? " (review window lapsed)" : ""} — ${r.outcome ? `outcome ${r.outcome}` : `decision due by ${r.dueAt}`}`).join("\n");
+  return { ...data, message: `${requests.length} human-review request(s):\n${lines}` };
+}
+
 async function handleReviewContract({ contractId, decision, milestoneId }) {
   const data = await apiPost(
     "/api/contracts/review",
@@ -2293,7 +2479,7 @@ async function handleWatchVerification({ milestoneId, content, filename, proofId
 // ─── MCP Server ───────────────────────────────────────────────────────────────
 
 const server = new Server(
-  { name: "cascrow", version: "3.0.0" },
+  { name: "cascrow", version: "3.1.0" },
   { capabilities: { tools: {} } }
 );
 
@@ -2344,6 +2530,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       case "cascrow_get_reputation":   result = await handleGetReputation(args);        break;
       case "cascrow_discover_agents":  result = await handleDiscoverAgents(args);       break;
       case "cascrow_set_discoverable":  result = await handleSetDiscoverable(args);      break;
+      case "cascrow_rotate_callback_secret": result = await handleRotateCallbackSecret(args); break;
       case "cascrow_list_my_contracts": result = await handleListMyContracts(args);      break;
       case "cascrow_review_queue":     result = await handleReviewQueue();              break;
       case "cascrow_v3_claims":        result = await handleV3Claims();                 break;
@@ -2354,6 +2541,8 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
       case "cascrow_v3_report_tx":     result = await handleV3ReportTx(args);           break;
       case "cascrow_v3_attestation":   result = await handleV3Attestation(args);        break;
       case "cascrow_review_contract":  result = await handleReviewContract(args);       break;
+      case "cascrow_request_human_review": result = await handleRequestHumanReview(args); break;
+      case "cascrow_human_reviews":     result = await handleHumanReviews(args);         break;
       case "cascrow_get_proof_status":  result = await handleGetProofStatus(args);       break;
       case "cascrow_mcp_submit":        result = await handleMcpSubmit(args);            break;
       case "cascrow_verify_work":           result = await handleVerifyWork(args);            break;

package/package.json

@@ -1,9 +1,15 @@
 {
   "name": "cascrow-mcp",
-  "version": "3.0.0",
+  "version": "3.1.0",
   "description": "MCP server for Cascrow — trust infrastructure for the agent economy: AI verification, on-chain reputation, and non-custodial milestone escrow (MilestoneEscrowV3, native XRP)",
   "type": "module",
   "main": "index.js",
+  "files": [
+    "index.js",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
   "bin": {
     "cascrow-mcp": "index.js"
   },
@@ -11,7 +17,7 @@
     "start": "node index.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.15.0"
+    "@modelcontextprotocol/sdk": "^1.32.1"
   },
   "keywords": [
     "mcp",

package/REMOTE_HTTP_SERVER.md

@@ -1,97 +0,0 @@
-# Remote HTTP MCP Server — Smithery Listing
-
-**Status: Done.** The HTTP transport described below is live at
-`src/app/api/mcp/route.ts` (Streamable HTTP, `@modelcontextprotocol/sdk`,
-`WebStandardStreamableHTTPServerTransport`), serving the same tools as this
-package's stdio server. `smithery.yaml` already lists both the remote URL
-(`https://cascrow.com/api/mcp`) and the local `npx cascrow-mcp` stdio fallback.
-The plan below is kept as a historical record of what was built and why —
-nothing in it is still pending.
-
-**Update (2026-08-03):** both this HTTP transport and the stdio server now also work
-without an API key — an unauthenticated caller gets a restricted server exposing only
-`cascrow_verify_work` (anonymous, 3/day per IP, same tier as `POST /api/verify/standalone`),
-instead of the transport-level 401 described below. Full 18-tool access still requires
-`Authorization: Bearer csk_...` exactly as documented.
-
-## Why
-
-The current `cascrow-mcp` package runs locally via `npx` (stdio transport).
-That works for **Claude Desktop** only.
-
-A remote HTTP MCP server at `https://cascrow.com/mcp` would enable:
-- **Claude.ai Web** (browser) — which only supports remote HTTP, not stdio
-- **Smithery listing** under `cascrow/cascrow` with one-click install for 10k+ users
-- **Any MCP client** without Node.js installed
-
-## The Use Case (no escrow needed)
-
-The primary value right now is **AI work verification**, independent of payments:
-
-- Agent does work → calls `cascrow_mcp_submit` with `amountUSD: 0`
-- 5 independent AI models vote on whether the work is complete
-- User sees: "4/5 models approved, 89% confidence"
-- Public certificate at `cascrow.com/proof/[hash]`
-
-This works today on testnet. No MetaMask, no wallet, no escrow required.
-Positions cascrow as the **trust/verification layer for AI work** before the agent economy matures.
-
-## What Needs to Be Built
-
-### 1. HTTP MCP Endpoint — `src/app/api/mcp/route.ts`
-
-Replace stdio transport with HTTP transport using `@modelcontextprotocol/sdk`:
-
-```ts
-import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
-import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
-
-// Same tools as cascrow-mcp/index.js but served over HTTP
-// Auth: API key from Authorization header or ?api_key= query param
-```
-
-The tools already exist in `cascrow-mcp/index.js` — they just need to be
-ported from stdio to HTTP transport. All business logic (`/api/mcp/submit`,
-`/api/contracts`, etc.) stays unchanged.
-
-### 2. Smithery Registration
-
-- Create Smithery account under `cascrow` org (not personal `moeller` namespace)
-- Go to smithery.ai/new
-- Namespace: `cascrow` / Server ID: `cascrow`
-- MCP Server URL: `https://cascrow.com/mcp`
-- Result: `smithery.ai/server/cascrow/cascrow` with one-click install
-
-### 3. Auth for Remote Connections
-
-Remote users authenticate with their cascrow API key (`csk_...`).
-Two options (both fine):
-- `Authorization: Bearer csk_...` header
-- `?api_key=csk_...` query param (easier for Smithery config UI)
-
-### 4. Smithery Config Schema (update smithery.yaml)
-
-```yaml
-startCommand:
-  type: http
-  configSchema:
-    type: object
-    properties:
-      CASCROW_API_KEY:
-        type: string
-        description: "Your cascrow API key (csk_...)"
-    required:
-      - CASCROW_API_KEY
-  url: https://cascrow.com/mcp
-```
-
-## Effort Estimate
-
-~4–6 hours. The hard parts (tools, auth, business logic) are already done.
-Only the transport layer needs to change.
-
-## When to Do This
-
-**Now** — the verification use case (amountUSD: 0) works on testnet today.
-Getting listed on Smithery/Claude.ai Web establishes cascrow as the
-verification standard before competitors enter the space.

package/server.json

@@ -1,46 +0,0 @@
-{
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
-  "name": "io.github.jnm04/cascrow-mcp",
-  "title": "Cascrow",
-  "description": "Independent 5-model AI verification of AI-generated work — free, no account required.",
-  "websiteUrl": "https://cascrow.com",
-  "repository": {
-    "url": "https://github.com/Jnm04/Milestone-Based-Funding",
-    "source": "github",
-    "subfolder": "cascrow-mcp"
-  },
-  "version": "3.0.0",
-  "packages": [
-    {
-      "registryType": "npm",
-      "registryBaseUrl": "https://registry.npmjs.org",
-      "identifier": "cascrow-mcp",
-      "version": "3.0.0",
-      "transport": {
-        "type": "stdio"
-      },
-      "environmentVariables": [
-        {
-          "name": "CASCROW_API_KEY",
-          "description": "Cascrow API key (csk_...). Optional — without it, only the free cascrow_verify_work tool is available (3 verifications/day per IP). Get one instantly via POST /api/agent/register, no human review required.",
-          "isRequired": false,
-          "isSecret": true
-        }
-      ]
-    }
-  ],
-  "remotes": [
-    {
-      "type": "streamable-http",
-      "url": "https://cascrow.com/api/mcp",
-      "headers": [
-        {
-          "name": "Authorization",
-          "description": "Bearer csk_... API key. Optional — without it, only the free cascrow_verify_work tool is available (3 verifications/day per IP).",
-          "isRequired": false,
-          "isSecret": true
-        }
-      ]
-    }
-  ]
-}

package/smithery.yaml

@@ -1,28 +0,0 @@
-# Smithery configuration file: https://smithery.ai/docs/config#smitheryyaml
-
-# Remote HTTP transport (Claude.ai web, Claude.ai API)
-url: https://cascrow.com/api/mcp
-
-startCommand:
-  type: stdio
-  configSchema:
-    type: object
-    properties:
-      CASCROW_API_KEY:
-        type: string
-        description: "Optional. Your cascrow API key (starts with csk_) — get one at cascrow.com/register or POST /api/agent/register. Without it, the server still starts but only cascrow_verify_work is available (3 free AI-verified checks per IP per day, no account needed). Set this to unlock every other tool."
-        pattern: "^csk_"
-      CASCROW_BASE_URL:
-        type: string
-        description: "Cascrow API base URL. Leave blank to use the default (https://cascrow.com)."
-        default: "https://cascrow.com"
-    required: []
-  commandFunction: |-
-    (config) => ({
-      command: 'npx',
-      args: ['-y', 'cascrow-mcp'],
-      env: {
-        CASCROW_API_KEY: config.CASCROW_API_KEY || '',
-        CASCROW_BASE_URL: config.CASCROW_BASE_URL || 'https://cascrow.com'
-      }
-    })