open_deal
Escrow funded
Tamper-evident evidence layer + on-chain AI settlement for agent-to-agent deals


The short version, before the evidence.
Flight Recorder is a black box for deals between AI agents. Every request, delivery and approval is written into a SHA-256 hash chain that breaks visibly if anyone rewrites history. When a deal goes wrong, that record becomes the evidence.
A settlement contract on GenLayer Studio Next then acts as judge and escrow: funds lock when the deal opens, the case-file hash anchors at dispute, AI validators fetch and check the evidence, and the winner is paid on-chain. No central arbiter.
Everything on this page is live. The transactions below ran on chain 61997, and the widgets let you reproduce the evidence checks in your own browser.
New here? Start with TRY IT - 30 seconds, no install.
Every transition is visible, deliberate, and anchored.
Escrow funded
Hash-chain witness
Case file anchored
AI validators decide
Winner paid
Inspect the deployed Settlement contract and its lifecycle transactions.
| METHOD | TX HASH | STATUS | EXPLORER |
|---|---|---|---|
| open_deal | 0x833a8910...a07260 | FINALIZED | VIEW ↗ |
| dispute | 0x571095fb...5167758c | FINALIZED | VIEW ↗ |
| resolve | 0xd581386f...dba4de8 | FINALIZED | VIEW ↗ |
| finalize | 0x847ed870...e2b61c9 | FINALIZED | VIEW ↗ |
Every row is a real transaction on GenLayer Studio Next (chain 61997). Deal 4 completed the full lifecycle: dispute → AI resolve → APPROVED → finalize, paying the worker 0.1 GEN. These four transactions ran on the previous deployment (v2, 0x8BC5…), which stays on-chain as evidence; the address above is the current v6 contract (D6).
Three independent paths from claim to evidence.
Open the contract page, check the transaction list and the FINALIZED badges.
Clone the repo, run the tests, then execute the live demo.
git clone https://github.com/hoveiser/flight-recorder.gitpytest tests/ -vnode scripts/e2e_demo.jsExpect 173 passed: 93 off-chain plus 80 direct-mode contract tests. The direct-mode half needs Linux/macOS (gltest cannot inject its fd-0 message on Windows), so on Windows run pytest tests --ignore=tests/direct and let CI be the authoritative full run.
No install needed. Use the Case File Hash Checker below and reproduce the on-chain hash yourself.
Live outcomes from the deployed Settlement contract.
| SCENARIO | VERDICT / OUTCOME | PAYOUT TO | KEY TX |
|---|---|---|---|
| 0 / HAPPY PATH, AI RESOLVE | APPROVED / released | Worker (0.1 GEN) | 0x847ed870... VIEW ↗ |
| 1 / OFF-CHAIN ANCHOR | Chain anchor verified on-chain | None | 0x6d87f4ed... VIEW ↗ |
| 2 / TIMEOUT RELEASE | Early release correctly rejected - 7-day escrow lock enforced | None | 0x19ca7d54... VIEW ↗ |
| 3 / EVIDENCE HASH MISMATCH | MISMATCH / refunded | Client | 0x535b7200... VIEW ↗ |
Row 3 / EVIDENCE HASH MISMATCH anchors a deliberately wrong case-file hash: validators re-fetch the served evidence, re-hash it during the consensus round, detect the mismatch, and refund the client - the tamper path, demonstrated live. Exact hashes and validator reasoning: scripts/e2e_results.md. Every row in this matrix ran on the previous deployment (v2, 0x8BC5…), which remains on-chain and verifiable. The current D6 contract's own runs, including twelve adversarial cases and a live CHAIN_MISMATCH refund, are recorded in the same file. The 7-day timeout lock is a deployment parameter chosen for escrow realism; per-deal configurable timeouts are on the roadmap.
Fetch the case file, hash it in your browser, compare with what is anchored on-chain.
The digest below is recomputed from the exact bytes served from the repo. A dispute anchors that same digest on-chain as case_file_hash, so a tampered copy fails here and on-chain for the same reason.
Edit any payload and watch every later hash change. This is exactly what /verify detects off-chain.
Chain rule: hash_i = SHA256(payload_i + previous_hash), genesis = 64 zeros.
The widgets above prove the evidence layer. This panel shows the execution layer: a real dispute lifecycle that ran on Studio Next, step by step, with the exact transactions and the commands to reproduce it.
Escrow funded, agreement hash locked.
0x833a8910...a07260 VIEW ↗FINALIZEDOff-chain hash chain grows; the widgets above verify it. No gas, no on-chain tx.
Case-file hash anchored on-chain.
0x571095fb...5167758c VIEW ↗FINALIZEDValidators fetch the case file, recompute the hash chain against the anchored head, verdict APPROVED.
0xd581386f...dba4de8 VIEW ↗FINALIZEDWinner paid on-chain, payout visible in get_payouts.
Executing a dispute needs a funded Studio Next account and a private key. We will not ask for your key, and we will not spend gas from a shared wallet silently. Instead, one command reproduces the entire lifecycle with your own account: node scripts/e2e_demo.js - or call the methods yourself on contract 0x51A54D74e86159482F2E57b8d4744c7Ba44D7043 in Studio Next (studio-dev, chain 61997). Every run shown above is public and verifiable.
Browser-executed disputes are live in section 08: TRY A DISPUTE connects your wallet and signs open_deal / dispute on-chain from your browser, and off-chain event recording is served by the hosted evidence API. An integrated faucet remains on the roadmap.
Evidence stays inspectable. Consensus stays distributed.
Append-only SQLite log. Any modification breaks the chain.
Equivalence-principle consensus. No single party controls the verdict.
The case file carries the record from the witness layer to the judge.
{ "deal_id": "demo_happy_002", "definition_of_done": { "success_criteria": "1000 valid records" }, "parties": [ "0x62F4e023b1d1e68a86E153829704610C007175Fb", "0x..." ], "events": [{ "event_type": "DELIVERY", "payload": { "valid": 500 }, "actor": "0x...", "signature": "0x... personal_sign by the actor", "sig_version": 2 }], "chain_integrity": { "verification": "PASS", "signature_status": "PASS", "last_hash": "33d588cb..." } }
| APPROVED | Worker paid | Agreement fulfilled |
| REFUNDED | Client refunded | Worker failed delivery |
| EVIDENCE_MISMATCH | Client refunded | Served bytes are not the anchored case file |
| AGREEMENT_MISMATCH | Client refunded | Case-file terms are not the anchored agreement |
| ANCHOR_MISMATCH | Client refunded | No delivery head was ever anchored on-chain; fails closed |
| CHAIN_MISMATCH | Client refunded | The contract recomputes the chain from genesis and its own head is not the anchored delivery head |
| UNRESOLVABLE | No payout until the appeal window closes | Too many failed attempts; then timeout_release refunds |
| TIMEOUT | Worker paid | No dispute filed within 7 days |
| The four red verdicts are evidence outcomes: they are derived from the fetched bytes, so validators must agree on them exactly, and none of them depends on what a model thinks about the work. | ||
Five commands from clone to on-chain verification.
git clone https://github.com/hoveiser/flight-recorder.git && cd flight-recorderpip install -r requirements.txt && npm installpytest tests/ -vuvicorn src.main:appnode scripts/e2e_demo.jsVerify on-chain: open the Studio Explorer contract page ↗
Recorded against deployment v1; the transaction hashes visible in the video belong to v1 (see Deployment history in the README).
Your connected wallet signs the writes. This page does not mint GEN.
Current contract: 0x51A54D… (v6 / D6). Superseded history that stays on-chain and verifiable: v5 / D5 0xc93007…, v4 0xfD91f7…, audited v3 0x223323CE… and v2 0x8BC5….
Locks 0.01 GEN escrow on the deployed Settlement contract.
Appends one off-chain event with the session token. Your wallet signs the event with personal_sign, so the recorder can prove the actor is a deal party and owns the session.
Seals your own evidence log, then anchors the case-file hash and the sealed chain head on-chain in one transaction. The head can never be overwritten afterwards.
Explorer links for every write in this run.