Live PayPal sandbox. No real money. Stood's hosted API and reconciler connect to the real PayPal sandbox, including saved-account signing and milestone funding; /health reports current readiness. Stood's runner judges code milestones live on Vercel Sandbox, and settlement is on (switched on by the owner on 11 October 2026, after the judge qualified live and the production review found no releases from the old runner), so the reconciler captures a released milestone or voids a refused one on the sandbox. A full live run did both on 12 October 2026, each step confirmed in PayPal (results). Yard's hosted app (owner-issued access codes) runs its Board, events, site log, private intake, the Foreman and its payment connection to Stood; builder payouts run from Yard's own sandbox PayPal app (qualified live: Payouts guide), 48 hours after a release (on release for the final milestone). What would have to be true before real money: docs/real-money.md.
Public links
| What | Link | Status |
|---|
| Website | https://ma-za-kpe.github.io/stood/ | Live |
| Yard (companion site) | https://ma-za-kpe.github.io/stood/yard/ | Live |
| Changelog | https://ma-za-kpe.github.io/stood/changelog.html | Live |
| Hosted sandbox API | https://stood-api.onrender.com · health: https://stood-api.onrender.com/health | Live on the PayPal sandbox. /health says whether sandbox payments are on and, if not, what is missing (setup record). Render Starter, always on |
| Hosted Yard app | https://stood-yard-api.onrender.com/app/ | Owner-issued access code; Board, events, site log and private intake |
| Stood API contract (OpenAPI 3.1) | https://stood-api.onrender.com/v1/openapi.json | Served by stood-api from API 1.4.1; the same file is openapi/stood.json |
| Stood API reference (APIMatic portal) | https://ma-za-kpe.github.io/stood/api/ | Generated from the same contract by APIMatic on every merge to main; HTTP and TypeScript examples, a signing guide, no Try It (requests need your secret) |
| Hosted Yard API | https://stood-yard-api.onrender.com/health | Yard's Board, events and site log on Render (Starter). Private intake, Foreman and the Stood payment connection are live; /health reports configured capabilities |
| Source code | https://github.com/ma-za-kpe/stood | MIT |
| Releases | https://github.com/ma-za-kpe/stood/releases | |
| Current work | #75 UX and app coverage · #76 hosted Foreman and Yard adapters · #51 submission | Hosted sign-in and import are deployed; C2 stays open for the UX/98% app audit, with #99 tracking import sanitization |
| Latest progress | Discord-ready update and screenshots (#108) | Verified against the deployed desktop/mobile app and public pages |
| Hackathon | https://paypalaihackathon.devpost.com/ | |
| Yard GitHub App | https://github.com/apps/yard-builder | Installed only on yard-sandbox (setup) |
| Yard test repository | https://github.com/ma-za-kpe/yard-sandbox | Throwaway: where Yard's wo/* branches and pull requests appear in demos |
| Guide for PayPal developers | Authorize, capture and void on the PayPal sandbox, step by step | Written from our own setup, with every error we hit |
| Guide for Render developers | Deploy Stood and Yard, step by step | Three services, migration order, readiness limits, release checks and rollback |
| Render quick deploy | | Three paid sandbox services; manual deploys; external database and provider accounts required |
| Guide for Kernel developers | Approve PayPal sandbox payments unattended with a Kernel cloud browser, step by step | Written from our own runs: CAPTURED, VOIDED and VAULTED with nobody at the keyboard, and every selector mistake we fixed |
| Guide for APIMatic developers | A typed SDK from your OpenAPI contract, including per-request HMAC signing, step by step | Written from our own runs: the SDK calls the real router in CI, and every generation mistake we fixed |
| Guide for Vercel Sandbox developers | Judge untrusted code with tests it cannot touch, step by step | Written from our own runs: the builder's early exit and forged report fail, its tampering is refused, and every isolation mistake we fixed |
| Guide for PayPal Payouts developers | Pay builders after the money is released, with PayPal Payouts, step by step | Written from our own sandbox run: paid out, a retry not paid twice, and where PayPal really puts the duplicate's link |
| Guide for AG Studio developers | Build a buyer-only reviewer file with a license-expiry fallback | Separate work-order and ledger sources; read-only data; plain-table fallback |
| Guide for Bryntum developers | Show signed milestones in a locked read-only Gantt | Lazy-loaded trial package, exact deadlines, no write path |
| Guide for Zapier developers | Deliver Yard notices through a private Catch Hook | Durable retries, explicit recipient allow-list and duplicate key |
| Guide for xAI Grok developers | Plan projects within a shared spend cap | Schema-checked proposals; buyer budget and dates stay deterministic |
| Guide for GitHub App developers | Scope Yard to one disposable repository | Short-lived installation tokens and guarded work-order branches |
| Guide for StartupTribunal developers | Import a public catalog idea into a private brief | Attribution, bounded reads and safe retry behavior |
| Guide for Cloudflare R2 developers | Store private, hash-checked evidence | Scoped bucket token, short-lived URLs and retention boundaries |
| Guide for GitGuardian developers | Scan every unmerged commit before pushing | ggshield, local checks and credential incident response |
| PayPal tools we use | PayPal Developer · PayPal AI Toolkit · APIMatic PayPal Context Plugin | How we use them |
Browse ideas: open hosted Yard, sign in with the buyer code from the private ~/.config/stood/yard-access-codes file, then open Describe a project. Ideas load automatically; search and click View idea to review a card. No StartupTribunal API key is needed for public discovery. Codes are already configured as accessCode entries in the private .env YARD_OPERATORS; never paste them into issues or screenshots.
The problem
Adaeze delegates a code milestone to Yard or a human developer. A green badge alone does not show whether signed tests were changed, skipped or too weak. Her payment needs a new commit, intact acceptance tests, a trustworthy run and the agreed budget and usage conditions. Buyer and builder identity does not change the decision.
The implemented code.milestone@1 rule profile composes deterministic findings. Trusted signed-runner ingestion is still planned (T-0159); the landing page's four commit examples are illustrative. Yard is the companion product in this monorepo. Its Board, events and site log run on Render. The hosted app adds private sign-in and intake; the planner and remaining live adapters are being connected in C3. The isolated Docker network exercises the complete scripted journey. The Yard page is an illustrative simulation, not a live work-order screen. Read the positioning and trust boundary. EyeOnSite remains a site-visit scenario.
EyeOnSite is a linked site-visit scenario, with its original research preserved in the historical docs.
What Stood does
Stood is the gate a platform calls before a staged payment leaves.
Saved-account signing and funding run through the hosted API and worker. Trusted execution and the complete release workflow are still being built:
- Allowance: the buyer freezes signed acceptance tests, the operator/payee, repository, base commit and budget: a $4,000 cap and $1,200 build milestone.
- Hold: PayPal authorises a milestone amount before work is submitted. Stood holds no money.
- Commit package: the builder submits the exact commit, frozen test hashes and signed runner report.
- Decision: rules check intact tests, execution, new work, mutation quality, budget and the agreed outside usage signal. Missing proof means wait.
| Outcome | What happens to the money | What the payer reads |
|---|
| Released | Confirmed PayPal capture | "Milestone 2 released. $1,200 paid. The signed tests passed for this commit." |
| Refused | Confirmed PayPal void | "Signed tests changed. Nothing was paid." |
| In review | Hold remains unresolved | "The tests are too weak. $1,200 is held, not paid." |
These are target confirmed-payment messages. A decision alone never claims money moved; pending or ambiguous submissions say payment is not confirmed. Receipts and dispute packets remain planned.
Principles
- Rules move money; models only report. The AI that looks at evidence runs without PayPal credentials (ADR-0003).
- Fail closed. Missing or uncertain evidence means wait. An expired hold pays nothing.
- Never holds funds. PayPal holds the authorisation. The calling platform pays people on local rails (ADR-0004).
- Industry-blind. Stood knows allowances, evidence and decisions, never houses or code. Verticals are evidence profiles (ADR-0007).
- Never silent. Every state has one plain sentence.
Use cases
One endpoint, many checklists (S16):
| Domain | "Done" means | Profile |
|---|
| Code milestones (lead) | Signed tests intact, trustworthy execution, new commit and agreed budget/usage proof | code.milestone@1 |
| Site visits (EyeOnSite, a scenario) | The stage is reached on this plot | construction.stage@1 |
| Freelance milestones | These screens and links were delivered, and they're not last week's files | freelance.milestone@1 |
| Insurance claims and lending draws | The field visit shows the damage, the stock or the shop | claims.field_visit@1 |
| Rentals and deposits | Return photos match checkout (inverted: a match returns the deposit) | rental.return@1 |
| Grants and NGOs | The site matches the proposal milestone | grant.site_visit@1 |
| Trade and goods | The seal, container and batch were received | delivery.goods@1 |
| AI agents that pay | The task's acceptance checks pass (via the Stood MCP) | any |
Quickstart
Judges and evaluators: the 2-minute path (local synthetic scenarios, no money executed) is at the top of the usage manual.
Default local judge fixture (synthetic evidence; no tests or payments execute):
docker compose up -d api
curl -s -X POST http://localhost:3000/v1/demo/scenarios/signed-tests-changed
It refuses with namedField signed_tests_changed and says: “The signed tests were changed. Nothing was paid. No payment was executed.” code-good passes the assessment; weak-tests and usage-pending wait.
Integrators (planned @stood/sdk, v1 draft contract):
import { Stood } from '@stood/sdk';
const stood = new Stood({ baseUrl: process.env.STOOD_BASE_URL, apiKey: process.env.STOOD_API_KEY,
hmacSecret: process.env.STOOD_HMAC_SECRET });
const allowance = await stood.allowances.create({ /* milestones + evidence profiles */ });
// → send the payer to allowance.approve_url (PayPal), then:
const held = await stood.tranches.dispatch(trancheId); // PayPal hold + nonce
await stood.tranches.submitPackage(held.id, { /* evidence */ }); // → webhook: released | refused | waiting
Keys you need: STOOD_API_KEY, STOOD_HMAC_SECRET and STOOD_WEBHOOK_SECRET (server-side only). Self-hosting adds sandbox PayPal credentials, Postgres, S3 / R2 and the evidence agent. See Keys and configuration.
Architecture
flowchart LR
P[Platform<br/>buyer or builder agent] -- allowance · dispatch · package --> API[stood-api<br/>rules + PayPal adapter]
API -- webhooks + sentence --> P
API -- authorise · capture · void --> PP[(PayPal sandbox)]
API -- signed URLs --> AG[evidence agent<br/>vision findings only<br/>no PayPal keys]
API --- DB[(Postgres)] & S3[(R2 / S3)]
RV[Reviewer] --> WEB[stood-web<br/>AG Studio · Bryntum]
WEB --> API
Hexagonal domain core, pure decision rules, idempotent money commands, a transactional outbox. Details: T02 Architecture · T03 Domain · T04 API (OpenAPI 3.1, TypeScript SDK) · T06 PayPal.
Built with
Integrated tools: PayPal at the centre (Orders v2 authorise / capture / void, Vault, Disputes, Transaction Search, Agent Toolkit MCP, the APIMatic-generated Server SDK), plus partner jobs (S13):
| Partner | Job in Stood |
|---|
| APIMatic | Context Plugin grounds PayPal SDK calls. Generates Stood's SDK, docs and MCP |
| AG Grid · AG Studio | Buyer-only read-only reviewer file with milestone and capture reconciliation; license expiry falls back to Yard tables |
| Bryntum | Lazy-loaded read-only Gantt of milestone deadlines; unreleased milestones remain locked |
| Channel3 | Catalog match: was the specified fitting installed? |
| Render | Hosting (Docker) + durable hold timers (Workflows) |
| Astropods | Runs the evidence agent, with no PayPal credentials |
| Elastic | Evidence memory: reused and internet photo detection |
| Kernel | Automates the sandbox buyer approval so judges can replay every outcome |
| Postman | Deferred by owner (2026-10-09); no paid upgrade, workspace or monitors in use. See operational decision. |
| Zapier | Delivers the one-line reason by email / SMS / Slack |
See the C5 submission draft and demo storyboard for the evidence-backed tools description and the owner-only submission steps. Sponsor integrations are sandbox/pilot features; their guides state where local tests stop and live provider qualification begins. Develocity 2026.3 was assessed for a no-cost fit; the current stack has no supported, ongoing free integration. See the fit decision and no-cost build measurement plan.
Target free-tier deployment: Render · Neon Postgres · Cloudflare R2 · Cloudflare Workers AI (Llama 3.2 Vision, open weights) · GitHub Actions / Pages. Everything else is open source (T09, T10).
Repository map
.
├─ site/ Landing page + changelog (GitHub Pages, deploys on merge to main)
├─ tools/site/ Site build (version + rendered CHANGELOG.md)
├─ docs/
│ ├─ USAGE.md Usage manual: keys, quickstart, webhooks, profiles
│ ├─ WAYS_OF_WORKING.md TDD · DDD · OOP · GitFlow · pre-commit · Definition of Done
│ ├─ stood/ Product specs S01–S17
│ ├─ tech/ Technical docs T01–T17
│ ├─ adr/ Architecture decisions
│ ├─ brand/ Logo, app icons, social, verdict chips (Volt)
│ └─ 01–13 *.md Research, hackathon, PayPal landscape, judges, checklist
├─ TASKS.md Append-only task ledger + ground rules + full backlog
├─ .pre-commit-config.yaml The cutthroat gate (also run by CI)
└─ .github/ CI, Pages, release-please, back-merge, templates, rulesets
Implemented core: services/api. Planned additional services: apps/web, services/api, services/workflows, services/evidence-agent, fixtures/ (S14).
Documentation
Development
Docker only. The host needs git, Docker and pre-commit (T15).
1. Install pre-commit (mandatory, before your first commit)
pip install pre-commit # or: brew install pre-commit / pipx install pre-commit
pre-commit install # installs pre-commit, commit-msg and pre-push hooks
pre-commit run --all-files # must pass before you push
Check it's active: ls .git/hooks/pre-commit .git/hooks/commit-msg .git/hooks/pre-push should list all three. Fast checks run on every commit; before every push, scripts/ci-local runs every CI job locally (clean image build, all hooks, the Docker product gate, the site, mock network and hosted Yard checks), about 25 minutes, so CI never fails first (ADR-0023). Docker must be running, because some hooks run in pinned containers. The commit-msg hook rejects any commit without a Conventional message and a DCO sign-off, so always commit with git commit -s.
To run the gate from a second checkout while another Stood checkout uses the default Compose project or database port, isolate its containers and choose a free host port, for example: COMPOSE_PROJECT_NAME=stood-c5 STOOD_DB_HOST_PORT=55432 scripts/ci-local. The database still listens on port 5432 inside Compose.
There's no way around the gate:
- CI runs the same
.pre-commit-config.yaml on every PR (pre-commit check).
- Rulesets on
develop and main block merging until the pre-commit, pr-title and dco checks pass.
--no-verify doesn't help, because CI fails the PR anyway.
What the gate checks (WoW §8):
- repository hygiene
- secrets (gitleaks)
- GitHub Actions (actionlint, zizmor, schemas)
- docs (markdownlint, typos, offline links and anchors)
- web code (Biome)
- banned words in user-facing copy
- GitFlow branch names, Conventional Commits and DCO
2. Install and run (Docker only)
You need git, Docker (Desktop or Engine, with Compose v2) and pre-commit (step 1). Nothing else runs on your machine: Node, pnpm and Postgres all run in containers. No keys are needed for local work; the PayPal simulator stands in for PayPal.
git clone https://github.com/ma-za-kpe/stood && cd stood
git switch develop # the default branch for work
cp .env.example .env && chmod 600 .env # names only; leave values empty for local work
docker compose build app # the dev image (Node 24, pnpm 10)
./scripts/dev install # pnpm install inside the container
./scripts/dev up # Postgres, local S3 (SeaweedFS), Mailpit
docker compose run --rm app pnpm test # unit tests; every command runs in a container
./scripts/dev validate # the full gate: lint, types, boundaries, coverage, build, Postgres tests
docker compose up -d api # local API with synthetic fixtures, no payment execution
See the whole product locally (Stood, Yard and the simulated network, no keys):
./scripts/dev demo # http://localhost:3002/ (Stood), /yard/, /yard/app/?project=yard-project
./scripts/dev demo:down # stop and remove it
scripts/mock-network # the 15 network scenarios; must exit 0 before you push
Use the real PayPal sandbox instead of the simulator: create a sandbox app (setup record, section 3), then run ./scripts/dev setup. It asks for the keys, checks them with PayPal and never prints them. Set PROVIDER_PAYPAL=live (which still means the sandbox).
Hosting: the hosted sandbox (Render + Neon) and every step to repeat it are in docs/SETUP.md. Key names and scopes are in docs/HANDOFF.md.
Troubleshooting on macOS: if commands fail with Operation not permitted or getcwd, give your terminal app access to the Documents folder (System Settings → Privacy & Security → Files and Folders), then reopen it.
3. Branch, commit and open a PR (GitFlow)
git switch develop && git pull
git switch -c feature/42-hold-timers # <type>/<issue>-<slug>, validated by the gate
# … write the failing test first, then the code …
git commit -s -m "feat(tranche): reauthorise holds from day 4"
git push -u origin feature/42-hold-timers # open a PR into develop
feature/* → develop (squash, Conventional-Commit PR title) → main (merge commit) → release-please tags vX.Y.Z and updates the changelog. develop is the default branch (ADR-0006).- Test-first, domain-driven: red → green → refactor. 100% branch coverage on decision and money code (WoW §4–6).
- Review gate: sandbox PRs merge after required CI passes, including the product and network checks (ADR-0024). Human money-path approval is required before real money.
Roadmap
| Version | Target | Scope |
|---|
| 0.1.0 | Released | Docs, brand, landing page and quality gate |
| 0.2.0 | Released 5 Oct | Tested domain, durable storage, guarded funded-hold adapter, signed DRAFT API and new landing page; money HTTP off |
| 0.3.0 | 23 Oct | All three outcomes, evidence agent, receipts, webhooks, EyeOnSite wired |
| 0.4.0 | 30 Oct | Reviewer file (AG Studio), Gantt, dispute packet, notifications |
| 1.0.0 | 11 Nov | Hackathon submission: video, partner docs, final checklist |
The full backlog lives in TASKS.md. Milestone detail is in T14.
Contributing
Contributions are welcome. Read CONTRIBUTING and Ways of working, install pre-commit, then pick an issue.
We especially want to hear from:
-
buyers and builders using code milestones,
-
agent operators and test-runner engineers,
-
freelancers and platforms with milestone payments,
-
payments, risk and compliance folks.
-
Code of conduct: Contributor Covenant 2.1
-
Security: report privately, see SECURITY.md. Never test with real accounts or real money.
License
MIT © 2026 ma-za-kpe and Stood contributors.
Third-party tools and services (PayPal, AG Grid / AG Studio, Bryntum and the other partners) are subject to their own licences and terms. Commercial components are installed from their registries and never vendored. "Stood" hasn't yet been checked as a trademark.
Connected local simulation
Run scripts/dev demo to build and check the connected Docker journey, then open http://localhost:3002/ for Stood or http://localhost:3002/yard/app/?project=yard-project for the Yard room. Choose Buyer. This uses real local services with simulated providers and synthetic evidence; no real payment is executed. No keys are needed. Stop the disposable demo with scripts/dev demo:down. The hosted app is available at https://stood-yard-api.onrender.com/app/ with owner-issued sign-in, the Board and private StartupTribunal intake. Stood signing/funding and reconciliation are qualified on the real PayPal sandbox. Hosted Foreman and Yard payment integration continue in #76.
Site-visit photo upload sessions reserve bounded, tenant-owned storage and complete only after byte-integrity checks. Completion is evidence intake; trusted site-visit assessment remains open. Hosted Yard payment evidence includes a real sandbox capture driven through Yard app sessions.
Created and maintained by Maku Mazakpe, based in Accra, Ghana. Support · GitHub · LinkedIn.
Mandate requests accept an empty JSON object and retain their first acceptance time on an identical retry. The signing worker retires unused expired consent and polls waiting requests fairly; ambiguous provider writes remain read-only recovery work. See mandate operations. Broad C4 requirements remain tracked in #77.
