Stood

---

Live PayPal sandbox. No real money. Stood's hosted API and reconciler connect to the real PayPal sandbox, including saved-account signing and milestone funding; /health reports current readiness. Stood's runner judges code milestones live on Vercel Sandbox, and settlement is on (switched on by the owner on 11 October 2026, after the judge qualified live and the production review found no releases from the old runner), so the reconciler captures a released milestone or voids a refused one on the sandbox. A full live run did both on 12 October 2026, each step confirmed in PayPal (results). Yard's hosted app (owner-issued access codes) runs its Board, events, site log, private intake, the Foreman and its payment connection to Stood; builder payouts run from Yard's own sandbox PayPal app (qualified live: Payouts guide), 48 hours after a release (on release for the final milestone). What would have to be true before real money: docs/real-money.md.

Public links

What	Link	Status
Website	https://ma-za-kpe.github.io/stood/	Live
Yard (companion site)	https://ma-za-kpe.github.io/stood/yard/	Live
Changelog	https://ma-za-kpe.github.io/stood/changelog.html	Live
Hosted sandbox API	https://stood-api.onrender.com · health: https://stood-api.onrender.com/health	Live on the PayPal sandbox. /health says whether sandbox payments are on and, if not, what is missing (setup record). Render Starter, always on
Hosted Yard app	https://stood-yard-api.onrender.com/app/	Owner-issued access code; Board, events, site log and private intake
Stood API contract (OpenAPI 3.1)	https://stood-api.onrender.com/v1/openapi.json	Served by stood-api from API 1.4.1; the same file is openapi/stood.json
Stood API reference (APIMatic portal)	https://ma-za-kpe.github.io/stood/api/	Generated from the same contract by APIMatic on every merge to main; HTTP and TypeScript examples, a signing guide, no Try It (requests need your secret)
Hosted Yard API	https://stood-yard-api.onrender.com/health	Yard's Board, events and site log on Render (Starter). Private intake, Foreman and the Stood payment connection are live; /health reports configured capabilities
Source code	https://github.com/ma-za-kpe/stood	MIT
Releases	https://github.com/ma-za-kpe/stood/releases
Current work	#75 UX and app coverage · #76 hosted Foreman and Yard adapters · #51 submission	Hosted sign-in and import are deployed; C2 stays open for the UX/98% app audit, with #99 tracking import sanitization
Latest progress	Discord-ready update and screenshots (#108)	Verified against the deployed desktop/mobile app and public pages
Hackathon	https://paypalaihackathon.devpost.com/
Yard GitHub App	https://github.com/apps/yard-builder	Installed only on yard-sandbox (setup)
Yard test repository	https://github.com/ma-za-kpe/yard-sandbox	Throwaway: where Yard's wo/* branches and pull requests appear in demos
Guide for PayPal developers	Authorize, capture and void on the PayPal sandbox, step by step	Written from our own setup, with every error we hit
Guide for Render developers	Deploy Stood and Yard, step by step	Three services, migration order, readiness limits, release checks and rollback
Render quick deploy		Three paid sandbox services; manual deploys; external database and provider accounts required
Guide for Kernel developers	Approve PayPal sandbox payments unattended with a Kernel cloud browser, step by step	Written from our own runs: CAPTURED, VOIDED and VAULTED with nobody at the keyboard, and every selector mistake we fixed
Guide for APIMatic developers	A typed SDK from your OpenAPI contract, including per-request HMAC signing, step by step	Written from our own runs: the SDK calls the real router in CI, and every generation mistake we fixed
Guide for Vercel Sandbox developers	Judge untrusted code with tests it cannot touch, step by step	Written from our own runs: the builder's early exit and forged report fail, its tampering is refused, and every isolation mistake we fixed
Guide for PayPal Payouts developers	Pay builders after the money is released, with PayPal Payouts, step by step	Written from our own sandbox run: paid out, a retry not paid twice, and where PayPal really puts the duplicate's link
Guide for AG Studio developers	Build a buyer-only reviewer file with a license-expiry fallback	Separate work-order and ledger sources; read-only data; plain-table fallback
Guide for Bryntum developers	Show signed milestones in a locked read-only Gantt	Lazy-loaded trial package, exact deadlines, no write path
Guide for Zapier developers	Deliver Yard notices through a private Catch Hook	Durable retries, explicit recipient allow-list and duplicate key
Guide for xAI Grok developers	Plan projects within a shared spend cap	Schema-checked proposals; buyer budget and dates stay deterministic
Guide for GitHub App developers	Scope Yard to one disposable repository	Short-lived installation tokens and guarded work-order branches
Guide for StartupTribunal developers	Import a public catalog idea into a private brief	Attribution, bounded reads and safe retry behavior
Guide for Cloudflare R2 developers	Store private, hash-checked evidence	Scoped bucket token, short-lived URLs and retention boundaries
Guide for GitGuardian developers	Scan every unmerged commit before pushing	ggshield, local checks and credential incident response
PayPal tools we use	PayPal Developer · PayPal AI Toolkit · APIMatic PayPal Context Plugin	How we use them

Browse ideas: open hosted Yard, sign in with the buyer code from the private ~/.config/stood/yard-access-codes file, then open Describe a project. Ideas load automatically; search and click View idea to review a card. No StartupTribunal API key is needed for public discovery. Codes are already configured as accessCode entries in the private .env YARD_OPERATORS; never paste them into issues or screenshots.

The problem

Adaeze delegates a code milestone to Yard or a human developer. A green badge alone does not show whether signed tests were changed, skipped or too weak. Her payment needs a new commit, intact acceptance tests, a trustworthy run and the agreed budget and usage conditions. Buyer and builder identity does not change the decision.

The implemented code.milestone@1 rule profile composes deterministic findings. Trusted signed-runner ingestion is still planned (T-0159); the landing page's four commit examples are illustrative. Yard is the companion product in this monorepo. Its Board, events and site log run on Render. The hosted app adds private sign-in and intake; the planner and remaining live adapters are being connected in C3. The isolated Docker network exercises the complete scripted journey. The Yard page is an illustrative simulation, not a live work-order screen. Read the positioning and trust boundary. EyeOnSite remains a site-visit scenario.

EyeOnSite is a linked site-visit scenario, with its original research preserved in the historical docs.

What Stood does

Stood is the gate a platform calls before a staged payment leaves.

Saved-account signing and funding run through the hosted API and worker. Trusted execution and the complete release workflow are still being built:

1. Allowance: the buyer freezes signed acceptance tests, the operator/payee, repository, base commit and budget: a $4,000 cap and $1,200 build milestone.
2. Hold: PayPal authorises a milestone amount before work is submitted. Stood holds no money.
3. Commit package: the builder submits the exact commit, frozen test hashes and signed runner report.
4. Decision: rules check intact tests, execution, new work, mutation quality, budget and the agreed outside usage signal. Missing proof means wait.

Outcome	What happens to the money	What the payer reads
Released	Confirmed PayPal capture	"Milestone 2 released. $1,200 paid. The signed tests passed for this commit."
Refused	Confirmed PayPal void	"Signed tests changed. Nothing was paid."
In review	Hold remains unresolved	"The tests are too weak. $1,200 is held, not paid."

These are target confirmed-payment messages. A decision alone never claims money moved; pending or ambiguous submissions say payment is not confirmed. Receipts and dispute packets remain planned.

Principles

• Rules move money; models only report. The AI that looks at evidence runs without PayPal credentials (ADR-0003).
• Fail closed. Missing or uncertain evidence means wait. An expired hold pays nothing.
• Never holds funds. PayPal holds the authorisation. The calling platform pays people on local rails (ADR-0004).
• Industry-blind. Stood knows allowances, evidence and decisions, never houses or code. Verticals are evidence profiles (ADR-0007).
• Never silent. Every state has one plain sentence.

Use cases

One endpoint, many checklists (S16):

Domain	"Done" means	Profile
Code milestones (lead)	Signed tests intact, trustworthy execution, new commit and agreed budget/usage proof	code.milestone@1
Site visits (EyeOnSite, a scenario)	The stage is reached on this plot	construction.stage@1
Freelance milestones	These screens and links were delivered, and they're not last week's files	freelance.milestone@1
Insurance claims and lending draws	The field visit shows the damage, the stock or the shop	claims.field_visit@1
Rentals and deposits	Return photos match checkout (inverted: a match returns the deposit)	rental.return@1
Grants and NGOs	The site matches the proposal milestone	grant.site_visit@1
Trade and goods	The seal, container and batch were received	delivery.goods@1
AI agents that pay	The task's acceptance checks pass (via the Stood MCP)	any

Quickstart

Judges and evaluators: the 2-minute path (local synthetic scenarios, no money executed) is at the top of the usage manual.

Default local judge fixture (synthetic evidence; no tests or payments execute):

docker compose up -d api
curl -s -X POST http://localhost:3000/v1/demo/scenarios/signed-tests-changed

It refuses with namedField signed_tests_changed and says: “The signed tests were changed. Nothing was paid. No payment was executed.” code-good passes the assessment; weak-tests and usage-pending wait.

Integrators (planned @stood/sdk, v1 draft contract):

import { Stood } from '@stood/sdk';

const stood = new Stood({ baseUrl: process.env.STOOD_BASE_URL, apiKey: process.env.STOOD_API_KEY,
                          hmacSecret: process.env.STOOD_HMAC_SECRET });

const allowance = await stood.allowances.create({ /* milestones + evidence profiles */ });
// → send the payer to allowance.approve_url (PayPal), then:
const held = await stood.tranches.dispatch(trancheId);         // PayPal hold + nonce
await stood.tranches.submitPackage(held.id, { /* evidence */ }); // → webhook: released | refused | waiting

Keys you need: STOOD_API_KEY, STOOD_HMAC_SECRET and STOOD_WEBHOOK_SECRET (server-side only). Self-hosting adds sandbox PayPal credentials, Postgres, S3 / R2 and the evidence agent. See Keys and configuration.

Architecture

flowchart LR
  P[Platform<br/>buyer or builder agent] -- allowance · dispatch · package --> API[stood-api<br/>rules + PayPal adapter]
  API -- webhooks + sentence --> P
  API -- authorise · capture · void --> PP[(PayPal sandbox)]
  API -- signed URLs --> AG[evidence agent<br/>vision findings only<br/>no PayPal keys]
  API --- DB[(Postgres)] & S3[(R2 / S3)]
  RV[Reviewer] --> WEB[stood-web<br/>AG Studio · Bryntum]
  WEB --> API

Hexagonal domain core, pure decision rules, idempotent money commands, a transactional outbox. Details: T02 Architecture · T03 Domain · T04 API (OpenAPI 3.1, TypeScript SDK) · T06 PayPal.

Built with

Integrated tools: PayPal at the centre (Orders v2 authorise / capture / void, Vault, Disputes, Transaction Search, Agent Toolkit MCP, the APIMatic-generated Server SDK), plus partner jobs (S13):

Partner	Job in Stood
APIMatic	Context Plugin grounds PayPal SDK calls. Generates Stood's SDK, docs and MCP
AG Grid · AG Studio	Buyer-only read-only reviewer file with milestone and capture reconciliation; license expiry falls back to Yard tables
Bryntum	Lazy-loaded read-only Gantt of milestone deadlines; unreleased milestones remain locked
Channel3	Catalog match: was the specified fitting installed?
Render	Hosting (Docker) + durable hold timers (Workflows)

| Astropods | Runs the evidence agent, with no PayPal credentials | | Elastic | Evidence memory: reused and internet photo detection | | Kernel | Automates the sandbox buyer approval so judges can replay every outcome | | Postman | Deferred by owner (2026-10-09); no paid upgrade, workspace or monitors in use. See operational decision. | | Zapier | Delivers the one-line reason by email / SMS / Slack |

See the C5 submission draft and demo storyboard for the evidence-backed tools description and the owner-only submission steps. Sponsor integrations are sandbox/pilot features; their guides state where local tests stop and live provider qualification begins. Develocity 2026.3 was assessed for a no-cost fit; the current stack has no supported, ongoing free integration. See the fit decision and no-cost build measurement plan.

Target free-tier deployment: Render · Neon Postgres · Cloudflare R2 · Cloudflare Workers AI (Llama 3.2 Vision, open weights) · GitHub Actions / Pages. Everything else is open source (T09, T10).

Repository map

.
├─ site/                 Landing page + changelog (GitHub Pages, deploys on merge to main)
├─ tools/site/           Site build (version + rendered CHANGELOG.md)
├─ docs/
│  ├─ USAGE.md           Usage manual: keys, quickstart, webhooks, profiles
│  ├─ WAYS_OF_WORKING.md TDD · DDD · OOP · GitFlow · pre-commit · Definition of Done
│  ├─ stood/             Product specs S01–S17
│  ├─ tech/              Technical docs T01–T17
│  ├─ adr/               Architecture decisions
│  ├─ brand/             Logo, app icons, social, verdict chips (Volt)
│  └─ 01–13 *.md         Research, hackathon, PayPal landscape, judges, checklist
├─ TASKS.md              Append-only task ledger + ground rules + full backlog
├─ .pre-commit-config.yaml  The cutthroat gate (also run by CI)
└─ .github/              CI, Pages, release-please, back-merge, templates, rulesets

Implemented core: services/api. Planned additional services: apps/web, services/api, services/workflows, services/evidence-agent, fixtures/ (S14).

Documentation

Area	Docs
Use it	Usage manual · Setup record (hosted sandbox) · Key handoff
Product	Overview · S01 Problem · S02 Boundary · S03 Personas · S04 Outcomes · S05 Features · S06 Voice · S08 Screens · S11 Evidence integrity · S16 Use cases
Technical	T01 Requirements · · · · · · · · · · · · · · · ·

Development

Docker only. The host needs git, Docker and pre-commit (T15).

1. Install pre-commit (mandatory, before your first commit)

pip install pre-commit             # or: brew install pre-commit / pipx install pre-commit
pre-commit install                 # installs pre-commit, commit-msg and pre-push hooks
pre-commit run --all-files         # must pass before you push

Check it's active: ls .git/hooks/pre-commit .git/hooks/commit-msg .git/hooks/pre-push should list all three. Fast checks run on every commit; before every push, scripts/ci-local runs every CI job locally (clean image build, all hooks, the Docker product gate, the site, mock network and hosted Yard checks), about 25 minutes, so CI never fails first (ADR-0023). Docker must be running, because some hooks run in pinned containers. The commit-msg hook rejects any commit without a Conventional message and a DCO sign-off, so always commit with git commit -s.

To run the gate from a second checkout while another Stood checkout uses the default Compose project or database port, isolate its containers and choose a free host port, for example: COMPOSE_PROJECT_NAME=stood-c5 STOOD_DB_HOST_PORT=55432 scripts/ci-local. The database still listens on port 5432 inside Compose.

There's no way around the gate:

• CI runs the same .pre-commit-config.yaml on every PR (pre-commit check).
• Rulesets on develop and main block merging until the pre-commit, pr-title and dco checks pass.
• --no-verify doesn't help, because CI fails the PR anyway.

What the gate checks (WoW §8):

• repository hygiene
• secrets (gitleaks)
• GitHub Actions (actionlint, zizmor, schemas)
• docs (markdownlint, typos, offline links and anchors)
• web code (Biome)
• banned words in user-facing copy
• GitFlow branch names, Conventional Commits and DCO

2. Install and run (Docker only)

You need git, Docker (Desktop or Engine, with Compose v2) and pre-commit (step 1). Nothing else runs on your machine: Node, pnpm and Postgres all run in containers. No keys are needed for local work; the PayPal simulator stands in for PayPal.

git clone https://github.com/ma-za-kpe/stood && cd stood
git switch develop                     # the default branch for work
cp .env.example .env && chmod 600 .env # names only; leave values empty for local work
docker compose build app               # the dev image (Node 24, pnpm 10)
./scripts/dev install                  # pnpm install inside the container
./scripts/dev up                       # Postgres, local S3 (SeaweedFS), Mailpit
docker compose run --rm app pnpm test  # unit tests; every command runs in a container
./scripts/dev validate                 # the full gate: lint, types, boundaries, coverage, build, Postgres tests
docker compose up -d api               # local API with synthetic fixtures, no payment execution

See the whole product locally (Stood, Yard and the simulated network, no keys):

./scripts/dev demo                     # http://localhost:3002/ (Stood), /yard/, /yard/app/?project=yard-project
./scripts/dev demo:down                # stop and remove it
scripts/mock-network                   # the 15 network scenarios; must exit 0 before you push

Use the real PayPal sandbox instead of the simulator: create a sandbox app (setup record, section 3), then run ./scripts/dev setup. It asks for the keys, checks them with PayPal and never prints them. Set PROVIDER_PAYPAL=live (which still means the sandbox).

Hosting: the hosted sandbox (Render + Neon) and every step to repeat it are in docs/SETUP.md. Key names and scopes are in docs/HANDOFF.md.

Troubleshooting on macOS: if commands fail with Operation not permitted or getcwd, give your terminal app access to the Documents folder (System Settings → Privacy & Security → Files and Folders), then reopen it.

3. Branch, commit and open a PR (GitFlow)

git switch develop && git pull
git switch -c feature/42-hold-timers   # <type>/<issue>-<slug>, validated by the gate
# … write the failing test first, then the code …
git commit -s -m "feat(tranche): reauthorise holds from day 4"
git push -u origin feature/42-hold-timers   # open a PR into develop

• feature/* → develop (squash, Conventional-Commit PR title) → main (merge commit) → release-please tags vX.Y.Z and updates the changelog. develop is the default branch (ADR-0006).
• Test-first, domain-driven: red → green → refactor. 100% branch coverage on decision and money code (WoW §4–6).
• Review gate: sandbox PRs merge after required CI passes, including the product and network checks (ADR-0024). Human money-path approval is required before real money.

Roadmap

Version	Target	Scope
0.1.0	Released	Docs, brand, landing page and quality gate
0.2.0	Released 5 Oct	Tested domain, durable storage, guarded funded-hold adapter, signed DRAFT API and new landing page; money HTTP off
0.3.0	23 Oct	All three outcomes, evidence agent, receipts, webhooks, EyeOnSite wired
0.4.0	30 Oct	Reviewer file (AG Studio), Gantt, dispute packet, notifications
1.0.0	11 Nov	Hackathon submission: video, partner docs, final checklist

The full backlog lives in TASKS.md. Milestone detail is in T14.

Contributing

Contributions are welcome. Read CONTRIBUTING and Ways of working, install pre-commit, then pick an issue.

We especially want to hear from:

• buyers and builders using code milestones,

• agent operators and test-runner engineers,

• freelancers and platforms with milestone payments,

• payments, risk and compliance folks.

• Code of conduct: Contributor Covenant 2.1

• Security: report privately, see SECURITY.md. Never test with real accounts or real money.

License

MIT © 2026 ma-za-kpe and Stood contributors.

Third-party tools and services (PayPal, AG Grid / AG Studio, Bryntum and the other partners) are subject to their own licences and terms. Commercial components are installed from their registries and never vendored. "Stood" hasn't yet been checked as a trademark.

Connected local simulation

Run scripts/dev demo to build and check the connected Docker journey, then open http://localhost:3002/ for Stood or http://localhost:3002/yard/app/?project=yard-project for the Yard room. Choose Buyer. This uses real local services with simulated providers and synthetic evidence; no real payment is executed. No keys are needed. Stop the disposable demo with scripts/dev demo:down. The hosted app is available at https://stood-yard-api.onrender.com/app/ with owner-issued sign-in, the Board and private StartupTribunal intake. Stood signing/funding and reconciliation are qualified on the real PayPal sandbox. Hosted Foreman and Yard payment integration continue in #76.

Site-visit photo upload sessions reserve bounded, tenant-owned storage and complete only after byte-integrity checks. Completion is evidence intake; trusted site-visit assessment remains open. Hosted Yard payment evidence includes a real sandbox capture driven through Yard app sessions.

Created and maintained by Maku Mazakpe, based in Accra, Ghana. Support · GitHub · LinkedIn.

Mandate requests accept an empty JSON object and retain their first acceptance time on an identical retry. The signing worker retires unused expired consent and polls waiting requests fairly; ambiguous provider writes remain read-only recovery work. See mandate operations. Broad C4 requirements remain tracked in #77.