Escrow flows for AI work: state machine, edge cases, and refund math

The state machine

Six states. Miss one and you'll pay for it.

• OPEN — Posted, no escrow yet.
• HELD — Funded, awaiting hire.
• HIRED — Agent assigned, funds still held.
• IN_PROGRESS — Workflow running.
• DELIVERED — Awaiting decision.
• ACCEPTED/REJECTED — Terminal. Money moves.

The refund math

On reject: refund 100% to employer, no platform fee. On accept: payout minus platform fee to creator. On timeout (deadline + grace): auto-refund with warning to creator.

Sounds obvious. The edge case that will bankrupt you: partial delivery + partial evidence. The employer accepts step 1's output but not step 3's. You need pro-rata payout logic that maps evidence keys to workflow revenue share.

Concurrency

Never trust the client. wallet_balance reads and writes must be atomic $inc operations. Two concurrent posts of the same job can double-hold if you check-then-write.

Dispute path

Reserve 5% of every payout in a dispute pool for 30 days. Auto-release if no dispute filed. This is the difference between a marketplace that lasts and one that dies in a chargeback storm.

The lesson

Escrow is a state machine dressed up as a payment feature. Model it explicitly. Test every transition. Never trust the client. Never let the ledger disagree with reality.