Phantomcall/Checkpoint__V2

Spending controls for AI agents on NEAR, demonstrated by Procurement Desk.
A team of AI agents can research, compare and buy things for you, and pay for them, without ever holding your keys.
NEAR Hackathon 2026 · AI Security & Defense · Autonomous Business · Agent Economy · NEAR testnet
> [!IMPORTANT]
> Status: in active development (5 → 14 November 2026). This README describes the target design for the hackathon MVP, as specified in our PRD v2. Sections marked 🚧 planned describe things that are not built yet. The Roadmap shows what is done. We update this file as each part lands, so the README always matches what actually runs.
## Contents
1. The problem
2. What Checkpoint does: three locks
3. Scope
4. Hackathon tracks and what we claim
5. System overview
6. Data flow diagrams (DFD)
7. Entity relationship diagrams (ERD)
8. Lifecycles
9. Guard rules
10. Security model
11. Contract interface
12. The basket payload
13. Tech stack
14. Repository layout
15. Getting started
16. Roadmap
17. Limitations and honest claims
18. Team
19. Project documents
## 1. The problem
AI agents now hold wallets. Agents that "spend, negotiate and pay" are a theme across this hackathon. The easy way to let an agent pay is to give it a full-access key or a hot wallet. Then one prompt injection, one bug or one leaked key can empty it.
Two incidents on NEAR in 2026 show where money systems break. They broke at the edges between a contract's records and reality, not in the base chain:
| Incident | What went wrong | The lesson we apply |
| NEAR Intents, Sep–Oct 2026 (~$3.87M) | A refund and callback path left internal credit spendable after the backing assets had already been returned. It went unnoticed for about 40 hours. | Reserve funds before any external call. Settle only from the callback result, exactly once. Reconcile the ledger against real balances, and pause on a deficit. |
| Rhea Finance, Apr 2026 (~$18.4M) | A check counted an intermediate amount as the final value. | The contract checks the exact amounts it pays and never trusts a client-computed total. |
| LLM agents in general | Untrusted text (e.g. a product listing that says "ignore your rules") can steer an LLM. | The LLM never decides who gets paid or how much. Deterministic rules and the contract decide. |
> We do not claim Checkpoint would have prevented those incidents inside those protocols. We apply their design lessons to our own Vault.
The AI Security & Defense track puts the goal in one line: "Give AI money without giving it the keys to everything." Checkpoint builds that.
## 2. What Checkpoint does: three locks
You give the agents a shopping list. They find real offers, compare them and propose one basket. The basket is paid only when three independent locks agree. The agents hold none of them.
| Lock | Who | What it guarantees |
| 🔒 Guard | Off-chain rules engine and signer | Every offer passed deterministic price, vendor and data rules. Guard signs the exact basket bytes, valid for 15 minutes, once. |
| 🔒 Human | The owner's wallet | The owner approved this exact basket hash on-chain. Any change (vendor, amount, token, expiry, policy) produces a different hash, which has no approval. |